pefile
pefile is a Python module to read and work with PE (Portable Executable) files
Science Score: 54.0%
This score indicates how likely this project is to be science-related based on various indicators:
-
✓CITATION.cff file
Found CITATION.cff file -
✓codemeta.json file
Found codemeta.json file -
✓.zenodo.json file
Found .zenodo.json file -
○DOI references
-
○Academic publication links
-
✓Committers with academic emails
2 of 83 committers (2.4%) from academic institutions -
○Institutional organization owner
-
○JOSS paper metadata
-
○Scientific vocabulary similarity
Low similarity (13.5%) to scientific vocabulary
Keywords from Contributors
Repository
pefile is a Python module to read and work with PE (Portable Executable) files
Basic Info
Statistics
- Stars: 1,952
- Watchers: 80
- Forks: 525
- Open Issues: 125
- Releases: 16
Metadata Files
README.md
pefile
pefile is a multi-platform Python module to parse and work with Portable Executable (PE) files. Most of the information contained in the PE file headers is accessible, as well as all the sections' details and data.
The structures defined in the Windows header files will be accessible as attributes in the PE instance. The naming of fields/attributes will try to adhere to the naming scheme in those headers. Only shortcuts added for convenience will depart from that convention.
pefile requires some basic understanding of the layout of a PE file — with it, it's possible to explore nearly every single feature of the PE file format.
Installation
To install pefile through pip:
pip3 install pefile
Features
Some of the tasks that pefile makes possible are:
- Inspecting headers
- Analyzing of sections' data
- Retrieving embedded data
- Reading strings from the resources
- Warnings for suspicious and malformed values
- Basic butchering of PEs, like writing to some fields and other parts of the PE
- This functionality won't rearrange PE file structures to make room for new fields, so use it with care.
- Overwriting fields should mostly be safe.
- Packer detection with PEiD’s signatures
- PEiD signature generation
Please, refer to Usage Examples for some code snippets that demonstrate how to use pefile.
Here are a few examples of what a dump produced with pefile looks like for different types of files:
To work with authenticated binaries, including Authenticode signatures, please check the project verify-sigs.
pefile runs in several pipelines scanning hundreds of thousands of new PE files every day, and, while not perfect, it has grown to be pretty robust over time. That being said, small glitches are found now and then. If you bump into a PE that does not appear to be processed correctly, do report it, please! It will help make pefile a tiny bit more powerful.
Dependencies
pefile is self-contained. The module has no dependencies; it is endianness independent; and it works on OS X, Windows, and Linux.
Recent changes
Prompted by the move to GitHub, the need to support Python 3 in addition to resolving a slew of pending issues (some having to do with the old versioning scheme), pefile has changed its version number scheme and from now on it will be using the release date as its version.
Projects and products using pefile
- Didier Stevens' pecheck, a tool for displaying PE file info, handles PEiD files better then pefile does.
- MAEC, a standardized language for encoding and communicating high-fidelity information about malware based upon attributes such as behaviors, artifacts, and attack patterns. MAEC converts pefile's output into their XML format.
- Qiew, a Hex/File format viewer.
- VirusTotal
- bbfreeze
- pyemu: download, whitepaper
- Immunity Debugger 1.1
- Cuckoo
- MultiScanner
Additional resources
PDFs of posters depicting the PE file format:
- Portable Executable Format Layout shows the full view of the headers and structures defined by the PE format.
- Portable Executable Header Walkthrough shows the raw view of an executable file with the PE format fields laid out over the corresponding areas.
The following links provide detailed information about the PE format and its structures.
- corkami's wiki page about the PE format has grown to be one of the most in-depth repositories of information about the PE format.
- corkami's treasure trove of PE weirdness
- An In-Depth Look into the Win32 Portable Executable File Format
- An In-Depth Look into the Win32 Portable Executable File Format, Part 2
- The Portable Executable File Format
- Get icons from Exe or DLL the PE way
- Solar Eclipse's Tiny PE page at "http://www.phreedom.org/solar/code/tinype/" is no longer available (html-only archive), corkami's TinyPE is available here (Code only)
Owner
- Name: Ero Carrera
- Login: erocarrera
- Kind: user
- Location: Barcelona
- Website: http://blog.dkbza.org
- Twitter: erocarrera
- Repositories: 3
- Profile: https://github.com/erocarrera
Reverse engineering and threat-intelligence by way of F-Secure, zynamics, Google.
Citation (CITATION.cff)
abstract: "pefile is a Python module to read and work with PE (Portable Executable) files"
authors:
- family-names: Carrera Ventura
given-names: Ero
orcid: "https://orcid.org/0000-0002-9549-9291"
cff-version: 1.2.0
date-released: "2024-08-26"
license: MIT
message: "If you use this software, please cite it using these metadata."
repository-code: "https://github.com/erocarrera/pefile"
title: "pefile"
version: "2024.8.26"
GitHub Events
Total
- Issues event: 5
- Watch event: 93
- Issue comment event: 13
- Pull request review event: 3
- Pull request review comment event: 3
- Pull request event: 25
- Fork event: 18
Last Year
- Issues event: 5
- Watch event: 93
- Issue comment event: 13
- Pull request review event: 3
- Pull request review comment event: 3
- Pull request event: 25
- Fork event: 18
Committers
Last synced: 10 months ago
Top Committers
| Name | Commits | |
|---|---|---|
| Ero Carrera | e****a@g****m | 273 |
| ero.carrera@gmail.com | e****a@g****m@8****1 | 73 |
| j-t-1 | 1****1 | 21 |
| Sebastian Willenborg | c****l@w****e | 18 |
| ero.carrera | e****a@8****1 | 11 |
| Lukas Bernhard | l****d@q****o | 7 |
| Sébastien Larinier | s****r@s****r | 6 |
| pspcreateprocess | p****s@m****u | 6 |
| Joachim Metz | j****z@g****m | 5 |
| angelkillah | n****c@g****m | 4 |
| Drew Bonasera | D****f | 4 |
| Raphaël Vinot | r****l@v****o | 4 |
| zjgcjy | z****y@g****m | 4 |
| Andrew Dutcher | a****r@g****m | 3 |
| Stephen Rauch | s****b@g****m | 3 |
| Zoë Peterson | h****o@z****m | 3 |
| anatoly techtonik | t****k@g****m | 3 |
| Brett Meyer | c****r@g****m | 3 |
| matt price | m****1@g****m | 3 |
| nyx0 | n****0 | 3 |
| Martin Zibricky | m****k | 2 |
| Mark Jansen | m****n@r****g | 2 |
| Hilko Bengen | b****n@h****e | 2 |
| Caleb Madrigal | c****l@g****m | 2 |
| @Antelox | a****e@g****m | 2 |
| mat | m****t@m****t | 2 |
| Nirbheek Chauhan | n****k@c****m | 2 |
| Linhai | s****3@g****m | 2 |
| dieresys | d****s | 1 |
| daladim | d****m | 1 |
| and 53 more... | ||
Committer Domains (Top 20 + Academic)
Issues and Pull Requests
Last synced: 6 months ago
All Time
- Total issues: 79
- Total pull requests: 165
- Average time to close issues: 3 months
- Average time to close pull requests: 7 months
- Total issue authors: 65
- Total pull request authors: 60
- Average comments per issue: 1.35
- Average comments per pull request: 0.62
- Merged pull requests: 77
- Bot issues: 0
- Bot pull requests: 0
Past Year
- Issues: 7
- Pull requests: 62
- Average time to close issues: N/A
- Average time to close pull requests: N/A
- Issue authors: 6
- Pull request authors: 9
- Average comments per issue: 0.0
- Average comments per pull request: 0.1
- Merged pull requests: 0
- Bot issues: 0
- Bot pull requests: 0
Top Authors
Issue Authors
- pd-fkie (6)
- j-t-1 (3)
- randomascii (2)
- im-overlord04 (2)
- hacktorious (2)
- vj68 (2)
- plusvic (2)
- Javagedes (2)
- adang1345 (2)
- huettenhain (1)
- KatherineLiu-holdon (1)
- pombredanne (1)
- richardweiss80 (1)
- platomav (1)
- TheMythologist (1)
Pull Request Authors
- j-t-1 (90)
- learn-more (3)
- hillu (2)
- itaiavni (2)
- ForensicITGuy (2)
- daniel-mekuria (2)
- wangmot (2)
- wesinator (2)
- dinateper (2)
- aursulis (2)
- asivery (2)
- step-security-bot (2)
- Derekt2 (2)
- N0fix (2)
- qux-bbb (2)
Top Labels
Issue Labels
Pull Request Labels
Packages
- Total packages: 15
-
Total downloads:
- pypi 2,533,087 last-month
- Total docker downloads: 713,854,675
-
Total dependent packages: 121
(may contain duplicates) -
Total dependent repositories: 7,070
(may contain duplicates) - Total versions: 50
- Total maintainers: 2
pypi.org: pefile
Python PE parsing module
- Homepage: https://github.com/erocarrera/pefile
- Documentation: https://pefile.readthedocs.io/
- License: MIT
-
Latest release: 2024.8.26
published over 1 year ago
Rankings
Maintainers (1)
alpine-v3.18: py3-pefile-pyc
Precompiled Python bytecode for py3-pefile
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2023.2.7-r1
published almost 3 years ago
Rankings
Maintainers (1)
alpine-v3.18: py3-pefile
Python PE parsing module
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2023.2.7-r1
published almost 3 years ago
Rankings
Maintainers (1)
alpine-edge: py3-pefile
Python PE parsing module
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2024.8.26-r0
published over 1 year ago
Rankings
Maintainers (1)
alpine-edge: py3-pefile-pyc
Precompiled Python bytecode for py3-pefile
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2024.8.26-r0
published over 1 year ago
Rankings
Maintainers (1)
conda-forge.org: pefile
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2022.5.30
published almost 4 years ago
Rankings
anaconda.org: pefile
pefile is a Python module to read and work with PE (Portable Executable) files. The structures defined in the Windows header files will be accessible as attributes in the PE instance. The naming of fields/attributes will try to adhere to the naming scheme in those headers. Only shortcuts added for convenience will depart from that convention.
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2023.2.7
published over 1 year ago
Rankings
alpine-v3.22: py3-pefile
Python PE parsing module
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2024.8.26-r0
published 9 months ago
Rankings
Maintainers (1)
alpine-v3.22: py3-pefile-pyc
Precompiled Python bytecode for py3-pefile
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2024.8.26-r0
published 9 months ago
Rankings
Maintainers (1)
alpine-v3.20: py3-pefile-pyc
Precompiled Python bytecode for py3-pefile
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2023.2.7-r2
published almost 2 years ago
Rankings
Maintainers (1)
alpine-v3.19: py3-pefile
Python PE parsing module
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2023.2.7-r1
published over 2 years ago
Rankings
Maintainers (1)
alpine-v3.21: py3-pefile-pyc
Precompiled Python bytecode for py3-pefile
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2024.8.26-r0
published over 1 year ago
Rankings
Maintainers (1)
alpine-v3.21: py3-pefile
Python PE parsing module
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2024.8.26-r0
published over 1 year ago
Rankings
Maintainers (1)
alpine-v3.20: py3-pefile
Python PE parsing module
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2023.2.7-r2
published almost 2 years ago
Rankings
Maintainers (1)
alpine-v3.19: py3-pefile-pyc
Precompiled Python bytecode for py3-pefile
- Homepage: https://github.com/erocarrera/pefile
- License: MIT
-
Latest release: 2023.2.7-r1
published over 2 years ago
Rankings
Maintainers (1)
Dependencies
- future *
- actions/checkout v3 composite
- actions/checkout master composite
- actions/download-artifact v3 composite
- actions/setup-python v4 composite
- actions/upload-artifact v3 composite
- schneegans/dynamic-badges-action v1.6.0 composite
- actions/checkout f43a0e5ff2bd294095638e18286ca9a3d1956744 composite
- github/codeql-action/analyze e949a1676c32f4c215780f7429eb9f00ff18b225 composite
- github/codeql-action/autobuild e949a1676c32f4c215780f7429eb9f00ff18b225 composite
- github/codeql-action/init e949a1676c32f4c215780f7429eb9f00ff18b225 composite
- step-security/harden-runner 63c24ba6bd7ba022e95695ff85de572c04a18142 composite
- actions/checkout f43a0e5ff2bd294095638e18286ca9a3d1956744 composite
- actions/dependency-review-action 0efb1d1d84fc9633afcdaad14c485cbbc90ef46c composite
- step-security/harden-runner 63c24ba6bd7ba022e95695ff85de572c04a18142 composite
- actions/checkout f43a0e5ff2bd294095638e18286ca9a3d1956744 composite
- actions/upload-artifact a8a3f3ad30e3422c9c7b888a15615d19a852ae32 composite
- github/codeql-action/upload-sarif e949a1676c32f4c215780f7429eb9f00ff18b225 composite
- ossf/scorecard-action 99c53751e09b9529366343771cc321ec74e9bd3d composite
- step-security/harden-runner 63c24ba6bd7ba022e95695ff85de572c04a18142 composite