ppar

Minimalist Windows PE (Portable Executable) parser written in pure C with zero CRT dependencies. Compiles down to an ~8.5 KB standalone binary linking only against kernel32.dll.

features

• headers: architecture (x86/x64/ARM64), subsystem, image base, entry point RVA + calculated VA, image size
• security & mitigations: ASLR, DEP (NX), Control Flow Guard (CFG), Authenticode signature presence, TLS callbacks, base relocations
• sections: virtual & raw sizes, RVAs, permissions, and Shannon entropy calculation (via hardware x87 FPU fyl2x)
• debug directory: extracts CodeView RSDS PDB debug paths
• exports: module name, function count, ordinals, names, RVAs
• imports: dependency tree listing imported DLLs and functions / ordinals
• no crt: direct Win32 console output, zero libc/msvcrt/libm overhead

download

Grab the pre-built ppar.exe from the latest GitHub Releases.

build

Compile locally with GCC (MinGW-w64 / MSYS2):

gcc -Os -s -nostdlib -e main main.c -o ppar.exe -lkernel32

usage

ppar.exe <path_to_pe_file>

example output

Target:        C:\Windows\System32\user32.dll
Architecture:  x64 (AMD64)
Subsystem:     GUI
ImageBase:     0x0000000180000000
Entry Point:   0x00051D30 (VA: 0x0000000180051D30)
Image Size:    0x001C6000 bytes

Mitigations:
  ASLR:        Enabled
  DEP:         Enabled
  CFG:         Enabled
  Signature:   Present (Signed)
  TLS:         None
  Relocs:      Present

Sections:
  Name     VirtSize     VirtAddr     RawSize      Entropy  Permissions
  .text    0x000A8652   0x00001000   0x000A9000   6.34     Execute | Read
  fothk    0x00001000   0x000AA000   0x00001000   0.02     Execute | Read
  .rdata   0x00024970   0x000AB000   0x00025000   5.59     Read
  .data    0x00002208   0x000D0000   0x00001000   1.83     Read | Write
  .pdata   0x00007830   0x000D3000   0x00008000   5.71     Read
  .didat   0x00000110   0x000DB000   0x00001000   0.32     Read | Write
  .rsrc    0x000E8E50   0x000DC000   0x000E9000   3.87     Read
  .reloc   0x00000560   0x001C5000   0x00001000   2.52     Read

Debug:
  PDB:         user32.pdb

Exports (USER32.dll):
  Functions:   1318 (Named: 1046, Base Ordinal: 1502)
  ├── [#1504] ActivateKeyboardLayout (RVA: 0x00060C80)
  ├── [#1505] AddClipboardFormatListener (RVA: 0x00065530)
  ├── [#1506] AddVisualIdentifier (RVA: 0x00072340)
  ├── [#1507] AdjustWindowRect (RVA: 0x00018CA0)
  ...

Imports:
  KERNEL32.dll
    ├── CloseHandle
    ├── CreateFileA
    ├── GetLastError
    └── WriteFile

license

MIT