Skip to main content

Scripts to parse the following file formats - Executable and Linking Format (ELF), Portable Executable (PE), Mach-O and OAT (Android Runtime).

Project description


Classes/Types to read and edit the following file formats:
- Executable and Linking Format (ELF),
- Portable Executable (PE) and
- MachO
- OAT (Android Runtime)


Install FileBytes

$ python install

Or install with PyPi

$ pip install filebytes


Parsing ELF file
from filebytes.elf import *
elf_file = ELF('test-binaries/ls-x86')

elf_header = elf_file.elfHeader
sections = elf_file.sections
segments = elf_file.segments # elf_file.programHeaders does the same

Parsing PE file
from import *
pe_file = PE('test-binaries/cmd-x86.exe')

image_dos_header = pe_file.imageDosHeader
image_nt_headers = pe_file.imageNtHeaders
sections = pe_file.sections
data_directory = pe_file.dataDirectory

import_directory = data_directory[ImageDirectoryEntry.IMPORT]
export_directory = data_directory[ImageDirectoryEntry.EXPORT]

Parsing MachO file
from filebytes.mach_o import *
macho_file = MachO('test-binaries/ls-macho-x86_64')

mach_header = macho_file.machHeader
load_commands = macho_file.loadCommands

Parsing OAT file, read DEX files and save them
from filebytes.oat import *

oat = OAT('test-binaries/boot.oat')

for odh in oat.oatDexHeader:
name ='/')[-1]
with open(name, 'wb') as dex:

For further samples look at the sample folder.

If you would like contribute, here some ideas:
- Implementation of parsing of missing LoadCommand types for MachO files
- Implementation of parsing of the missing section types for ELF files
- Implementation of parsing of the missing data directory fields for PE files

But any kind of contribution is welcome. :)

Project page & Examples

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

filebytes-0.9.20.tar.gz (20.0 kB view hashes)

Uploaded source

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page