PEFile Class Reference

Inheritance diagram for PEFile:

Public Member Functions
	add_icon (self, icon, ordinal=2)
	add_resource_section (self)
	add_section (self, name, flags, data)
	add_version_info (self, file_ver, product_ver, data, lang=1033, codepage=1200)
	close (self)
	get_address_offset (self, addr)
	get_address_section (self, addr)
	get_export_address (self, symbol_name)
	open (self, fn, mode='r')
	read (self, fp)
	rename_export (self, old_name, new_name)
	write_changes (self)

Public Attributes
	code_size = 0:
	exp_rva = RVASize(0, 0)
	file_alignment = unpack('<II', fp.read(8))
	fp = open(fn, mode)
	header_size = unpack('<II', fp.read(8))
	image_size
	imp_rva = RVASize(0, 0)
	initialized_size
	machine
	res_rva = RVASize(0, 0)
	resources = ResourceTable()
	rva_offset = fp.tell()
	section_alignment
list	sections = []
	uninitialized_size
	vmem = bytearray(self.sections[-1].vaddr + self.sections[-1].size)

Static Public Attributes
tuple	imports = ()

Protected Member Functions
	_mark_address_modified (self, rva)

Member Function Documentation

_mark_address_modified()

_mark_address_modified ( self, rva )

protected

add_icon()

add_icon	(		self,
			icon,
			ordinal = 2 )

 Adds an icon resource from the given Icon object.  Requires
calling add_resource_section() afterwards. 

add_resource_section()

add_resource_section

(

self

)

 Adds a resource section to the file containing the resources that
were previously added via add_icon et al.  Assumes the file does not
contain a resource section yet. 

add_section()

add_section	(		self,
			name,
			flags,
			data )

 Adds a new section with the given name, flags and data.  The
virtual address space is automatically resized to fit the new data.

Returns the newly created Section object. 

add_version_info()

add_version_info	(		self,
			file_ver,
			product_ver,
			data,
			lang = 1033,
			codepage = 1200 )

 Adds a version info resource to the file. 

close()

close

(

self

)

get_address_offset()

get_address_offset	(		self,
			addr )

 Turns an address into a offset relative to the file beginning. 

get_address_section()

get_address_section	(		self,
			addr )

 Returns the section that this virtual address belongs to. 

get_export_address()

get_export_address	(		self,
			symbol_name )

 Finds the virtual address for a named export symbol. 

open()

open	(		self,
			fn,
			mode = 'r' )

read()

read	(		self,
			fp )

 Reads a PE file from the given file object, which must be opened
in binary mode. 

rename_export()

rename_export	(		self,
			old_name,
			new_name )

 Renames a symbol in the export table. 

write_changes()

write_changes

(

self

)

 Assuming the file was opened in read-write mode, writes back the
changes made via this class to the .exe file. 

Member Data Documentation

code_size

code_size = 0:

exp_rva

exp_rva = RVASize(0, 0)

file_alignment

file_alignment = unpack('<II', fp.read(8))

fp

fp = open(fn, mode)

header_size

header_size = unpack('<II', fp.read(8))

image_size

image_size

imp_rva

imp_rva = RVASize(0, 0)

imports

tuple imports = ()

static

initialized_size

initialized_size

machine

machine

res_rva

res_rva = RVASize(0, 0)

resources

resources = ResourceTable()

rva_offset

rva_offset = fp.tell()

section_alignment

section_alignment

sections

sections = []

uninitialized_size

uninitialized_size

Initial value:

=  \
            unpack('<HxxIII', fp.read(16))

vmem

vmem = bytearray(self.sections[-1].vaddr + self.sections[-1].size)