Print('Signature : ' + hex(pe.NT_HEADERS.Signature)) # Prints the Signature field of the NT_HEADERS The only field we care about in the PE Header (NT_HEADER) is Signature which identify the file as a PE file and two other structures (FILE_HEADER and OPTIONAL_HEADER) Print('e_lfnew : ' + hex(pe.DOS_HEADER.e_lfanew)) # Prints the e_lfnew field of the DOS_HEADER Print('e_magic : ' + hex(pe.DOS_HEADER.e_magic)) # Prints the e_magic field of the DOS_HEADER Pe.print_info() # Prints all Headers in a human readable format OUTPUT: Pe = pefile.PE('path_to_your_executable') Get all information about PE header with pefile python module import pefile Note that in the picture above e_magic = 0x4d5a (because of little endian) e_lfnew → a pointer to the PE header (NT Header).įor most Windows programs DOS header contains a DOS program which does nothing but prints “This program cannot be run in DOS mode”.e_magic → magic number of DOS header is ‘MZ’ (0x5a4d) and ‘MZ’ refers to Mark Zbikowski the designer of MS-DOS executable file format.OR clone the repository and follow the setup instructions PE File Structure DOS Header: To follow along with me you should install pefile module pip3 install pefile PE files refers to Portable Executable files in Windows which may have any extension of the listed below Windows Executable files Extensions:

Pestudio overlay