利用Python获取导出表

import pefile
def GetCurrentExportFunction(module_name, module_base = 0):
       pe = pefile.PE(module_name)
       if module_base != 0:
               pe.relocate_image(module_base)
       for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
               function_dict[pe.OPTIONAL_HEADER.ImageBase + exp.address] = exp.name
               print hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), exp.name, exp.ordinal
       pe.close()

推荐阅读更多精彩内容