Skip to content

Instantly share code, notes, and snippets.

@callistabee
Created February 2, 2019 19:36
Show Gist options
  • Save callistabee/8056b647a5e4be5138ae9b455dbd0f20 to your computer and use it in GitHub Desktop.
Save callistabee/8056b647a5e4be5138ae9b455dbd0f20 to your computer and use it in GitHub Desktop.
disassemble a windows executable
import pefile
import sys
import distorm3
fn = sys.argv[1]
pe = pefile.PE(fn)
try:
text_section = (
[ section
for section in pe.sections
if section.Name.startswith(b".text")
][0]
)
except IndexError:
sys.stderr.write("file has no .text section")
sys.exit(1)
code = text_section.get_data()
disass = distorm3.DecomposeGenerator(0, code, distorm3.Decode32Bits)
for inst in disass:
sys.stdout.write(
"%.8x (%d) 0x%-16s %-48s %s\n" % (
inst.address,
inst.size,
inst.instructionBytes.hex(),
str(inst),
inst.instructionClass
)
)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment