Skip to content

Fast minimalistic library for Portable Executable format parsing + ctypes structures in dataclass style

License

Notifications You must be signed in to change notification settings

dfint/peclasses

Repository files navigation

PECLASSES

Tests Coverage Status Maintainability

This is intended to be a fast, minimalistic, IDE-friendly library for Portable Executable file parsing.

Also, it contains AnnotatedStructure and AnnotatedUnion base classes which allow to declare ctypes structures in the dataclass style.

For example, you can write:

class POINT(AnnotatedStructure):
    x: c_int
    y: c_int

instead of

class POINT(Structure):
    _fields_ = [("x", c_int),
                ("y", c_int)]

More examples of AnnotatedStructure usage see here: examples/annotated_structure.py

Derived from the dfrus project.

Features

  • As is peclasses is IDE-friendly, i.e. an IDE will show you hints about fields of structures;
  • it is pythonic, i.e. names of structures and their fields comply to PEP8 rules;
  • ease to add new structures.

Cons

  • Comparing to pefile, peclasses is in the early stages of development and may lack some features;
  • pythonic name style may confuse some library users;
  • it's not tested against a variety of real life species of portable executable, and may not be suitable for e.g. malware analysis (at least without some improvements);
  • type annotations with types from ctypes can be somewhat misleading: e.g. a structure field can be annotated as c_uint, ctypes will return its value as plain int, but typing tools (such as mypy) will complain that you cannot treat this value as int (because it's annotated as c_uint), so you may need to use cast function from typing.

About

Fast minimalistic library for Portable Executable format parsing + ctypes structures in dataclass style

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages