Skip to main content

Parse 16-bit New Executable (NE) programs.

Project description

Like its namesake pefile does for the modern Portable Executable format, this nefile library parses the ancient 16-bit New Executable (NE) format.

I drafted this library because here are not many good cross-platform tools for analyzing and extracting data (more than just code) from NE files. For instance, Ghidra is great at decompilation but not really at resources. wrestool and icoutils are the only tools I have found to date that can extract resources from NE files, but I ran into multiple issues using wrestool, including resources being corrupted upon extraction.

This library fills the gap. Also, I just love Windows 3.1.

Currently there is read-only support for the NE header and resources, as that's all I need at the moment. Feel free to contribute if you need other functionality from Python!

Spec References

The main spec reference used is the Microsoft Windows 3.1 Programmer's Reference, Volume 4 (Resources), referred to in the code as W3.1PRV4.

The Microsoft MS-DOS Programmer's Reference helped provide insight into the DOS MZ header.

Installation

Get it on PyPI: pip3 install nefile

Usage

import nefile
from nefile.resource_table import ResourceType

# OPEN THE WINDOWS 3.1 PROGRAM MANAGER.
progman = nefile.NE('/media/windows-3.1/WINDOWS/PROGMAN.EXE')
print(progman.header.target_operating_system) # <TargetOperatingSystem.WINDOWS_3X: 2>
print(progman.header.expected_windows_version) # 3.10
# See the resource types defined in Program Manager.
print(progman.resource_table.resource_type_tables.keys())
# Known resource types are replaced with an enum member. There can also be integer and string IDs
# for resource types that don't have a globally-defined type.
# dict_keys([<ResourceType.RT_GROUP_ICON: 14>, <ResourceType.RT_MENU: 4>, <ResourceType.RT_DIALOG: 5>, 
#            <ResourceType.RT_STRING: 6>, <ResourceType.RT_ACCELERATOR: 9>, <ResourceType.RT_VERSION: 16>,
#            <ResourceType.RT_ICON: 3>])
# 
# List all the bitmap resources defined in Program Manager.
print(progman.resource_table.resource_type_tables[ResourceType.RT_GROUP_ICON])
# Individual resource IDs are either integer or string IDs, as dictated in the file.
# {3: <nefile.resources.Resource object at 0x7f0d72c79fa0>, 6: <nefile.resources.Resource object at 0x7f0d72c7af40>, 
#  'DATAICON': <nefile.resources.Resource object at 0x7f0d72c7a0d0>, 'COMMICON': <nefile.resources.Resource object at 0x7f0d72c7afd0>, 
#  'MSDOSICON': <nefile.resources.Resource object at 0x7f0d72c7ab80>}

# OPEN THE WINDOWS 3.1 SHELL.
# This is where the famous easter egg is stored! I actually wrote this library
# because I wanted to get at those resources solely in Python and not bother
# with `wrestool`.
shell = nefile.NE('/media/windows-3.1/WINDOWS/SYSTEM/SHELL.DLL')
# dict_keys([<ResourceType.RT_BITMAP: 2>, <ResourceType.RT_DIALOG: 5>, <ResourceType.RT_STRING: 6>, 
#            <ResourceType.RT_RCDATA: 10>, <ResourceType.RT_VERSION: 16>, 100])
shell.export_resources("/root/shell")
# Produces files with names like "SHELL.DLL-RT_BITMAP-130.bmp".

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

nefile-0.9.2.tar.gz (17.5 kB view details)

Uploaded Source

Built Distribution

nefile-0.9.2-py3-none-any.whl (20.9 kB view details)

Uploaded Python 3

File details

Details for the file nefile-0.9.2.tar.gz.

File metadata

  • Download URL: nefile-0.9.2.tar.gz
  • Upload date:
  • Size: 17.5 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/4.0.2 CPython/3.11.5

File hashes

Hashes for nefile-0.9.2.tar.gz
Algorithm Hash digest
SHA256 181b1b920036194da773c1b42a5b6eac1c5ec622ad169abb65abc12f56d96c96
MD5 d4829ba75507a7c8e438aa3ca001bd74
BLAKE2b-256 0dbc3257784725311ab7dafe2c77bab2a3b605647d59de0ea132632b9b26e969

See more details on using hashes here.

File details

Details for the file nefile-0.9.2-py3-none-any.whl.

File metadata

  • Download URL: nefile-0.9.2-py3-none-any.whl
  • Upload date:
  • Size: 20.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/4.0.2 CPython/3.11.5

File hashes

Hashes for nefile-0.9.2-py3-none-any.whl
Algorithm Hash digest
SHA256 2f2e236cb888f00772f09b26a7647431859d83ef94cd9645b27818f17455a8e7
MD5 fe738adad7a88c0fa4a377a26e0d2b27
BLAKE2b-256 426c43057fe9892cdfa6a0fde464e251ff2dc605522451d873093ca28d857e33

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page