tieske / pe-parser

Lua module to parse a Portable Executable (.exe , .dll, etc.) file and extract metadata

pe-parser

Lua module to parse a Portable Executable (.exe , .dll, etc.) file and extract metadata. The implementation is far from complete, but it works for the basics. It was developed to check 32/64bit-ness of a binary and imported dll's. Documentation is available in LDoc format, in the doc directory.

A commandline script is available, also by the name of pe-parser. Use pe-parser -help for information on the usage of this utility.

Limitations

It uses regular Lua numbers (for file seeking), so for really large files it will not work properly because Lua numbers cannot hold 64bit integers. Generally this is not an issue as executable files don't tend to be that big. All numbers returned will be as hex formatted strings, so 64bit flag fields can be processed correctly.

PE info

• Portable Executable
• Peering Inside the PE: A Tour of the Win32 Portable Executable File Format
• Iczelion's Win32 Assembly Homepage - Tutorial 6: Import Table
• Understanding RVAs and Import Tables

Copyright

Copyright 2013-2018 Thijs Schreijer

License

MIT X11

pe-parser's Issues

Does not recognize C runtime used by Visual Studio 2015

As seen here, pe-parser does not recognize the C runtime used by VS 2015.

Will try to provide binaries to test it or a patch myself.

Using built-in functions for Hex <-> Decimal Conversion

This is actually more of a question than an issue, but unfortunately I didn't any other avenue for asking it. I'm currently working on a project that will need to do some binary file parsing, and so I was looking at your project to get an idea of how people previously handled the task.

Anyways, I was wondering what your reasons were for implementing the toHex(IN, LEN) and toDec(IN) functions by hand, rather than using the built-in:

string.format("%0" .. tostring(LEN) .. "X", IN)

and

tonumber(IN, 16)

Your implementation of toHex seems to give the added benefit of being able to truncate the resulting string, but since I won't need that, I just wanted to make sure your decision wasn't based on there being a compatibility issue with string.format.

MS runtime dll's; debug version is not recognized

-----Original Message-----
From: Philipp Janda [mailto:[email protected]]
Sent: maandag 13 april 2015 17:27
To: Hisham
Cc: Thijs Schreijer; Ignacio Burgueño
Subject: Re: prg-lr4win

<< SNIP >>

(Btw. @thijs, the pe-parser module doesn't recognize the debug versions
of the MSVC runtime DLLs, e.g. MSVCR100D.DLL.)