17 lines
645 B
Text
17 lines
645 B
Text
|
pefile is a multi-platform Python module to read and work with Portable
|
||
|
|
Executable (aka PE) files. Most of the information in the PE Header is
|
||
|
|
accessible, as well as all the sections, section's information and data.
|
||
|
|
|
||
|
|
pefile requires some basic understanding of the layout of a PE file. Armed with
|
||
|
|
it it's possible to explore nearly every single feature of the file.
|
||
|
|
|
||
|
|
Some of the tasks that pefile makes possible are:
|
||
|
|
|
||
|
|
* Modifying and writing back to the PE image
|
||
|
|
* Header Inspection
|
||
|
|
* Sections analysis
|
||
|
|
* Retrieving data
|
||
|
|
* Warnings for suspicious and malformed values
|
||
|
|
* Packer detection with PEiD's signatures
|
||
|
|
* PEiD signature generation
|