dorkbox/peparser

Windows PE (Portable Executable) file parser for Java 6+

PeParser

Provides a light-weight way to parse and extract data from windows PE files, from Java.

This library can access meta-data information and details from within the PE file, and specifically it was designed to access and copy out files from the .rsrc section.

Windows PE format and details: http://msdn.microsoft.com/en-us/library/ms809762.aspx

• This is for cross-platform use, specifically - linux 32/64, mac 32/64, and windows 32/64. Java 8+

   

Maven Info

<dependencies>
    ...
    <dependency>
      <groupId>com.dorkbox</groupId>
      <artifactId>PeParser</artifactId>
      <version>3.3</version>
    </dependency>
</dependencies>

Gradle Info

dependencies {
    ...
    implementation("com.dorkbox:PeParser:3.3")
}

Or if you don't want to use Maven, you can access the files directly here:
https://repo1.maven.org/maven2/com/dorkbox/PeParser/

License

This project is © 2014 dorkbox llc, and is distributed under the terms of the Apache v2.0 License. See file "LICENSE" for further references.

peparser's Issues

ResourceType lookup invalid ordinal NPE

Caused by: java.lang.NullPointerException
	at dorkbox.peParser.types.ResourceDirName.<init>(ResourceDirName.java:87)
	at dorkbox.peParser.headers.resources.ResourceDirectoryEntry.<init>(ResourceDirectoryEntry.java:71)
	at dorkbox.peParser.headers.resources.ResourceDirectoryHeader.<init>(ResourceDirectoryHeader.java:62)
	at dorkbox.peParser.PE.fromInputStream(PE.java:135)
	at dorkbox.peParser.PE.<init>(PE.java:68)

Tested in 2.13 and 2.9 releases. The index in my case is 256. The executable in question is not mine but from a famous computer game (Warcraft III), so should be valid.

ClassNotFoundException: dorkbox.util.OS;

The PE class imports dorkbox.util.OS but it is not part of the dependency list.

Error parsing PE file

I want to pare the resources from the .rsrc section of the following PE file (147.7 MB). I got that file from the Edge MSI installer (inside the Binary.MicrosoftEdgeInstaller stream).

I tried to use PeParser from Java as follows:

PE pe = new PE("/path/to/MicrosoftEdge_X64_116.0.1938.76.exe");

... but I got the following error:

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 685592958
	at dorkbox.bytes.LittleEndian$UInt_.from-_W1zjd8(LittleEndian.kt:259)
	at dorkbox.peParser.ByteArray.readUInt-OGnWXxg(ByteArray.kt:36)
	at dorkbox.peParser.headers.resources.ResourceDataEntry.<init>(ResourceDataEntry.kt:33)
	at dorkbox.peParser.headers.resources.ResourceDirectoryEntry.<init>(ResourceDirectoryEntry.kt:85)
	at dorkbox.peParser.headers.resources.ResourceDirectoryHeader.<init>(ResourceDirectoryHeader.kt:57)
	at dorkbox.peParser.PE.fromInputStream(PE.kt:192)
	at dorkbox.peParser.PE.<init>(PE.kt:119)

Any idea of what is wrong here? Thanks in advance.

Is it somehow possible to parse resource entries

Hey,
is it possible to parse the resource data entry, to get the actual values? I don't need the decompiled resource script, just the values from this entry. For example the values from the "Version" resource entry. Is their a way to achieve this with your library or did I have to implement it by my own or search another library?

Best regards,
Chris

Parsing invalid length .exe results in raw ArrayIndexOutOfBoundsException

Hi, if you don't mind, you could add a check to prevent this exception from happening:

Caused by: java.lang.ArrayIndexOutOfBoundsException: 61
	at dorkbox.util.bytes.LittleEndian$UShort_.from(LittleEndian.java:276)
	at dorkbox.peParser.ByteArray.readUShort(ByteArray.java:53)
	at dorkbox.peParser.PE.getPEOffset(PE.java:201)
	at dorkbox.peParser.PE.isPE(PE.java:208)
	at dorkbox.peParser.PE.fromInputStream(PE.java:102)
	at dorkbox.peParser.PE.<init>(PE.java:70)
	at dorkbox.peParser.PE.getVersion(PE.java:260)

if the input file is of invalid length, since it isn't caught/thrown. Perhaps throw your own exception.

possible to edit / change pe resource ?

hi , i want to change my jpg images or strings inside my exe.
is it possible to find and change resource string or binary , images ?
if yes , is there any sample for that?

Error

Exception in thread "main" java.lang.NumberFormatException: Value is out of range : 5368709120
at dorkbox.util.bytes.UInteger.rangeCheck(UInteger.java:260)
at dorkbox.util.bytes.UInteger.valueOf(UInteger.java:219)
at dorkbox.peParser.types.ImageBase_Wide.format(ImageBase_Wide.java:39)
at dorkbox.peParser.PE.getInfo(PE.java:175)
at TaskThree.main(TaskThree.java:47)

Execution failed for task ':task-3:TaskThree.main()'.

Process 'command '/usr/lib/jvm/java-17-openjdk/bin/java'' finished with non-zero exit value 1

for:
pe.getInfo()