erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files
MIT License
1.83k stars 516 forks source link

Feature request: function for checking of validity of PE files #371

Open TheMythologist opened 1 year ago

TheMythologist commented 1 year ago

Hi, I'm looking through the documentation and I don't think there is currently a way to check if a file / bytes is a valid PE file, other than via the following try...except excerpt:

import pefile

try:
    pefile.PE(filename)
    print("Valid PE file")
except pefile.PEFormatError:
    print("Invalid PE file")

Looking through the functions available, I see the function is_valid in peutils.py, but it currently does nothing (simply a pass statement).

Would it be alright for me to create a pull request, targeting the updating of this function? This will help to implement the functionality of checking if a file is valid PE file, similar to the zipfile standard library's function is_zipfile.

erocarrera commented 1 year ago

Hi, if you have a use for such functionality, feel free to send a PR. I would avoid the "is valid PE" naming. I feel like saying that a PE is valid implies that it is a correct, well-formed, functioning PE, which is a hard thing to say for sure. I would limit it to a is_pe_file() method that attempts a light-weight parse (with fast_load=True). That would differentiate between a parseable PE and non-PE data.