November 2019
Intermediate to advanced
346 pages
9h 36m
English
In the following steps, we will parse the PE header of a file, and then print out notable portions of it:
import pefiledesired_file = "python-3.7.2-amd64.exe"pe = pefile.PE(desired_file)
for entry in pe.DIRECTORY_ENTRY_IMPORT: print(entry.dll) for imp in entry.imports: print("\t", hex(imp.address), imp.name)
A small portion of the output is shown here:

for section in pe.sections: print( section.Name, hex(section.VirtualAddress), hex(section.Misc_VirtualSize), section.SizeOfRawData, ...