Keywords: pev, pe, malware, analysis, threat, manual

Looking at function directories
Prev | Chapter 4. Basic usage | Next

## Looking at function directories

readpe can show you the PE data directories with -d option, like this:

    $ readpe -d putty.exe
    Data directories
        Directory
            IMAGE_DIRECTORY_ENTRY_IMPORT:    0x78378 (240 bytes)
        Directory
            IMAGE_DIRECTORY_ENTRY_RESOURCE:  0x80000 (15248 bytes)
        Directory
            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: 0x78318 (72 bytes)
        Directory
            IMAGE_DIRECTORY_ENTRY_IAT:       0x5d000 (1292 bytes)

If the executable has an import directory you may want to see a list of imported functions with -i / --imports option:

    $ readpe -i putty.exe
    Imported functions
        Library
            Name:                            ADVAPI32.dll
            Functions
                Function
                    Name:                            RegCloseKey
                Function
                    Name:                            RegQueryValueExA
                Function
                    Name:                            RegOpenKeyA
                Function
                    Name:                            GetUserNameA
                Function
                    Name:                            EqualSid
                Function
                    Name:                            CopySid
        Library
            Name:                            COMCTL32.dll
            Functions
                Function
                    Ordinal:                         14
                Function
                    Ordinal:                         15
                Function
                    Ordinal:                         17
                Function
                    Ordinal:                         13
        Library
            Name:                            comdlg32.dll
            Functions
                Function
                    Name:                            ChooseColorA
                Function
                    Name:                            ChooseFontA

You can see the exported functions as well by using readpe -e / --exports option.

Prev | Up | Next
Chapter 4. Basic usage | Home | Comparing PE pieces