pefile

Parsing Pefile (Portable Executable) in Golang

$ cd pefile-go/
$ go build
$ ./pefile-go ./exe_test_files/00b6ea24092c43db96e4dec79dfcdafd301c78a3d0ebaa27d8d5e4934793876d

Features :

Import Hash calculation
Section Hash Calculation ( md5, sha1,sha256,sha512)
Extract Section string

Usage

	pefile, err := pe.NewPEFile(args[0])
	if err != nil {
		log.Println("Ooopss looks like there was a problem")
		log.Println(err)
		return
	}

	log.Println("Imphash : ", pefile.GetImpHash())

	for _, section := range pefile.Sections {
		fmt.Println("-------------------------")
		data := pefile.GetData(section)
		name := fmt.Sprintf("%s", section.Data.Name)
		md5 := section.Get_hash_md5(data)
		sha256 := section.Get_hash_sha256(data)
		entropy := section.Get_entropy(data)
		fmt.Println("name:", name)
		fmt.Println("md5 : ", md5)
		fmt.Println("sha256:", sha256)
		fmt.Println("entropy:", entropy)
	}

pefile is a multi-platform Python module to parse and work with Portable Executable (aka PE) files. Most of the information contained in the PE headers is accessible as well as all sections' details and their data.

The structures defined in the Windows header files will be accessible as attributes in the PE instance. The naming of fields/attributes will try to adhere to the naming scheme in those headers. Only shortcuts added for convenience will depart from that convention.

pefile requires some basic understanding of the layout of a PE file. Armed with it it's possible to explore nearly every single feature of the file format.

Features

Some of the tasks that pefile makes possible are:

Inspecting headers
Analysis of sections' data
Retrieving embedded data
Reading strings from the resources
Warnings for suspicious and malformed values
Support to write to some of the fields and to other parts of the PE, so it's possible to do some basic butchering of PEs. The functionality won't rearrange structures to make room for new ones, so use it with care. Overwriting fields should mostly be safe.
Packer detection with PEiD’s signatures
PEiD signature generation

Please, refer to Usage Examples for some code snippets showing how to use pefile.

A few examples of what a dump produced with pefile look like can be found here for a packed file, here for one of kernel32.dll and here for one of TinyPE.

In order to work with authenticated binaries, including Authenticode signatures, please check the project verify-sigs

pefile runs in several pipelines scanning hundreds of thousands of new PE files every day and, while not perfect, it has grown to be pretty robust over time. That being said small glitches are found every now and then. If you bump into a PE that does not appear to be processed correctly, do report it please! it will help make pefile a tiny bit more tough.

Dependencies

pefile is self-contained. It has no dependecies and it is endianness independent, it works on OS X, Windows, and Linux.

Projects and products using pefile

Additional resources

PDFs of posters depicting the PE file format:

Portable Executable Format shows the full view of the headers and structures defined by the Portable Executable format
Portable Executable Format. A File Walkthrough Shows a walkthrough over the raw view of an executable file with the PE format fields laid out over the corresponding areas

The following links provide detailed information about the PE format and its structures.

corkami's wiki page about the PE format has grown to be one of the most in-depth repositories of information about the PE format
An In-Depth Look into the Win32 Portable Executable File Format
An In-Depth Look into the Win32 Portable Executable File Format, Part 2
The Portable Executable File Format
Get icons from Exe or DLL the PE way
Solar Eclipse's Tiny PE page at "http://www.phreedom.org/solar/code/tinype/" is no longer available, corkami has a copy of TinyPE here

Neo23x0 / pefile-go