Getting version from PE executables

  • Thread starter Fernando Mercês
  • Start date
F

Fernando Mercês

Hi.

I'm trying to get file version from EXE or DLL files, writing a ruby
script (to run it in Linux).

My code is:

fd = File.open(ARGV[0], "rb")
size = File.size(fd)

# signature VS_VERSION_INFO
sig = [ ?V, ?S, ?_, ?V, ?E, ?R, ?S, ?I, ?O, ?N,
?_, ?I, ?N, ?F, ?O, ]

fd.pos=0
data=fd.read(size)
offset = data.find(sig)
puts offset # => #<Enumerable::Enumerator:0x7fe4fa164e28>

I can't understand it. I've tried to do it in the same way of this
Python script (using pack and unpack), but without success too:

def getVersion(file):
sig = struct.pack("32s", u"VS_VERSION_INFO".encode("utf-16-le"))
try:
data = open(file).read()
except IOError:
return "Unknown"
offset = data.find(sig)
if offset == -1:
return "Unknown"

data = data[offset + 32 : offset + 32 + (13*4)]
version_struct = struct.unpack("13I", data)
ver_ms, ver_ls = version_struct[4], version_struct[5]
return "%d.%d.%d.%d" % (ver_ls & 0x0000ffff, (ver_ms & 0xffff0000)

Any ideas to do it?
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

No members online now.

Forum statistics

Threads
474,431
Messages
2,571,679
Members
48,796
Latest member
Greg L.

Latest Threads

Top