Win32::PEFile - Portable Executable File parser

NAME

Win32::PEFile - Portable Executable File parser

SYNOPSIS

    use Win32::PEFile;
    my $pe = Win32::PEFile->new (-file => 'someFile.exe');
    print "someFile.exe has a entry point for EntryPoint1"
        if $pe->getEntryPoint ("EntryPoint1");
    my $strings = $pe->getVersionStrings ();
    print "someFile.exe version $strings->{'ProductVersion'}\n";

Methods

Win32::PEFile provides the following public methods.

new (%parameters)
Parses a PE file and returns an object used to access the results. The following parameters may be passed:
-file: file name, required
The file name (and path if required) of the PE file to process.

getSectionNames()
Return the list of named sections present in the PEFile.

setMSDOSStub($stub)
Set the MS-DOS stub code. $stub contains the code as a raw binary blob.

getMSDOSStub()
Return a string containing MS-DOS stub code as a raw binary blob.

Section methods

The helper module Win32::PEFile::SectionHandlers provides handlers for various sections. At present only a few of the standard sections are handled and documented here. If there are sections that you would like to be able to manipulate that are not currently handled enter a ticket using CPAN's request tracker (see below).

.rsrc

Resource section. At present only access to the version resource is provided, although the other resources are parsed internally.

getVersionStrings ($language)
Returns a hash reference containing the strings in the version resource keyed by string name.

getVersionCount ($language)
Returns a count of version resources.
$language: optional
Selected language specified as a MicroSoft LangID. If the language is not specified all language variants are counted.

getFixedVersionValues ($language)
Returns a hash reference containing the fixed version resource values keyed by value name.

getResourceData ($type, $name, $language)
Returns a string containg the raw data for the specified resource or undef if the resource doesn't exist.
$language: optional
Preferred language for the strings specified as a MicroSoft LangID. US English is preferred by default.

If the preferred language is not available one of the available languages will be used instead.

.edata

Exports section.

getExportNames ()
Returns a list of all the named entry points.

getExportOrdinalsCount ()
Returns the count of all the ordinal entry points.

haveExportEntry ($entryPointName)
Returns true if the given entry point exists in the exports table. For compatibility with previous versions of the module getEntryPoint ($entryPointName) is provided as an alias for haveExportEntry ($entryPointName).
$entryPointName: required
Name of the entry point to search for in the Exports table of the PE file.

.idata

getImportNames ()
Returns a hash keyed by .DLL name of lists of all the named entry points.

getImportNamesArray ()
Returns the list of .DLL names in table entry order.

haveImportEntry ($entryPath)
Returns true if the given entry point exists in the imports table.
$entryPath: required
Path to the entry point to search for in the Imorts table of the PE file. The path is in the form 'dll name/entry name'. For example: 
    my $havePrintf = $pe->haveImportEntry('MSVCR80.dll/printf');

would set $havePrintf true if the PE file has an import entry for the MicroSoft C standard library version of printf.

BUGS

Please report any bugs or feature requests to bug-Win32-PEFile at rt.cpan.org, or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

SUPPORT

This module is supported by the author through CPAN. The following links may be of assistance:

SEE ALSO

Related documentation

http://kishorekumar.net/pecoff_v8.1.htm

Win32::Exe and Win32::PEFile

Win32::PEFile overlaps in functionality with Win32::Exe. Win32::Exe is a much more mature module and is more comprehensive. The only current (small) disadvantages of Win32::Exe are that it is not pure Perl and that has a larger dependency tree than Win32::PEFile.

For some applications a larger problem with Win32::Exe is that some file editing operations are not portable across systems.

The intent is that Win32::PEFile will remain pure Perl and low dependency. Over time PEFile will acquire various editing functions and will remain both cross- platform and endien agnostic.

ACKNOWLEDGEMENTS

Thank you Engin Bulanik for contributing the seed code for getVersionCount().

AUTHOR

    Peter Jaquiery
    CPAN ID: GRANDPA
    grandpa@cpan.org

COPYRIGHT AND LICENSE

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

The full text of the license can be found in the LICENSE file included with this module.

 Win32::PEFile - Portable Executable File parser