erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files
MIT License
1.88k stars 522 forks source link

Is it possible to remove a section from the import table? #345

Open galeone opened 2 years ago

galeone commented 2 years ago

Hi! Thank you for this great library. I'm trying to use it for removing from the import table of a .dll all the references to another library. Here's what I wrote so far

import sys

import pefile

pe = pefile.PE(
    "./build/mxe/usr/x86_64-w64-mingw32.shared.posix.web/bin/libgio-2.0-0.dll"
)

kill = -1
newlist = pe.DIRECTORY_ENTRY_IMPORT
for idx, imp in enumerate(pe.DIRECTORY_ENTRY_IMPORT):
    if "libz1.dll" in str(imp.dll):
        kill = idx
        break
if kill < 0:
    print("libz1.dll not found among imported descriptors")
    sys.exit()
print(kill)
del pe.DIRECTORY_ENTRY_IMPORT[kill]

pe.write("libgio-2.0-0.dll")

I thought this was enough for removing any reference to libz1.dll in the library libgio-2.0-0.dll, but it looks like pe.write is not able to make persistent this change, in fact, if I load ./libgio-2.0-0.dll I can still find this imported symbols.

What am I doing wrong? Is it something pefile can help me do?

Thanks!