libpe - GitLite

KO | EN

gitlite — search

#hacktoberfest #ai #typescript #llm #golang #machine-learning #deep-learning #cli #kubernetes #awesome-list #security #mcp #ios #openai

libpe

(★ 71)

A C/C++ library to parse Windows portable executables written with speed and stability in mind.

파일 탐색기

최종 버전 다운로드 (.zip)

- htable.cpp
- htable.h
- libpe.cpp
- libpe.h
- libpe.vcxproj
- libpe.vcxproj.filters
- llist.cpp
- llist.h
- ReadMe.txt
- - config.h
  - decoder.c
  - decoder.h
  - distorm.c
  - distorm.h
  - instructions.c
  - instructions.h
  - insts.c
  - insts.h
  - mnemonics.c
  - mnemonics.h
  - operands.c
  - operands.h
  - prefix.c
  - prefix.h
  - textdefs.c
  - textdefs.h
  - wstring.c
  - wstring.h
  - x86defs.h
- pefunctions.cpp
- pefunctions.vcxproj
- pefunctions.vcxproj.filters
- peview.cpp
- peview.vcxproj
- peview.vcxproj.filters
.gitignore
libpe.sln
LICENSE
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/evilsocket/libpe

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd libpe

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. .NET

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
.NET SDK dotnet 명령어를 쓰기 위한 SDK입니다.

dotnet restore

프로젝트에 필요한 패키지를 내려받습니다.

dotnet run

프로젝트를 빌드하고 바로 실행합니다.

✅ dotnet run 실행 후 터미널에 나타나는 안내 메시지나 주소를 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# libpe

A C/C++ library to parse Windows portable executables ( both PE32 and PE32+ ) written with **speed** and **stability** in mind.

Copyleft of Simone Margaritelli <evilsocket@gmail.com>
[http://www.evilsocket.net/](http://www.evilsocket.net/)

## Features

* Fully compatible with both x86 and AMD64 binaries.
* Parse only what you are really interested into to reduce useless data parsing overhead.
* Export directory parsing, lookup symbols by name or ordinal.
* Import directory parsing with different configurations ( resolve ordinals, name demangling, etc ), fast modules and symbols lookup by name.
* Fast strings extraction ( both ascii and unicode ).
* Every RVA is returned as a structure with an absolute virtual address field ( base + RVA ), the corresponding raw offset into the file and a pointer to the data.
* Clean and doxygen documented API.
* Minimum speed and memory overhead.

## Samples

* **peview** a sample PE dumper tool that will print informations extracted from any portable executable.
* **pefunctions** a proof of concept using libpe and distorm, analyzes and isolates functions from any portable executable.

## TODO

* Cross platform compatibilty.
* Cross platform cmake files.
* Parsing of other directories such as resources, debug info, etc.
* Basic disassembly features.

## License

Release under the GPL 3 license.

[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/evilsocket/libpe/trend.png)](https://bitdeli.com/free "Bitdeli Badge")