Package modules :: Package processing :: Module static :: Class PortableExecutable
[hide private]
[frames] | no frames]

Class PortableExecutable

source code

object --+
         |
        PortableExecutable

PE analysis.

Instance Methods [hide private]
 
__init__(self, file_path)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
_get_filetype(self, data)
Gets filetype, uses libmagic if available.
source code
 
_get_peid_signatures(self)
Gets PEID signatures.
source code
 
_get_imported_symbols(self)
Gets imported symbols.
source code
 
_get_exported_symbols(self)
Gets exported symbols.
source code
 
_get_sections(self)
Gets sections.
source code
 
_get_resources(self)
Get resources.
source code
 
_get_versioninfo(self)
Get version info.
source code
 
_get_imphash(self)
Gets imphash.
source code
 
_get_timestamp(self)
Get compilation timestamp.
source code
 
_get_pdb_path(self)
Get the path to any available debugging symbols.
source code
 
_get_signature(self)
If this executable is signed, get its signature(s).
source code
 
run(self)
Run analysis.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, file_path)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Parameters:
  • file_path - file path.
Overrides: object.__init__

_get_filetype(self, data)

source code 

Gets filetype, uses libmagic if available.

Parameters:
  • data - data to be analyzed.
Returns:
file type or None.

_get_peid_signatures(self)

source code 

Gets PEID signatures.

Returns:
matched signatures or None.

_get_imported_symbols(self)

source code 

Gets imported symbols.

Returns:
imported symbols dict or None.

_get_exported_symbols(self)

source code 

Gets exported symbols.

Returns:
exported symbols dict or None.

_get_sections(self)

source code 

Gets sections.

Returns:
sections dict or None.

_get_resources(self)

source code 

Get resources.

Returns:
resources dict or None.

_get_versioninfo(self)

source code 

Get version info.

Returns:
info dict or None.

_get_imphash(self)

source code 

Gets imphash.

Returns:
imphash string or None.

_get_timestamp(self)

source code 

Get compilation timestamp.

Returns:
timestamp or None.

run(self)

source code 

Run analysis.

Returns:
analysis results dict or None.