https://github.com/evilsocket/libpe

A C/C++ library to parse Windows portable executables written with speed and stability in mind.
https://github.com/evilsocket/libpe

Last synced: 6 days ago
JSON representation

A C/C++ library to parse Windows portable executables written with speed and stability in mind.

• Host: GitHub
• URL: https://github.com/evilsocket/libpe
• Owner: evilsocket
• License: gpl-3.0
• Created: 2014-02-21T16:46:04.000Z (over 10 years ago)
• Default Branch: master
• Last Pushed: 2015-02-17T16:24:44.000Z (over 9 years ago)
• Last Synced: 2024-07-31T22:56:04.332Z (3 months ago)
• Language: C
• Size: 408 KB
• Stars: 66
• Watchers: 9
• Forks: 18
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# libpe

A C/C++ library to parse Windows portable executables ( both PE32 and PE32+ ) written with **speed** and **stability** in mind.

Copyleft of Simone Margaritelli 

[http://www.evilsocket.net/](http://www.evilsocket.net/)

## Features

* Fully compatible with both x86 and AMD64 binaries.

* Parse only what you are really interested into to reduce useless data parsing overhead.

* Export directory parsing, lookup symbols by name or ordinal.

* Import directory parsing with different configurations ( resolve ordinals, name demangling, etc ), fast modules and symbols lookup by name.

* Fast strings extraction ( both ascii and unicode ).

* Every RVA is returned as a structure with an absolute virtual address field ( base + RVA ), the corresponding raw offset into the file and a pointer to the data.

* Clean and doxygen documented API.

* Minimum speed and memory overhead.

## Samples

* **peview** a sample PE dumper tool that will print informations extracted from any portable executable.

* **pefunctions** a proof of concept using libpe and distorm, analyzes and isolates functions from any portable executable.

## TODO

* Cross platform compatibilty.

* Cross platform cmake files.

* Parsing of other directories such as resources, debug info, etc.

* Basic disassembly features.

## License

Release under the GPL 3 license.

[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/evilsocket/libpe/trend.png)](https://bitdeli.com/free "Bitdeli Badge")