---
id: pefile
version: "2024.8.26"
license: MIT
license_treatment: permissive
maintenance: active
---

# pefile — Python PE parsing module

License: permissive · Maintenance: active · Downloads: 8.4M/mo

## What it is and what it does

pefile is a pure-Python library for reading and analyzing Portable Executable (PE) files, the binary format underlying Windows executables, DLLs, and system libraries. It exposes PE internal structures—headers, sections, import/export tables, resources—as object attributes with both uppercase names for raw structures and lowercase names for processed elements like the import table. The library is designed to handle real-world edge cases including corrupted, malformed, and malware-obfuscated PE files that may violate the standard format.

The package has no runtime dependencies and installs as a pure Python wheel, making it lightweight and portable. It supports Python 3.6 and later, is actively maintained with recent commits, and has been battle-tested against malware and unusual PE variants since its initial release in 2016.

Use it for:

- Analyze Windows executables and DLLs to extract metadata, imports, exports, and resource sections for security or compatibility audits.
- Parse PE files in malware analysis workflows to inspect suspicious binaries for obfuscation, packing, or anomalous structures.
- Automate binary inspection in build pipelines to validate executable structure, detect tampering, or extract version information.
- Reverse-engineer or debug Windows binaries by examining their sections, entry points, and import tables programmatically.
- Inspect PE files in forensic or incident-response contexts to understand binary composition and detect signs of compromise.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

pefile reads and parses Portable Executable (PE) files—the binary format used for Windows executables, DLLs, and related binaries—exposing their internal structures as Python object attributes.

Yes. pefile is a mature, actively maintained, zero-dependency library with a permissive license and no known vulnerabilities. It solves a specific and well-defined problem—PE file parsing—with proven robustness against edge cases and malware-crafted binaries. Install it if you need to analyze or inspect Windows executables programmatically.

## Install

pip install pefile
uv add pefile
poetry add pefile

## Installing pefile

Before you install: Low friction: pure Python wheel with no runtime dependencies. Actively maintained with recent commits and a stable release history since 2016.

License in practice: MIT license permits unrestricted use, modification, and distribution in both open-source and commercial contexts.

Quickstart:

import pefile

pe = pefile.PE('/path/to/binary.exe')
print(pe.DOS_HEADER)
print(pe.sections)

Verify before relying:

- Whether the package handles all modern PE variants (e.g., ARM64 executables, signed binaries with complex certificates).
- Performance characteristics when parsing very large PE files or processing many files in sequence.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 8.4M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

PE file parser, portable executable reader, windows binary analysis, exe dll parsing, PE structure extraction, binary format inspection, malware analysis tools, binary-analysis, reverse-engineering, malware-analysis

[View on SkillFed](https://skillfed.io/packages/pefile) · [View on PyPI](https://pypi.org/project/pefile/)