readpe

readpe is designed for application security research, digital forensics, incident response, and malware analysis. It offers comprehensive tools to parse PE files, extract information such as headers, sections, resources, imports, exports, and security mitigations. Similar to elftools but for PE files, it surpasses specific tools like icoextract or ntldd in features.

The package includes commands like ofs2rva, pedis, pehash, peldd, pepack, peres, pescan, pesec, pestr, readpe, and rva2ofs. These enable detailed examination of PE internals, detection of packers, disassembly of sections, hashing of components, and identification of anomalies.

It supports various output formats and is built on libpe1t64 library for reading PE 32 and 64-bit files.

readpe leverages the libpe1t64 library to parse PE file structures, including DOS, COFF, optional headers, sections, data directories, imports, exports, and resources. Tools dissect specific parts: converting offsets/RVAs, disassembling code with Intel/AT&T syntax, hashing sections/headers/content using md5/sha1/sha256/ssdeep/imphash, scanning for packers via database, extracting resources, searching strings, checking mitigations/certificates, and flagging suspicious traits.