libyanlake/oneliner_PEs.md

Created May 14, 2025 15:37

Star (1) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/libyanlake/2c7dee7e1e6eb364f1c531e5f0716ac2.js"></script>
Save libyanlake/2c7dee7e1e6eb364f1c531e5f0716ac2 to your computer and use it in GitHub Desktop.

Raw

sharing this oneliner i made and use a lot on PEs. doesn't work on DLLs or if you have 0 imports:
alias peinfo="python -c \"import pefile, sys; pe = pefile.PE(sys.argv[1]); print('\\n'.join(['Module: {} - {}, Address: {}'.format(entry.dll.decode('utf-8'), imp.name.decode('utf-8'), hex(imp.address)) for entry in pe.DIRECTORY_ENTRY_IMPORT for imp in entry.imports]))\""
sample output:

Module: KERNEL32.dll - DeleteCriticalSection, Address: 0x14000d1d8
Module: msvcrt.dll - __initenv, Address: 0x14000d270
Module: msvcrt.dll - calloc, Address: 0x14000d2e8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment