A Python utility to search for strings, imports, exports, and debug symbols within Windows PE executables using regular expressions.
hackers-grep is a Python-based command-line utility designed to search for strings, function imports, exports, and debug symbols within Windows PE (Portable Executable) files. It solves the problem of manually inspecting binaries by allowing regex-based searches across entire directories, helping users quickly identify functionality, dependencies, and internal structures in Windows executables and libraries.
Security researchers, reverse engineers, malware analysts, and Windows system developers who need to investigate binary files, understand system internals, or analyze software dependencies.
Developers choose hackers-grep for its focused capability to search PE-specific sections like imports and exports with regex, its integration with Microsoft debug symbols, and its practical use in answering investigative questions about Windows functionality across large sets of binaries.
hackers-grep is a utility to search for strings in PE executables including imports, exports, and debug symbols
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Allows precise searches in imports, exports, and strings within PE files, as demonstrated in examples like finding DLLs that import InternetOpenA or export DllGetClassObject.
Supports Python's re module syntax for complex pattern matching, enabling searches like 'xmlns.*' across binaries, as shown in the XML processing example.
Integrates Microsoft debugging symbols (.pdb files) to search for function names and data structures, exemplified by searching for HFONT or IStream::Read symbols.
Designed for real-world security research with features like import and export filters, helping answer specific questions such as identifying RPC servers that import CreateFile.
Acknowledged in the README as slow, especially when searching entire drives with symbol processing, which can hinder large-scale or time-sensitive analyses.
Requires installing multiple dependencies like comtypes, pywin32, and Microsoft debugging symbols, making initial installation non-trivial and platform-dependent.
Exclusively designed for Windows PE files, with no support for other binary formats or operating systems, limiting its use in cross-platform environments.