NAME

Win32::PEFile - Portable Executable File parser

SYNOPSIS

use Win32::PEFile;

my $pe = Win32::PEFile->new (-file => 'someFile.exe');

print "someFile.exe has a entry point for EntryPoint1"
    if $pe->getEntryPoint ("EntryPoint1");

my $strings = $pe->getVersionStrings ();
print "someFile.exe version $strings->{'ProductVersion'}\n";

Methods

Win32::PEFile provides the following public methods.

new (%parameters)

Parses a PE file and returns an object used to access the results. The following parameters may be passed:

-file: file name, required

The file name (and path if required) of the PE file to process.

getSectionNames()

Return the list of named sections present in the PEFile.

setMSDOSStub($stub)

Set the MS-DOS stub code. $stub contains the code as a raw binary blob.

getMSDOSStub()

Return a string containing MS-DOS stub code as a raw binary blob.

Section methods

The helper module Win32::PEFile::SectionHandlers provides handlers for various sections. At present only a few of the standard sections are handled and documented here. If there are sections that you would like to be able to manipulate that are not currently handled enter a ticket using CPAN's request tracker (see below).

.rsrc

Resource section. At present only access to the version resource is provided, although the other resources are parsed internally.

getVersionStrings ($language)

Returns a hash reference containing the strings in the version resource keyed by string name.

getVersionCount ($language)

Returns a count of version resources.

$language: optional

Selected language specified as a MicroSoft LangID. If the language is not specified all language variants are counted.

getFixedVersionValues ($language)

Returns a hash reference containing the fixed version resource values keyed by value name.

getResourceData ($type, $name, $language)

Returns a string containg the raw data for the specified resource or undef if the resource doesn't exist.

$language: optional

Preferred language for the strings specified as a MicroSoft LangID. US English is preferred by default.

If the preferred language is not available one of the available languages will be used instead.

.edata

Exports section.

getExportNames ()

Returns a list of all the named entry points.

getExportOrdinalsCount ()

Returns the count of all the ordinal entry points.

haveExportEntry ($entryPointName)

Returns true if the given entry point exists in the exports table. For compatibility with previous versions of the module getEntryPoint ($entryPointName) is provided as an alias for haveExportEntry ($entryPointName).

$entryPointName: required

Name of the entry point to search for in the Exports table of the PE file.

.idata

getImportNames ()

Returns a hash keyed by .DLL name of lists of all the named entry points.

getImportNamesArray ()

Returns the list of .DLL names in table entry order.

haveImportEntry ($entryPath)

Returns true if the given entry point exists in the imports table.

$entryPath: required

Path to the entry point to search for in the Imorts table of the PE file. The path is in the form 'dll name/entry name'. For example:

my $havePrintf = $pe->haveImportEntry('MSVCR80.dll/printf');

would set $havePrintf true if the PE file has an import entry for the MicroSoft C standard library version of printf.

BUGS

Please report any bugs or feature requests to bug-Win32-PEFile at rt.cpan.org, or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Win32-PEFile. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

SUPPORT

This module is supported by the author through CPAN. The following links may be of assistance:

• AnnoCPAN: Annotated CPAN documentation

  http://annocpan.org/dist/Win32-PEFile

• CPAN Ratings

  http://cpanratings.perl.org/d/Win32-PEFile

• RT: CPAN's request tracker

  http://rt.cpan.org/NoAuth/Bugs.html?Dist=Win32-PEFile

• Search CPAN

  http://search.cpan.org/dist/Win32-PEFile

SEE ALSO

Related documentation

http://kishorekumar.net/pecoff_v8.1.htm

Win32::Exe and Win32::PEFile

Win32::PEFile overlaps in functionality with Win32::Exe. Win32::Exe is a much more mature module and is more comprehensive. The only current (small) disadvantages of Win32::Exe are that it is not pure Perl and that has a larger dependency tree than Win32::PEFile.

For some applications a larger problem with Win32::Exe is that some file editing operations are not portable across systems.

The intent is that Win32::PEFile will remain pure Perl and low dependency. Over time PEFile will acquire various editing functions and will remain both cross- platform and endien agnostic.

ACKNOWLEDGEMENTS

Thank you Engin Bulanik for contributing the seed code for getVersionCount().

AUTHOR

Peter Jaquiery
CPAN ID: GRANDPA
grandpa@cpan.org

COPYRIGHT AND LICENSE

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

The full text of the license can be found in the LICENSE file included with this module.

cpanm Win32::PEFile

perl -MCPAN -e shell
install Win32::PEFile