Jonathan Salwan

https://github.com/JonathanSalwan/abf

Abstract Binary Format Manipulation - ELF, PE and Mach-O format

???

???

https://github.com/angr

https://github.com/angr/cle

CLE loads binaries and their associated libraries, resolves imports and provides an abstraction of process memory the same way as if it was loader by the OS's loader.

rop_compiler

???

distorm, Gil Dabah (arkon@ragestorm.net)

http://code.google.com/p/distorm/

A Fast Python Library for Reading PE+ Files.

???

???

Philippe BIONDI (phil(at)secdev.org)

http://hg.secdev.org/elfesteem/

ELF/PE editing library.

Smiasm

???

???

https://github.com/frank2/peel

PEEL, with its ever-redundant project name, is a python-based library for manipulating and wrangling PE files.

???

???

Ero Carrera (@erocarrera)

https://github.com/erocarrera/pefile

pefile is a multi-platform Python module to read and work with Portable Executable (aka PE) files. Most of the information in the PE Header is accessible, as well as all the sections, section's information and data. pefile requires some basic understanding of the layout of a PE file. Armed with it it's possible to explore nearly every single feature of the file.

IDA PEiD
peframe
PyPEELF
MemoryPatchDetector
mpesm
Thug
Qiew

usage examples
usage examples
"Win32 Static Analysis in Python" presentation
"4 x 5: Reverse Engineering Automation with Python" presentation

Wesley Shields (wxs@atarininja.org)

https://github.com/trailofbits/pe-parse/tree/master/python

pe-parse

pepy (pronounced p-pie) is a python binding to the pe-parse parser.

pe-parse is a principled, lightweight parser for windows portable executable files. It was created to assist in compiled program analysis, potentially of programs of unknown origins. This means that it should be resistant to malformed or maliciously crafted PE files, and it should support questions that analysis software would ask of an executable program container. For example, listing relocations, describing imports and exports, and supporting byte reads from virtual addresses as well as file offsets.

???

???

Joxean Piti

https://github.com/joxeankoret/pyew

Pyew is a (command line) python tool like radare and *iew oriented, mainly, to analyze malware. It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits), PE and ELF file formats (it does code analysis the right way), following direct call/jmp instructions, OLE2 format, PDF format (limited) and more. It also supports plugins to add more features to the tool.

???

entries in blog about usage pyew

Nahuel Riva

https://github.com/crackinglandia/pype32

Yet another Python library to read and write PE/PE+ files.

???

???

Nahuel Riva

https://github.com/crackinglandia/pypeelf

Cross-platform and Multi-format Binary Editor.

???

???

AmrThabet

https://github.com/AmrThabet/pySRDF

The Security Research and Development Framework

This Project is a the python implementation for The Security Research and Development Framework
This Project includes:
1. PE Parser
2. Process analyzer, DLL Injector
3. Debugger
4. x86 Emulator for binary files and shellcodes

???

Examples

invisigoth kenshoto (@invisig0th)

http://visi.kenshoto.com/viki/MainPage

https://github.com/vivisect/vivisect

Vivisect is programatic binary analysis framework.
Features:
* Simple/fast python API for trying out crazy analysis ideas
* Complete emulation pass with annotation
* Import emulation to allow emu state tracking
* Analysis of Elf/PE/binaryblob formats (Mach-O to come soon)
* Support for easy to implement and batch run analysis module interface
* Support for more than one binary file loaded in one workspace
* Colaborative real-time client/server mode
* Reasonably decent GUI (mostly for viewing) results
* Support for running on windows/linux/mac
* Windows symbol server support (when run on win32)
* Bulk analysis mode which goes nice and fast (w/o GUI)

SocketSniff
Nightmare
FLOSS
flare-dbg

Visipedia
Examples