Skip to content

Instantly share code, notes, and snippets.

@OALabs
Created December 1, 2019 05:12
Show Gist options
  • Star 7 You must be signed in to star a gist
  • Fork 6 You must be signed in to fork a gist
  • Save OALabs/94ff4fc02bf02d55a8161068cafd11c0 to your computer and use it in GitHub Desktop.
Save OALabs/94ff4fc02bf02d55a8161068cafd11c0 to your computer and use it in GitHub Desktop.
Build dictionary of DLL exports (Windows API Names)
import os
import pefile
import json
INTERESTING_DLLS = [
'kernel32.dll', 'comctl32.dll', 'advapi32.dll', 'comdlg32.dll',
'gdi32.dll', 'msvcrt.dll', 'netapi32.dll', 'ntdll.dll',
'ntoskrnl.exe', 'oleaut32.dll', 'psapi.dll', 'shell32.dll',
'shlwapi.dll', 'srsvc.dll', 'urlmon.dll', 'user32.dll',
'winhttp.dll', 'wininet.dll', 'ws2_32.dll', 'wship6.dll',
'advpack.dll',
]
exports_list = []
for filename in os.listdir("C:\\Windows\\System32"):
if filename.lower() in INTERESTING_DLLS:
pe = pefile.PE("C:\\Windows\\System32\\" + filename)
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
try:
exports_list.append(exp.name.decode('utf-8'))
except:
continue
exports_json = {'exports':exports_list}
open('exports.json','wb').write(json.dumps(exports_json))
@dave5623
Copy link

dave5623 commented Jul 26, 2020

I had to change the open() call such that it was just 'w' instead of 'wb' since it was writing json strings and not binary data. I got this error message: "TypeError: a bytes-like object is required, not 'str'"

open('exports.json','w').write(json.dumps(exports_json))

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment