No module named pefile

Today I want to build a python script to EXE file using PyInstaller. But after running PyInstaller, I got following error

No module named pefile

The full stack trace is


Starting from PyInstaller 3.2, a new module named pefile is introduced. This module is used to work with Windows binary file (EXE file, also called PE file). Before PyInstaller 3.2, PE related operation is done using its own module, like setting PE header and DOS header)



Assume the Python installation direcotry is C:\Python27.

Open Command Prompt window, and navigate to C:\Python27\Scripts

cd C:\Python27\Scripts

Then install pefile module using following command

pip install pefile


(pip is built into latest Python distribution, 2.7.12 for now)

Multiprocessing for Frozen Python

Recently I built a GUI application using PySide, and do some background calculation using multiprocessing. Using Python interpreter to run this application works smoothly. But if I freeze it to Windows executable file (exe) and run it, guess what, I got two main windows showing up!


After searching a while, I found following code should be added

It should be placed right after:


The freeze_support() is mainly used to pass initialization data from parent process to newly created process using pipe, including modules, process name, current working directory, etc. In Unix-based system this function is not needed, because fork will do these things for us (multiprocessing.Process will call os.fork() in start method on Linux)


the low-level implementation is in Lib/multiprocessing/ and a wrapper in Lib/multiprocessing/

By reading the source code, we can see Python will detect –multiprocessing-fork in command line arguments to determine whether current process is child process or not. And the last command line argument is the pipe file handle. The data in main process is serialized using pickle, then pass to child process using pipe.

Memory Forensic for DateTime Type

In C or C++, a DateTime value is often represented by time_t type, it’s a UNIX timestamp format, which is number of seconds elapsed since 1970-1-1.  This type is defined as long (4 bytes long) on 32 bit machine, and long long (8 bytes long) on 64 bit machine.

And Datetime value has one important trait:

In short time the high byte won’t change.

Suppose a DateTime value is DDCCBBAA, so in memory it will be AA BB CC DD (in little endian), the highest byte (DD) won’t change in short time, and the second highest byte (CC) don’t change much. This is because the low 2 bytes can represent 65536 seconds, which is about 18 hours, that means after every 18 hours the second highest byte will only increase by 1. And the highest byte only change after 18*256 hours (nearly 192 days) passed by.


Next we will see how to use Python to convert bytes array to timestamp value, and display it as readable format

The data variable contains bytes needed work on, after some observing and investigation,  we think byte 4 to byte 8 is the DateTime value. Then we use struct.unpack function to convert the bytes to timestamp value, ‘<L’ means little endian and long type. Next we will convert timestamp value to human-readable format.


Note that time_t doesn’t contain timezone information, you need discover timezone at other places.

No module named Crypto.PublicKey

When I tried to import the paramiko module, I got following error:

No module named Crypto.PublicKey

That means we need to install pycrypto library. Run following command to install pycrypto library by using pip:

In the installation process I got a another error message:

error: Unable to find vcvarsall.bat

That means we need a C compiler to compile this extension. But we can also download a pre-built extension for windows:


After installing this extension and tried to import “paramiko” module, I got the same error “No module named Crypto.PublicKey” again. This is because the installer installs pycrypto library with lowercase name, but paramiko tries to import it with uppercase name. We should rename crypto directory under “Lib/site-packages” to Crypto, then importing paramiko will work.

Unable to find vcvarsall.bat when installing gmpy using pip

GMPY is a multiple-precision arithmetic module, which is a extension module written by C. I tried to install it by using pip, then I got following error message:

Unable to find vcvarsall.bat

It’s because it’s trying to find a c compiler (Visual C++ or MinGW) to compile this extension but failed. To fix this error, one method is to install a C compiler (Visual C++ or MinGW). And another easier way is to download an windows installer:

PySide message box

When you want to display a warning message (like “File doesn’t exist”) to user, using message box is a good choice. Following code is how to create a message box in PySide:

QMessageBox is the message window class, it’s defined in PySide.QtGui module. setText method will set the information text, and exec_ method will display the message box and waiting for user’s operation.

Python CGI setup (for Hostgator hosting)

In this post we will enable Python CGI for Hostgator

Create a .htaccess file and put following contents in this file:

This will make the web server to interprete .py file as Python CGI script.


Next create a python file (named here) with following code:

And set this file’s permission setting so that Owner, Group and Public have “execute” permission for this file (Or set 755 permission simply)

Visit http://server_address/app_path/, you will see a page with “hello” printed.



The first two lines of code is necessary, otherwise you will get a “500 Internal Server Error”.


python timer tutorial

There are two methods in Python to make the process wait some seconds:






easy_install Twisted: unable to find vcvarsall.bat

Error “unable to find vcvarsall.bat” generally means that Visual C++ need be installed.

But for installing Twisted we get another option: Twisted windows installer, please check here


After installing it, if you try to “import twisted”, you will get ImportError: Twisted requires zope.interfaces: no module named zope.interface.

We can install this missed module by using easy_install:

easy_install zope.interface

python windll.kernel32.CreateProcessA returns 0 (FALSE)

Above simple code didn’t work in the latest version of my program, but it works well in previous version.

After reading documentation from MSDN, I got that CreateProcessA will return TRUE(1) if execution succeed, and return FALSE(0) if failed. Then I put “print ret” right after that line of code, exactly the return value is 0 (FALSE).

But how to get more details about the error? We can use GetLastError() function.

And after calling GetLastError(), it returns 2.

By looking up this error code page at MSDN, we can get the return value is actually ERROR_FILE_NOT_FOUND, meaning the system cannot find the file specified. But after printing the file path to console and checking the file path twice, I found the file existed actually.


Searching on google for some time, I found this post from stackoverflow

This guy met same problem: the executable file exists but calling CreateProcessA failed. The answer is use CreateProcessA with ANSI string, and use CreateProcessW with Unicode string. Then I tried CreateProcessW instead of CreateProcessA and it works perfectly!


Actually in previous version of the application, the executable path is read only from configuration file. But in the latest version, it can be loaded from registry key value, using _winreg.QueryValueEx. And this bug is introduced as well. So, is registry key value Unicode? or QueryValueEx returns an Unicode string?

Reading this documentation, we know that REG_SZ key value can either be ANSI or Unicode, it’s depending on what function we use. And this bug post tells us that QueryValueEx will convert REG_SZ to unicode automatically, so finally we found where problem is.