search

erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files
MIT License
1.83k stars 516 forks source link

how do for the result of dump in str #376

Closed CeContreras closed 1 year ago

CeContreras commented 1 year ago

image i am used .dump_info()

erocarrera commented 1 year ago

You can find each of those fields and their corresponding value exposed as attributes of the PE instance. For the fields that you highlight that would be, assuming your PE instance is named pe, pe.DOS_HEADER.e_magic and so on.

CeContreras commented 1 year ago

image

image

I realiced your instruction, however i get number. This means memory address?

erocarrera commented 1 year ago

Most of the header values are numbers (some refer to addresses, relative or absolute, and others can be counts, ids, etc). If you just print them you'll see their base-10 representation. dump_info() shows their base-16 (hex) representation.