pefile is a Python module to read and work with PE (Portable Executable) files
Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file
Golang port of PEFile
Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging
Extract resources from PE files
#计算机科学#A Machine Learning approach for classifying a file as Malicious or Legitimate
Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump in-memory PE files and reconstruct imports.
#十六进制编辑器#PE Tools - Portable executable (PE) manipulation toolkit