## Interpret-PE

I have recently been using a lot of Powershell, for offence and defence. As a result I was reading memory from PE files and I thought I would try my hand a writing small PE parser. The script will extract data from the DOS Header, PE Header, Optional Header and Sections Table.
Functions in Powershell scripts can be imported by dot sourcing the script. Alternatively you can automatically import the function by modifying your Powershell profile.

[Get-Help]

    PS C:\> Get-Help Interpret-PE

    NAME
        Interpret-PE

    SYNOPSIS
        Parse PE [DOS Header, PE Header, Optional Header, Sections Table]
        Author: Ruben Boonen (b33f)

    SYNTAX
        Interpret-PE [-Path]  []

    DESCRIPTION

    RELATED LINKS
        Twitter: @FuzzySec
        Blog:    http://www.fuzzysecurity.com/

        -=Reading Materials=-
        PE (xkcd) - https://i.imgur.com/pHjcI.png
        PE Format (MSDN) - https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547%28v=vs.85%29.aspx

    REMARKS
        To see the examples, type: "get-help Interpret-PE -examples".
        For more information, type: "get-help Interpret-PE -detailed".
        For technical information, type: "get-help Interpret-PE -full".
        For online help, type: "get-help Interpret-PE -online"

[PE32+ Format]

    PS C:\> Interpret-PE -Path C:\Windows\System32\kernel32.dll

    e_magic DOS Header:        MZ
    PE Header Offset:          0x00F8
    ASCII PE Header:           PE
    Supported Machine Type:    x64
    Number of PE Sections:     6
    PE Compile Time:           03/01/2014 07:35:47
    Optional Header Size:      240 bytes
    PE Format:                 PE32+
    Module Entry Point Offset: 0x00001758
    Preferred Image Base:      0x0000000180000000

    Section Name:    .text
    Virtual Size:    1114144 bytes
    Virtual Address: 0x00001000
    Raw Data Size:   1114624 bytes
    Raw Data PTR:    0x00000400
    Section Flags:   |Executable Code|

    Section Name:    .data
    Virtual Size:    6416 bytes
    Virtual Address: 0x00112000
    Raw Data Size:   4096 bytes
    Raw Data PTR:    0x00110600
    Section Flags:   |Initialized Data|

    Section Name:    .pdata
    Virtual Size:    40152 bytes
    Virtual Address: 0x00114000
    Raw Data Size:   40448 bytes
    Raw Data PTR:    0x00111600
    Section Flags:   |Section Readable||Initialized Data|

    Section Name:    .idata
    Virtual Size:    47204 bytes
    Virtual Address: 0x0011E000
    Raw Data Size:   47616 bytes
    Raw Data PTR:    0x0011B400
    Section Flags:   |Section Readable||Initialized Data|

    Section Name:    .rsrc
    Virtual Size:    1304 bytes
    Virtual Address: 0x0012A000
    Raw Data Size:   1536 bytes
    Raw Data PTR:    0x00126E00
    Section Flags:   |Section Readable||Initialized Data|

    Section Name:    .reloc
    Virtual Size:    48820 bytes
    Virtual Address: 0x0012B000
    Raw Data Size:   49152 bytes
    Raw Data PTR:    0x00127400
    Section Flags:   |Section Readable||Disgardable||Initialized Data|

[PE32 Format]

    PS C:\> Interpret-PE -Path C:\Users\b33f\Desktop\ctf.exe

    e_magic DOS Header:        MZ
    PE Header Offset:          0x00D8
    ASCII PE Header:           PE
    Supported Machine Type:    Intel I386
    Number of PE Sections:     4
    PE Compile Time:           03/23/2013 22:26:54
    Optional Header Size:      224 bytes
    PE Format:                 PE32
    Module Entry Point Offset: 0x0000B2F7
    Preferred Image Base:      0x00400000

    Section Name:    .text
    Virtual Size:    105142 bytes
    Virtual Address: 0x00001000
    Raw Data Size:   105472 bytes
    Raw Data PTR:    0x00000400
    Section Flags:   |Executable Code|

    Section Name:    .rdata
    Virtual Size:    24996 bytes
    Virtual Address: 0x0001B000
    Raw Data Size:   25088 bytes
    Raw Data PTR:    0x0001A000
    Section Flags:   |Section Readable||Initialized Data|

    Section Name:    .data
    Virtual Size:    42628 bytes
    Virtual Address: 0x00022000
    Raw Data Size:   6144 bytes
    Raw Data PTR:    0x00020200
    Section Flags:   |Initialized Data|

    Section Name:    .rsrc
    Virtual Size:    59960 bytes
    Virtual Address: 0x0002D000
    Raw Data Size:   60416 bytes
    Raw Data PTR:    0x00021A00
    Section Flags:   |Section Readable||Initialized Data|

Download: Interpret-PE.ps1