Wednesday, January 07, 2009

Updated pefile

I've just released pefile-1.2.10-56 which besides some new functionality it also fixes bugs for a few extreme cases and incorporates some performance improvements, the biggest of which is the one in the generation of the textual representation of the file. dump_info() is now much faster than it used to be.
This version adds onto the features provided by version 1.2.9 which introduced the ability to test and generate checksums for the PE file among a few other things.

Please refer to pefile's homepage for a detailed list of the changes.

Also, to get started with pefile it's often useful to take a look at usage examples. There's a wiki page in the project's page showing a few different recipes on how to go about doing different tasks. Some as simple as, for instance, extracing a DLL's exported symbols...


import pefile
pe = pefile.PE(‘/path/to/pefile.exe’)

for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
    print hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), exp.name, exp.ordinal


An all the way into more complex examples.

Enjoy!

6 comments:

Anonymous said...

Maybe you do know if there is something like pefile for linux elf?

Ero Carrera said...

I'm not aware of such project, would love to hear about it if someone knows

Joxean Koret said...

This is exactly what you're looking for.

Anonymous said...

Thanks for info Joxean ;)

Ero Carrera said...

Thanks for the pointer Joxean! I wasn't aware of that one. Have you played with it? any good/bad experiences to share?

Joxean Koret said...

Yes, I'm using pyelf in Inguma. Is a good library although not very intuitive.

This is an example usage of the library, a tiny disassembler using pydasm.