pecon package

Submodules

pecon.pecon module

pecon - PE file reCONstructor

Usage:

>>> import pecon

# Create a PE object:
>>> pe = pecon.PE()

# Fill in pe with known information (fields not provided will contain a default as defined in the PE constructor)
>>> pe.DosHeader.e_lfanew = 0x3211
>>> pe.OptionalHeader.SizeOfCode = 0x3141241
>>> pe.OptionalHeader.AddressOfEntryPoint = 0x43222
>>> pe.OptionalHeader.Subsystem = pecon.IMAGE_SUBSYSTEM_WINDOWS_GUI
# DataDirectory is a list of IMAGE_DATA_DIRECTORY structs.
# By default it contains the standard 16, which can be accessed with indexes or though helper attributes
# ("imports", "exports", etc)
# NOTE: While it would make more sense to call it "DataDirectories", we are trying to be
#       consistent with Microsoft's names.
>>> pe.OptionalHeader.DataDirectory.imports.VirtualAddress = 0x101
>>> pe.OptionalHeader.DataDirectory.imports.Size = 20
# Create pecon.Section() objects to fill in section information.
# (By default there are no sections.)
>>> pe.SectionTable.append(pecon.Section(Name='.text', VirtualSize=4, VirtualAddress=0x3422, data=b'blah'))

# Generate file data.
>>> pe_data = pe.build()
# To only build the header, you can tell it to avoid writing the section data.
>>> pe_data = pe.build(write_section_data=False)

# You can also modifiy fields in an already existing exe file.
>>> pe = pecon.PE(exe_data)
>>> pe.OptionalHeader.SizeOfCode = 0x3422
>>> pe_data = pe.build()

class pecon.pecon.Container(*args, **kwargs)

Bases: Container

classmethod from_container(container_object)

Factory method for converting an already existing Container object.

class pecon.pecon.DataDirectories(size=16)

Bases: ListContainer

A list of IMAGE_DATA_DIRECTORY entries

Provides convenience properties for accessing standard directories by name.

Parameters:

size (int) – Number of directory entries. defaults to the standard size of 16

sizeof()

property exports

property imports

property resource

property exception

property certificate

property base_reloc

property debug

property architecture

property global_ptr

property tls

property load_config

property bound_import

property import_address

property dely_import_descriptor

property clr_header

class pecon.pecon.Section(*args, **kw)

Bases: Container

Container for IMAGE_SECTION_HEADER

(Provides defaults for non-filled values.)

class pecon.pecon.PE(data=None, is_64bit=False)

Bases: Container

build(write_section_data=True)

Generate PE file.

Parameters:

write_section_data – Whether to include section data (otherwise only the headers are written)

Returns bytes:

PE file data.

Raises:

ValueError – If set attributes contains contradicting data.

property OptionalHeader

property FileHeader

property Signature

Module contents