Skip to content

Instantly share code, notes, and snippets.

@hasherezade
Last active May 28, 2020 20:28
Show Gist options
  • Select an option

  • Save hasherezade/91d0e2a968bacb615758 to your computer and use it in GitHub Desktop.

Select an option

Save hasherezade/91d0e2a968bacb615758 to your computer and use it in GitHub Desktop.
Search library in PE file
import pefile
import os
def list_files(dir, ext):
file_list = []
for root, dirs, files in os.walk(dir):
for file in files:
if file.endswith(ext):
path = os.path.join(root, file)
file_list.append(path)
return file_list
dir_path = "D:\\challs"
file_ext = ".exe"
files = list_files(dir_path, file_ext)
searched_import = "MSVBVM60.DLL"
for f_path in files:
#path = "D://challs//app2.exe"
try:
pe = pefile.PE(f_path)
except pefile.PEFormatError :
print f_path + "is NOT PE!"
continue
#
#print "\nSections:"
#for section in pe.sections:
# print (section.Name, hex(section.VirtualAddress),
# hex(section.Misc_VirtualSize), section.SizeOfRawData )
## If the PE file was loaded using the fast_load=True argument, we will need to parse the data directories:
pe.parse_data_directories()
#print "\nImports:"
isFound = False
for entry in pe.DIRECTORY_ENTRY_IMPORT:
if entry.dll == searched_import :
isFound = True
break
if isFound == True :
print f_path + " [YES]"
else :
print f_path + " [NO]"
#for imp in entry.imports:
# print '\t', hex(imp.address), imp.name
@evandrix

Copy link
Copy Markdown

@hasherezade

Copy link
Copy Markdown
Author

@evandrix - of course, but making an explicit comparison is not an error either, so I don't know what is the point of such "correction"? just like you can write if (buf) or if (but != NULL) - it is one and the same thing - but sometimes you want to make it more explicit for the convenience of the human who will read the code. it is the matter of taste which form you will like to use, rather than "the only right way".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment