QuasarApp/pe-parse
4
0
Fork 0
mirror of https://github.com/QuasarApp/pe-parse.git synced 2025-05-10 10:29:32 +00:00
Code Issues Projects Releases Wiki Activity

Document parsed object.

Browse Source
This commit is contained in:
Wesley Shields 2013-11-30 23:17:50 -05:00
parent 1caefedc6a
commit cb0549dbb2
1 changed files with 39 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
python/README.md
View File

@ -14,15 +14,15 @@ libraries) you can build pepy.
Using Using
===== =====
There are a number of objects involved in pepy. The main one is the *parsed* There are a number of objects involved in pepy. The main one is the **parsed**
object. This object is returned by the *parse* method. object. This object is returned by the *parse* method.
` ```
import pepy import pepy
p = pepy.parse("/path/to/exe") p = pepy.parse("/path/to/exe")
` ```
The *parsed* object has a number of methods: The **parsed** object has a number of methods:
* get_entry_point: Return the entry point address * get_entry_point: Return the entry point address
* get_bytes: Return the first N bytes at a given address * get_bytes: Return the first N bytes at a given address
@ -31,6 +31,41 @@ The *parsed* object has a number of methods:
* get_exports: Return a list of export objects. * get_exports: Return a list of export objects.
* get_relocations: Return a list of relocation objects * get_relocations: Return a list of relocation objects
The **parsed** object has a number of attributes:
* signature: PE Signature
* machine: Machine
* numberofsections: Number of sections
* timedatestamp: Timedate stamp
* numberofsymbols: Number of symbols
* characteristics: Characteristics
* magic: Magic
* majorlinkerver: Major linker version
* minorlinkerver: Minor linker version
* codesize: Size of code
* initdatasize: Size of initialized data
* uninitdatasize: Size of uninitialized data
* entrypointaddr: Address of entry point
* baseofcode: Base address of code
* baseofdata: Base address of data
* imagebase: Image base address
* sectionalignement: Section alignment
* filealingment: File alignment
* majorosver: Major OS version
* minorosver: Minor OS version
* win32ver: Win32 version
* imagesize: Size of image
* headersize: Size of headers
* checksum: Checksum
* subsystem: Subsystem
* dllcharacteristics: DLL characteristics
* stackreservesize: Size of stack reserve
* stackcommitsize: Size of stack commit
* heapreservesize: Size of heap reserve
* heapcommitsize: Size of heap commit
* loaderflags: Loader flags
* rvasandsize: Number of RVA and sizes
Authors Authors
======= =======
pe-parse was designed and implemented by Andrew Ruef (andrew@trailofbits.com) pe-parse was designed and implemented by Andrew Ruef (andrew@trailofbits.com)