pe2json 0.1.0

Convert PE (Portable Executable) files to JSON format.

PE to JSON Converter

This Python script extracts detailed information from a Portable Executable (PE) file (e.g., .exe, .dll) using the pefile library and saves it in a properly formatted JSON file.

🧠 Why This Script Exists

While the pefile library provides a convenient dump_dict() method to extract the structure of PE files, the resulting data often includes:

• Non-serializable data like bytes, tuples, and custom objects.
• Byte-encoded dictionary keys, which are not valid JSON keys.
• Data that causes json.dump() to fail or result in unreadable output.

This script solves these problems by recursively converting all data into formats compatible with JSON (e.g., converting bytes to hex strings, decoding byte keys, etc.).

---

✅ Features

• Converts complex PE structures into clean, readable JSON
• Handles bytes, dicts, lists, tuples, and other non-serializable types
• Preserves important PE metadata and layout
• Useful for reverse engineering, malware analysis, digital forensics, etc.
• Includes CLI interface for easy usage
• Programmatic API for integration into other projects
• Comprehensive error handling and logging

---

📦 Installation

pip install pefile

---

🚀 Usage

Command Line Interface

# Convert a PE file to JSON
python pe_to_json.py path/to/file.exe output.json

# Convert a DLL to JSON
python pe_to_json.py library.dll library.json

Example:

python pe_to_json.py notepad.exe notepad.json

As a Python Module

from pe_to_json import pe_to_json, convert_to_serializable
import pefile

# Convert PE file to JSON
pe_to_json("input.exe", "output.json")

# Or use the conversion function directly
pe = pefile.PE("input.exe")
pe_dict = pe.dump_dict()
serializable_dict = convert_to_serializable(pe_dict)

# Then save manually if needed
import json
with open("output.json", "w") as f:
    json.dump(serializable_dict, f, indent=4)

---

🛠 How It Works

convert_to_serializable(obj: Any)

Recursively processes the pefile dump to:

• Convert bytes to hex strings
• Convert byte-string keys to UTF-8 strings with error handling
• Traverse and clean nested lists, dicts, and tuples
• Handle any non-serializable objects gracefully

pe_to_json(pe_file_path, json_file_path)

• Loads the PE file with pefile.PE
• Converts the structure to a serializable format
• Writes the cleaned data to a JSON file with proper indentation
• Includes comprehensive error handling and informative logging

---

📁 Output

The resulting JSON file will contain:

• PE headers (DOS, NT, Optional headers)
• Section data (.text, .data, .rdata, etc.)
• Import/export tables
• Resource information
• Debug info
• Rich header information
• ...and more, all in a valid and readable format

---

📋 Requirements

• Python 3.11+
• pefile library

---

🐞 Error Handling

The script handles:

• Missing files (FileNotFoundError)
• Invalid PE files (pefile.PEFormatError)
• Unexpected exceptions (with detailed logging and stack traces)

---

📄 License

MIT License — feel free to use, modify, and distribute.

---

🗺️ Roadmap

Enhanced Output Options

• Memory-based processing - Keep parsed data in memory instead of always writing files
• Direct string generation - Output JSON as string variable for web applications
• Chunked file handling - Process massive PE files piece by piece to avoid memory issues
• Output customization - Let users control JSON spacing and organization

Targeted Analysis

• Focused extraction - Parse only the PE sections you actually need
• Data transformation - Apply custom rules to modify output during conversion
• Alternative formats - Export to YAML or XML instead of JSON
• Speed improvements - Make large file processing much faster

Workflow Integration

• Directory scanning - Analyze hundreds of PE files automatically
• Database connectivity - Send results directly to databases
• Tool chaining - Connect with other security analysis software
• Remote analysis - Accept PE files over HTTP for server-based processing

---

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request or open an issue.

---

🔗 Related Tools

• pefile on PyPI
• PE format documentation (Microsoft)
• PE-bear - GUI PE analyzer
• PEiD - PE identifier tool