trailofbits/pe-parse is a C++ project with 912 stars. Principled, lightweight C/C++ PE parser
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
pe-parse is a principled, lightweight parser for Windows portable executable files.
It was created to assist in compiled program analysis, potentially of programs of unknown origins.
This means that it should be resistant to malformed or maliciously crafted PE files, and it should
support questions that analysis software would ask of an executable program container.
For example, listing relocations, describing imports and exports, and supporting byte reads from
virtual addresses as well as file offsets.
pe-parse supports these use cases via a minimal API that provides methods for
Opening and closing a PE file
Iterating over the imported functions
Iterating over the relocations
Iterating over the exported functions
Iterating over sections
Iterating over resources
Reading bytes from specified virtual addresses
Retrieving the program entry point
The interface is defined in parser-library/parse.h.
The program in dump-pe/main.cpp is an example of using the parser-library API to dump
information about a PE file.
Internally, the parser-library uses a bounded buffer abstraction to access information stored in
the PE file. This should help in constructing a sane parser that allows for detection of the use
of bogus values in the PE that would result in out of bounds accesses of the input buffer.
Once data is read from the file it is sanitized and placed in C++ STL containers of internal types.
[!WARNING]
pe-parse's error handling is not thread safe. If you want to perform PE
writes/parses in multiple threads, you must independently synchronize
your operations.
Installation
pe-parse can be installed via vcpkg:
$ vcpkg install pe-parse
pe-parse includes Python bindings via pepy, which can be installed via pip:
$ pip3 install pepy
More information about pepy can be found in its README.
Dependencies
ICU
ICU is required on non-Windows platforms (Linux, macOS). You do not need ICU on Windows.
ICU library (International Components for Unicode)
Debian/Ubuntu: sudo apt-get install libicu-dev
RedHat/Fedora: sudo dnf install libicu-devel
macOS: brew install icu4c
vcpkg: vcpkg install icu
CMake
Debian/Ubuntu: sudo apt-get install cmake
RedHat/Fedora: sudo yum install cmake
OSX: brew install cmake
Windows: Download the installer from the CMake page
VS 2017, VS 2019, VS 2022, and VS 2026 are supported.
# Compile 64-bit binaries with Visual Studio 2017
cmake -G "Visual Studio 15 2017 Win64" ..
# Or, with VS 2019, use the -A flag for architecture
cmake -G "Visual Studio 16 2019" -A Win64 ..
# Or, with VS 2022
cmake -G "Visual Studio 17 2022" -A Win64 ..
# Or, with VS 2026
cmake -G "Visual Studio 18 2026" -A Win64 ..
# Pass the build type at build time
cmake --build . --config Release
MacOS-specific
When ICU is installed via brew it will not be in the usual library path, so you will need to set the ICU_ROOT environment variable to the location where ICU is installed when running cmake.
The path is usually /opt/homebrew/opt/icu4c@version, where version is the version number of ICU you have installed.
You can build the (catch2-based) tests by adding -DPEPARSE_ENABLE_TESTING=ON during CMake configuration. Build, and then run with ctest or cmake --build . --target test.
To run the full test suite with the Corkami test suite, you must clone the submodule with git submodule update --init.
Examples
You can build the included examples by adding -DPEPARSE_ENABLE_EXAMPLES=ON during CMake configuration.
Building with Sanitizers
If you are familiar with C++ sanitizers and any specific development environment requirements for them (compiler, instrumented standard library, etc.), you can choose to compile with any of the following sanitizers: Address, HWAddress, Undefined, Memory, MemoryWithOrigins, Leak, Address,Undefined.
For example, to compile with both Address and Undefined sanitizers, use the following (recommended for development and testing, and tested in CI):
How active is development on trailofbits/pe-parse?
The most recent commit recorded on trailofbits/pe-parse was 2 months ago, based on the GitHub push timestamp. The repository has 170 forks — one of the better signals of community interest.
How many stars does trailofbits/pe-parse have?
trailofbits/pe-parse has 912 GitHub stars — refresh the page for the live number, or check github.com/trailofbits/pe-parse. TopGit mirrors GitHub's count but does not claim minute-by-minute accuracy.
Is trailofbits/pe-parse open source?
Yes — trailofbits/pe-parse ships under the MIT license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/trailofbits/pe-parse.
What is trailofbits/pe-parse?
trailofbits/pe-parse (trailofbits/pe-parse) is a C++ project on GitHub. From the project's own README: Principled, lightweight C/C++ PE parser
What language is trailofbits/pe-parse written in?
trailofbits/pe-parse is written primarily in C++. GitHub's language field is based on the largest share of bytes in the default branch.
What license does trailofbits/pe-parse use?
trailofbits/pe-parse is released under the MIT license. Always verify the LICENSE file directly on GitHub for the authoritative terms — license strings can be edited out of sync with a project's actual stance.
Where do I read more about trailofbits/pe-parse?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/trailofbits/pe-parse is the definitive source.
Read full README in the tab above.
Is pe-parse worth your time?
ChatGPT, Claude and Perplexity can all read this page. Ask one of them what it makes of pe-parse.
/pe-parse