PE Package

Warning

The documentation for PE isn’t quite finished yet! If you want to contribute (or have ideas for better documentation), feel free to send me a pull request or email me.

PE Package

class PE.PE(fd, inmem=False)

Bases: object

The PE object is what gets returned after asking for a PE from any of the ways possible

PE.peFromBytes, PE.peFromFileName, or PE.peFromMemoryObject

Parameters:

• fd (file descriptor) – A file descriptor open with ‘rb’ (read binary)
• inmem – Whether our PE is actually loaded into memory, or a real file

Returns:

an instance of itself. Duh.

Return type:

PE.PE

checkRva(rva, size=None)

Make sure an RVA falls inside the valid mapped range for the file. (also make sure it’s not 0...)

getDllName()

Return the “dll name” from the Name field of the IMAGE_EXPORT_DIRECTORY if one is present. If not, return None.

Returns:dll name Return type:str

getExportName()

Return the name of this file acording to it’s export entry. (if there are no exports, return None)

getExports()

Return the list of exports in this PE. The list contains tuples in the format; (rva, ord, name).

Returns:List of export tuples Return type:list

getForwarders()

Return the list of forwarders in this PE. The list contains tuples in the format; (rva, name, forwardname).

Returns:List of forwarders Return type:list

getImports()

Return the list of import tuples for this PE. The tuples are in the format (rva, libname, funcname).

Returns:List of import tuples Return type:list

getPdataEntries()

Parse out the PE’s .pdata section bytes.

No parameters, just uses PE.getSectionByName to get and parse .pdata entries.

If the section doesn’t exist, returns an empty tuple.

Returns:list of items found

getRelocations()

Return the list of RVA base-relocations in this PE.

getResourceDef(rtype, name_id)

Get the (rva, size, codepage) tuple for the specified resource type/id combination. Returns None if not found.

getResources()

Get the (rtype, nameid, (rva, size, codepage)) tuples for each resource in the PE.

getSectionByName(name)

Find the structure based off it’s name.

Parameters:name (string) – A file descriptor open with ‘rb’ (read binary) Returns:a vstruct header section Return type:vstruct.defs.pe.IMAGE_SECTION_HEADER

getSections()

Return the list of sections in this PE in VStruct format.

Returns:List of sections Return type:list

getVS_VERSIONINFO()

Get a VS_VERSIONINFO object for this PE. (returns None if version resource is not found)

readResource(rtype, name_id)

Return the bytes which define the specified resource. Returns None if not found.

rvaToOffset(rva)

Resolve relative-virtual-address => offset for PE sections. Given a RVA, returns an offset from the current location.

Parameters:rva (long) – Relative Virtual Address to resolve Returns:Pointer to data Return type:long

PE.peFromBytes(fbytes)

Returns a PE class for a string of bytes. Basically just passes your bytes into a StringIO() and hands that off to PE.PE

Parameters:fbytes (str.) – The bytestring for our PE. Returns:PE.PE instance of the specified PE. Return type:PE.PE

PE.peFromFileName(fname)

Returns a PE class for a specified file path. Makes sure to open the file in “rb” mode to read binary.

Parameters:fname (str.) – The filename of our PE. Returns:PE.PE instance of the specified PE. Return type:PE.PE

PE.peFromMemoryObject(memobj, baseaddr)

Returns a PE class for a string of bytes. Basically just passes your bytes into a StringIO() and hands that off to PE.PE

Example:

>>> # Import vtrace and PE
>>> import vtrace, PE
>>> # Initilize our vtrace.Trace object
>>> trace = vtrace.getTrace()
>>> trace.execute('C:\Path\To\Program\blah.exe')
>>> # Get our library bases
>>> libBase = trace.getMeta("LibraryBases")
>>> # Get the first address of our first entry (not realistic)
>>> base = libBase.items()[0][1]
>>> # Create our PE.PE()
>>> p = PE.peFromMemoryObject(trace, base)

Parameters:

• memobj (vtrace.Trace) – Our memory object (trace object)
• baseaddr (long) – Base address for our PE

Returns:

PE.PE instance of the specified PE (with inmem=True).

Return type:

PE.PE

class PE.MemObjFile(memobj, baseaddr)

A helper class to act as a file object, mainly used by PE.peFromMemoryObject. The seek() function sets the current virtual address.

Implements seek(),read() and write() functions for PE.PE to read

Parameters:

• memobj (vtrace.Trace) – Our memory object (trace object)
• baseaddr (long) – Base address for our PE

class PE.ResourceDirectory

Resources are sorted into a hierarchy which begins with “type” and then “name/id” which still points to another directory entry which has 1 child (id 1033) with data.

getResourceDef(restype, name_id)

This should only be called on the root node!

class PE.VS_VERSIONINFO(bytes)

A simple (read-only) VS_VERSIONINFO parser

getVersionItems()

Return dictionary style key,val tuples for the version keys in this VS_VERSIONINFO structure.

Example: for vskey,vsdata in vs.getVersionItems(): print vskey,vsdata

getVersionKeys()

Return a list of the keys in this VS_VERSIONINFO struct.

Example: for keyname in vs.getVersionKeys(): print keyname

getVersionValue(key, default=None)

Retrieve a key from the VS_VERSIONINFO data.

Example: vs.getVersionValue(‘FileVersion’)

carve Module

class PE.carve.CarvedPE(fbytes, offset, xkey)

Bases: PE.PE

getFileSize()

readAtOffset(offset, size)

PE.carve.carve(pbytes, offset=0)

Return a list of (offset, size, xor) tuples of embedded PEs

PE.carve.xorbytes(data, key)

PE.carve.xorstatic(data, i)

cofflib Module

Some utilities for dealing with COFF .LIB files

class PE.cofflib.IMAGE_ARCHIVE

Bases: vstruct.VStruct

vsParse(bytes, offset=0)

class PE.cofflib.IMAGE_ARCHIVE_COFF(bigend=False)

Bases: PE.cofflib.IMAGE_ARCHIVE_MEMBER

pcb_FileHeader()

class PE.cofflib.IMAGE_ARCHIVE_IMPORT

Bases: PE.cofflib.IMAGE_ARCHIVE_MEMBER

class PE.cofflib.IMAGE_ARCHIVE_LINKER1

Bases: PE.cofflib.IMAGE_ARCHIVE_MEMBER

pcb_NumberOfSymbols()

class PE.cofflib.IMAGE_ARCHIVE_LINKER2

Bases: PE.cofflib.IMAGE_ARCHIVE_MEMBER

pcb_NumberOfMembers()

pcb_NumberOfSymbols()

class PE.cofflib.IMAGE_ARCHIVE_MEMBER

Bases: vstruct.VStruct

vsParse(bytes, offset=0)

class PE.cofflib.IMAGE_ARCHIVE_MEMBER_HEADER

Bases: vstruct.VStruct

class PE.cofflib.IMAGE_COFF_SYMBOL

Bases: vstruct.VStruct

pcb_NumberOfAuxSymbols()

PE.cofflib.foo(a, b, idx)

petool Module

Submodules

• ordlookup Package
  • ordlookup Package
  • printord Module
  • ws2_32 Module