libTriton  version 0.4 build 1356
PeImportLookup

Table of Contents

[python api] All information about the PeImportLookup python object.

Description


This object is used to represent an import table from the PE binary format.

Example

>>> b = Pe('C:/Windows/System32/notepad.exe')
>>> for tbl in b.getImportTable():
... print tbl.getName(),":"
... for lookup in tbl.getEntries():
... print " ",hex(lookup.getOrdinal())," - ",lookup.getName()
...
ADVAPI32.dll :
0x214L - OpenProcessToken
0x16fL - GetTokenInformation
0xeeL - DuplicateEncryptionInfoFile
0x2a6L - RegSetValueExW
0x296L - RegQueryValueExW
0x264L - RegCreateKeyW
0x258L - RegCloseKey
0x289L - RegOpenKeyExW
0x121L - EventSetInformation
0x120L - EventRegister
0x122L - EventUnregister
0x128L - EventWriteTransfer
0x197L - IsTextUnicode
KERNEL32.dll :
...

Python API - Methods of the PeImportLookup class