mirror of
https://github.com/QuasarApp/pe-parse.git
synced 2025-05-08 09:39:34 +00:00
Document parsed object.
This commit is contained in:
parent
1caefedc6a
commit
cb0549dbb2
@ -14,15 +14,15 @@ libraries) you can build pepy.
|
||||
|
||||
Using
|
||||
=====
|
||||
There are a number of objects involved in pepy. The main one is the *parsed*
|
||||
There are a number of objects involved in pepy. The main one is the **parsed**
|
||||
object. This object is returned by the *parse* method.
|
||||
|
||||
`
|
||||
```
|
||||
import pepy
|
||||
p = pepy.parse("/path/to/exe")
|
||||
`
|
||||
```
|
||||
|
||||
The *parsed* object has a number of methods:
|
||||
The **parsed** object has a number of methods:
|
||||
|
||||
* get_entry_point: Return the entry point address
|
||||
* get_bytes: Return the first N bytes at a given address
|
||||
@ -31,6 +31,41 @@ The *parsed* object has a number of methods:
|
||||
* get_exports: Return a list of export objects.
|
||||
* get_relocations: Return a list of relocation objects
|
||||
|
||||
The **parsed** object has a number of attributes:
|
||||
|
||||
* signature: PE Signature
|
||||
* machine: Machine
|
||||
* numberofsections: Number of sections
|
||||
* timedatestamp: Timedate stamp
|
||||
* numberofsymbols: Number of symbols
|
||||
* characteristics: Characteristics
|
||||
* magic: Magic
|
||||
* majorlinkerver: Major linker version
|
||||
* minorlinkerver: Minor linker version
|
||||
* codesize: Size of code
|
||||
* initdatasize: Size of initialized data
|
||||
* uninitdatasize: Size of uninitialized data
|
||||
* entrypointaddr: Address of entry point
|
||||
* baseofcode: Base address of code
|
||||
* baseofdata: Base address of data
|
||||
* imagebase: Image base address
|
||||
* sectionalignement: Section alignment
|
||||
* filealingment: File alignment
|
||||
* majorosver: Major OS version
|
||||
* minorosver: Minor OS version
|
||||
* win32ver: Win32 version
|
||||
* imagesize: Size of image
|
||||
* headersize: Size of headers
|
||||
* checksum: Checksum
|
||||
* subsystem: Subsystem
|
||||
* dllcharacteristics: DLL characteristics
|
||||
* stackreservesize: Size of stack reserve
|
||||
* stackcommitsize: Size of stack commit
|
||||
* heapreservesize: Size of heap reserve
|
||||
* heapcommitsize: Size of heap commit
|
||||
* loaderflags: Loader flags
|
||||
* rvasandsize: Number of RVA and sizes
|
||||
|
||||
Authors
|
||||
=======
|
||||
pe-parse was designed and implemented by Andrew Ruef (andrew@trailofbits.com)
|
||||
|
Loading…
x
Reference in New Issue
Block a user