Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How can I get .text section from PE file using pefile [closed]

How can I get the content of .text section (or any other section) from PE by using pefile module?

like image 376
Farseer Avatar asked Nov 17 '13 06:11

Farseer


1 Answers

sections attr of PE class instance is sections list and each item have get_data function:

>>> import pefile
>>> pe = pefile.PE('./psfile.exe')

>>> for section in pe.sections:
...   print (section.Name, hex(section.VirtualAddress),
...     hex(section.Misc_VirtualSize), section.SizeOfRawData )
... 
('.text\x00\x00\x00', '0x1000', '0xd3e4', 57344)
('.rdata\x00\x00', '0xf000', '0x5504', 24576)
('.data\x00\x00\x00', '0x15000', '0x3684', 8192)
('.rsrc\x00\x00\x00', '0x19000', '0x444', 4096)

10 first bytes from text section data for example:

>>> pe.sections[0].get_data()[:10]
'\x81\xec\x90\x00\x00\x00j>\x8dD'
like image 180
ndpu Avatar answered Oct 31 '22 16:10

ndpu