Displaying Constants

[Alex_H]

Hello,

Is it possible to display the constant rather than the value?

For example:
print "Subsystem: ", hex(pe.OPTIONAL_HEADER.Subsystem)
output:
Subsystem: 0x2

I would like to display "Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI". I
was looking through pefile.py and I saw the below:

subsystem_types = [
('IMAGE_SUBSYSTEM_UNKNOWN', 0),
('IMAGE_SUBSYSTEM_NATIVE', 1),
('IMAGE_SUBSYSTEM_WINDOWS_GUI', 2),
('IMAGE_SUBSYSTEM_WINDOWS_CUI', 3),
('IMAGE_SUBSYSTEM_OS2_CUI', 5),
('IMAGE_SUBSYSTEM_POSIX_CUI', 7),
('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', 9),
................

I have been googling for a while but I can't seem to find an example.
Sorry if this has been answered some where else but I'm a little
stuck. Thanks.

[Ero Carrera]

Sure, the pefile module contains dictionaries with both mappings value-
>constant and constant->value.

Instead of:

>>> print pe.OPTIONAL_HEADER.Subsystem
2

You could do:

>>> pefile.SUBSYSTEM_TYPE[ pe.OPTIONAL_HEADER.Subsystem ]
'IMAGE_SUBSYSTEM_WINDOWS_GUI'

--
ero

[Alex_H]

Ero, that's exactly what I needed. Thank you for your help and for
creating this module.