lief模块使用

使用lief模块解析pe文件信息

简介

lief是一个测试可执行格式的库

安装

pip install lief

用法

import json

import lief

pe_file = r"D:\Program Files\JetBrains\PyCharm 2022.3\bin\pycharm64.exe"
binary = lief.parse(open(pe_file, 'rb'))
data = json.loads(lief.to_json(binary))
print(json.dumps(data, indent=4))

读取文件说明信息

def read_FileDescription(file):
    """读取文件说明信息"""
    binary = lief.parse(open(file, 'rb'))
    try:
        d = json.loads(lief.to_json(binary))
        file_info = d.get('resources_manager').get('version').get('string_file_info')
        FileDescription = file_info.get('langcode_items')[0].get('items').get('FileDescription')
        return FileDescription
    except:
        return

读取文件数字签名信息

def get_certificate_info(self, file):
    binary = lief.parse(file)
    d = json.loads(lief.to_json(binary))
    issuer = d["signatures"][0]['signer_info'][0]["issuer"]
    lst = d["signatures"][0]['certificates']
    for item in lst:
        if item['issuer'] == issuer:
            name = item['subject'].split("=")[-1]
            valid = item['valid_to']
            return name, datetime.datetime(*valid)