pe - A :zap: lightweight Go package to parse, analyze a

项目说明

<a href=" target="_blank" rel="noopener noreferrer"><img align="right" width="300" src=".github/assets/logo.png" alt="Saferwall logo"></a>

Portable Executable Parser

![GoDoc]() !Go ![Report Card]() ![codecov]() !GitHub Workflow Status

pe is a go package for parsing the portable executable file format. This package was designed with malware analysis in mind, and being resistent to PE malformations.

Table of content

Portable Executable Parser

- Table of content
- Features
- Installing
- Using the library
- PE Header
- Rich Header
- Iterating o
- Roadmap
- Fuzz Testing
- Projects Using This Library
- References

Features

Works with PE32/PE32+ file format.

Supports Intel x86/AMD64/ARM7ARM7 Thumb/ARM8-64/IA64/CHPE architectures.

MS DOS header.

Rich Header (calculate checksum and hash).

NT Header (file header + optional header).

COFF symbol table and string table.

Sections headers + entropy calculation.

Data directories

- Import Table + ImpHash calculation.
- Export Table
- Resource Table
- Exceptions Table
- Security Table + Authentihash calculation.
- Relocations Table
- Debug Table (CODEVIEW, POGO, , REPRO, FPO, EXDLL CHARACTERISTICS debug types).
- TLS Table
- Load Config Directory (SEH, GFID, GIAT, Guard LongJumps, CHPE, Dynamic Value Reloc Table, Encla, Metadata tables).
- Bound Import Table
- Delay Import Table
- COM Table (CLR Metadata Header, Metadata Table Streams)

Report several anomalies

Installing

Using this go package is easy. First, use go get to install the latest of the library. This command will install the pedumper executable along with the library and its dependencies:

go get -u github.com/saferwall/pe

Next, include pe package in your application:

Using the library

Start by instantiating a pe object by called the New() method, which takes the file path to the file to be parsed and some optional options.

Afterwards, a call to the Parse() method will give you access to all the different part of the PE format, directly accessible to be used. Here is the definition of the struct:

PE Header

As mentioned before, all members of the struct are directly (no getters) accessible, additionally, the fields types has been preserved as the spec defines them, that means if you need to show the prettified of an int type, you have to call the corresponding helper function.

Output:

Rich Header

Example:

Output:

Iterating o

Output:

Roadmap

imports MS-styled names demangling

PE: VB5 and VB6 typical structures: project info, DLLCall-imports, referenced modules, object table

Fuzz Testing

To the parser we use the go-fuzz and a corpus of known malformed and tricky PE files from corkami.

Projects Using This Library

<a href=" >
<img src=" alt="Fibratus" width="50px">
</a>

Fibratus A modern tool for Windows kernel exploration and tracing with a focus on security.

References

Peering Inside the PE: A Tour of the Win32 Portable Executable File Format by Matt Pietrek

An In-Depth Look into the Win32 Portable Executable File Format - Part 1 by Matt Pietrek

An In-Depth Look into the Win32 Portable Executable File Format - Part 2 by Matt Pietrek

Portable Executable File Format

PE Format MSDN spec

DotNET format

BlackHat 2011 - CONSTANT INSECURITY: (PECOFF) Portable Executable FIle Format

项目信息

开发语言：Go

Star 数：397

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A :zap: lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries. Designed for malware analysis tasks and robust against PE malformations.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。