Python pefile member question

Gang,

I apologize if this is a really dumb question... I am wanting to use the super convenient python script pefile (http://code.google.com/p/pefile/) that parses an executable and lists particular information about the PE structure. My question is where can I find information about how to access particular members of the executable? I've scoured the wiki and read the usage examples but that documentation only covered 4-5 members. What I am wondering is if you guys have a list of members I can access to di开发者_运维问答splay the information I care about. So specifically, if I wanted to list the Stack Commit Size of an executable, does it look like this: pe.FILE_HEADER.StackCommitSize, obviously I can run this code and figure it out but have you guys seen API DOC floating around that I find the members i need?

THANKS!

From the PE docstring:

Basic headers information will be available in the attributes:

DOS_HEADER  
NT_HEADERS  
FILE_HEADER  
OPTIONAL_HEADER

All of them will contain among their attributes the members of the  
corresponding structures as defined in WINNT.H

So, look at winnt.h and you'll see which attributes are available.

Or just read the source code for the module. It's big, but everything you need to know is in there.

You can generally find everything that is in a PE file in the Microsoft PE/COFF specification.

Once you've looked there, you know that the StackCommitSize is in the optional image header. Then all you have to do is to look for the corresponding structure in pefile, which usually bears a similar name, if not indeed the very same name. In this case:

pe = pefile.PE("C:\\Windows\\Notepad.exe")
print pe.OPTIONAL_HEADER.SizeOfStackCommit

Will give you what you want.

If you have trouble finding SizeOfStackCommit (after you've found it in the specification), just use your quick find on the source code. It's as easy to read as you can get, and I don't think you'll have any trouble finding the required structure.

Now, there probably aren't any API docs for pefile itself, but as you can see there's really no need for it, since it's just a nice Pythonic wrapper around the PE specification itself.