# erocarrera/pefile

pefile is a Python module to read and work with PE (Portable Executable) files

Repository: https://github.com/erocarrera/pefile
Canonical: https://ross.abutalabs.com/products/pefile
Language: Python
License: MIT
License Family: permissive
Last push: 2026-08-21T22:29:03+00:00

## Health v2 (maintenance only)
Score: 67/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 8, longevity 100
- inputs: {"age_days": 4160, "days_push": 12, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2064, forks 541 (observed 2026-08-28T04:06:10.030111+00:00)

## What it is
pefile is a multi-platform Python module for parsing and working with Portable Executable (PE) files such as EXE and DLL binaries. It exposes PE headers, sections, resources, and embedded data as Python attributes, and supports inspection, modification, and packer detection.

## Use cases
- parse headers and sections from exe and dll files in python
- analyze PE files for malware research
- extract strings and resources from a windows executable
- detect packers in a PE binary using PEiD signatures
- read and modify fields in a portable executable
- inspect embedded data inside a PE file

## When to choose
- you need to programmatically inspect or analyze Windows PE binaries in Python
- you're doing malware analysis, reverse engineering, or binary forensics
- you want a pure-Python, cross-platform PE parser with no heavy dependencies

## When to avoid
- you need to parse non-PE formats like ELF or Mach-O
- you need to restructure or rebuild PE files with new sections (modification support is limited)
- you need a GUI-based static analysis tool rather than a library

## Facets
- artifact type: library
- maturity: stable
- function: parser, security, developer-tools
- domain: security, reverse-engineering, files, developer-tools
- platform: python, cross-platform
- tags: pe-files, portable-executable, malware-analysis, binary-parsing, windows-binaries

## Member repositories
- erocarrera/pefile (main) score 67

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:10.030111+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:57:08.374294+00:00, confidence not recorded.
  - readme: https://github.com/erocarrera/pefile (fetched 2026-08-28T04:06:10.030111+00:00, sha 16035bb82688)
  - registry_pypi: https://pypi.org/pypi/pefile/json (fetched 2026-08-29T10:37:18.275176+00:00, sha 939c8db7c7cc)
- Data as of 2026-08-30T08:39:29.467469+00:00.