Package: pe-tree
PE TreePE Tree is a Python module for viewingPortable Executable (PE) filesin a tree-view usingpefileandPyQt5.
It can also be used withIDA Pro,Ghidra,Volatility,Rekallandminidumpto view and dump in-memory PE files, as well as perform import table reconstruction.Table of contentsFeaturesApplicationRequirementsFeaturesInstallationWindowsMac/LinuxFor developersUsageDark-modeIDAPythonRequirementsFeaturesInstallationUsing setuptoolsInstall manuallyFor developersUsageExampleDumping in-memory PE filesRekallRequirementsFeaturesInstallationUsageVolatilityRequirementsFeaturesInstallationUsageGhidraRequirementsFeaturesInstallationUsageMinidumpRequirementsFeaturesInstallationUsageConfigurationOverviewOptionsLocation3rd party data sharingTroubleshootingContributingDeveloper documentationLicenseFeaturesStandalone application with plugins for:IDA ProGhidraVolatilityRekallMinidumpsCarvingSupports Windows, Linux and MacParsing PE files and memory images from:File-systemZIP archives (including password protected)Windows memory dumps (raw, EWF, vmem etc.)Live Windows memory (using rekall)Windows MinidumpIDA Pro databaseGhidra databaseBinary file carvingRainbow PE map:Provides a high-level overview of PE structures, size and file locationAllows for fast visual overview and comparison of PE samplesDisplays the following PE headers in a tree-view:MZ headerDOS stubRich headersNT/File/Optional headersData directoriesSectionsImportsExportsDebug informationLoad configTLSResourcesVersion informationCertificatesOverlayExtract and save data from:DOS stubSectionsResourcesCertificatesOverlayExport to CyberChef for further manipulationPerform VirusTotal searches of:File hashesPDB pathTimestampsSection hash/nameImport hash/nameExport nameResource hashCertificate serialDump loaded PE images from memory:Fix up section pointers and sizesFix up PE headers:Remove unnecessary data directory pointersRecalculate PE checksumUpdate entry-pointReconstruct import address and directory tables (IAT/IDT) using several methods:Use existing IAT/IDTRebuild IDT from existing IATRebuild IAT and IDT from disassembly (using IDA Pro, Ghidra or capstone)ApplicationThe PE Tree standalone application finds portable executables in files, folders and ZIP archives.RequirementsPython 3.5+FeaturesScan files and folders for PE filesExtract PE files from ZIP archives (including password protected withinfected)Carve PE files from binary filesDouble-click VA/RVA to disassemble with capstoneHex-dump dataInstallationUsing pip (recommended)Install directly from GitHub using a fresh virtual environment and pip:Windows> virtualenv env
> env\Scripts\activate
> pip install --upgrade pip
> pip install git+https://github.com/blackberry/pe_tree.gitMac/Linux$ python3 -m venv env
$ source ./env/bin/activate
$ pip install --upgrade pip
$ pip install git+https://github.com/blackberry/pe_tree.gitFor developersGit clone the repository and setup for development:Windows> git clone https://github.com/blackberry/pe_tree.git
> cd pe_tree
> virtualenv env
> env\Scripts\activate
> pip install -e .Mac/Linux$ git clone https://github.com/blackberry/pe_tree.git
$ cd pe_tree
$ python3 -m venv env
$ source ./env/bin/activate
$ pip install -e .UsageRun PE Tree and scan for portable executables in files, folders and ZIP archives:$ pe-tree -h
usage: pe-tree [-h] [filenames [filenames ...]]

PE-Tree

positional arguments:
  filenames   Path(s) to file/folder/zip

optional arguments:
  -h, --help  show this help message and exitRun PE Tree and attempt tocarveportable executable files from a binary file:$ pe-tree-carve -h
usage: pe-tree-carve [-h] filename

PE-Tree (Carve)

positional arguments:
  filename    Path to file to carve

optional arguments:
  -h, --help  show this help message and exitDark-modeDark-mode can be enabled by installingQDarkStyle:$ pip install qdarkstyleIDAPythonThe PE Tree IDAPython plugin finds portable executables in IDA databases.RequirementsIDA Pro 7.0+ with Python 2.7IDA Pro 7.4+ with Python 2.7 or 3.5+FeaturesEasy navigation of PE file structuresDouble-click on a memory address in PE Tree to view inIDA-vieworhex-viewSearch an IDB for in-memory PE images and;Reconstruct imports (IAT + IDT)Dump reconstructed PE filesAutomatically comment PE file structures in IDBAutomatically label IAT offsets in IDBInstallationTo install and run as an IDAPython plugin you can either use setuptools or install manually.Using setuptoolsDownload pe_tree and install for theglobalPython interpreter used by IDA:$ git clone https://github.com/blackberry/pe_tree.git
$ cd pe_tree
$ python setup.py develop --idaCopype_tree_ida.pyto yourIDA plugins folderInstall manuallyDownload pe_tree and install requirements for theglobalPython interpreter used by IDA:$ git clone https://github.com/blackberry/pe_tree.git
$ cd pe_tree
$ pip install -r requirements.txtCopype_tree_ida.pyand the contents of./pe_tree/to yourIDA plugins folderFor developersTo forgo installing as a plugin, and simply run as a script under IDA, first install the pe_tree package requirements for theglobalPython installation:$ pip install -r requirements.txtThen runpe_tree_ida.pyunder IDA:File -> Script file... -> pe_tree_ida.py -> OpenIDA plugins folderOSPlugins folderWindows%ProgramFiles%\IDA Pro 7.X\pluginsLinux/opt/ida-7.X/pluginsMac~/.idapro/pluginsUsageLaunch IDA Pro and disassemble a PE file (always selectManual LoadandLoad Resourcesfor best results!)Load the PE Tree plugin:Edit -> Plugins -> PE TreeExampleDumping in-memory PE filesBelow are the basic steps to dump a packed PE file (for example MPRESS orUPX) and reconstruct imports (assuming the image base/entry-point is fairly standard):Launch IDA Pro and disassemble an MPRESS or UPX packed PE file (selectManual LoadandLoad Resources)Select a debugger (Windows orBochs) and run until OEP (usually 0x00401000, but not always!)At this point you could take a memory snapshot (saving all segments) and save the IDB for laterEnsure IDA has found all code:Options -> General -> Analysis -> Reanalyze programOpen the PE Tree IDAPython plugin, right-click in the right-hand pane and select:Add PE -> Search IDBThis will scan the IDB for MZ/PE headers and display any modules it finds.Right-click onHEADER-0x00400000(or appropriate module name) and selectDump...Specify theAddressOfEntryPoint(typically 0x1000, but again, not always!)EnsureRebuild IDT/IATis selectedDump!A new executable will be created using the unpacked section data obtained from memory/IDB, whilst a new section named.pe_treeand containing the rebuilt IAT, hint name table and IDT will be appended to the PE file (much like an.idatasection).
If the entry-point memory segment has been marked writable during execution (viaVirtualProtectfor example) then the entry-point section's characteristics will also be marked writable.
Finally, the BASERELOC, BOUND_IMPORT and SECURITY data directories are marked null, and the OPTIONAL_HEADER checksum is recalculated (if specified).Using the above approach it is possible to dump many in-memory PE files that have either been unpacked, injected, reflectively loaded or hollowed etc.RekallThe PE Tree Rekall plugin finds portable executables in Windows memory dumps.RequirementsPython 3+FeaturesOperates against a Windows memory dump or a live systemView, dump and reconstruct PE modules from;Active processes and DLLsLoaded kernel-mode driversInstallationInstall Rekall fromGitHub.Install PE Tree standalone application (seeInstallation) under the same virtual environment.UsageRun Rekall and view active processes, DLLs and drivers on a live system:$ rekall --live Memory
[1] Live (Memory) 00:00:00> run -i pe_tree_rekall.pyAlternatively, run Rekall/PE Tree against an existing memory dump:$rekall -f memory.vmem
[1] memory.vmem 00:00:00> run -i pe_tree_rekall.pyVolatilityThe PE Tree Volatility plugin finds portable executables in Windows memory dumps.RequirementsPython 3.5+FeaturesOperates against a Windows memory dumpView, dump and reconstruct PE modules from;Active processes and DLLsLoaded kernel-mode driversInstallationInstall Volatility3 fromGitHub.Install PE Tree standalone application (seeInstallation) under the same virtual environment.Usage$ pe-tree-vol -h
usage: pe-tree-vol [-h] filename

PE-Tree (Volatility)

positional arguments:
  filename    Path to memory dump

optional arguments:
  -h, --help  show this help message and exitGhidraThe PE Tree Ghidra plugin finds portable executables in Ghidra databases.RequirementsPython 3.5+Ghidra BridgeFeaturesEasy navigation of PE file structuresDouble-click on a memory address in PE Tree to view in Ghidra disassembly/hex-viewReconstruct imports (IAT + IDT)Dump reconstructed PE filesInstallationInstall PE Tree (seeInstallation)InstallGhidra BridgeUsageStart theGhidra Bridge serverRun the PE Tree Ghidra plugin$ pe-tree-ghidra -h
usage: pe-tree-ghidra [-h] [--server SERVER] [--port PORT]

PE-Tree (Ghidra)

optional arguments:
  -h, --help       show this help message and exit
  --server SERVER  Ghidra bridge server IP (default: 127.0.0.1)
  --port PORT      Ghidra bridge server port (default: 4768)MinidumpThe PE Tree Minidump plugin finds portable executables in Windows Minidumps.RequirementsPython 3.6+minidumpFeaturesView, dump and reconstruct PE modules from a Windows Minidump (.dmp) fileInstallationInstall PE Tree (seeInstallation)Installminidump(pip install minidump)Usage$ pe-tree-minidump -h
usage: pe-tree-minidump [-h] filename

PE-Tree (Minidump)

positional arguments:
  filename    Path to .dmp file

optional arguments:
  -h, --help  show this help message and exitConfigurationOverviewThe configuration is stored in an INI file and defaults to the following values:[config]
debug = False
fonts = Consolas,Monospace,Courier
passwords = ,infected
virustotal_url = https://www.virustotal.com/gui/search
cyberchef_url = https://gchq.github.io/CyberChefOptionsSectionOptionTypeDescriptionconfigdebugbooleanPrint pefile.dump() to outputconfigfontsstringComma-separated list of font names for UIconfigpasswordsstringComma-separated list of ZIP file passwordsconfigvirustotal_urlstringVirusTotal search URLconfigcyberchef_urlstringCyberChef URLLocationTypeOSPathApplicationWindows%TEMP%\pe_tree.iniApplicationLinux/Mac/tmp/pe_tree.iniIDAPythonWindows%APPDATA%\HexRays\IDA Pro\pe_tree.iniIDAPythonLinux/Mac~/.idapro/pe_tree.iniRekallWindows%TEMP%\pe_tree_rekall.iniRekallLinux/Mac/tmp/pe_tree_rekall.iniVolatilityWindows%TEMP%\pe_tree_volatility.iniVolatilityLinux/Mac/tmp/pe_tree_volatility.iniGhidraWindows%TEMP%\pe_tree_ghidra.iniGhidraLinux/Mac/tmp/pe_tree_ghidra.iniMinidumpWindows%TEMP%\pe_tree_minidump.iniMinidumpLinux/Mac/tmp/pe_tree_minidump.iniCarveWindows%TEMP%\pe_tree_carve.iniCarveLinux/Mac/tmp/pe_tree_carve.ini3rd party data sharingThe following information will be shared with 3rd party web-applications (depending on configuration) under the following conditions:VirusTotalIf theVirusTotalURL is specified in the configuration then metadata such as file hashes, timestamps, etc will be sent to VirusTotal for processing when the user clicks on highlighted links or selects "VirusTotal search" from the right-click context menu.CyberChefIf theCyberChefURL is present in the configuration then any file data will be base64 encoded and sent to CyberChef for processing when the user selects "CyberChef" from the right-click context menu.TroubleshootingAttributeError: module 'pip' has no attribute 'main'orPyQt5 fails to install under LinuxTry to upgrade pip to version 20.0+:$ pip install --upgrade pipModuleNotFoundError: No module named 'PyQt5.sip'Try uninstalling and reinstalling PyQt5 as follows:pip uninstall PyQt5
pip uninstall PyQt5-sip
pip install PyQt5 PyQt5-sipMissing imports after dumpingEnsure IDA has found and disassembled all code:Options -> General -> Analysis -> Reanalyze programAfter this is completed try to dump/rebuild imports again.ContributingPlease feel free to contribute! Issues and pull requests are most welcome.Developer documentationTo build documentation from source usingSphinx:$ pip install sphinx
$ sphinx-apidoc -o ./doc/source/ .
$ sphinx-build -b html ./doc/source ./doc/build -ETo view the documentation open./doc/build/index.htmlin a web-browser.AuthorsTom Bonner-tombonner-@thomas_bonnerLicensePE Tree is distributed under the Apache License. SeeLICENSEfor more information.