A modern C++ library for parsing and manipulating Windows Portable Executable (PE) files.

Full API docs can be found here.

This Library provides a clean interface for working with Windows PE file formats. The library is designed to handle DOS headers, NT headers, Sections, Data directories and more with a focus on simplicity and performance.

• Full PE32 & PE32+ (x86/x64) support with validation
• Complete DOS Header, NT Headers, Optional Header, and Section Table access
• Section addition and modification
• RVA ↔ File Offset ↔ VA conversion utilities

• Import Table – enumeration by name and ordinal
• Export Table – function listing with ordinals and forwarders
• Relocations – full block and entry parsing
• TLS Directory – callbacks and data inspection
• Resources – tree traversal, version info, manifest, and icon extraction
• Rich Header – parsing, checksum validation, and compiler/linker identification
• Debug Directory – support for common debug formats

• Unicode and ANSI string extraction
• Data directory validation and bounds checking
• Pattern Scanning

• Visual Studio 2022 (or later with C++17 support)
• Windows SDK 10.0
• Platform Toolset v143 or later

The library can be added directly to your project using CMake's FetchContent

include(FetchContent)

FetchContent_Declare(
    pe_lib
    GIT_REPOSITORY https://github.com/NtProtectVirtualMemory/PE-Library.git
    GIT_TAG master # or whichever commit your prefer
    SOURCE_SUBDIR PE-Library
)

FetchContent_MakeAvailable(pe_lib)

target_link_libraries(your_target PRIVATE PE::Library)

After linking, the public headers are automatically available:

#include <image.hpp>
#include <sections.hpp>
#include <directories.hpp>
#include <rich.hpp>

#include <vector>

#include "pe-lib/image.hpp"
#include "pe-lib/sections.hpp"

int main()
{
    // Read your PE file into a byte buffer
    std::vector<std::uint8_t> bytes = /* ... */;

    PE::Image image(std::move(bytes));
    PE::ImageSections sections(&image);

    // Your code here...

    return 0;
}

Note: PE::Image no longer performs file I/O. Load the file into memory, then construct the image from the resulting byte buffer.

The fuzzer has already processed ~275,000 different PE samples and helped discover & fix multiple parsing edge-cases, buffer issues and potential crashes as well as slow units.

For more information see: PE-Fuzzer/

• All discovered crashes, UB and slow units have been fixed.
• Actively used during development & testing

Special thanks to Christopher Wellons (skeeto) for the Fuzzer, design suggestions, and overall feedback that helped improve the library and fuzzer.

This project is licensed under the MIT License - see the LICENSE file for details.