Package: pepy
pepypepy (pronounced p-pie) is a python binding to the pe-parse parser.pepy supports Python versions 3.6 and above.The easiest way to use pepy is to install it via pip:$pip3installpepyBuildingIf you can build pe-parse and have a working python environment (headers and
libraries) you can build pepy.Build pepy:python3 setup.py buildInstall pepy:python3 setup.py installBuilding on Windows:Python 3.x is typically installed aspython.exe,NOTpython3.exe.UsingParsed objectThere are a number of objects involved in pepy. The main one is theparsedobject. This object is returned by theparsemethod.importpepyp=pepy.parse("/path/to/exe")Theparsedobject has a number of methods:get_entry_point: Return the entry point addressget_machine_as_str: Return the machine as a human readable stringget_subsystem_as_str: Return the subsystem as a human readable stringget_bytes: Return the first N bytes at a given addressget_sections: Return a list of section objectsget_imports: Return a list of import objectsget_exports: Return a list of export objectsget_relocations: Return a list of relocation objectsget_resources: Return a list of resource objectsTheparsedobject has a number of attributes:signaturemachinenumberofsectionstimedatestampnumberofsymbolscharacteristicsmagicmajorlinkerverminorlinkervercodesizeinitdatasizeuninitdatasizeentrypointaddrbaseofcodebaseofdataimagebasesectionalignementfilealignmentmajorosverminorosverwin32verimagesizeheadersizechecksumsubsystemdllcharacteristicsstackreservesizestackcommitsizeheapreservesizeheapcommitsizeloaderflagsrvasandsizeExample:importtimeimportpepyp=pepy.parse("/path/to/exe")print("Timedatestamp:%s"%time.strftime("%Y-%m-%d%H:%M:%S",time.localtime(p.timedatestamp)))ep=p.get_entry_point()print("Entry point: 0x%x"%ep)Theget_sections,get_imports,get_exports,get_relocationsandget_resourcesmethods each return a list of objects. The type of object
depends upon the method called.get_sectionsreturns a list ofsectionobjects,get_importsreturns a list ofimportobjects, etc.Section ObjectThesectionobject has the following attributes:baselengthvirtaddrvirtsizenumrelocsnumlinenumscharacteristicsdataImport ObjectTheimportobject has the following attributes:symnameaddrExport ObjectTheexportobject has the following attributes:modfuncaddrRelocation ObjectTherelocationobject has the following attributes:typeaddrResource ObjectTheresourceobject has the following attributes:type_strname_strlang_strtypenamelangcodepageRVAsizedataTheresourceobject has the following methods:type_as_strResources are stored in a directory structure. The first three levels of the
are calledtype,nameandlang. Each of these levels can have
either a pre-defined value or a custom string. The pre-defined values are
stored in thetype,nameandlangattributes. If a custom string is
found it will be stored in thetype_str,name_strandlang_strattributes. Thetype_as_strmethod can be used to convert a pre-defined
type value to a string representation.The following code shows how to iterate through resources:importpepyfromhashlibimportmd5importsysp=pepy.parse(sys.argv[1])resources=p.get_resources()print("Resources: (%i)"%len(resources))forresourceinresources:print("[+] MD5: (%i)%s"%(len(resource.data),md5(resource.data).hexdigest()))ifresource.type_str:print("\tType string:%s"%resource.type_str)else:print("\tType:%s(%s)"%(hex(resource.type),resource.type_as_str()))ifresource.name_str:print("\tName string:%s"%resource.name_str)else:print("\tName:%s"%hex(resource.name))ifresource.lang_str:print("\tLang string:%s"%resource.lang_str)else:print("\tLang:%s"%hex(resource.lang))print("\tCodepage:%s"%hex(resource.codepage))print("\tRVA:%s"%hex(resource.RVA))print("\tSize:%s"%hex(resource.size))Note that some binaries (particularly packed) may have corrupt resource entries.
In these cases you may find thatlen(resource.data)is 0 butresource.sizeis
greater than 0. Thesizeattribute is the size of the data as declared by the
resource data entry.Authorspe-parse was designed and implemented by Andrew Ruef (andrew@trailofbits.com).pepy was written by Wesley Shields (wxs@atarininja.org).