马克一下:http://code.google.com/p/pefile/

pefile is a multi-platform Python module to read and work with Portable Executable (aka PE) files. Most of the information in the PE Header is accessible, as well as all the sections, section’s information and data.
pefile requires some basic understanding of the layout of a PE file. Armed with it it’s possible to explore nearly every single feature of the file.
Some of the tasks that pefile makes possible are:

  • Modifying and writing back to the PE image
  • Header Inspection
  • Sections analysis
  • Retrieving data
  • Warnings for suspicious and malformed values
  • Packer detection with PEiD’s signatures
  • PEiD signature generation

  • Please, refer to UsageExamples for starting points on how to use pefile

    知识共享授权条款
    本著作Chen, Zai-Chun制作,以知识共享 姓名标示-相同方式分享 4.0 国际 授权条款释出

    留言

    Dec 12 2010