Skip to content

Set of python scripts to analyse PE32/PE64 binaries and to extract VB 5/6 headers and Visual Basic p-code functions.

Notifications You must be signed in to change notification settings

SekoiaLab/pe-tools

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

12 Commits
 
 
 
 
 
 
 
 

Repository files navigation

What?

It is a set of python scripts to parse PE and VB5/6 headers in a Windows executable file. The peparser module analyses PE headers. The vbparser module analyses VB headers and the pcodes module allows disassembly of p-code functions. The PE signature can be saved to a file in DER format (pyasn1 needed).

Why?

pefile module does not accept invalid PE headers. One of the malware we had to analyse has got an invalid IMPORT descriptor and it makes pefile report the file as invalid.

Limitations:

peparser module is, at the moment, limited to DOS, File, Optional ans Section headers. And from the Optional header it lists the data directories and parse only the IMPORT one (even if an entry is invalid we continue parsing). At the moment, the pcodes module cannot show arguments of the p-code.

TODO:

  • Add parsing of more data directories in peparser module,
  • Add methods in vbparser module to get Visual Basic structures instead of just printing them.
  • Add p-code arguments display in pcodes module.

Requirements:

  • pyasn1
  • pyasn1-modules
  • distorm3

Usage:

>>> import peparser
>>> pe = peparser.PeParser('test.exe')
>>> print 'Address Of Entry Point: ', hex(pe.optionalHeader.AddressOfEntryPoint + pe.optionalHeader.ImageBase)
>>> pe.dump_info()
...
>>> import vbparser
>>> vb_header_addr = vbparser.getVbHeaderAddress(pe)
>>> if vb_header_addr != None:
>>>   vbHeader = vbparser.VbParser(pe, vb_header_addr)
>>>   print vbHeader
...
>>> import pcodes
>>> db = pcodes.PcodeDecoder()
>>> data = '\xfd\x16\x10\x00\x5c\xff\xfd\x16\x14\x00\x4c\xff\xfb\x17\x3c\xff\xfc\xf6\x6c\xff\xfd\x95\x10\x00'
>>> offset = 0
>>> while offset < len(data):
>>>   name, size = db.get_pcode(data, offset)
>>>   print hex(offset), "\t", name, " -- size: ", size
>>>   for byte in data[offset:offset+size]:
>>>     print hex(ord(byte)),
>>>   print '\n'
>>>   offset += size
...
>>> import peparser
>>> pe = peparser.PeParser('file.exe')
>>> if pe.signature is not None:
>>>   pe.signature.saveDerToFile('signeddata.der')
>>>   pe.signature.saveCertificatesNamesToCsvFile('issuer_subject.csv')

About

Set of python scripts to analyse PE32/PE64 binaries and to extract VB 5/6 headers and Visual Basic p-code functions.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages