pefile

import pefile import os # Create a dummy executable for demonstration if one doesn't exist dummy_exe_path = 'dummy_app.exe' if not os.path.exists(dummy_exe_path): # This is not a real PE file, just a placeholder with open(dummy_exe_path, 'wb') as f: f.write(b'MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4\x09\xcd\x21\xb8\x01\x4c\xcd\x21This is a dummy executable file.') try: pe = pefile.PE(dummy_exe_path) print(f"[*] Successfully parsed: {dummy_exe_path}") print(f" Image Base: 0x{pe.OPTIONAL_HEADER.ImageBase:X}") print(f" Number of Sections: {pe.FILE_HEADER.NumberOfSections}") print("\n[*] Sections:") for section in pe.sections: print(f" Name: {section.Name.decode().strip(chr(0))}, Virtual Address: 0x{section.VirtualAddress:X}, Virtual Size: 0x{section.Misc_VirtualSize:X}") # Attempt to print imports if any (unlikely for a dummy file) if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'): print("\n[*] Imports:") for entry in pe.DIRECTORY_ENTRY_IMPORT: print(f" DLL: {entry.dll.decode().strip(chr(0))}") for imp in entry.imports: if imp.name: print(f" Function: {imp.name.decode().strip(chr(0))}") else: print(f" Ordinal: {imp.ordinal}") except pefile.PEFormatError as e: print(f"[!] PEFormatError: {e}") except Exception as e: print(f"[!] An unexpected error occurred: {e}") finally: # Clean up the dummy file if os.path.exists(dummy_exe_path): os.remove(dummy_exe_path)