U
|
T ±d¥t ã g @ s¾ d Z dZdZdZddlZddlZddlZddlZddlZddl Z ddl
|
Z
|
ddl Z ddl Z ddlm Z ddlmZ ddlmZ dd lmZ dd
|
lmZ dd lmZ ddlZddlZddlZe d e d ¡¡ eZ d:ddZ e dddd Z e dddd Z dd Z dZ!dZ"dZ#d Z$d Z%d Z&dZ'd Z(d Z)dZ*d Z+d Z,d!Z-d"Z.d#Z/d$Z0d%Z1d&Z2d'Z3d(Z4d)Z5d*Z6d+d, Z7d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<gZ8e7e8Z9d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLgZ:e7e:Z;dMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzg.Z<e7e<Z=d{d|d}d~ddddddd
dddddddgZ>e7e>Z?ddddddddddddddgZ@e7e@ZAdddddd d¡d¢d£d¤d¥d¦d§d¨d©dªd«d¬dd®d¯d°d±d²d³d´dµd¶d·d¸d¹dºd»d¼d½d¾g$ZBe7eBZCd¿dÀdÁdÂdÃdÄdÅdÆdÇdÈdÉdÊg ZDe7eDZEdËdÌdÍdÎdÏdÐdÑdÒdÓdÔdÕdÖd×dØdÙgZFe7eFZGd ZHdÚdÛdÜgZIe7eIZJdÝdÞdßdàdádâdãdädådædçdèdédêdëdìgZKe7eKZLdZMdíZNdîZOdïZPdðZQdñZRdòZSdóZTdôZUdõZVdöd÷dødùdúdûdüdýdþdÿd ddddddddd d
|
gZWe7eWZXd d d ddddddddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhg^ZYe7eYZZdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddd
ddddddddddddddddddddddddddd d¡d¢d£d¤d¥d¦d§d¨d©dªd«d¬dd®d¯d°d±d²d³d´dµd¶d·d¸d¹dºd»d¼d½d¾d¿dÀdÁdÂdÃdÄdÅdÆdÇdÈdÉdÊdËdÌdÍdÎdÏggZ[e7e[Z\e]e[Z\e[D ].\Z^Z_e_e\kr0e\e_ `e^¡ n
|
e^ge\e_< qdÐdÑ ZadÒdÓ ZbdÔdÕ ZcdÖd× ZddØdÙ ZedÚdÛ ZfG dÜdÝ dÝegZhG dÞdß dßZiG dàdá dáejZkG dâdã dãZldídídídídîdîdðdðdðdðdðdódódódídäZme dddådæ Zne ddçdèdédê ZoG dëdì dìZpG dídî dîepZqe dddèdïdð ZrG dñdò dòepZsG dódô dôZtG dõdö döetZuG d÷dø døetZvG dùdú dúetZwG dûdü düetZxG dýdþ dþetZyG dÿd d etZzG dd detZ{G dd detZ|G dd detZ}G dd detZ~G d d
|
d
|
etZG d d d etZG d d detZG dd detZG dd detZG dd detZG dd desZ
G dd dZG dd deZG dd d eZG d d d eZG d d d eZG d!d" d"eZG d#d$ d$eZG d%d& d&eZG d'd( d(eZG d)d* d*eZG d+d, d,eZG d-d. d.Zefe
|
je
|
j e
|
j d/ Zd0d1 Zefe
|
je
|
j e
|
j Ze ddd;eeeef eed2d3d4ZG d5d6 d6Zd7d8 Zed9k rºe dS (< ab pefile, Portable Executable reader module
|
|
All the PE file basic structures are available with their default names as
|
attributes of the instance returned.
|
|
Processed elements such as the import table are made available with lowercase
|
names, to differentiate them from the upper case basic structure names.
|
|
pefile has been tested against many edge cases such as corrupted and malformed
|
PEs as well as malware, which often attempts to abuse the format way beyond its
|
standard use. To the best of my knowledge most of the abuse is handled
|
gracefully.
|
|
Copyright (c) 2005-2023 Ero Carrera <ero.carrera@gmail.com>
|
z Ero Carreraz2023.2.7zero.carrera@gmail.comé N)ÚCounter)ÚUnion)Úsha1)Úsha256)Úsha512)Úmd5Úbackslashreplace_Úbackslashreplaceé Fc s" |st ¡S fdd}|S )Nc s* t ¡| t | ¡ fdd}|S )Nc s t | |¡S ©N)ÚcopymodÚcopy)ÚargsÚkwargs©Z cached_func© ú=d:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\pefile.pyÚwrapper; s z-lru_cache.<locals>.decorator.<locals>.wrapper)Ú functoolsÚ lru_cacheÚwraps)Úfr ©ÚmaxsizeÚtypedr r Ú decorator8 s z lru_cache.<locals>.decorator)r r )r r r r r r r r 4 s
|
r é )r c C s |t k r | S t| d d S )Né )Ú FILE_ALIGNMENT_HARDCODED_VALUEÚint)ÚvalÚfile_alignmentr r r Úcache_adjust_FileAlignmentE s r" c C s, |dk r |}|r(| | r(|t | | S | S )Né )r )r Úsection_alignmentr! r r r Ú cache_adjust_SectionAlignmentL s
|
r% c C s
|
| d¡S ©Nr )Úcount)Údatar r r Ú count_zeroes\ s r) é é r é é iMZ iZM iNE iLE iLX iVZ iPE é ì l i i c C s t dd | D | S )Nc S s g | ]}|d |d fqS )é r r ©Ú.0Úer r r Ú
|
<listcomp> s z two_way_dict.<locals>.<listcomp>)Údict)Úpairsr r r Ú two_way_dict s r7 )Ú IMAGE_DIRECTORY_ENTRY_EXPORTr )Ú IMAGE_DIRECTORY_ENTRY_IMPORTr0 )Ú IMAGE_DIRECTORY_ENTRY_RESOURCEé )Ú IMAGE_DIRECTORY_ENTRY_EXCEPTIONé )Ú IMAGE_DIRECTORY_ENTRY_SECURITYé )Ú IMAGE_DIRECTORY_ENTRY_BASERELOCé )ÚIMAGE_DIRECTORY_ENTRY_DEBUGé )Z IMAGE_DIRECTORY_ENTRY_COPYRIGHTé )Z IMAGE_DIRECTORY_ENTRY_GLOBALPTRé )ÚIMAGE_DIRECTORY_ENTRY_TLSé )Ú!IMAGE_DIRECTORY_ENTRY_LOAD_CONFIGé
|
)Ú"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORTé )ZIMAGE_DIRECTORY_ENTRY_IATé )Ú"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORTé )Z$IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTORé )Z IMAGE_DIRECTORY_ENTRY_RESERVEDé )ZIMAGE_FILE_RELOCS_STRIPPEDr0 )ÚIMAGE_FILE_EXECUTABLE_IMAGEr; )Z IMAGE_FILE_LINE_NUMS_STRIPPEDr? )Z IMAGE_FILE_LOCAL_SYMS_STRIPPEDrE )Z IMAGE_FILE_AGGRESIVE_WS_TRIMr. )Z IMAGE_FILE_LARGE_ADDRESS_AWAREr- )ZIMAGE_FILE_16BIT_MACHINEé@ )Z IMAGE_FILE_BYTES_REVERSED_LOr
|
)ZIMAGE_FILE_32BIT_MACHINEé )ZIMAGE_FILE_DEBUG_STRIPPEDr )Z"IMAGE_FILE_REMOVABLE_RUN_FROM_SWAPé )Z IMAGE_FILE_NET_RUN_FROM_SWAPr )ZIMAGE_FILE_SYSTEMr# )ÚIMAGE_FILE_DLLr+ )ZIMAGE_FILE_UP_SYSTEM_ONLYé @ )Z IMAGE_FILE_BYTES_REVERSED_HIr, )ZIMAGE_SCN_TYPE_REGr )ZIMAGE_SCN_TYPE_DSECTr0 )ZIMAGE_SCN_TYPE_NOLOADr; )ZIMAGE_SCN_TYPE_GROUPr? )ZIMAGE_SCN_TYPE_NO_PADrE )ZIMAGE_SCN_TYPE_COPYr. )ZIMAGE_SCN_CNT_CODEr- )Z IMAGE_SCN_CNT_INITIALIZED_DATArR )Z IMAGE_SCN_CNT_UNINITIALIZED_DATAr
|
)ZIMAGE_SCN_LNK_OTHERrS )ZIMAGE_SCN_LNK_INFOr )ZIMAGE_SCN_LNK_OVERrT )ZIMAGE_SCN_LNK_REMOVEr )ZIMAGE_SCN_LNK_COMDATr# )ZIMAGE_SCN_MEM_PROTECTEDrV )ZIMAGE_SCN_NO_DEFER_SPEC_EXCrV )ZIMAGE_SCN_GPRELr, )ZIMAGE_SCN_MEM_FARDATAr, )ZIMAGE_SCN_MEM_SYSHEAPé )ZIMAGE_SCN_MEM_PURGEABLEé )ZIMAGE_SCN_MEM_16BITrX )ZIMAGE_SCN_MEM_LOCKEDi )ZIMAGE_SCN_MEM_PRELOADi )ZIMAGE_SCN_ALIGN_1BYTESr* )ZIMAGE_SCN_ALIGN_2BYTESi )ZIMAGE_SCN_ALIGN_4BYTESi 0 )ZIMAGE_SCN_ALIGN_8BYTESi @ )ZIMAGE_SCN_ALIGN_16BYTESi P )ZIMAGE_SCN_ALIGN_32BYTESi ` )ZIMAGE_SCN_ALIGN_64BYTESi p )ZIMAGE_SCN_ALIGN_128BYTESi )ZIMAGE_SCN_ALIGN_256BYTESi )ZIMAGE_SCN_ALIGN_512BYTESi )ZIMAGE_SCN_ALIGN_1024BYTESi ° )ZIMAGE_SCN_ALIGN_2048BYTESi À )ZIMAGE_SCN_ALIGN_4096BYTESi Ð )ZIMAGE_SCN_ALIGN_8192BYTESi à )ZIMAGE_SCN_ALIGN_MASKi ð )ZIMAGE_SCN_LNK_NRELOC_OVFLi )ZIMAGE_SCN_MEM_DISCARDABLEi )ZIMAGE_SCN_MEM_NOT_CACHEDi )ZIMAGE_SCN_MEM_NOT_PAGEDé )ZIMAGE_SCN_MEM_SHAREDé )ÚIMAGE_SCN_MEM_EXECUTEi )ZIMAGE_SCN_MEM_READi @)ÚIMAGE_SCN_MEM_WRITEr/ )ZIMAGE_DEBUG_TYPE_UNKNOWNr )ZIMAGE_DEBUG_TYPE_COFFr0 )ZIMAGE_DEBUG_TYPE_CODEVIEWr; )ZIMAGE_DEBUG_TYPE_FPOr= )ZIMAGE_DEBUG_TYPE_MISCr? )ZIMAGE_DEBUG_TYPE_EXCEPTIONrA )ZIMAGE_DEBUG_TYPE_FIXUPrC )Z IMAGE_DEBUG_TYPE_OMAP_TO_SRCrD )Z IMAGE_DEBUG_TYPE_OMAP_FROM_SRCrE )ZIMAGE_DEBUG_TYPE_BORLANDrG )ZIMAGE_DEBUG_TYPE_RESERVED10rI )ZIMAGE_DEBUG_TYPE_CLSIDrK )ZIMAGE_DEBUG_TYPE_VC_FEATURErL )ZIMAGE_DEBUG_TYPE_POGOrN )ZIMAGE_DEBUG_TYPE_ILTCGrO )ZIMAGE_DEBUG_TYPE_MPXrP )ZIMAGE_DEBUG_TYPE_REPROr. )Z&IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICSé )ZIMAGE_SUBSYSTEM_UNKNOWNr )ÚIMAGE_SUBSYSTEM_NATIVEr0 )ZIMAGE_SUBSYSTEM_WINDOWS_GUIr; )ZIMAGE_SUBSYSTEM_WINDOWS_CUIr= )ZIMAGE_SUBSYSTEM_OS2_CUIrA )ZIMAGE_SUBSYSTEM_POSIX_CUIrD )Ú IMAGE_SUBSYSTEM_NATIVE_WINDOWSrE )Z IMAGE_SUBSYSTEM_WINDOWS_CE_GUIrG )Z IMAGE_SUBSYSTEM_EFI_APPLICATIONrI )Z'IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVERrK )Z"IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVERrL )ZIMAGE_SUBSYSTEM_EFI_ROMrN )ZIMAGE_SUBSYSTEM_XBOXrO )Z(IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATIONr. )ZIMAGE_FILE_MACHINE_UNKNOWNr )ÚIMAGE_FILE_MACHINE_I386iL )ZIMAGE_FILE_MACHINE_R3000ib )ZIMAGE_FILE_MACHINE_R4000if )ZIMAGE_FILE_MACHINE_R10000ih )Z IMAGE_FILE_MACHINE_WCEMIPSV2ii )ZIMAGE_FILE_MACHINE_ALPHAi )ZIMAGE_FILE_MACHINE_SH3i¢ )ZIMAGE_FILE_MACHINE_SH3DSPi£ )ZIMAGE_FILE_MACHINE_SH3Ei¤ )ZIMAGE_FILE_MACHINE_SH4i¦ )ZIMAGE_FILE_MACHINE_SH5i¨ )ZIMAGE_FILE_MACHINE_ARMiÀ )ZIMAGE_FILE_MACHINE_THUMBi )ZIMAGE_FILE_MACHINE_ARMNTiÄ )ZIMAGE_FILE_MACHINE_AM33iÓ )ZIMAGE_FILE_MACHINE_POWERPCið )Z IMAGE_FILE_MACHINE_POWERPCFPiñ )ÚIMAGE_FILE_MACHINE_IA64r )ZIMAGE_FILE_MACHINE_MIPS16if )ZIMAGE_FILE_MACHINE_ALPHA64é )ZIMAGE_FILE_MACHINE_AXP64rb )ZIMAGE_FILE_MACHINE_MIPSFPUif )Z IMAGE_FILE_MACHINE_MIPSFPU16if )ZIMAGE_FILE_MACHINE_TRICOREi )ZIMAGE_FILE_MACHINE_CEFiï )ZIMAGE_FILE_MACHINE_EBCi¼ )ZIMAGE_FILE_MACHINE_RISCV32i2P )ZIMAGE_FILE_MACHINE_RISCV64idP )ZIMAGE_FILE_MACHINE_RISCV128i(Q )Z IMAGE_FILE_MACHINE_LOONGARCH32i2b )Z IMAGE_FILE_MACHINE_LOONGARCH64idb )ÚIMAGE_FILE_MACHINE_AMD64id )ZIMAGE_FILE_MACHINE_M32RiA )ZIMAGE_FILE_MACHINE_ARM64idª )ZIMAGE_FILE_MACHINE_CEEiîÀ )ÚIMAGE_REL_BASED_ABSOLUTEr )ÚIMAGE_REL_BASED_HIGHr0 )ÚIMAGE_REL_BASED_LOWr; )ÚIMAGE_REL_BASED_HIGHLOWr= )ÚIMAGE_REL_BASED_HIGHADJr? )Z IMAGE_REL_BASED_MIPS_JMPADDRrA )ZIMAGE_REL_BASED_SECTIONrC )ZIMAGE_REL_BASED_RELrD )Z IMAGE_REL_BASED_MIPS_JMPADDR16rG )ZIMAGE_REL_BASED_IA64_IMM64rG )ÚIMAGE_REL_BASED_DIR64rI )ZIMAGE_REL_BASED_HIGH3ADJrK )ZIMAGE_LIBRARY_PROCESS_INITr0 )ZIMAGE_LIBRARY_PROCESS_TERMr; )ZIMAGE_LIBRARY_THREAD_INITr? )ZIMAGE_LIBRARY_THREAD_TERMrE )Z(IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VAr- )Z%IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASErR )Z(IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITYr
|
)Z"IMAGE_DLLCHARACTERISTICS_NX_COMPATrS )Z%IMAGE_DLLCHARACTERISTICS_NO_ISOLATIONr )Z IMAGE_DLLCHARACTERISTICS_NO_SEHrT )Z IMAGE_DLLCHARACTERISTICS_NO_BINDr )Z%IMAGE_DLLCHARACTERISTICS_APPCONTAINERr# )Z#IMAGE_DLLCHARACTERISTICS_WDM_DRIVERr+ )Z!IMAGE_DLLCHARACTERISTICS_GUARD_CFrV )Z.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWAREr, )ÚUNW_FLAG_EHANDLERr0 )ÚUNW_FLAG_UHANDLERr; )ÚUNW_FLAG_CHAININFOr? )ZRAXr )ZRCXr0 )ZRDXr; )ZRBXr= )ZRSPr? )ZRBPrA )ZRSIrC )ZRDIrD )ZR8rE )ZR9rG )ZR10rI )ZR11rK )ZR12rL )ZR13rN )ZR14rO )ZR15rP r0 r; r= r? rA rC rE rG rI )Z RT_CURSORr0 )Z RT_BITMAPr; )ZRT_ICONr= )ZRT_MENUr? )Z RT_DIALOGrA )Ú RT_STRINGrC )Z
|
RT_FONTDIRrD )ZRT_FONTrE )ZRT_ACCELERATORrG )Z RT_RCDATArI )ZRT_MESSAGETABLErK )ZRT_GROUP_CURSORrL )Z RT_GROUP_ICONrO )Ú
|
RT_VERSIONr. )Z RT_DLGINCLUDEé )Z RT_PLUGPLAYé )ZRT_VXDr] )Z RT_ANICURSORé )Z
|
RT_ANIICONé )ZRT_HTMLé )Z RT_MANIFESTé )Z LANG_NEUTRALr )ZLANG_INVARIANTé )ZLANG_AFRIKAANSé6 )Z LANG_ALBANIANé )Z LANG_ARABICr0 )Z LANG_ARMENIANé+ )Z LANG_ASSAMESEéM )Z
|
LANG_AZERIé, )Z LANG_BASQUEé- )ZLANG_BELARUSIANé# )Z LANG_BENGALIéE )ZLANG_BULGARIANr; )Z LANG_CATALANr= )Z LANG_CHINESEr? )Z LANG_CROATIANé )Z
|
LANG_CZECHrA )Z LANG_DANISHrC )Z LANG_DIVEHIée )Z
|
LANG_DUTCHrp )Z LANG_ENGLISHrG )Z LANG_ESTONIANé% )Z LANG_FAEROESEé8 )Z
|
LANG_FARSIé) )Z LANG_FINNISHrK )Z LANG_FRENCHrL )Z LANG_GALICIANéV )Z LANG_GEORGIANé7 )Z LANG_GERMANrD )Z
|
LANG_GREEKrE )Z LANG_GUJARATIéG )Z LANG_HEBREWrN )Z
|
LANG_HINDIé9 )ZLANG_HUNGARIANrO )ZLANG_ICELANDICrP )ZLANG_INDONESIANé! )Z LANG_ITALIANr. )Z LANG_JAPANESEro )Z LANG_KANNADAéK )Z LANG_KASHMIRIé` )Z
|
LANG_KAZAKé? )Z LANG_KONKANIéW )Z LANG_KOREANé )Z LANG_KYRGYZrR )Z LANG_LATVIANé& )ZLANG_LITHUANIANé' )ZLANG_MACEDONIANé/ )Z
|
LANG_MALAYé> )ZLANG_MALAYALAMéL )Z LANG_MANIPURIéX )Z LANG_MARATHIéN )ZLANG_MONGOLIANéP )Z LANG_NEPALIéa )ZLANG_NORWEGIANr] )Z
|
LANG_ORIYAéH )Z LANG_POLISHrq )ZLANG_PORTUGUESErr )Z LANG_PUNJABIéF )Z LANG_ROMANIANrt )Z LANG_RUSSIANé )Z LANG_SANSKRITéO )Z LANG_SERBIANr~ )Z LANG_SINDHIéY )Z LANG_SLOVAKé )ZLANG_SLOVENIANé$ )Z LANG_SPANISHrI )Z LANG_SWAHILIéA )Z LANG_SWEDISHé )Z LANG_SYRIACéZ )Z
|
LANG_TAMILéI )Z
|
LANG_TATARéD )Z LANG_TELUGUéJ )Z LANG_THAIé )Z LANG_TURKISHé )ZLANG_UKRAINIANé" )Z LANG_URDUr- )Z
|
LANG_UZBEKéC )ZLANG_VIETNAMESEé* )Z LANG_GAELICé< )Z LANG_MALTESEé: )Z
|
LANG_MAORIé( )ZLANG_RHAETO_ROMANCErs )Z
|
LANG_SAAMIé; )Z LANG_SORBIANé. )Z LANG_SUTUé0 )Z LANG_TSONGAé1 )Z LANG_TSWANAé2 )Z
|
LANG_VENDAé3 )Z
|
LANG_XHOSAé4 )Z LANG_ZULUé5 )ZLANG_ESPERANTOé )Z
|
LANG_WALONé )Z LANG_CORNISHé )Z
|
LANG_WELSHé )Z LANG_BRETONé )ZSUBLANG_NEUTRALr )ZSUBLANG_DEFAULTr0 )ZSUBLANG_SYS_DEFAULTr; )ZSUBLANG_ARABIC_SAUDI_ARABIAr0 )ZSUBLANG_ARABIC_IRAQr; )ZSUBLANG_ARABIC_EGYPTr= )ZSUBLANG_ARABIC_LIBYAr? )ZSUBLANG_ARABIC_ALGERIArA )ZSUBLANG_ARABIC_MOROCCOrC )ZSUBLANG_ARABIC_TUNISIArD )ZSUBLANG_ARABIC_OMANrE )ZSUBLANG_ARABIC_YEMENrG )ZSUBLANG_ARABIC_SYRIArI )ZSUBLANG_ARABIC_JORDANrK )ZSUBLANG_ARABIC_LEBANONrL )ZSUBLANG_ARABIC_KUWAITrN )ZSUBLANG_ARABIC_UAErO )ZSUBLANG_ARABIC_BAHRAINrP )ZSUBLANG_ARABIC_QATARr. )ZSUBLANG_AZERI_LATINr0 )ZSUBLANG_AZERI_CYRILLICr; )ZSUBLANG_CHINESE_TRADITIONALr0 )ZSUBLANG_CHINESE_SIMPLIFIEDr; )ZSUBLANG_CHINESE_HONGKONGr= )ZSUBLANG_CHINESE_SINGAPOREr? )ZSUBLANG_CHINESE_MACAUrA )Z SUBLANG_DUTCHr0 )ZSUBLANG_DUTCH_BELGIANr; )ZSUBLANG_ENGLISH_USr0 )ZSUBLANG_ENGLISH_UKr; )ZSUBLANG_ENGLISH_AUSr= )ZSUBLANG_ENGLISH_CANr? )ZSUBLANG_ENGLISH_NZrA )ZSUBLANG_ENGLISH_EIRErC )Z SUBLANG_ENGLISH_SOUTH_AFRICArD )ZSUBLANG_ENGLISH_JAMAICArE )ZSUBLANG_ENGLISH_CARIBBEANrG )ZSUBLANG_ENGLISH_BELIZErI )ZSUBLANG_ENGLISH_TRINIDADrK )ZSUBLANG_ENGLISH_ZIMBABWErL )ZSUBLANG_ENGLISH_PHILIPPINESrN )ZSUBLANG_FRENCHr0 )ZSUBLANG_FRENCH_BELGIANr; )ZSUBLANG_FRENCH_CANADIANr= )ZSUBLANG_FRENCH_SWISSr? )ZSUBLANG_FRENCH_LUXEMBOURGrA )ZSUBLANG_FRENCH_MONACOrC )ZSUBLANG_GERMANr0 )ZSUBLANG_GERMAN_SWISSr; )ZSUBLANG_GERMAN_AUSTRIANr= )ZSUBLANG_GERMAN_LUXEMBOURGr? )Z SUBLANG_GERMAN_LIECHTENSTEINrA )ZSUBLANG_ITALIANr0 )ZSUBLANG_ITALIAN_SWISSr; )ZSUBLANG_KASHMIRI_SASIAr; )ZSUBLANG_KASHMIRI_INDIAr; )ZSUBLANG_KOREANr0 )ZSUBLANG_LITHUANIANr0 )ZSUBLANG_MALAY_MALAYSIAr0 )Z SUBLANG_MALAY_BRUNEI_DARUSSALAMr; )ZSUBLANG_NEPALI_INDIAr; )ZSUBLANG_NORWEGIAN_BOKMALr0 )ZSUBLANG_NORWEGIAN_NYNORSKr; )ZSUBLANG_PORTUGUESEr; )Z SUBLANG_PORTUGUESE_BRAZILIANr0 )ZSUBLANG_SERBIAN_LATINr; )ZSUBLANG_SERBIAN_CYRILLICr= )ZSUBLANG_SPANISHr0 )ZSUBLANG_SPANISH_MEXICANr; )ZSUBLANG_SPANISH_MODERNr= )ZSUBLANG_SPANISH_GUATEMALAr? )ZSUBLANG_SPANISH_COSTA_RICArA )ZSUBLANG_SPANISH_PANAMArC )Z"SUBLANG_SPANISH_DOMINICAN_REPUBLICrD )ZSUBLANG_SPANISH_VENEZUELArE )ZSUBLANG_SPANISH_COLOMBIArG )ZSUBLANG_SPANISH_PERUrI )ZSUBLANG_SPANISH_ARGENTINArK )ZSUBLANG_SPANISH_ECUADORrL )ZSUBLANG_SPANISH_CHILErN )ZSUBLANG_SPANISH_URUGUAYrO )ZSUBLANG_SPANISH_PARAGUAYrP )ZSUBLANG_SPANISH_BOLIVIAr. )ZSUBLANG_SPANISH_EL_SALVADORro )ZSUBLANG_SPANISH_HONDURASr )ZSUBLANG_SPANISH_NICARAGUArp )ZSUBLANG_SPANISH_PUERTO_RICOr] )ZSUBLANG_SWEDISHr0 )ZSUBLANG_SWEDISH_FINLANDr; )ZSUBLANG_URDU_PAKISTANr0 )ZSUBLANG_URDU_INDIAr; )ZSUBLANG_UZBEK_LATINr0 )ZSUBLANG_UZBEK_CYRILLICr; )ZSUBLANG_DUTCH_SURINAMr= )ZSUBLANG_ROMANIANr0 )ZSUBLANG_ROMANIAN_MOLDAVIAr; )ZSUBLANG_RUSSIANr0 )ZSUBLANG_RUSSIAN_MOLDAVIAr; )ZSUBLANG_CROATIANr0 )ZSUBLANG_LITHUANIAN_CLASSICr; )ZSUBLANG_GAELICr0 )ZSUBLANG_GAELIC_SCOTTISHr; )ZSUBLANG_GAELIC_MANXr= c C s@ t | d¡}t |g ¡D ]}||kr| S qt |dg¡d S )Nú *unknown*r )ÚLANGÚgetÚSUBLANG)Z
|
lang_valueÚ sublang_valueZ lang_nameÚ sublang_namer r r Úget_sublang_name_for_lang s
|
|
r¾ c C sÚ d}d}|t | k rÖ| ||d
}t |dk r2qÖt d|¡d }|d7 }|dkrÌd|d krnt | krÌn nZz&t| |||d
d¡||< W n tk
|
r´ |d7 }Y nX |dkrÀqÖ||d 7 }|d7 }qd S )Nr r; z<húutf-16ler0 r= )ÚlenÚstructÚunpackÚbÚdecodeÚUnicodeDecodeError)r( ÚcounterÚlÚiÚ error_countZ
|
data_sliceZlen_r r r Ú parse_strings s$ (& rÊ c s fdd ¡ D S )z´Read the flags from a dictionary and return them in a usable form.
|
|
Will return a list of (flag, value) for all flags in "flag_dict"
|
matching the filter "flag_filter".
|
c s0 g | ](}t |ttfr| ¡r| | fqS r )Ú
|
isinstanceÚstrÚbytesÚ
|
startswith)r2 Úflag©Z flag_dictZ flag_filterr r r4 ½ s
|
þz"retrieve_flags.<locals>.<listcomp>)ÚkeysrÐ r rÐ r Úretrieve_flags¶ s þrÒ c C s0 |D ]&\}}||@ r d| j |< qd| j |< qdS )a
|
Will process the flags and set attributes in the object accordingly.
|
|
The object "obj" will gain attributes named after the flags provided in
|
"flags" and valued True/False, matching the results of applying each
|
flag value from "flags" to flag_field.
|
TFN)Ú__dict__)ÚobjZ
|
flag_fieldÚflagsrÏ Úvaluer r r Ú set_flagsÄ s r× c C s | dko| | d @ dkS )Nr r0 r )r r r r Ú power_of_twoÓ s rØ c C s0 t | tr| S t | tr t| S t | d¡S d S )NÚcp1252)rË rÍ Ú bytearrayÚcodecsÚencode)Úxr r r rÃ × s
|
|
|
rà c s0 e Zd Z fddZ fddZdd Z ZS )Ú
|
AddressSetc s t ¡ d | _d | _d S r )ÚsuperÚ__init__ÚminÚmax©Úself©Ú __class__r r rà á s
|
zAddressSet.__init__c sH t |¡ | jd kr|n
|
t| j|| _| jd kr6|n
|
t| j|| _d S r )rß Úaddrá râ ©rä rÖ rå r r rç æ s zAddressSet.addc C s$ | j d ks| jd krdS | j| j S r& )rá râ rã r r r Údiffë s zAddressSet.diff)Ú__name__Ú
|
__module__Ú __qualname__rà rç ré Ú __classcell__r r rå r rÞ à s rÞ c @ s` e Zd ZdZdd Zdd Zdd Zdd Zd
|
d Zd d Z dd Z
|
dd Z dd Z dd Z dS )Ú!UnicodeStringWrapperPostProcessorzæThis class attempts to help the process of identifying strings
|
that might be plain Unicode or Pascal. A list of strings will be
|
wrapped on it with the hope the overlappings will help make the
|
decision about their type.c C s || _ || _d | _d S r )ÚpeÚrva_ptrÚstring)rä rï rð r r r rà õ s z*UnicodeStringWrapperPostProcessor.__init__c C s | j S )zGet the RVA of the string.)rð rã r r r Úget_rvaú s z)UnicodeStringWrapperPostProcessor.get_rvac C s | dd¡S )z6Return the escaped UTF-8 representation of the string.úutf-8r )rÄ rã r r r Ú__str__þ s z)UnicodeStringWrapperPostProcessor.__str__c G s | j s
|
dS | j j| S )NÚ )rñ rÄ )rä r r r r rÄ s z(UnicodeStringWrapperPostProcessor.decodec C s d} dS )z>Make this instance None, to express it's no known string type.Nr rã r r r Ú
|
invalidate s z,UnicodeStringWrapperPostProcessor.invalidatec C sV z | j j| jd | ¡ d| _W n0 tk
|
rP | j ¡ d | jd ¡¡ Y nX d S )Nr; ©Ú
|
max_lengthzCFailed rendering pascal string, attempting to read from RVA 0x{0:x}) rï Úget_string_u_at_rvarð Úget_pascal_16_lengthrñ Ú PEFormatErrorÚ get_warningsÚappendÚformatrã r r r Úrender_pascal_16 s ÿ
|
ÿÿz2UnicodeStringWrapperPostProcessor.render_pascal_16c C s | | j¡S r )Ú9_UnicodeStringWrapperPostProcessor__get_word_value_at_rvarð rã r r r rú s z6UnicodeStringWrapperPostProcessor.get_pascal_16_lengthc C sJ z| j |d¡}W n tk
|
r( Y dS X t|dk r:dS t d|¡d S )Nr; Fú<Hr )rï Úget_datarû rÀ rÁ r )rä Úrvar( r r r Z__get_word_value_at_rva s z9UnicodeStringWrapperPostProcessor.__get_word_value_at_rvac C s& | |d ¡dkr"|| j | _dS dS )zÙThe next RVA is taken to be the one immediately following this one.
|
|
Such RVA could indicate the natural end of the string and will be checked
|
to see if there's a Unicode NULL character there.
|
r; r TF)r rð Úlength)rä Z next_rva_ptrr r r Úask_unicode_16$ s z0UnicodeStringWrapperPostProcessor.ask_unicode_16c C sF z| j | j¡| _W n, tk
|
r@ | j ¡ d | j¡¡ Y nX d S )NzDFailed rendering unicode string, attempting to read from RVA 0x{0:x})rï rù rð rñ rû rü rý rþ rã r r r Úrender_unicode_160 s
|
ÿÿz3UnicodeStringWrapperPostProcessor.render_unicode_16N)rê rë rì Ú__doc__rà rò rô rÄ rö rÿ rú r r r r r r r rî ï s rî c @ s e Zd ZdZdd Zdd ZdS )rû z"Generic PE format error exception.c C s
|
|| _ d S r )rÖ rè r r r rà = s zPEFormatError.__init__c C s
|
t | jS r )ÚreprrÖ rã r r r rô @ s zPEFormatError.__str__N)rê rë rì r rà rô r r r r rû : s rû c @ sN e Zd ZdZdd ZdddZdddZdd d
|
Zd d Zd d Z dd Z
|
dS )ÚDumpz1Convenience class for dumping the PE information.c C s
|
g | _ d S r )Útextrã r r r rà G s z Dump.__init__r c C s |D ]}| ||¡ qdS )zeAdds a list of lines.
|
|
The list can be indented with the optional argument 'indent'.
|
N©Úadd_line)rä ÚtxtÚindentÚliner r r Ú add_linesJ s zDump.add_linesc C s | |d |¡ dS )z\Adds a line.
|
|
The line can be indented with the optional argument 'indent'.
|
Ú
|
N)rç ©rä r r r r r r R s z Dump.add_linec C s | j d d| |¡¡ dS )z|Adds some text, no newline will be appended.
|
|
The text can be indented with the optional argument 'indent'.
|
z{0}{1}ú N)r
|
rý rþ r r r r rç Y s zDump.addc C s | d d|¡¡ dS )zAdds a header element.z
|
{0}{1}{0}
|
z
|
----------N)r rþ )rä r r r r Ú
|
add_header` s zDump.add_headerc C s | j d¡ dS )zAdds a newline.r N)r
|
rý rã r r r Ú add_newlined s zDump.add_newlinec C s d dd | jD ¡S )z"Get the text in its current state.rõ c s s | ]}d |¡V qdS )ú{0}N©rþ )r2 rà r r r Ú <genexpr>j s z Dump.get_text.<locals>.<genexpr>)Újoinr
|
rã r r r Úget_texth s z Dump.get_textN)r )r )r ) rê rë rì r rà r r rç r r r r r r r r D s
|
|
|
r )rÝ Úcrà ÚBÚhÚHrÈ ÚIrÇ ÚLr ÚqÚQÚdÚsc C sN d}| }| d t jkrBtd dd | D ¡}d dd | D ¡}t| | S )Nr0 r rõ c S s g | ]}|t jkr|qS r ©rñ Údigits©r2 r# r r r r4 s
|
z sizeof_type.<locals>.<listcomp>c S s g | ]}|t jkr|qS r r% r' r r r r4 s
|
)rñ r& r r ÚSTRUCT_SIZEOF_TYPES)Útr' Z_tr r r Ú sizeof_type s r* T)r r c sÔ d}g }i }g }d}d}| D ]}d|kr | dd¡\} ||7 }| d ¡ d¡} g }
|
| D ]F |kr fdd|D } | ¡} d | ¡ |
|
¡ || < q\|t|7 }| |
|
¡ q t |¡}|||||fS )Nú<r ú,r0 c s g | ]}|d t
qS r )rÀ )r2 rÝ ©Úelm_namer r r4 s z set_format.<locals>.<listcomp>z {0}_{1:d})Úsplitrý r' rþ r* rÁ Úcalcsize) rþ Ú__format_str__Ú__unpacked_data_elms__Ú__field_offsets__Ú__keys__Ú__format_length__ÚoffsetÚelmÚelm_typeZ elm_namesÚnamesZ search_listZ occ_countr r- r Ú
|
set_format s:
|
|
|
|
|
|
ûr: c @ s e Zd ZdZd!ddZedddZdd Zd
|
d Zd d Z dd Z
|
dd Z dd Z dd Z dd Zdd Zdd Zd"d d Zd d ZdS )#Ú StructurezPrepare structure object to extract members from data.
|
|
Format is a list containing definitions for the elements
|
of the structure.
|
Nc C sz d| _ g | _d| _i | _g | _|d }t|ts8t|}t|\| _ | _| _| _| _d| _|| _ |rl|| _
|
n
|
|d | _
|
d S )Nr+ r r0 F) r1 r4 r5 r3 r2 rË Útupler: Ú__all_zeroes__Ú__file_offset__Úname)rä rþ r? Ú file_offsetr# r r r rà ¾ s(
|
úzStructure.__init__)Úreturnc C s | j S r )r1 rã r r r Ú__get_format__Ú s zStructure.__get_format__c C s | j | j| S )zLReturn the offset within the field for the requested field in the structure.)r> r3 ©rä Ú
|
field_namer r r Úget_field_absolute_offsetÝ s z#Structure.get_field_absolute_offsetc C s
|
| j | S )z?Return the offset within the structure for the requested field.)r3 rC r r r Úget_field_relative_offsetá s z#Structure.get_field_relative_offsetc C s | j S r ©r> rã r r r Úget_file_offsetå s zStructure.get_file_offsetc C s
|
|| _ d S r rG ©rä r6 r r r Úset_file_offsetè s zStructure.set_file_offsetc C s | j S )z/Returns true is the unpacked data is all zeros.)r= rã r r r Ú
|
all_zeroesë s zStructure.all_zeroesc C s | j S )z Return size of the structure.)r5 rã r r r Úsizeofð s zStructure.sizeofc C s t |}t|| jkr&|d | j
}nt|| jk r<tdt|t|krRd| _t | j|¡| _ t
|
| j D ]$\}}| j | D ]}t | || q~qld S )Nz-Data length less than expected header length.T) rà rÀ r5 rû r) r= rÁ r r1 r2 Ú enumerater4 Úsetattr)rä r( Úidxr Úkeyr r r Ú
|
__unpack__õ s zStructure.__unpack__c C s^ g }t | jD ]<\}}d }| j| D ]}t| |}||kr$ q@q$| |¡ qtj| jf| S r )rM r2 r4 Úgetattrrý rÁ Úpackr1 )rä Z
|
new_valuesrO r Únew_valrP r r r Ú__pack__ s
|
zStructure.__pack__c C s d | ¡ ¡S )Nr ©r Údumprã r r r rô s zStructure.__str__c C s dd dd | ¡ D ¡ S )Nz<Structure: %s>r c S s g | ]}d | ¡ ¡qS )r )r r/ ©r2 r$ r r r r4 ! s z&Structure.__repr__.<locals>.<listcomp>rV rã r r r Ú__repr__ s ÿzStructure.__repr__r c
|
s@ g }| d | j¡¡ dd tjD | jD ] }|D ] }t| |}t|tt frÀ|
|
d¡rjd |¡}n
|
d |¡}|dks|dkr¾z |d t t |¡¡ 7 }W n tk
|
r¼ |d
|
7 }Y nX nLt|}|
|
d ¡rîd d d | d¡D ¡}n d fdd| d¡D ¡}| d| j| | j | j| |d |f ¡ q6q,|S )z1Returns a string representation of the structure.z[{0}]c S s g | ]}|t jkrt|qS r )rñ Ú
|
whitespaceÚord©r2 rÈ r r r r4 + s
|
z"Structure.dump.<locals>.<listcomp>Z
|
Signature_z{:<8X}z0x{:<8X}Ú TimeDateStampÚ dwTimeStampz [%s UTC]z [INVALID TIME]Ú Signaturerõ c S s g | ]}d |¡qS )z{:02X}r r\ r r r r4 C s ó c s& g | ] }| krt |nd |¡qS )z \x{0:02x})Úchrrþ r\ ©Zprintable_bytesr r r4 G s þÿ
|
z0x%-8X 0x%-3X %-30s %sú:)rý rþ r? rñ Ú printabler4 rR rË r ÚlongrÎ ÚtimeÚasctimeÚgmtimeÚ
|
ValueErrorrÚ r Úrstripr3 r> )rä Ú indentationrW rÑ rP r Zval_strr rb r rW $ sJ ÿ
|
|
|
|
|
ÿ
|
üÿ üÿÿ
|
zStructure.dumpc
|
C sÌ i }| j |d< | jD ]²}|D ]¨}t| |}t|ttfr|dksH|dkr¢z d|t t |¡¡f }W q¢ t k
|
r d| }Y q¢X n d
|
dd d d
|
|D D ¡}| j | | j | j | |d ||< q q|S ) z5Returns a dictionary representation of the structure.r; r] r^ z0x%-8X [%s UTC]z0x%-8X [INVALID TIME]rõ c s s, | ]$}t |tjkr t |nd | V qdS )z\x%02xN©ra rñ rd r' r r r r r s ÿz&Structure.dump_dict.<locals>.<genexpr>c S s" g | ]}t |tst|n|qS r ©rË r r[ ©r2 r r r r r4 t s z'Structure.dump_dict.<locals>.<listcomp>)Z
|
FileOffsetÚOffsetÚValue) r? r4 rR rË r re rf rg rh ri r r3 r> )rä Ú dump_dictrÑ rP r r r r rq [ s,
|
|
|
þ
|
|
þýzStructure.dump_dict)NN)r )rê rë rì r rà rÌ rB rE rF rH rJ rK rL rQ rU rô rY rW rq r r r r r; · s
|
|
7r; c @ s e Zd ZdZdd Zdd Zdd Zd$d
|
d Zd d Zdd Z dd Z
|
dd Z dd Z dd Z dd Zdd Zd d Zd d Zd d! Zd"d# ZdS )%ÚSectionStructurez#Convenience section handling class.c O s^ d|kr|d | _ |d= d | _d | _d | _d | _tj| f|| d | _d | _d | _ d | _
|
d S )Nrï ) rï ÚPointerToRawDataÚVirtualAddressÚ SizeOfRawDataÚMisc_VirtualSizer; rà ÚPointerToRawData_adjÚVirtualAddress_adjÚsection_min_addrÚsection_max_addr)rä ZarglZargdr r r rà s
|
zSectionStructure.__init__c C s2 | j d kr,| jd k r,| j | j| jjj¡| _ | j S r )rw rs rï Úadjust_FileAlignmentÚOPTIONAL_HEADERÚ FileAlignmentrã r r r Úget_PointerToRawData_adj s
|
|
ÿz)SectionStructure.get_PointerToRawData_adjc C s: | j d kr4| jd k r4| j | j| jjj| jjj¡| _ | j S r )rx rt rï Úadjust_SectionAlignmentr| ÚSectionAlignmentr} rã r r r Úget_VirtualAddress_adj s
|
|
ýz'SectionStructure.get_VirtualAddress_adjNFc C s¶ |dkr| ¡ }n|| ¡ | ¡ }|dk r8|| }n| jdk rN|| j }n|}|rv|dk rv|dk rvt||| j }| jdk r¦| jdk r¦|| j| j kr¦| j| j }| jj||
S )a Get data chunk from a section.
|
|
Allows to query data from the section by passing the
|
addresses where the PE file would be loaded by default.
|
It is then possible to retrieve code and data by their real
|
addresses as they would be if loaded.
|
|
Note that sections on disk can include padding that would
|
not be loaded to memory. That is the case if `section.SizeOfRawData`
|
is greater than `section.Misc_VirtualSize`, and that means
|
that data past `section.Misc_VirtualSize` is padding.
|
In case you are not interested in this padding, passing
|
`ignore_padding=True` will truncate the result in order
|
not to return the padding (if any).
|
|
Returns bytes() under Python 3.x and set() under Python 2.7
|
N)r~ r ru rá rv rs rï Ú__data__)rä Ústartr Zignore_paddingr6 Úendr r r r ¤ s
|
|
þ
|
|
zSectionStructure.get_datac C sr |dkr t td}t| || nDd|krdt| |rd|rN| jd t| O < n| jd t| N < || j|< d S )NÚCharacteristicsÚ
|
IMAGE_SCN_)rÒ ÚSECTION_CHARACTERISTICSr× ÚhasattrrÓ )rä r? r Ú section_flagsr r r Ú __setattr__Ð s
|
z SectionStructure.__setattr__c C s || ¡ | ¡ S r )r~ r rI r r r Úget_rva_from_offsetà s z$SectionStructure.get_rva_from_offsetc C s || ¡ | ¡ S r )r r~ ©rä r r r r Úget_offset_from_rvaã s z$SectionStructure.get_offset_from_rvac C s4 | j dkrdS | ¡ }|| ko.|| j k S S )z<Check whether the section contains the file offset provided.NF)rs r~ ru )rä r6 rw r r r Úcontains_offsetæ s
|
|
ÿz SectionStructure.contains_offsetc C s | j dk r0| jdk r0| j | ko*| jk S S | ¡ }t| jj| ¡ | jk rZ| j}nt | j| j}| j
|
dk r| j
|
| j kr|| | j
|
kr| j
|
| }|| _ || | _|| ko¼|| k S S )z8Check whether the section contains the address provided.N) ry rz r rÀ rï r r~ ru rv râ Ú next_section_virtual_addressrt )rä r rx Úsizer r r Ú contains_rvaò s ÿ
|
þ ý
|
|
z SectionStructure.contains_rvac C s
|
| |¡S r )r r r r r Úcontains s zSectionStructure.containsc C s | | ¡ ¡S )z1Calculate and return the entropy for the section.)Ú entropy_Hr rã r r r Ú get_entropy s z SectionStructure.get_entropyc C s t dk rt | ¡ ¡ S dS )z/Get the SHA-1 hex-digest of the section's data.N)r r Ú hexdigestrã r r r Ú get_hash_sha1 s z SectionStructure.get_hash_sha1c C s t dk rt | ¡ ¡ S dS )z1Get the SHA-256 hex-digest of the section's data.N)r r r rã r r r Úget_hash_sha256& s z SectionStructure.get_hash_sha256c C s t dk rt | ¡ ¡ S dS )z1Get the SHA-512 hex-digest of the section's data.N)r r r rã r r r Úget_hash_sha512, s z SectionStructure.get_hash_sha512c C s t dk rt | ¡ ¡ S dS )z-Get the MD5 hex-digest of the section's data.N)r r r rã r r r Ú get_hash_md52 s z SectionStructure.get_hash_md5c C sN |sdS t t|}d}| ¡ D ](}t|t| }||t |d¡ 8 }q |S )z)Calculate the entropy of a chunk of data.g r r; )r rÚ ÚvaluesÚfloatrÀ ÚmathÚlog)rä r( Z
|
occurencesZentropyrÝ Zp_xr r r r 8 s zSectionStructure.entropy_H)NNF)rê rë rì r rà r~ r r r r r r r r r r r r r r r r r r rr s"
|
|
, &rr c C sT G dd d}g }i }|||}| d D ]}d|krH| ¡ | |¡ q(| dd¡\}}d|krhtd| dd¡\}}t|}|| ¡ ks|| ¡ krª| ¡ | |¡ | ||¡ q(| ¡ t t
|
|\} }
|
} } } g }t | D ]`\}}||krþ| |¡ qâ|| \}
|
}dd |D }| |¡ |D ]}| |d | |d < q&qâ| | | | ||fS )
|
Nc @ sD e Zd Zdd Zdd Zdd Zdd Zd d
|
Zd d Zd d Z dS )z)set_bitfields_format.<locals>.Accumulatorc S s( g | _ d| _d | _d| _|| _|| _d S )Nú~r )Ú
|
_subfieldsÚ_nameÚ_typeÚ
|
_bits_leftÚ _comp_fieldsÚ_format)rä ÚfmtÚ comp_fieldsr r r rà K s z2set_bitfields_format.<locals>.Accumulator.__init__c S sX | j d krd S | j | j d | j ¡ | j | jf| jt| jd < d| _d | _ g | _d S )Nr, r0 r )r¡ r¤ rý r r r£ rÀ rã r r r Úwrap_upU s
|
z1set_bitfields_format.<locals>.Accumulator.wrap_upc S s t | d | _|| _d S ©NrE )r( r¢ r¡ )rä Útpr r r Únew_type^ s z2set_bitfields_format.<locals>.Accumulator.new_typec S s0 | j |7 _ | j|8 _| j ||f¡ d S r )r r¢ r rý )rä r? Zbitcntr r r Ú add_subfieldb s z6set_bitfields_format.<locals>.Accumulator.add_subfieldc S s | j S r )r¡ rã r r r Úget_typeg s z2set_bitfields_format.<locals>.Accumulator.get_typec S s | j S r )r rã r r r Úget_namej s z2set_bitfields_format.<locals>.Accumulator.get_namec S s | j S r )r¢ rã r r r Ú get_bits_leftm s z7set_bitfields_format.<locals>.Accumulator.get_bits_leftN)
|
rê rë rì rà r§ rª r« r¬ r r® r r r r Ú AccumulatorJ s
|
r¯ r0 rc r, z3Structures with bitfields do not support unions yetc S s g | ]}|t j gqS r )ÚStructureWithBitfieldsÚ BTF_NAME_IDX)r2 r r r r r4 s z(set_bitfields_format.<locals>.<listcomp>r ) r§ rý r/ ÚNotImplementedErrorr r¬ r® rª r« r: r< rM Úextend)rþ r¯ Zold_fmtr¦ Úacr7 r8 r. Zelm_bitsZ
|
format_strÚ_Z field_offsetsrÑ Z format_lengthZ extended_keysrO r ZsbfZbf_namesÚnr r r Úset_bitfields_formatH sB &
|
|
ÿ
|
|
|
r· c sp e Zd ZdZdZdZdZdZdddZ fddZ fd d
|
Z
|
d fd d Z fd dZ dd Z dd Z ZS )r° aV
|
Extends Structure's functionality with support for bitfields such as:
|
('B:4,LowerHalf', 'B:4,UpperHalf')
|
To this end, two lists are maintained:
|
* self.__keys__ that contains compound fields, for example
|
('B,~LowerHalfUpperHalf'), and is used during packing/unpaking
|
* self.__keys_ext__ containing a separate key for each field (ex., LowerHalf,
|
UpperHalf) to simplify implementation of dump()
|
This way the implementation of unpacking/packing and dump() from Structure can be
|
reused.
|
|
In addition, we create a dictionary:
|
<comound_field_index_in_keys> -->
|
(data type, [ (subfield name, length in bits)+ ] )
|
that facilitates bitfield paking and unpacking.
|
|
With lru_cache() creating only once instance per format string, the memory
|
overhead is negligible.
|
r r0 Nc C s\ t |\| _| _| _| _| _| _dd t| jD | _d| _ || _
|
|d krN|n|d | _ d S )Nc S s g | ]}d qS r r r\ r r r r4 ¿ s z3StructureWithBitfields.__init__.<locals>.<listcomp>Fr ) r· r1 r5 r3 r4 Ú __keys_ext__Ú__compound_fields__Úranger2 r= r> r? )rä rþ r? r@ r r r rà ´ s ùz StructureWithBitfields.__init__c s t t| |¡ | ¡ d S r )rß r° rQ Ú_unpack_bitfield_attributes©rä r( rå r r rQ Ä s z!StructureWithBitfields.__unpack__c s* | ¡ ztt| ¡ }W 5 | ¡ X |S r )Ú_pack_bitfield_attributesr» rß r° rU r¼ rå r r rU Ê s
|
|
z StructureWithBitfields.__pack__c s0 | j }| j| _ ztt| |¡}W 5 || _ X |S r )r4 r¸ rß r° rW )rä rk ÚtkÚretrå r r rW Ò s zStructureWithBitfields.dumpc s. | j }| j| _ ztt| ¡ }W 5 || _ X |S r )r4 r¸ rß r° rq )rä r¾ r¿ rå r r rq Û s z StructureWithBitfields.dump_dictc C s | j ¡ D ]}| j| d }t| |}t| | d}| j | tj D ]F}d|tj > d }||K }t| |tj ||@ |? ||tj 7 }qDq
|
dS )zaReplace compound attributes corresponding to bitfields with separate
|
sub-fields.
|
r r0 N)
|
r¹ rÑ r4 rR Údelattrr° Ú CF_SUBFLD_IDXÚBTF_BITCNT_IDXrN r± )rä rÈ Úcf_nameÚcvalÚoffstÚsfÚmaskr r r r» ä s
|
|
|
ýz2StructureWithBitfields._unpack_bitfield_attributesc C s | j ¡ D ]|}| j| d }d\}}| j | tj D ]D}d|tj > d }t| |tj |@ }|||> O }||tj 7 }q4t| || q
|
dS )z(Pack attributes into a compound bitfieldr ©r r r0 N) r¹ rÑ r4 r° rÁ r rR r± rN )rä rÈ rà rÅ Zacc_valrÆ rÇ Z field_valr r r r½ ÷ s ÿ z0StructureWithBitfields._pack_bitfield_attributes)NN)r )rê rë rì r r± r Z CF_TYPE_IDXrÁ rà rQ rU rW rq r» r½ rí r r rå r r° s
|
r° c s e Zd ZdZ fddZ ZS )Ú DataContainerzGeneric data container.c s, t t| j}| ¡ D ]\}}||| qd S r )rß rÉ r Úitems)rä r Z bare_setattrrP rÖ rå r r rà s zDataContainer.__init__)rê rë rì r rà rí r r rå r rÉ s rÉ c @ s e Zd ZdZdS )ÚImportDescDatazÅHolds import descriptor information.
|
|
dll: name of the imported DLL
|
imports: list of imported symbols (ImportData instances)
|
struct: IMAGE_IMPORT_DESCRIPTOR structure
|
N©rê rë rì r r r r r rË s rË c @ s e Zd ZdZdd ZdS )Ú
|
ImportDatazÆHolds imported symbol's information.
|
|
ordinal: Ordinal of the symbol
|
name: Name of the symbol
|
bound: If the symbol is bound, this contains
|
the address.
|
c C sh t | drZt | drZt | drZ|dkr| jjtkr>t}n| jjtkrNt}||d@ B | j_| jj| j_ | jj| j_
|
| jj| j_ nÖ|dkrÄ| j d k rÂ|| j _ | j j | j _ | j j | j _
|
| j j | j _ n|dkrú|| j_ | jj | j_| jj | j_
|
| jj | j_ n`|dkrZ| j rZ| j | j ¡}| j | jd|B ¡ t|t| jkrJtd| j | j |¡ || j|< d S )NÚordinalÚboundr? éÿÿ Úaddressr ú9The export name provided is longer than the existing one.)r rï ÚPE_TYPEÚOPTIONAL_HEADER_MAGIC_PEÚIMAGE_ORDINAL_FLAGÚ OPTIONAL_HEADER_MAGIC_PE_PLUSÚIMAGE_ORDINAL_FLAG64Ú struct_tableÚOrdinalÚ AddressOfDataÚFunctionÚForwarderStringÚ
|
struct_iatÚ name_offsetr Úset_dword_at_offsetÚordinal_offsetrÀ r? rû Úset_bytes_at_offsetrÓ )rä r? r Ú ordinal_flagZname_rvar r r r ! sN ÿþý
|
|
ÿÿzImportData.__setattr__N©rê rë rì r r r r r r rÍ s rÍ c @ s e Zd ZdZdS )Ú ExportDirDatazHolds export directory information.
|
|
struct: IMAGE_EXPORT_DIRECTORY structure
|
symbols: list of exported symbols (ExportData instances)NrÌ r r r r rä Z s rä c @ s e Zd ZdZdd ZdS )Ú
|
ExportDataad Holds exported symbols' information.
|
|
ordinal: ordinal of the symbol
|
address: address of the symbol
|
name: name of the symbol (None if the symbol is
|
exported by ordinal only)
|
forwarder: if the symbol is forwarded it will
|
contain the name of the target symbol,
|
None otherwise.
|
c C sÐ t | drÂt | drÂt | drÂt | drÂ|dkrB| j | j|¡ n|dkr\| j | j|¡ nf|dkrt|t| jkr~td| j | j
|
|¡ n2|dkrÂt|t| j kr²td| j | j |¡ || j |< d S )NrÎ rÑ Ú forwarderr? rÒ z<The forwarder name provided is longer than the existing one.)r rï Úset_word_at_offsetrà rß Úaddress_offsetrÀ r? rû rá rÞ ræ Úforwarder_offsetrÓ ©rä r? r r r r r m s2 ÿþýüÿÿzExportData.__setattr__Nrã r r r r rå a s rå c @ s e Zd ZdZdS )ÚResourceDirDatazHolds resource directory information.
|
|
struct: IMAGE_RESOURCE_DIRECTORY structure
|
entries: list of entries (ResourceDirEntryData instances)
|
NrÌ r r r r rë s rë c @ s e Zd ZdZdS )ÚResourceDirEntryDataaF Holds resource directory entry data.
|
|
struct: IMAGE_RESOURCE_DIRECTORY_ENTRY structure
|
name: If the resource is identified by name this
|
attribute will contain the name string. None
|
otherwise. If identified by id, the id is
|
available at 'struct.Id'
|
id: the id, also in struct.Id
|
directory: If this entry has a lower level directory
|
this attribute will point to the
|
ResourceDirData instance representing it.
|
data: If this entry has no further lower directories
|
and points to the actual resource data, this
|
attribute will reference the corresponding
|
ResourceDataEntryData instance.
|
(Either of the 'directory' or 'data' attribute will exist,
|
but not both.)
|
NrÌ r r r r rì s rì c @ s e Zd ZdZdS )ÚResourceDataEntryDataz£Holds resource data entry information.
|
|
struct: IMAGE_RESOURCE_DATA_ENTRY structure
|
lang: Primary language ID
|
sublang: Sublanguage ID
|
NrÌ r r r r rí ¯ s rí c @ s e Zd ZdZdS )Ú DebugDatazHolds debug information.
|
|
struct: IMAGE_DEBUG_DIRECTORY structure
|
entries: list of entries (IMAGE_DEBUG_TYPE instances)
|
NrÌ r r r r rî ¸ s rî c @ s e Zd ZdZdS )ÚDynamicRelocationDataa Holds dynamic relocation information.
|
|
struct: IMAGE_DYNAMIC_RELOCATION structure
|
symbol: Symbol to which dynamic relocations must be applied
|
relocations: List of dynamic relocations for this symbol (BaseRelocationData instances)
|
NrÌ r r r r rï À s rï c @ s e Zd ZdZdS )ÚBaseRelocationDatazHolds base relocation information.
|
|
struct: IMAGE_BASE_RELOCATION structure
|
entries: list of relocation data (RelocationData instances)
|
NrÌ r r r r rð É s rð c @ s e Zd ZdZdd ZdS )ÚRelocationDatazÅHolds relocation information.
|
|
type: Type of relocation
|
The type string can be obtained by
|
RELOCATION_TYPE[type]
|
rva: RVA of the relocation
|
c C sj t | dr\| jj}|dkr,|d> |d@ B }n(|dkrTt|| j d}|d@ |d@ B }|| j_|| j|< d S )NrÁ ÚtyperL éÿ r r i ð )r rÁ ÚDatarâ Úbase_rvarÓ )rä r? r Úwordr6 r r r r Ú s
|
zRelocationData.__setattr__Nrã r r r r rñ Ñ s rñ c @ s e Zd ZdZdS )ÚTlsDatazJHolds TLS information.
|
|
struct: IMAGE_TLS_DIRECTORY structure
|
NrÌ r r r r r÷ ò s r÷ c @ s e Zd ZdZdS )ÚBoundImportDescDataaà Holds bound import descriptor data.
|
|
This directory entry will provide information on the
|
DLLs this PE file has been bound to (if bound at all).
|
The structure will contain the name and timestamp of the
|
DLL at the time of binding so that the loader can know
|
whether it differs from the one currently present in the
|
system and must, therefore, re-bind the PE's imports.
|
|
struct: IMAGE_BOUND_IMPORT_DESCRIPTOR structure
|
name: DLL name
|
entries: list of entries (BoundImportRefData instances)
|
the entries will exist if this DLL has forwarded
|
symbols. If so, the destination DLL will have an
|
entry in this list.
|
NrÌ r r r r rø ù s rø c @ s e Zd ZdZdS )ÚLoadConfigDataz°Holds Load Config data.
|
|
struct: IMAGE_LOAD_CONFIG_DIRECTORY structure
|
name: dll name
|
dynamic_relocations: dynamic relocation information, if present
|
NrÌ r r r r rù s rù c @ s e Zd ZdZdS )ÚBoundImportRefDatazÞHolds bound import forwarder reference data.
|
|
Contains the same information as the bound descriptor but
|
for forwarded DLLs, if any.
|
|
struct: IMAGE_BOUND_FORWARDER_REF structure
|
name: dll name
|
NrÌ r r r r rú s rú c @ s e Zd ZdZdS )ÚExceptionsDirEntryDataz¢Holds the data related to SEH (and stack unwinding, in particular)
|
|
struct an instance of RUNTIME_FUNTION
|
unwindinfo an instance of UNWIND_INFO
|
NrÌ r r r r rû s rû c st e Zd ZdZd fdd Z fddZd fdd Z fd d
|
Zd d Zd d Z fddZ
|
dd Z dd Z Z S )Ú
|
UnwindInfozHandles the complexities of UNWIND_INFO structure:
|
* variable number of UWIND_CODEs
|
* optional ExceptionHandler and FunctionEntry fields
|
r c sH t t| jd|d t t| ¡ | _d | _tddd| _d | _d| _ d S )N)Z UNWIND_INFO)z B:3,Versionz B:5,FlagszB,SizeOfPrologzB,CountOfCodeszB:4,FrameRegisterzB:4,FrameOffset©r@ ©Z UNWIND_CODE)ú B,CodeOffsetú B:4,UnwindOpú
|
B:4,OpInfor F)
|
rß rü rà rL Ú
|
_full_sizeÚ_opt_field_namer° Ú
|
_code_infoÚ_chained_entryÚ_finished_unpacking)rä r@ rå r r rà . s
|
ôþzUnwindInfo.__init__c s¾ | j r
|
dS tt| |¡ | jd d@ }tt| ¡ || j ¡ }|| jdkrTdntd | _ t
|
|| j k rrdS | j dkr| j dkrdt | j S g | _tt| ¡ }| j}|dkrZ| j |||| j ¡
¡ t | j¡}|dkrüdt | j | S | | j| ¡}| j ¡ | }| | j||||
| | j | ¡ ||7 }||8 }| j |¡ q®| jsj| jrpd | _| jr~d
|
| _| jdkr´t| | jt d |||td
¡d d | _ dS ) z§Unpacks the UNWIND_INFO "in two calls", with the first call establishing
|
a full size of the structure and the second, performing the actual unpacking.
|
Nr0 éþÿÿÿr r r; z&Unsupported version of UNWIND_INFO at zUnknown UNWIND_CODE at ZExceptionHandlerÚ FunctionEntryú<IT)r rß rü rQ Z CountOfCodesrL r ÚFlagsr( r rÀ ÚVersionÚhexr> Ú UnwindCodesÚPrologEpilogOpsFactoryÚcreateÚlength_in_code_structuresÚ
|
initializerý rj rk r rl rN rÁ r ) rä r( Z codes_cnt_maxZ hdlr_offsetÚroZ
|
codes_leftZucodeZ len_in_codesZopc_sizerå r r Úunpack_in_stagesF sb ÿÿ
|
ü ÿþýzUnwindInfo.unpack_in_stagesc s¢ j d kr0 jtd j j < j j g¡ ztt |¡}W 5 j d krZ j ¡ X | dd
|
fddt D ¡ ¡ | dd
|
dd j D ¡ ¡ |S ) Nr úFlags: ú, c s" g | ]}t |d r|d qS ©r )rR rX rã r r r4 s z#UnwindInfo.dump.<locals>.<listcomp>zUnwind codes: z; c S s g | ]}| ¡ rt|qS r )Úis_validrÌ rn r r r r4 s ) r r r( r3 r¸ rý Úpoprß rü rW r Úunwind_info_flagsr )rä rk rW rå rã r rW s&
|
ÿ
|
|
ÿÿÿÿzUnwindInfo.dumpc s^ | j d kr0| jtd | j| j < | j | j g¡ ztt| ¡ }W 5 | j d krX| j ¡ X |S )Nr )
|
r r r( r3 r¸ rý r rß rü rq )rä r¿ rå r r rq s
|
ÿ
|
|
zUnwindInfo.dump_dictc C sh |dkrt | |t nDd|krZt| |rZ|rD| jd t| O < n| jd t| N < || j|< d S )Nr
|
Z UNW_FLAG_)r× r r rÓ ÚUNWIND_INFO_FLAGSrê r r r r ¬ s zUnwindInfo.__setattr__c C s | j S r )r rã r r r rL ¶ s zUnwindInfo.sizeofc s¼ t | j}tt| ¡ |dtt| ¡
< tt| ¡ }| jD ]F}||j ¡ | jkrZ q|j ¡ ||||j ¡
< ||j ¡ 7 }q>| jd kr¸t dt
|
| | j¡|| jt d | j
< |S )Nr r r ) rÚ r rß rü rU rL r rÁ r rS rR r( )rä r( Z
|
cur_offsetZucrå r r rU ¹ s
|
|
|
þ ÿzUnwindInfo.__pack__c C s | j S r )r rã r r r Úget_chained_function_entryË s z%UnwindInfo.get_chained_function_entryc C s | j d krtd|| _ d S )Nz(Chained function entry cannot be changed)r rû )rä Úentryr r r Úset_chained_function_entryÎ s
|
z%UnwindInfo.set_chained_function_entry)r )r )rê rë rì r rà r rW rq r rL rU r r rí r r rå r rü ( s >
|
rü c @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
|
S ) ÚPrologEpilogOpzMeant as an abstract class representing a generic unwind code.
|
There is a subclass of PrologEpilogOp for each member of UNWIND_OP_CODES enum.
|
c C s$ t | |¡|d| _| j |¡ d S )Nrý )r° Ú _get_formatrÁ rQ ©rä Úunw_coder( Úunw_infor@ r r r r Ù s
|
ÿzPrologEpilogOp.initializec C s dS )zÄComputes how many UNWIND_CODE structures UNWIND_CODE occupies.
|
May be called before initialize() and, for that reason, should not rely on
|
the values of intance attributes.
|
r0 r ©rä r! r" r r r r ß s z(PrologEpilogOp.length_in_code_structuresc C s dS )NTr rã r r r r æ s zPrologEpilogOp.is_validc C s dS )Nrþ r ©rä r! r r r r é s zPrologEpilogOp._get_formatN)rê rë rì r r r r r r r r r r Ô s
|
r c @ s e Zd ZdZdd Zdd ZdS )ÚPrologEpilogOpPushRegÚUWOP_PUSH_NONVOLc C s dS )N)ZUNWIND_CODE_PUSH_NONVOL)rÿ r úB:4,Regr r$ r r r r ð s z!PrologEpilogOpPushReg._get_formatc C s dt | jj S )Nz .PUSHREG )Ú REGISTERSrÁ ÚRegrã r r r rô ó s z PrologEpilogOpPushReg.__str__N)rê rë rì r r rô r r r r r% í s r% c @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
|
S ) ÚPrologEpilogOpAllocLargeÚUWOP_ALLOC_LARGEc C s dddd|j dkrdndffS )NZUNWIND_CODE_ALLOC_LARGErÿ r r r zH,AllocSizeInQwordsz I,AllocSize©ÚOpInfor$ r r r r ú s üþz$PrologEpilogOpAllocLarge._get_formatc C s |j dkrdS dS )Nr r; r= r, r# r r r r s z2PrologEpilogOpAllocLarge.length_in_code_structuresc C s | j jdkr| j jd S | j jS )Nr rE )rÁ r- ZAllocSizeInQwordsZ AllocSizerã r r r Úget_alloc_size s
|
ÿýz'PrologEpilogOpAllocLarge.get_alloc_sizec C s dt | ¡ S ©Nz .ALLOCSTACK ©r r. rã r r r rô s z PrologEpilogOpAllocLarge.__str__N)rê rë rì r r r r. rô r r r r r* ÷ s
|
r* c @ s( e Zd ZdZdd Zdd Zdd ZdS ) ÚPrologEpilogOpAllocSmallÚUWOP_ALLOC_SMALLc C s dS )N)ZUNWIND_CODE_ALLOC_SMALL)rÿ r zB:4,AllocSizeInQwordsMinus8r r$ r r r r s z$PrologEpilogOpAllocSmall._get_formatc C s | j jd d S r¨ )rÁ ZAllocSizeInQwordsMinus8rã r r r r. s z'PrologEpilogOpAllocSmall.get_alloc_sizec C s dt | ¡ S r/ r0 rã r r r rô s z PrologEpilogOpAllocSmall.__str__N)rê rë rì r r r. rô r r r r r1 s r1 c s( e Zd ZdZ fddZdd Z ZS )ÚPrologEpilogOpSetFPÚUWOP_SET_FPREGc s. t t| ||||¡ |j| _|jd | _d S ©Nr. )rß r3 r Z FrameRegisterÚ_frame_registerZ FrameOffsetÚ _frame_offsetr rå r r r & s
|
ÿz PrologEpilogOpSetFP.initializec C s dt | j d t| j S )Nz
|
.SETFRAME r )r( r6 r r7 rã r r r rô - s ÿþýÿzPrologEpilogOpSetFP.__str__)rê rë rì r r rô rí r r rå r r3 # s r3 c @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
|
S ) ÚPrologEpilogOpSaveRegÚUWOP_SAVE_NONVOLc C s dS ©Nr; r )rä Úunwcoder" r r r r 9 s z/PrologEpilogOpSaveReg.length_in_code_structuresc C s | j jd S r¨ )rÁ ZOffsetInQwordsrã r r r Ú
|
get_offset< s z PrologEpilogOpSaveReg.get_offsetc C s dS )N)ZUNWIND_CODE_SAVE_NONVOL)rÿ r r' zH,OffsetInQwordsr r$ r r r r ? s z!PrologEpilogOpSaveReg._get_formatc C s dt | jj d t| ¡ S ©Nz .SAVEREG r )r( rÁ r) r r< rã r r r rô E s z PrologEpilogOpSaveReg.__str__N©rê rë rì r r r< r rô r r r r r8 6 s
|
r8 c @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
|
S ) ÚPrologEpilogOpSaveRegFarÚUWOP_SAVE_NONVOL_FARc C s dS ©Nr= r r# r r r r L s z2PrologEpilogOpSaveRegFar.length_in_code_structuresc C s | j jS r ©rÁ ro rã r r r r< O s z#PrologEpilogOpSaveRegFar.get_offsetc C s dS )N)ZUNWIND_CODE_SAVE_NONVOL_FAR©rÿ r r' zI,Offsetr r$ r r r r R s z$PrologEpilogOpSaveRegFar._get_formatc C s dt | jj d t| jj S r= )r( rÁ r) r ro rã r r r rô X s z PrologEpilogOpSaveRegFar.__str__Nr> r r r r r? I s
|
r? c @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
|
S ) ÚPrologEpilogOpSaveXMMÚUWOP_SAVE_XMM128c C s dS )N)ZUNWIND_CODE_SAVE_XMM128)rÿ r r' zH,OffsetIn2Qwordsr r$ r r r r _ s z!PrologEpilogOpSaveXMM._get_formatc C s dS r: r r# r r r r e s z/PrologEpilogOpSaveXMM.length_in_code_structuresc C s | j jd S r5 )rÁ ZOffsetIn2Qwordsrã r r r r< h s z PrologEpilogOpSaveXMM.get_offsetc C s dt | jj d t| ¡ S ©Nz.SAVEXMM128 XMMr )rÌ rÁ r) r r< rã r r r rô k s z PrologEpilogOpSaveXMM.__str__N©rê rë rì r r r r< rô r r r r rD \ s
|
rD c @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
|
S ) ÚPrologEpilogOpSaveXMMFarÚUWOP_SAVE_XMM128_FARc C s dS )N)ZUNWIND_CODE_SAVE_XMM128_FARrC r r$ r r r r r s z$PrologEpilogOpSaveXMMFar._get_formatc C s dS rA r r# r r r r x s z2PrologEpilogOpSaveXMMFar.length_in_code_structuresc C s | j jS r rB rã r r r r< { s z#PrologEpilogOpSaveXMMFar.get_offsetc C s dt | jj d t| jj S rF )rÌ rÁ r) r ro rã r r r rô ~ s z PrologEpilogOpSaveXMMFar.__str__NrG r r r r rH o s
|
rH c @ s e Zd ZdZdd ZdS )ÚPrologEpilogOpPushFrameÚUWOP_PUSH_MACHFRAMEc C s d| j jrdnd S )Nz
|
.PUSHFRAMEz <code>rõ )rÁ r- rã r r r rô
s z PrologEpilogOpPushFrame.__str__N)rê rë rì r rô r r r r rJ s rJ c sH e Zd ZdZ fddZdd Zdd Zdd Zd
|
d Zd d Z Z
|
S )ÚPrologEpilogOpEpilogMarkerÚ UWOP_EPILOGc s\ d| _ t|d | _tt| ||||¡ | jrPt|d| jj |j d@ dk| _ |j
|
| _ d S )NTÚ SizeOfEpilogr0 r ) Ú _long_offstr Ú_firstrß rL r rN rÁ ÚSizer- rN Ú _epilog_sizer rå r r r s
|
ÿz%PrologEpilogOpEpilogMarker.initializec C s( | j r d|jd@ dkrdndfS dS d S )NÚUNWIND_CODE_EPILOGr0 )zB,OffsetLow,Sizer ú B:4,Flags)zB,Sizer rT ú B,OffsetLowz
|
B:4,UnusedúB:4,OffsetHigh)rS )rU r rV )rP r- r$ r r r r s ÿüz&PrologEpilogOpEpilogMarker._get_formatc C s t |ds |jd@ dkr dS dS )NrN r0 r r; )r r- r# r r r r ® s ÿ ÿýz4PrologEpilogOpEpilogMarker.length_in_code_structuresc C s | j j| jr| j jd> ndB S )NrE r )rÁ Z OffsetLowrO Z
|
OffsetHighrã r r r r< µ s ÿz%PrologEpilogOpEpilogMarker.get_offsetc C s | ¡ dkS r& )r< rã r r r r º s z#PrologEpilogOpEpilogMarker.is_validc C s. | ¡ dkr*dt| j d t| ¡ S dS )Nr z EPILOG: size=z, offset from the end=-rõ )r< r rR rã r r r rô ½ s
|
üÿþ
|
ýúz"PrologEpilogOpEpilogMarker.__str__) rê rë rì r r r r r< r rô rí r r rå r rL s rL c @ sH e Zd ZdZeeeeee e
|
e e e eeeeeeeeeei
|
Zedd ZdS )r zBA factory for creating unwind codes based on the value of UnwindOpc C s | j }|tjkr tj| S d S r )ZUnwindOpr Ú _class_dict)r; Úcoder r r r Ù s
|
ÿýz PrologEpilogOpsFactory.createN)rê rë rì r r& r% r+ r* r2 r1 r4 r3 r9 r8 r@ r? rE rD rI rH rK rJ rM rL rW Ú staticmethodr r r r r r É s0 ö r z!#$%&'()-@^_`{}~+,.;=[]c s> | d kst | tttfs dS td t fddt| D S )NFs \/c 3 s | ]}| kV qd S r r rn ©Úallowedr r r ø s z(is_valid_dos_filename.<locals>.<genexpr>)rË rÌ rÍ rÚ Úallowed_filenameÚallÚset)r$ r rZ r Úis_valid_dos_filenameó s r_ )r$ Úrelax_allowed_charactersrA c s> d |r d | d k o<t | tttfo<t fddt| D S )Ns ._?@$()<>s !"#$%&'()*+,-./:<>?[\]^_`{|}~@c 3 s | ]}|t kp| kV qd S r )Úallowed_function_namern ©Z allowed_extrar r r s z)is_valid_function_name.<locals>.<genexpr>)rË rÌ rÍ rÚ r] r^ )r$ r` r rb r Úis_valid_function_name s ÿýrc c @ s¨ e Zd ZdZdZdZdZdZdZdZ dZ
|
d Z d
|
Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Z*d)d)d)e+d*fd+d,Z,d-d. Z-d/d0 Z.d1d2 Z/d3d4 Z0d5d6 Z1d7d8 Z2d9d: Z3d;d< Z4d=d> Z5d?d@ Z6dådAdBZ7dCdD Z8dædFdGZ9dHdI Z:dJdK Z;dLdM Z<dNdO Z=dPdQ Z>dRdS Z?dçdTdUZ@dVdW ZAdXdY ZBdZd[ ZCdèd]d^ZDd_d` ZEdadb ZFdcdd ZGdédedfZHdgdh ZIdidj ZJdkdl ZKdêdndoZLdpdq ZMdrds ZNdëdtduZOdìdvdwZPdídxdyZQdîd{d|ZRd}d~ ZSdïddZTdd ZUdd ZVeWfd
dZXdd ZYdd ZZdðddZ[dd Z\dd Z]dd Z^dd Z_dd Z`dñddZadòddZbdd Zcd d¡ Zdd¢d£ Zed¤d¥ Zfd¦d§ Zgd¨d© Zhdªd« Zid¬d Zjd®d¯ Zkd°d± Zld²d³ Zmd´dµ Znd¶d· Zod¸d¹ Zpdºd» Zqd¼d½ Zrd¾d¿ ZsdÀdÁ ZtdÂdà ZudÄdÅ ZvdÆdÇ ZwdÈdÉ ZxeyezdÊdËdÌZ{dÍdÎ Z|dÏdÐ Z}dÑdÒ Z~dÓdÔ ZdÕdÖ Zd×dØ ZdÙdÚ ZdÛdÜ ZdÝdÞ Zdßdà Z
dádâ Zdãdä Zd)S )óÚPEa A Portable Executable representation.
|
|
This class provides access to most of the information in a PE file.
|
|
It expects to be supplied the name of the file to load or PE data
|
to process and an optional argument 'fast_load' (False by default)
|
which controls whether to load all the directories information,
|
which can be quite time consuming.
|
|
pe = pefile.PE('module.dll')
|
pe = pefile.PE(name='module.dll')
|
|
would load 'module.dll' and process it. If the data is already
|
available in a buffer the same can be achieved with:
|
|
pe = pefile.PE(data=module_dll_data)
|
|
The "fast_load" can be set to a default by setting its value in the
|
module itself by means, for instance, of a "pefile.fast_load = True".
|
That will make all the subsequent instances not to load the
|
whole PE structure. The "full_load" method can be used to parse
|
the missing data at a later stage.
|
|
Basic headers information will be available in the attributes:
|
|
DOS_HEADER
|
NT_HEADERS
|
FILE_HEADER
|
OPTIONAL_HEADER
|
|
All of them will contain among their attributes the members of the
|
corresponding structures as defined in WINNT.H
|
|
The raw data corresponding to the header (from the beginning of the
|
file up to the start of the first section) will be available in the
|
instance's attribute 'header' as a string.
|
|
The sections will be available as a list in the 'sections' attribute.
|
Each entry will contain as attributes all the structure's members.
|
|
Directory entries will be available as attributes (if they exist):
|
(no other entries are processed at this point)
|
|
DIRECTORY_ENTRY_IMPORT (list of ImportDescData instances)
|
DIRECTORY_ENTRY_EXPORT (ExportDirData instance)
|
DIRECTORY_ENTRY_RESOURCE (ResourceDirData instance)
|
DIRECTORY_ENTRY_DEBUG (list of DebugData instances)
|
DIRECTORY_ENTRY_BASERELOC (list of BaseRelocationData instances)
|
DIRECTORY_ENTRY_TLS
|
DIRECTORY_ENTRY_BOUND_IMPORT (list of BoundImportData instances)
|
|
The following dictionary attributes provide ways of mapping different
|
constants. They will accept the numeric value and return the string
|
representation and the opposite, feed in the string and get the
|
numeric constant:
|
|
DIRECTORY_ENTRY
|
IMAGE_CHARACTERISTICS
|
SECTION_CHARACTERISTICS
|
DEBUG_TYPE
|
SUBSYSTEM_TYPE
|
MACHINE_TYPE
|
RELOCATION_TYPE
|
RESOURCE_TYPE
|
LANG
|
SUBLANG
|
)ZIMAGE_DOS_HEADER)z H,e_magiczH,e_cblpzH,e_cpzH,e_crlcz H,e_cparhdrz H,e_minallocz H,e_maxalloczH,e_sszH,e_spzH,e_csumzH,e_ipzH,e_csz
|
H,e_lfarlczH,e_ovnoz8s,e_resz H,e_oemidz H,e_oeminfoz
|
20s,e_res2z
|
I,e_lfanew)ZIMAGE_FILE_HEADER)z H,MachinezH,NumberOfSectionsúI,TimeDateStampzI,PointerToSymbolTablezI,NumberOfSymbolszH,SizeOfOptionalHeaderzH,Characteristics)ZIMAGE_DATA_DIRECTORY)úI,VirtualAddressúI,Size)ZIMAGE_OPTIONAL_HEADER) úH,MagicúB,MajorLinkerVersionúB,MinorLinkerVersionú I,SizeOfCodeúI,SizeOfInitializedDataúI,SizeOfUninitializedDataúI,AddressOfEntryPointú I,BaseOfCodez I,BaseOfDataz I,ImageBaseúI,SectionAlignmentúI,FileAlignmentú H,MajorOperatingSystemVersionú H,MinorOperatingSystemVersionúH,MajorImageVersionúH,MinorImageVersionúH,MajorSubsystemVersionúH,MinorSubsystemVersionú I,Reserved1ú I,SizeOfImageúI,SizeOfHeadersú
|
I,CheckSumú H,SubsystemúH,DllCharacteristicszI,SizeOfStackReservezI,SizeOfStackCommitzI,SizeOfHeapReservezI,SizeOfHeapCommitú I,LoaderFlagsúI,NumberOfRvaAndSizes)ZIMAGE_OPTIONAL_HEADER64) rh ri rj rk rl rm rn ro z Q,ImageBaserp rq rr rs rt ru rv rw rx ry rz r{ r| r} zQ,SizeOfStackReservezQ,SizeOfStackCommitzQ,SizeOfHeapReservezQ,SizeOfHeapCommitr~ r )ZIMAGE_NT_HEADERS)ú I,Signature)ZIMAGE_SECTION_HEADER)
|
z8s,Namez,I,Misc,Misc_PhysicalAddress,Misc_VirtualSizerf zI,SizeOfRawDataúI,PointerToRawDatazI,PointerToRelocationszI,PointerToLinenumberszH,NumberOfRelocationszH,NumberOfLinenumbersúI,Characteristics)Z IMAGE_DELAY_IMPORT_DESCRIPTOR)z I,grAttrszI,szNamezI,phmodzI,pIATzI,pINTz I,pBoundIATz I,pUnloadIATz I,dwTimeStamp)ZIMAGE_IMPORT_DESCRIPTOR)z$I,OriginalFirstThunk,Characteristicsre zI,ForwarderChainúI,Namez I,FirstThunk)ZIMAGE_EXPORT_DIRECTORY) r re úH,MajorVersionúH,MinorVersionr zI,BasezI,NumberOfFunctionszI,NumberOfNameszI,AddressOfFunctionszI,AddressOfNameszI,AddressOfNameOrdinals)ZIMAGE_RESOURCE_DIRECTORY)r re r r
zH,NumberOfNamedEntrieszH,NumberOfIdEntries)Z IMAGE_RESOURCE_DIRECTORY_ENTRY)r úI,OffsetToData)ZIMAGE_RESOURCE_DATA_ENTRY)r rg z
|
I,CodePagez
|
I,Reserved)ÚVS_VERSIONINFO©zH,Lengthz H,ValueLengthzH,Type)ÚVS_FIXEDFILEINFO) r zI,StrucVersionzI,FileVersionMSzI,FileVersionLSzI,ProductVersionMSzI,ProductVersionLSzI,FileFlagsMaskz I,FileFlagszI,FileOSz
|
I,FileTypez I,FileSubtypez I,FileDateMSz I,FileDateLS)ZStringFileInfor )Ú StringTabler )ÚStringr )ÚVarr )ÚIMAGE_THUNK_DATA)z0I,ForwarderString,Function,Ordinal,AddressOfData)r )z0Q,ForwarderString,Function,Ordinal,AddressOfData)ZIMAGE_DEBUG_DIRECTORY)r re r r
zI,Typez I,SizeOfDatazI,AddressOfRawDatar )ZIMAGE_BASE_RELOCATION)rf z I,SizeOfBlock)ZIMAGE_BASE_RELOCATION_ENTRY)zH,Data)Z0IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION)úI:12,PageRelativeOffsetúI:1,IndirectCallz I:19,IATIndex)Z/IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION)r r zI:1,RexWPrefixz I:1,CfgCheckz I:1,Reserved)Z+IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION)r zI:4,RegisterNumber)ÚIMAGE_TLS_DIRECTORY)zI,StartAddressOfRawDatazI,EndAddressOfRawDatazI,AddressOfIndexzI,AddressOfCallBacksúI,SizeOfZeroFillr )r )zQ,StartAddressOfRawDatazQ,EndAddressOfRawDatazQ,AddressOfIndexzQ,AddressOfCallBacksr r )ÚIMAGE_LOAD_CONFIG_DIRECTORY)+rg re r r
úI,GlobalFlagsClearúI,GlobalFlagsSetú I,CriticalSectionDefaultTimeoutz I,DeCommitFreeBlockThresholdz I,DeCommitTotalFreeThresholdzI,LockPrefixTablezI,MaximumAllocationSizezI,VirtualMemoryThresholdúI,ProcessHeapFlagszI,ProcessAffinityMaskú H,CSDVersionú H,Reserved1z
|
I,EditListzI,SecurityCookiezI,SEHandlerTablezI,SEHandlerCountz I,GuardCFCheckFunctionPointerz I,GuardCFDispatchFunctionPointerzI,GuardCFFunctionTablezI,GuardCFFunctionCountú I,GuardFlagsúH,CodeIntegrityFlagsúH,CodeIntegrityCatalogú I,CodeIntegrityCatalogOffsetúI,CodeIntegrityReservedz I,GuardAddressTakenIatEntryTablez I,GuardAddressTakenIatEntryCountzI,GuardLongJumpTargetTablezI,GuardLongJumpTargetCountzI,DynamicValueRelocTablezI,CHPEMetadataPointerzI,GuardRFFailureRoutinez&I,GuardRFFailureRoutineFunctionPointerú I,DynamicValueRelocTableOffsetú H,DynamicValueRelocTableSectionú H,Reserved2z?I,GuardRFVerifyStackPointerFunctionPointerI,HotPatchTableOffsetú I,Reserved3z I,EnclaveConfigurationPointer)r ),rg re r r
r r r z Q,DeCommitFreeBlockThresholdz Q,DeCommitTotalFreeThresholdzQ,LockPrefixTablezQ,MaximumAllocationSizezQ,VirtualMemoryThresholdzQ,ProcessAffinityMaskr r r z
|
Q,EditListzQ,SecurityCookiezQ,SEHandlerTablezQ,SEHandlerCountz Q,GuardCFCheckFunctionPointerz Q,GuardCFDispatchFunctionPointerzQ,GuardCFFunctionTablezQ,GuardCFFunctionCountr r r r r z Q,GuardAddressTakenIatEntryTablez Q,GuardAddressTakenIatEntryCountzQ,GuardLongJumpTargetTablezQ,GuardLongJumpTargetCountzQ,DynamicValueRelocTablezQ,CHPEMetadataPointerzQ,GuardRFFailureRoutinez&Q,GuardRFFailureRoutineFunctionPointerr r r z*Q,GuardRFVerifyStackPointerFunctionPointerzI,HotPatchTableOffsetr¡ z Q,EnclaveConfigurationPointer)Z IMAGE_DYNAMIC_RELOCATION_TABLE)z I,Versionrg )ZIMAGE_DYNAMIC_RELOCATION)úI,SymbolúI,BaseRelocSize)ZIMAGE_DYNAMIC_RELOCATION64)úQ,Symbolr£ )ZIMAGE_DYNAMIC_RELOCATION_V2)ú I,HeaderSizeúI,FixupInfoSizer¢ ú I,SymbolGroupúI,Flags)Z IMAGE_DYNAMIC_RELOCATION64_V2)r¥ r¦ r¤ r§ r¨ )Z IMAGE_BOUND_IMPORT_DESCRIPTOR)re úH,OffsetModuleNamez H,NumberOfModuleForwarderRefs)ZIMAGE_BOUND_FORWARDER_REF)re r© z
|
H,Reserved)ZRUNTIME_FUNCTION)zI,BeginAddressz I,EndAddressz I,UnwindDataNéx c C s¾ || _ || _d | _g | _g | _d | _|d kr<|d kr<tdg | _d | _d| _ d| _
|
d| _ d| _ d| _ tjtjtjd| _|d k r|nt d }z| |||¡ W n | ¡ Y nX d S )Nz Must supply either name or dataFr )r= r? rA Ú fast_load)Úmax_symbol_exportsÚmax_repeated_symbolÚ _get_section_by_rva_last_usedÚsectionsÚ _PE__warningsrÓ ri Ú__structures__Ú_PE__from_fileÚFileAlignment_WarningÚSectionAlignment_WarningÚ!_PE__total_resource_entries_countÚ_PE__total_resource_bytesÚ_PE__total_import_symbolsrd Ú;__IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION_format__Ú:__IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION_format__Ú6__IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION_format__Ú#dynamic_relocation_format_by_symbolÚglobalsÚ __parse__Úclose)rä r? r( r« r¬ r r r r rà s2 ýz PE.__init__c C s | S r r rã r r r Ú __enter__T s z PE.__enter__c C s | ¡ d S r )r¾ )rä rò rÖ Ú tracebackr r r Ú__exit__W s z PE.__exit__c C sR | j dkrNt| drNttjtr.t| jtjs@dtt| jkrN| j ¡ | `d S )NTr z mmap.mmap)r² r rË Úmmaprò r r r¾ rã r r r r¾ Z s ÿþ
|
ü üû
|
zPE.closec
|
C sn t ||d}z| |¡ W nB tk
|
r\ } z$| j d |d ||¡¡ W Y ¢dS d}~X Y nX | j |¡ |S ©zyApply structure format to raw data.
|
|
Returns an unpacked structure object if successful, None otherwise.
|
rý z7Corrupt header "{0}" at file offset {1}. Exception: {2}r N)r; rQ rû r° rý rþ r± ©rä rþ r( r@ Ú structureÚerrr r r Ú__unpack_data__f s ÿÿ zPE.__unpack_data__c
|
C sn t ||d}z| |¡ W nB tk
|
r\ } z$| j d |d ||¡¡ W Y ¢dS d}~X Y nX | j |¡ |S rà )r° rQ rû r° rý rþ r± rÄ r r r Ú __unpack_data_with_bitfields__| s ÿÿ z!PE.__unpack_data_with_bitfields__c
|
s& |dk ràt |¡}|jdkr$tdd}z¢zTt|d}| ¡ _ttdr`t jdtj ¡ _
|
ntj jdtj d _
|
d _ W nH t k
|
rÆ } z*d |¡}|o¤d | }td
|
||¡W 5 d}~X Y nX W 5 |dk rÜ| ¡ X n|dk rô| _
|
d _ t j
|
_d _|stt j
|
¡ D ]h\}} |dkrD| t j
|
d ksb|dkr | t j
|
d kr j d |d| t j
|
¡¡ q j
|
dd
}
|
t|
|
dkr¬td j j|
|
dd _ jjt krÖtd jrì jjt krôtd jj t j
|
krtd jj } j j j
|
| | d
| d _ j rL j j!sTtdd j j!@ t"krntdd j j!@ t#krtdd j j!@ t$kr¢tdd j j!@ t%kr¼td j j!t&krÒtd j j' j
|
| d | d d
| d d _(t)t*d } j(std!t+ j( j(j,| | d j( -¡ } | j(j. } j j/ j
|
| | d"
| d _0d#} j0dkrÊt j
|
| | d$
|krÊd%} j
|
| | d$
d&| } j j/|| d _0 j0dk r j0j1t2krìt2 _3n j0j1t4krt4 _3 j j5 j
|
| | d$
| d _0d'} j0dkrt j
|
| | d$
|krd%} j
|
| | d$
d&| } j j5|| d _0 j(std! j0dkr¤td( j3dkrÆ j d) j0j1¡¡ t)t6d*}t+ j0 j0j7| g j0_8| j0 -¡ } j( j _( j0 j _0 j0j9 j0j:k r* j d+¡ j0j;d,krL j d- j0j; ¡ d"}t<t=d. j0j;@ D ]æ}t j
|
| dkr qLt j
|
| dk rª j
|
|d
d/ }n j
|
|||
} j j>||d}|dkrÞ qLzt?| |_@W n" tAtBfk
|
r Y qLY nX || -¡ 7 } j0j8 |¡ || j0 -¡ d% krd qLqd C|¡} fd0d1 jDD }t|dkrtE|}nd}|r||k r¨ j
|
d|
_Fn j
|
d|
_F G j0j9¡dk r H j0j9¡}|t j
|
kr j d2 j0j9 ¡ n j d3 j0j9 ¡ |s" I¡ dS )4z¤Parse a Portable Executable file.
|
|
Loads a PE file, parsing all its structures and making them available
|
through the instance's attributes.
|
Nr zThe file is emptyÚrbÚ MAP_PRIVATE)ÚaccessTr z: %sz Unable to access file '{0}'{1}Fg à?g333333Ã?zeByte 0x{0:02x} makes up {1:.4f}% of the file's contents. This may indicate truncation / malformation.g Y@rR z9Unable to read the DOS Header, possibly a truncated file.rý z)Probably a ZM Executable (not a PE file).zDOS Header magic not found.z.Invalid e_lfanew value, probably not a PE filerE zNT Headers not found.rÐ z0Invalid NT Headers signature. Probably a NE filez0Invalid NT Headers signature. Probably a LE filez0Invalid NT Headers signature. Probably a LX filez0Invalid NT Headers signature. Probably a TE filez Invalid NT Headers signature.r? r- Ú IMAGE_FILE_zFile Header missingrS r} r r
|
r` r z5No Optional Header found, invalid PE32 or PE32+ file.z*Invalid type 0x{0:04x} in Optional Header.ÚIMAGE_DLLCHARACTERISTICS_zXSizeOfHeaders is smaller than AddressOfEntryPoint: this file cannot run under Windows 8.r. zsSuspicious NumberOfRvaAndSizes in the Optional Header. Normal values are never larger than 0x10, the value is: 0x%xéÿÿÿs c s( g | ] }|j d kr |j jj¡qS r )rs r{ r| r} rX rã r r r4 Ò s
|
ü ÿz PE.__parse__.<locals>.<listcomp>z[Possibly corrupt file. AddressOfEntryPoint lies outside the file. AddressOfEntryPoint: 0x%xzTAddressOfEntryPoint lies outside the sections' boundaries. AddressOfEntryPoint: 0x%x)JÚosÚstatÚst_sizerû r¾ ÚopenÚfilenor r rÊ r Z ACCESS_READr² ÚIOErrorrþ Ú ExceptionrÀ Ú$_PE__resource_size_limit_upperboundsÚ _PE__resource_size_limit_reachedr rÚ rÊ r° rý rÇ Ú__IMAGE_DOS_HEADER_format__Ú
|
DOS_HEADERZe_magicÚIMAGE_DOSZM_SIGNATUREÚIMAGE_DOS_SIGNATUREZe_lfanewÚ__IMAGE_NT_HEADERS_format__Ú
|
NT_HEADERSr_ ÚIMAGE_NE_SIGNATUREÚIMAGE_LE_SIGNATUREÚIMAGE_LX_SIGNATUREÚIMAGE_TE_SIGNATUREÚIMAGE_NT_SIGNATUREÚ __IMAGE_FILE_HEADER_format__Ú FILE_HEADERrÒ ÚIMAGE_CHARACTERISTICSr× r
rL ÚSizeOfOptionalHeaderÚ __IMAGE_OPTIONAL_HEADER_format__r| ZMagicrÔ rÓ rÖ Ú"__IMAGE_OPTIONAL_HEADER64_format__ÚDLL_CHARACTERISTICSÚDllCharacteristicsÚDATA_DIRECTORYZAddressOfEntryPointZ SizeOfHeadersZNumberOfRvaAndSizesrº r Ú __IMAGE_DATA_DIRECTORY_format__ÚDIRECTORY_ENTRYr? ÚKeyErrorÚAttributeErrorÚparse_sectionsr¯ rá ÚheaderÚget_section_by_rvar Ú full_load)rä Úfnamer( r« rÐ ÚfdÚexcpZ exception_msgÚbyteZ
|
byte_countZdos_header_dataZnt_headers_offsetÚ image_flagsZoptional_header_offsetZsections_offsetZ&MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZEÚpadding_lengthZ padded_dataÚdll_characteristics_flagsr6 Z)MAX_ASSUMED_VALID_NUMBER_OF_RVA_AND_SIZESrÈ Ú dir_entryZrawDataPointersZlowest_section_offsetZ ep_offsetr rã r r½ sà
|
|
|
|
|
|
|
|
ÿ ÿÿÿ ýÿÿ ÿý
|
ý
|
üÿÿýþ
|
ÿþý ÿû ÿ ÿÿûþ
|
ÿþý ÿÿ ÿý
|
|
ÿÿÿþÿ ÿ ÿ
|
ÿ
|
|
|
ü
|
ÿÿÿþÿÿÿz PE.__parse__c C s
|
d}d}| j dd| j ¡ ¡}|dkr*dS zb| j d|d
}|ddtt|d
}tt d tt|d ¡|¡}||krW dS W n t
|
k
|
r¢ Y dS X t d
|
|| |¡d ¡}d |i}|d| d¡
}||d < dd } t }
|
t|D ]*\} } |
|
| | | || t| A ¡ qöt|
|
|d< |d } |d | A |ksd|d | ksd|d | krhdS | |d< g }||d< |dd
}ttt|d D ]h}|d| |krÚ|d| d | krÔ| j d¡ q||d| | A |d| d | A g7 }q|S )a" Parses the rich header
|
see http://www.ntcore.com/files/richsign.htm for more information
|
|
Structure:
|
00 DanS ^ checksum, checksum, checksum, checksum
|
10 Symbol RVA ^ checksum, Symbol size ^ checksum...
|
...
|
XX Rich, checksum, 0, 0,...
|
iDanSiRichs Richr
|
éÿÿÿÿNrE r? z<{0}Iú<Lr0 rP Úraw_datac S s t | tst| S | S r rm )r r r r Ú<lambda>0 ó z&PE.parse_rich_header.<locals>.<lambda>Ú
|
clear_datar r; r= Úchecksumr zRich Header is malformed)r Úfindr| rH r rÀ ÚlistrÁ r rþ rû rS ÚindexrÚ rM rý rÍ rº r° )rä ZDANSZRICHZ
|
rich_indexZ rich_datar( rP Úresultrþ Zord_r rO r r Z headervaluesrÈ r r r Úparse_rich_header sT ÿ ÿ
|
$ . ,zPE.parse_rich_headerc C s | j S )zºReturn the list of warnings.
|
|
Non-critical problems found when parsing the PE file are
|
appended to a list of warnings. This method returns the
|
full list.
|
)r° rã r r r rü S s zPE.get_warningsc C s | j D ]}td| qdS )zËPrint the list of warnings.
|
|
Non-critical problems found when parsing the PE file are
|
appended to a list of warnings. This method prints the
|
full list to standard output.
|
ú>N)r° Úprint)rä Úwarningr r r Ú show_warnings] s
|
zPE.show_warningsc C s | ¡ G dd d}| ¡ }|r|| | _| dd¡| j_| dd¡| j_| dd¡| j_| dd¡| j_| dd¡| j_nd| _dS ) z§Process the data directories.
|
|
This method will load the data directories which might not have
|
been loaded if the "fast_load" option was used.
|
c @ s e Zd ZdS )z PE.full_load.<locals>.RichHeaderN)rê rë rì r r r r Ú
|
RichHeaderq s r r Nr rP rþ r ) Úparse_data_directoriesr Ú RICH_HEADERrº r r rP rþ r )rä r Z rich_headerr r r ró h s z PE.full_loadc
|
C sZ t | j}| jD ],}t | ¡ }| ¡ }||||t|
< qt| dr,t| dr,| jD ]Î}|D ]Ä}t|drd|jD ]®}t |j
|
¡ D ]\} }|j | }
|
|j | } t|| d krø| d¡ d¡} | d| d d
||
|
d |
|
d | d d
< q| d¡ d¡} | ||
|
d |
|
d t|
< qqxqdq\|}|s:|S t|d }| |¡ | ¡ dS )
|
a
Write the PE file.
|
|
This function will process all headers and components
|
of the PE file and include all changes made (by just
|
assigning to attributes in the PE objects) and write
|
the changes back to a file whose name is provided as
|
an argument. The filename is optional, if not
|
provided the data will be returned as a 'str' object.
|
r ÚFileInfor r0 ró r¿ Nr; zwb+)rÚ r r± rU rH rÀ r r r r ÚentriesrÊ Úentries_offsetsÚentries_lengthsrÄ rÜ rÒ Úwriter¾ )rä ÚfilenameZ file_datarÅ Z struct_datar6 Úfinfor Úst_entryrP ÚoffsetsÚlengthsrÇ Z encoded_dataZ new_file_datar r r r r sH
|
|
|
|
|
|
|
þ ÿ
|
ÿþ ÿ
|
|
zPE.writec
|
C s g | _ d}t| jjD ]t}|tkrB| j d | jjt¡¡ qd}t| j | d}|s^ q||
|
¡ | }| |¡ | j |||
|
¡
}t ||
|
¡ kr¸| j d| d¡ q|sÖ| j d| d¡ q| |¡ | j |¡ |j|j t| j kr |d7 }| j d | d
|
¡ | |j| jj¡t| j krZ|d7 }| j d | d ¡ |jd kr|d7 }| j d | d¡ | |j| jj| jj¡d kr¼|d7 }| j d | d¡ | jjdkrú|j| jj dkrú|d7 }| j d | d¡ ||kr| j d¡ qttd}t ||j | |j dd¡r|j dd¡r|j !d¡dkrl| "¡ rln| j d| d¡ | j |¡ q| j j#dd d t$| j D ]8\} }| t| j d krÎd |_%n| j | d j|_%qª| jjdkr| j r|| j d
|
¡ | jj S |S d S ) a Fetch the PE file sections.
|
|
The sections will be readily available in the "sections" attribute.
|
Its attributes will contain all the section information plus "data"
|
a buffer containing the section's data.
|
|
The "Characteristics" member will be processed and attributes
|
representing the section characteristics (with the 'IMAGE_SCN_'
|
string trimmed from the constant's names) will be added to the
|
section instance.
|
|
Refer to the SectionStructure class for additional info.
|
r= z Too many sections {0} (>={1})r )rï zInvalid section z. Contents are null-bytes.z8. No data in the file (is this corkami's virtsectblXP?).r0 zError parsing section z$. SizeOfRawData is larger than file.z5. PointerToRawData points beyond the end of the file.rZ z'Suspicious value found parsing section z*. VirtualSize is extremely large > 256MiB.z&. VirtualAddress is beyond 0x10000000.z. PointerToRawData should normally be a multiple of FileAlignment, this might imply the file is trying to confuse tools which parse this incorrectly.z,Too many warnings parsing section. Aborting.r r\ Fr[ r` s PAGEz!Suspicious flags set for section zf. Both IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE are set. This might indicate a packed executable.c S s | j S r )rt )Úar r r rÿ 4 r z#PE.parse_sections.<locals>.<lambda>)rP N)&r¯ rº rä ZNumberOfSectionsÚ MAX_SECTIONSr° rý rþ rr Ú __IMAGE_SECTION_HEADER_format__rL rJ r r) rQ r± ru rs rÀ r{ r| r} rv r rt r rÒ r r× r
rÓ rº ÚNamerj Ú is_driverÚsortrM r )
|
rä r6 ZMAX_SIMULTANEOUS_ERRORSrÈ Zsimultaneous_errorsÚsectionZsection_offsetZ section_datar rO r r r rð ¶ sÆ ÿÿ
|
|
ÿ
|
ÿ
|
|
ÿ ÿþ
|
ÿ
|
ÿýûÿ
|
ÿ
|
ÿþ
|
þ
|
|
ÿ þ
|
ÿÿ ÿzPE.parse_sectionsFc
|
C sÊ d| j fd| jfd| jfd| jfd| jfd| jfd| jfd| jfd | jfd
|
| j ff
|
}|d k rpt
|
|t t fsp|g}|D ]N}z t |d }| jj| }W n tk
|
r² Y qÆY nX |d ksÆ||krd }|jr|rú|d dkrú|d |j|jdd}n|r&|d dkr&|d |j|jdd}nXz|d |j|j}W n@ tk
|
r| } z | j d|d d| ¡ W 5 d } ~ X Y nX |rt| |d dd
| |d k rtt
|
|t rt|d |krt| |¡ qtd S )aS Parse and process the PE file's data directories.
|
|
If the optional argument 'directories' is given, only
|
the directories at the specified indexes will be parsed.
|
Such functionality allows parsing of areas of interest
|
without the burden of having to parse all others.
|
The directories can then be specified as:
|
|
For export / import only:
|
|
directories = [ 0, 1 ]
|
|
or (more verbosely):
|
|
directories = [ DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
|
DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'] ]
|
|
If 'directories' is a list, the ones that are processed will be removed,
|
leaving only the ones that are not present in the image.
|
|
If `forwarded_exports_only` is True, the IMAGE_DIRECTORY_ENTRY_EXPORT
|
attribute will only contain exports that are forwarded to another DLL.
|
|
If `import_dllnames_only` is True, symbols will not be parsed from
|
the import table and the entries in the IMAGE_DIRECTORY_ENTRY_IMPORT
|
attribute will not have a `symbols` attribute.
|
r9 r8 r: rB r@ rF rH rM rJ r< Nr r0 T)Úforwarded_only)Ú dllnames_onlyz Failed to process directoty "z": rC )Úparse_import_directoryÚparse_export_directoryÚparse_resources_directoryÚparse_debug_directoryÚparse_relocations_directoryÚparse_directory_tlsÚparse_directory_load_configÚ parse_delay_import_directoryÚ parse_directory_bound_importsÚparse_exceptions_directoryrË r< r rí r| rë Ú
|
IndexErrorrt rQ rû r° rý rN Úremove)
|
rä Ú directoriesZforwarded_exports_onlyZimport_dllnames_onlyZdirectory_parsingr Zdirectory_indexrû rÖ rö r r r r D sp ö
|
ÿ
|
þýÿ
|
þ ÿÿÿþ
|
ýzPE.parse_data_directoriesc C s, | j jtd kr$| j jtd kr$dS t| j}| ¡ }i }g }i }t|| D ]}| j| j| ||¡| |¡d}|dkr qdd} |j
|
d@ dkr:|j
|
|kr¬||j
|
} n t | |j
|
¡d} | ||j
|
< | | |j
|
| ¡ ¡¡}
|
|
|
dkrú| j |
|
¡ qd| | |j
|
| ¡ ¡¡}
|
|
|
dkr.| j |
|
¡ qd| j | ¡ t|| d} | | ¡ | ||j< ||7 }qN|D ]¾}|jdkr|qht|jdsqh|jj|kr¼| j d |j ¡ d
|
d ¡ qhz|j ||jj ¡ W nN tk
|
r" } z.| j d |j ¡ d
|
d | ¡ W Y ¢qhW 5 d} ~ X Y nX qh|S )zØParses exception directory
|
|
All the code related to handling exception directories is documented in
|
https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details
|
rc ra Nrý r0 r )rÁ Ú
|
unwindinfor z FunctionEntry of UNWIND_INFO at rÝ z' points to an entry that does not existz/Failed parsing FunctionEntry of UNWIND_INFO at z: )rä ÚMachineÚ MACHINE_TYPEr; Ú__RUNTIME_FUNCTION_format__rL rº rÇ r r Z
|
UnwindDatarü r r° rý r± rû Z BeginAddressr/ r r rÁ rH r rû ) rä r r ÚrfZrf_sizeZrva2rtZrt_funcsZ rva2infosrµ ZuiÚwsr rö r r r r+ ¦ st ÿþ
|
|
ýÿ
|
|
|
|
|
ÿ
|
ÿÿ z PE.parse_exceptions_directoryc sB t | j}| ¡ }|}g }| j| j| j|||
|d}|dkrR| j d¡ dS | ¡ r^q>|| ¡ 7 }| |¡}| |¡ |dkrÒt
|
| j } fdd| j D } | rèt | }
|
| |
|
¡}|dk rè|j }n|j t
|
| ¡ }|s| j d |¡¡ dS g } tt |jt|d D ]¨} | j| j| j|||
|d} | sRtd|| ¡ 7 }|| j }| d | j||t
¡}|r´d
|
d t|D }t
|
|d ks®|r´ qÊ| t| |d ¡ q ||j }| d | j||t
¡}|r d d t|D }t
|
|d ks>|r q>|s(q>| t||| d¡ q|S )rõ rý Nz7The Bound Imports directory exists but can't be parsed.c s g | ]}|j kr|j qS r )rs rX rý r r r4 " s
|
þz4PE.parse_directory_bound_imports.<locals>.<listcomp>zHRVA of IMAGE_BOUND_IMPORT_DESCRIPTOR points to an invalid address: {0:x}rE z(IMAGE_BOUND_FORWARDER_REF cannot be readr c S s g | ]}t |tjkr|qS r rl rn r r r r4 W s rS )rÁ r? c S s g | ]}t |tjkr|qS r rl rn r r r r4 g s )rÁ r? r )r; Ú(__IMAGE_BOUND_IMPORT_DESCRIPTOR_format__rL rÇ r r° rý rK Úget_section_by_offsetr rÀ r¯ rá rs r rþ rº ZNumberOfModuleForwarderRefsr Ú$__IMAGE_BOUND_FORWARDER_REF_format__rû ZOffsetModuleNameÚget_string_from_dataÚMAX_STRING_LENGTHrÚ rú rø )rä r r Z bnd_descrZbnd_descr_sizer Z bound_importsr Úsafety_boundaryZsections_after_offsetZfirst_section_after_offsetZforwarder_refsrµ Z bnd_frwd_refr6 Zname_strZ invalid_charsr rý r r* s¬
|
ýÿ
|
|
|
þ
|
ÿÿýÿÿý
|
ÿ ÿ
|
ÿ
|
ÿÿ ÿÿz PE.parse_directory_bound_importsc C s| | j }| jtkr| j}z*| j|| |t| ¡ ¡| |¡d}W n( t k
|
rh | j
|
d| ¡ d}Y nX |srdS t |dS )rõ rý z5Invalid TLS information. Can't read data at RVA: 0x%xN)rÁ ) Ú __IMAGE_TLS_DIRECTORY_format__rÓ rÖ Ú __IMAGE_TLS_DIRECTORY64_format__rÇ r r; rL r rû r° rý r÷ )rä r r rþ Z
|
tls_structr r r r' w s"
|
ý
|
ÿ
|
zPE.parse_directory_tlsc
|
C s& | j tkr | |¡}| j}n,| j tkr8| |¡}| j}n| j d¡ dS d}d}|d D ].}|d7 }|t| d¡d 7 }||krX qqX|d |d d|
f}d}z*| j
|
|| |t | ¡ ¡| |¡d}W n$ tk
|
rò | j d| ¡ Y nX |südS d} |dkr| |j|j¡} t|| d S )
|
rõ zGDon't know how to parse LOAD_CONFIG information for non-PE32/PE32+ fileNr r0 r, rý z=Invalid LOAD_CONFIG information. Can't read data at RVA: 0x%xr| )rÁ Údynamic_relocations)rÓ rÔ Úget_dword_at_rvaÚ&__IMAGE_LOAD_CONFIG_DIRECTORY_format__rÖ Ú(__IMAGE_LOAD_CONFIG_DIRECTORY64_format__r° rý r( r/ rÇ r r; rL r rû Úparse_dynamic_relocationsZ DynamicValueRelocTableOffsetZ DynamicValueRelocTableSectionrù )
|
rä r r Zload_config_dir_szrþ Zfields_counterZ cumulative_szÚfieldZload_config_structr= r r r r( sR
|
|
|
|
ÿ ý
|
ÿ
|
|
þ ÿz PE.parse_directory_load_configc C sÞ |sd S |sd S |t | jkr"d S | j|d }|j| }d }t| j ¡ }z$| j| j| ||¡| |¡d}W n$ t k
|
r | j
|
d| ¡ Y nX |j dkr´| j
|
d|j ¡ d S ||7 }||j }g }||k rÚ| j} | jtkrê| j} t| ¡ }
|
z"| j| | ||
|
¡| |¡d} W n* t k
|
rB | j
|
d| ¡ d } Y nX | sNqÚ||
|
7 }| j} | j} d| krzdkr¦n n(| || | j| ¡}| t| | |d¡ | dkrÐ| || ¡}| t| | |d¡ || 7 }qÊ|S ) Nr0 rý zPInvalid IMAGE_DYNAMIC_RELOCATION_TABLE information. Can't read data at RVA: 0x%xzDNo pasring available for IMAGE_DYNAMIC_RELOCATION_TABLE.Version = %dú<Invalid relocation information. Can't read data at RVA: 0x%xr= rA )rÁ ÚsymbolÚ relocations)rÀ r¯ rt r; Ú)__IMAGE_DYNAMIC_RELOCATION_TABLE_format__rL rÇ r r rû r° rý r rQ Ú#__IMAGE_DYNAMIC_RELOCATION_format__rÓ rÖ Ú%__IMAGE_DYNAMIC_RELOCATION64_format__ZSymbolZ BaseRelocSizeÚ parse_image_base_relocation_listr» rï )rä Z dynamic_value_reloc_table_offsetZ!dynamic_value_reloc_table_sectionr r Z image_dynamic_reloc_table_structZreloc_table_sizer r= rþ Úrlc_sizeZ dynamic_rlcrD r rE r r r rA È s
|
ÿ
|
ý
|
ÿÿ
|
|
þ
|
|
|
|
ý
|
ÿÿ
|
ÿ ÿÿ
|
ÿÿ
|
z PE.parse_dynamic_relocationsc C s | ||¡S )rõ )rI )rä r r r r r r& " s z PE.parse_relocations_directoryc C s0 t | j ¡ }|| }g }||k r,z$| j| j| ||¡| |¡d}W n( tk
|
rp | j d| ¡ d }Y nX |szq,|j | j
|
j kr| j d|j ¡ q,|j | j
|
j krÂ| j d|j ¡ q,|d kræ| || |j |j | ¡}n | || |j |j | |¡}| t||d¡ |j s q,||j 7 }q|S )Nrý rC zEInvalid relocation information. VirtualAddress outside of Image: 0x%xz9Invalid relocation information. SizeOfBlock too large: %d©rÁ r )r; Ú __IMAGE_BASE_RELOCATION_format__rL rÇ r r rû r° rý rt r| Ú SizeOfImageZ SizeOfBlockÚparse_relocationsÚ parse_relocations_with_formatrð ) rä r r r¥ rJ r rE ZrlcZ reloc_entriesr r r rI ' sd
|
|
ý
|
ÿÿ
|
ÿÿÿÿ ÿ ÿ z#PE.parse_image_base_relocation_listc C s z| ||¡}| |¡}W n, tk
|
rF | j d|d¡ g Y S X g }t }ttt|d D ]¤}| j | j
|
||d |d d
|d} | s q | j }
|
|
|
d? } |
|
d@ } | | f|krÖ| j d| | ¡ q | | | f¡ | t | | || | d ¡ || ¡ 7 }qf|S )
|
rõ ú Bad RVA in relocation data: 0xrÝ r; r0 rý rL ró ú3Overlapping offsets in relocation data at RVA: 0x%x)rÁ rò rõ r )r r rû r° rý r^ rº r rÀ rÇ Ú&__IMAGE_BASE_RELOCATION_ENTRY_format__rô rç rñ rL ) rä Údata_rvar r r( r@ r Zoffsets_and_typerO r rö Z
|
reloc_typeÚ reloc_offsetr r r rN d sJ
|
ý ÿÿ ÿÿzPE.parse_relocationsc C sø z| ||¡}| |¡}W n, tk
|
rF | j d|d¡ g Y S X t| ¡ }g }t } tt t
|
|| D ]}
|
| j |||
|
| |
|
d |
|d} | s¢ qô| j } | | krÈ| j d| | ¡ qô| | ¡ | t| || | d¡ ||7 }qr|S )rõ rP rÝ r0 rý rQ )rÁ rõ r )r r rû r° rý r° rL r^ rº r rÀ rÈ ZPageRelativeOffsetrç rñ ) rä rS r r rþ r( r@ Z
|
entry_sizer r rO r rT r r r rO s>
|
ýÿÿ
|
ÿ
|
z PE.parse_relocations_with_formatc
|
C sª t | j ¡ }g }tt|| D ]}z| ||| |¡}W n( tk
|
rh | j d| ¡ Y dS X | j | j||
|
||| ¡d}|s dS d}|j dkr¦nì|j dkrú|j } |j }
|
| j| | |
|
} | dd
dkrdd d
|
d d d dddgg} |
|
t | ¡ } | dkr(| d d | ¡¡ | | | | ¡}|dk røt dd|j ¡d |_ttj|j|j|j|j|j|jfd dd ¡ ¡ |j d |_ n^| dd
dkrdddd dgg}|
|
t | ¡ } | dkrê|d d | ¡¡ | || | ¡}n|j dkr|j } |j }
|
| j| | |
|
} d d d d d!d"gg}| || | ¡}|r|j d#kr|
|
t | ¡ }|dkr|d d$ |¡¡ | || | ¡}| t!||d%¡ q"|S )&rõ z7Invalid debug information. Can't read data at RVA: 0x%xNrý r0 r; r? s RSDSZ CV_INFO_PDB70z4s,CvSignaturezI,Signature_Data1zH,Signature_Data2zH,Signature_Data3zB,Signature_Data4zB,Signature_Data5z6s,Signature_Data6zI,Ager z{0}s,PdbFileNamez>Qó )Úfieldsú-ÚXs NB10Z CV_INFO_PDB20zI,CvHeaderSignaturezI,CvHeaderOffsetr ZIMAGE_DEBUG_MISCz
|
I,DataTypezI,Lengthz B,Unicodez B,Reserved1r ©r r0 z {0}s,Data)rÁ r )"r; Ú __IMAGE_DEBUG_DIRECTORY_format__rL rº r r rû r° rý rÇ r ÚTypers Z
|
SizeOfDatar rþ rÁ r ZSignature_Data6ZSignature_Data6_valuerÌ ÚuuidÚUUIDZSignature_Data1ZSignature_Data2ZSignature_Data3ZSignature_Data4ZSignature_Data5ÚreplaceÚupperZAgeZSignature_StringZUnicoderî )rä r r Zdbg_sizeÚdebugrO r( ÚdbgZdbg_typeZdbg_type_offsetZ dbg_type_sizeZ dbg_type_dataZ__CV_INFO_PDB70_format__ZpdbFileName_sizeZ__CV_INFO_PDB20_format__Z ___IMAGE_DEBUG_MISC_format__Zdbg_type_partialÚ data_sizer r r r% ¸ s ÿ
|
ý
|
ÿøþÿ
|
|
ÿ ÿ
|
ÿþúÿÿ ôòÿüþ
|
ÿ
|
ÿ ÿ ÿûþ
|
ÿ
|
ÿÿ
|
ÿ ÿzPE.parse_debug_directoryr c % C s |dkr|g}|dkr|}|t kr:| j d|t f ¡ dS z| |t| j ¡ ¡}W n& tk
|
rz | j d| ¡ Y dS X | j| j|| |¡d}|dkr°| j d| ¡ dS g }|| ¡ 7 }|j
|
|j } d}
|
| |
|
krð| j d| |
|
f ¡ dS | j | 7 _ | j t kr$| j d| j t f ¡ dS g } d} t| D ]¦} | jsn| j| jkrnd | _| j d
|
| j| jf ¡ | |¡}|dkr| j d | |f ¡ qÞd}d}|jd @ d ? }|sÀ|j}n®||j }z|t| |}| j| ¡ 7 _| r*| d |k r*| d |kr*| ¡ | j d| ¡ W qÞ||| ¡ f} | |¡ W n& tk
|
rl | j d| ¡ Y nX |jrè||j |kr qÞ| j||j ||| ||d |||j g d}|sÊ qÞd}|td krÐi }|j D ]è}t |dræi }|j j D ]À}|dkst |dr|j j j!dks|j"dkr<q|j j j#}|j j j!}|j"}z| ||¡}W n6 tk
|
r | j d|dd| ¡ Y qY nX t$|t%|d d | | &|¡ q||j _'qæ| t(||||d¡ n^| )||j ¡} | r@| j| j!7 _t*| |jd@ |jd ? d } | t(|||| d ¡ n qÞ|dkrÎ|j+td krÎ|rn|d } z| j j d j j } W n Y n@X | D ]8} d}!z | j j }!W n Y nX |!dk r| ,|!¡ q|| ¡ 7 }q4d!d" | D }"|" -¡ t.| D ]\} }#|# /¡ qüt0||d#}$|$S )$aØ Parse the resources directory.
|
|
Given the RVA of the resources directory, it will process all
|
its entries.
|
|
The root will have the corresponding member of its structure,
|
IMAGE_RESOURCE_DIRECTORY plus 'entries', a list of all the
|
entries in the directory.
|
|
Those entries will have, correspondingly, all the structure's
|
members (IMAGE_RESOURCE_DIRECTORY_ENTRY) and an additional one,
|
"directory", pointing to the IMAGE_RESOURCE_DIRECTORY structure
|
representing upper layers of the tree. This one will also have
|
an 'entries' attribute, pointing to the 3rd, and last, level.
|
Another directory with more entries. Those last entries will
|
have a new attribute (both 'leaf' or 'data_entry' can be used to
|
access it). This structure finally points to the resource data.
|
All the members of this structure, IMAGE_RESOURCE_DATA_ENTRY,
|
are available as its attributes.
|
NzNError parsing the resources directory. Excessively nested table depth %d (>%s)zCInvalid resources directory. Can't read directory data at RVA: 0x%xrý zDInvalid resources directory. Can't parse directory data at RVA: 0x%xr# zNError parsing the resources directory. The directory contains %d entries (>%s)zRError parsing the resources directory. The file contains at least %d entries (>%d)TzGResource size 0x%x exceeds file size 0x%x, overlapping resources found.zHError parsing the resources directory, Entry %d is invalid, RVA = 0x%x. r/ r¤ r r0 z^Error parsing the resources directory, attempting to read entry name. Entry names overlap 0x%xznError parsing the resources directory, attempting to read entry name. Can't read unicode string at offset 0x%x)rõ ÚlevelÚdirsrm Ú directoryr( z2Error parsing resource of type RT_STRING at RVA 0xrÝ z with size r. )rÁ r? Úidre iÿ rI )rÁ ÚlangÚsublang)rÁ r? rf r( rn rü c S s g | ] }| ¡ qS r )rò rX r r r r4 s z0PE.parse_resources_directory.<locals>.<listcomp>rK )1ÚMAX_RESOURCE_DEPTHr° rý r r; Ú#__IMAGE_RESOURCE_DIRECTORY_format__rL rû rÇ r ZNumberOfNamedEntriesZNumberOfIdEntriesrµ ÚMAX_RESOURCE_ENTRIESrº r× r¶ rÖ Úparse_resource_entryr Ú
|
NameOffsetrî rú r ÚDataIsDirectoryÚOffsetToDirectoryr$ Ú RESOURCE_TYPEr r re r( rÁ rQ rf Ú OffsetToDatarÊ r ÚupdateÚstringsrì Úparse_resource_data_entryrí ÚIdÚparse_version_informationr rM rÿ rë )%rä r r rõ rc rd r( Ú resource_dirZ dir_entriesZnumber_of_entriesZMAX_ALLOWED_ENTRIESZstrings_to_postprocessZlast_name_begin_endrO ÚresZ
|
entry_nameZentry_idZname_is_stringÚ ustr_offsetZentry_directoryrs Ú resource_idZresource_stringsÚ resource_langZstring_entry_rvaZstring_entry_sizeZstring_entry_idZstring_entry_datarÁ Z
|
entry_dataZ
|
last_entryZversion_entriesZ version_entryZrt_version_structZ string_rvasr$ Zresource_directory_datar r r r$ c s¤ ÿÿ ÿÿÿýÿÿ
|
ÿþÿ þÿÿ
|
þþþÿ
|
|
ÿÿ
|
|
|
ÿ
|
þþÿ
|
þþÿ
|
|
û
|
ÿþ ýüÿ
|
ÿÿ ý üÿ
|
ÿ ÿ ÿÿ
|
ÿz PE.parse_resources_directoryc C s^ z| |t| j ¡ ¡}W n& tk
|
r@ | j d| ¡ Y dS X | j| j|| |¡d}|S )z0Parse a data entry from the resources directory.zGError parsing a resource directory data entry, the RVA is invalid: 0x%xNrý ) r r; Ú$__IMAGE_RESOURCE_DATA_ENTRY_format__rL rû r° rý rÇ r )rä r r( Z
|
data_entryr r r rt s$ ÿÿÿýz PE.parse_resource_data_entryc C s z| |t| j ¡ ¡}W n tk
|
r0 Y dS X | j| j|| |¡d}|dkrVdS |jd@ |_|jd@ |_ |jd@ |_
|
|j d@ d? |_ |j d@ |_ |S )z5Parse a directory entry from the resources directory.Nrý rÎ ì þ rÐ r/ r¤ )r r; Ú)__IMAGE_RESOURCE_DIRECTORY_ENTRY_format__rL rû rÇ r r rm Z_PE__padru rq rn ro )rä r r( Úresourcer r r rl ² s( ÿý zPE.parse_resource_entryc # C sÎ z| |j¡}W n* tk
|
r: | j d |j¡¡ Y dS X | j|||j
}| j| j ||d}|dkrndS |j|
|
¡ }| |¡}d}|r¢|j t |j|j }d}z4|dkrÀ| j|dd}n| j||| d? dd}W n& tk
|
r | j d| ¡ Y nX |dkr"| j d |¡¡ dS |dk r |d kr t|d
|
kr||dd
|
d¡} | d| d ¡
} td | t|¡}| j d | d¡ d d¡¡¡ dS t| ds²g | _|}
|
||
|
_| j |
|
¡ |dkrÖd}| |
|
¡ dt|d |j¡} | j| j|| d
|| d} | s dS t| ds2g | _| j | ¡ | | |
|
¡ |j¡} t| dsfg | _ g }| j| j || d
|| d}|dkr¢| j d¡ dS |j| |
|
¡ }z| |¡}W n. tk
|
rð | j d |¡¡ Y q¾Y nX ||_| |¡ |rÈ| d¡rÈ|j dkr|j dkr| | |
|
¡ dt|d |j¡}g |_!| j| j"||d
|| d}|sq|j| |
|
¡ }z| |¡}W n. tk
|
rÎ | j d |¡¡ Y qY nX ||_#i |_$i |_%i |_&|j! |¡ | ||
|
¡ dt|d |j¡}|||j' k r| j| j(||d
|| d}|sRq|j| |
|
¡ }z| |¡}| |¡}W n. tk
|
rª | j d |¡¡ Y qY nX | dt|d | |
|
¡ |j¡}|j| }z | j||j d}| |¡}W n0 tk
|
r* | j d |d ¡ Y qY nX |j'dkrD||j' }n| |j'| |j¡}||j$|< ||f|j%|< t|t|f|j&|< q| |j'| |j¡}||kr¬q|}||j'krXqqXnÂ|r| d ¡r|}d |_)|j dkr|j dkr| | |
|
¡ dt|d |j¡} g |_*| j| j+|| d
|| d} | sPq|j| |
|
¡ }z| |¡} W n. tk
|
r | j d |¡¡ Y qY nX | dkr®q|j* | ¡ | dt| d | |
|
¡ |j¡} | } | | | j k r^| ,|| | d
d¡}!| ,|| d | d!
d¡}"| d!7 } t-|!t.rät-|"t.rä| d"|!|"f i| _/qä| | | j' |j¡} | | | j' kr(qq(| |j'| |j¡} |j'dks¾| |j'krjq¾qj| j |¡ dS )#a Parse version information structure.
|
|
The date will be made available in three attributes of the PE object.
|
|
VS_VERSIONINFO will contain the first three fields of the main structure:
|
'Length', 'ValueLength', and 'Type'
|
|
VS_FIXEDFILEINFO will hold the rest of the fields, accessible as sub-attributes:
|
'Signature', 'StrucVersion', 'FileVersionMS', 'FileVersionLS',
|
'ProductVersionMS', 'ProductVersionLS', 'FileFlagsMask', 'FileFlags',
|
'FileOS', 'FileType', 'FileSubtype', 'FileDateMS', 'FileDateLS'
|
|
FileInfo is a list of all StringFileInfo and VarFileInfo structures.
|
|
StringFileInfo structures will have a list as an attribute named 'StringTable'
|
containing all the StringTable structures. Each of those structures contains a
|
dictionary 'entries' with all the key / value version information string pairs.
|
|
VarFileInfo structures will have a list as an attribute named 'Var' containing
|
all Var structures. Each Var structure will have a dictionary as an attribute
|
named 'entry' which will contain the name and value of the Var.
|
zWError parsing the version information, attempting to read OffsetToData with RVA: 0x{:x}Nrý Úascii©Úencodingr0 zzError parsing the version information, attempting to read VS_VERSION_INFO string. Can't read unicode string at offset 0x%xz"Invalid VS_VERSION_INFO block: {0}s VS_VERSION_INFOr
|
z\uz({0} ... ({1} bytes, too long to display)ú z\00r rõ r; r r z/Error parsing StringFileInfo/VarFileInfo structz|Error parsing the version information, attempting to read StringFileInfo string. Can't read unicode string at offset 0x{0:x}s StringFileInforY r zyError parsing the version information, attempting to read StringTable string. Can't read unicode string at offset 0x{0:x}z}Error parsing the version information, attempting to read StringTable Key string. Can't read unicode string at offset 0x{0:x}r÷ zzError parsing the version information, attempting to read StringTable Value string. Can't read unicode string at offset 0xrÝ s VarFileInfoZ VarFileInfoz}Error parsing the version information, attempting to read VarFileInfo Var string. Can't read unicode string at offset 0x{0:x}r? z 0x%04x 0x%04x)0r rq rû r° rý rþ r rQ rÇ Ú__VS_VERSIONINFO_format__rL rò rt râ ru rv rù rÀ rÄ Úrfindrà r^ r r ZKeyÚ dword_alignÚ__VS_FIXEDFILEINFO_format__r r Ú__StringFileInfo_format__rÎ r[ Z ValueLengthr Ú__StringTable_format__ÚLangIDr r r ZLengthÚ__String_format__r? r Ú__Var_format__Úget_word_from_datarË r r )#rä Zversion_structZ start_offsetrþ Zversioninfo_structry r Z section_endZversioninfo_stringZexcerptZvinfoZfixedfileinfo_offsetZfixedfileinfo_structZstringfileinfo_offsetr Zstringfileinfo_structZstringfileinfo_stringZstringtable_offsetZstringtable_structZstringtable_stringZ entry_offsetZ string_structrP Z
|
key_offsetZ value_offsetrÖ Znew_stringtable_offsetZvarfileinfo_structZ
|
var_offsetZ
|
var_structZ
|
var_stringZvarword_offsetZorig_varword_offsetZword1Zword2r r r rv Ñ s þÿ ÿ
|
ÿ ÿ
|
ÿ
|
þÿ
|
|
ÿ ÿÿÿÿ
|
þ
|
ý
|
þ
|
ý
|
ÿÿþÿþÿ
|
|
ÿÿþÿþü
|
ýÿþÿýÿ ÿþü
|
ÿÿ
|
ýÿþÿ
|
ýÿ ÿþü
|
ÿ
|
ÿ ÿþ
|
þ
|
þþ
|
|
ÿÿþÿþü
|
ýÿþÿýÿ
|
ÿþüÿÿ ÿ ÿ
|
ÿ
|
ÿþÿþz PE.parse_version_informationc s¾ z. j j |t j ¡ ¡ |¡d}W n& tk
|
rT j d| ¡ Y dS X |s^dS fdd}zd |j t
|
||j |j d ¡} |j t
|
||j |j d ¡} |j t
|
||j |jd ¡}W n& tk
|
rô j d| ¡ Y dS X g } d}
|
|j ¡} t j} | r2| jt| ¡ |j } t t¡} d}tt
|
|j t| d D ]^} ||¡}|dk r|d t|k r ||¡}n dS |dksX|d kr²qX||kr||| k r |¡}z |¡}W n tk
|
rþ Y qXY nX n|r qXd}d} ||¡}|dkrF|
|
d
|
8 }
|
|
|
d krFd } qº |t¡}t|dd sjd } qºz |¡}W n tk
|
rú |
|
d
|
8 }
|
|
|
d kr¨d }Y qºz |¡}W n> tk
|
rô |
|
d
|
8 }
|
|
|
d krèd }Y Y qºY Y qXY nX Y nX | ||f d
|
7 < | ||f dkrF j d | d|dd¡ qºn*t| j krp j d j ¡¡ qº| t |j | |j d| ¡| |j d| ¡||||d ¡ qX|sÖ j d|j d¡ dd | D }d}
|
|j ¡} t j} | r | jt| ¡ |j } t t¡} d}tt
|
|jt| d D ].}||j |krBz ||¡}W n tk
|
r d}Y nX |dkrª|
|
d
|
8 }
|
|
|
d krªd } qt|d kr¸qB|dk ræ||kræ||| k ræ |¡}nd}| | d
|
7 < | | j kr( j d j |¡¡ qtn,t| j krT j d j d¡ qt| t |j | |d|d¡ qB|s j d |j d¡ dS | s¨| !¡ r¨dS t"|| |j#¡d S ) a Parse the export directory.
|
|
Given the RVA of the export directory, it will process all
|
its entries.
|
|
The exports will be made available as a list of ExportData
|
instances in the 'IMAGE_DIRECTORY_ENTRY_EXPORT' PE attribute.
|
rý z+Error parsing export directory at RVA: 0x%xNc s t j | ¡ S r )rÀ r r )r rã r r Úlength_until_eof¤ s z3PE.parse_export_directory.<locals>.length_until_eofr? rI Tr r0 F)r` z9Export directory contains more than 10 repeated entries (r z#02xz). Assuming corrupt.zHExport directory contains more than {} symbol entries. Assuming corrupt.r; ) rï rÎ rà rÑ rè r? rÞ ræ ré zIRVA AddressOfNames in the export directory points to an invalid address: rÝ c S s h | ]
|
}|j qS r )rÎ )r2 Úexpr r r Ú <setcomp>8 s z,PE.parse_export_directory.<locals>.<setcomp>z[Export directory contains more than {} repeated ordinal entries (0x{:x}). Assuming corrupt.z$Export directory contains more than z# ordinal entries. Assuming corrupt.)rÎ rÑ r? ræ zMRVA AddressOfFunctions in the export directory points to an invalid address: )rÁ Úsymbolsr? )$rÇ Ú!__IMAGE_EXPORT_DIRECTORY_format__r r; rL r rû r° rý ZAddressOfNamesrá Z NumberOfNamesZAddressOfNameOrdinalsZAddressOfFunctionsZNumberOfFunctionsrò rÀ r rt Ú collectionsÚ defaultdictr rº r Úget_dword_from_dataÚget_string_at_rvaÚMAX_SYMBOL_NAME_LENGTHrc r¬ rþ rå ZBaser rK rä r )rä r r r Z
|
export_dirr Zaddress_of_namesZaddress_of_name_ordinalsZaddress_of_functionsÚexportsZ#max_failed_entries_before_giving_upr r: Z symbol_countsZ&export_parsing_loop_completed_normallyrÈ Zsymbol_ordinalZsymbol_addressZ forwarder_strré Zsymbol_name_addressZ symbol_nameZsymbol_name_offsetZordinalsrO r rã r r# s¢
|
ÿû
|
ÿ þþþþþþÿ
|
|
ÿþÿ
|
ÿ ÿ
|
|
|
ÿ
|
|
|
ÿÿÿ ÿ ÿóÿ ÿ
|
|
ÿþÿ
|
|
|
|
|
ÿþ
|
ý þÿ ÿüÿ ÿ
|
ýzPE.parse_export_directoryc C s || d d@ |d@ S )Nr= l üÿ r )rä r6 Úbaser r r r s zPE.dword_alignc C s4 | j j}| j j| j j }||kr0||k r0||8 }|S r )r| Ú ImageBaserM )rä ÚvaZbegin_of_imageZ end_of_imager r r Únormalize_import_va s
|
zPE.normalize_import_vac
|
C s\ g }d}z| |t| j ¡ ¡}W n* tk
|
rL | j d| ¡ Y qXY nX | |¡}| j| j||d}|rv| ¡ rzqXd}|j
|
dkrð| j j t d krð| |j¡|_| |j¡|_| |j¡|_| |j¡|_| |j¡|_| |j¡|_d}|| ¡ 7 }t| j| } ||jks"||jkr8t||j ||j } g }
|
z| |j|jd| |¡}
|
W n: tk
|
r } z| j d || j¡¡ W 5 d} ~ X Y nX |d kr²| j d
|
|¡¡ qX|
|
sÂ|d 7 }q| jt krè| j d | jt f ¡ qX| |jt ¡} t | st d } | r|
|
D ]0} | j!dkrt" #| $¡ | j%¡}|r|| _!q| t&||
|
| d¡ q|S )z*Walk and parse the delay import directory.r z5Error parsing the Delay import directory at RVA: 0x%xrý Fr` TNzSError parsing the Delay import directory. Invalid import data at RVA: 0x{0:x} ({1})rA zWToo many errors parsing the Delay import directory. Invalid import data at RVA: 0x{0:x}r0 z)Error, too many imported symbols %d (>%s)ú *invalid*©rÁ ÚimportsÚdll)'r r; Ú(__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__rL rû r° rý r rÇ rK ZgrAttrsrä r0 r1 r Z pBoundIATZpIATZpINTZ
|
pUnloadIATZphmodZszNamerÀ r râ Ú parse_importsrþ rÖ r· ÚMAX_IMPORT_SYMBOLSr ÚMAX_DLL_LENGTHr_ rà r? Ú ordlookupÚ ordLookupÚlowerrÎ rË )rä r r Ú import_descsrÉ r( r@ Ú import_descÚcontains_addressesÚmax_lenÚ import_datarö r rD Úfuncnamer r r r) s¨ þÿ
|
ý ÿþÿ û ÿÿ
|
ÿÿ ÿÿ
|
|
ÿz PE.parse_delay_import_directoryr c C s t | dr| jd krdS |dkr0t| jj ¡ S |dkrHt| jj ¡ S |dkr`t| jj ¡ S |dkrxt| jj ¡ S tdd S )Nr rõ r r r r z#Invalid hashing algorithm specified) r r r r r r r r rÕ )rä Ú algorithmr r r Úget_rich_header_hash s zPE.get_rich_header_hashc C s g }dddg}t | ds dS | jD ]à}t|jtrB|j ¡ ¡ }n
|
|j ¡ }| dd¡}t|dkrx|d |krx|d }|j ¡ }|j D ]x}d }|j
|
sÈt j ||j d
|
d }|sÎtd |j d |j dn|j
|
}|sÔqt|træ| ¡ }| d| ¡ | ¡ f ¡ qq"td |¡ ¡ ¡ S )a? Return the imphash of the PE file.
|
|
Creates a hash based on imported symbol names and their specific order within
|
the executable:
|
https://www.mandiant.com/resources/blog/tracking-malware-import-hashing
|
|
Returns:
|
the hexdigest of the MD5 hash of the exported symbols.
|
ZocxÚsysr ÚDIRECTORY_ENTRY_IMPORTrõ Ú.r0 r NT)Z make_namezUnable to look up ordinal rc Z04xz%s.%sr, )r r± rË r rÍ rÄ r§ ÚrsplitrÀ r r? r¥ r¦ rÎ rû rý r r rÜ r ) rä ZimpstrsÚextsr ÚlibnameÚpartsZentry_dll_lowerÚimpr r r r Ú get_imphash s>
|
|
|
|
|
|
ÿÿ
|
zPE.get_imphashc C sV t | dsdS t | jds dS dd | jjD }t|dkr@dS td |¡ ¡ ¡ S )zÝReturn the exphash of the PE file.
|
|
Similar to imphash, but based on exported symbol names and their specific order.
|
|
Returns:
|
the hexdigest of the SHA256 hash of the exported symbols.
|
ÚDIRECTORY_ENTRY_EXPORTrõ r c S s( g | ] }|r|j d k r|j ¡ ¡ qS r )r? rÄ r§ r1 r r r r4 Y s
|
þz"PE.get_exphash.<locals>.<listcomp>r r, )r r¹ r rÀ r r rÜ r )rä Z export_listr r r Ú get_exphashJ s
|
þ zPE.get_exphashc
|
C s g }d}t | j ¡ }z| ||¡}W n. tk
|
rT | j d|d¡ Y qÒY nX | |¡}| j| j||d} | r~| ¡ rqÒ|| ¡ 7 }t
|
| j | }
|
|| j ks°|| j krÆt|| j || j }
|
g } |sbz | j| j | j | j|
|
d} W nB tk
|
r. } z"| j d|dd| j d¡ W 5 d } ~ X Y nX |d
|
krR| j d |d¡ qÒ| sb|d 7 }q| | jt¡} t| std } | r| D ]0}|jd krt | ¡ |j¡}|r||_q| t | | | d¡ q|st ddg}d}d}|D ]v}|j D ]h}|D ]T}|r|jsq|j}t |jt kr:|j !d¡}| "|¡r|d 7 } qXq|d 7 }qúqð|t
|
|kr|dk r| j d¡ |S )z$Walk and parse the import directory.r z-Error parsing the import directory at RVA: 0xrÝ rý r÷ zBError parsing the import directory. Invalid Import data at RVA: 0xz (ú)NrA zLToo many errors parsing the import directory. Invalid import data at RVA: 0xr0 r r Ú LoadLibraryZGetProcAddressró r] z?Imported symbols contain entries typical of packed executables.)#r; Ú"__IMAGE_IMPORT_DESCRIPTOR_format__rL r rû r° rý r rÇ rK rÀ r ZOriginalFirstThunkZ
|
FirstThunkrâ r¢ ZForwarderChainrÖ r r r¤ r_ rà r? r¥ r¦ r§ rÎ rË r^ r rò rÍ rÄ rÎ )rä r r r! r¨ rÉ Z image_import_descriptor_sizer( r@ r© r« r¬ r3 r rD r Zsuspicious_importsZsuspicious_imports_countZ total_symbolsZimp_dllZsuspicious_symbolr? r r r r" c s¨ ÿ
|
ÿ
|
ÿ ÿü
|
ÿ
|
|
ÿ
|
|
ÿ
|
|
|
ÿþÿzPE.parse_import_directoryc C s g }| |||¡}| |||¡}|r0t|dkr`|r@t|dkr`| j d|dd|d¡ g S d} |rn|} n|rx|} ndS d}
|
d} | jtkrt} n | jtkr¬t} d}
|
d } nt} d} t | D ]Î\}}d}d}d}d}d}d
|
}|j
|
r|j
|
| @ r
|
d }|j
|
d @ }d}d}nvd
|
}zZ|j
|
| @ }| |d ¡}| |d¡}| |j
|
d t¡}t|sVtd}| |j
|
d ¡}W n tk
|
r~ Y nX | ¡ }| |¡}|| jj ||
|
}d}z>|râ|râ|| j
|
|| j
|
krâ|| j
|
}|| }nd}W n tk
|
r d}Y nX |dkr |dkr td|tdkrT| dkrJ| |krJtd| d7 } q¼|s^|r¼| t| ||||| ¡ ||||||||d¡ q¼|S )zíParse the imported symbols.
|
|
It will fill a list, which will be available as the dictionary
|
attribute "imports". Its keys will be the DLL names and the values
|
of all the symbols imported from that object.
|
r z\Damaged Import Table information. ILT and/or IAT appear to be broken. OriginalFirstThunk: 0xrÝ z FirstThunk: 0xNr? rÎ rE l ÿÿÿÿ FTrÐ r; r z"Invalid entries, aborting parsing.iè z)Too many invalid names, aborting parsing.r0 )rï rØ rÝ Úimport_by_ordinalrÎ rà Úhintr? rÞ rÏ rÑ Úhint_name_table_rvaÚ thunk_offsetÚ thunk_rva)Úget_import_tablerÀ r° rý rÓ rÔ rÕ rÖ r× rM rÚ r r r ÚMAX_IMPORT_NAME_LENGTHrc rà r rû rH r r| r r, rÍ ) rä Zoriginal_first_thunkZ first_thunkZforwarder_chainrø rª Zimported_symbolsZiltZiatÚtableZ
|
imp_offsetZ address_maskrâ Z num_invalidrO Z tbl_entryZimp_ordZimp_hintZimp_namerÞ rÀ r¾ r( rÁ r Z imp_addressrÝ Z imp_boundr r r r¢ Í sÀ ÿ ÿ
|
|
|
|
ÿ
|
ÿ
|
ÿ"
|
|
|
|
òÿzPE.parse_importsc C s^ g }| j tkrt}| j}n | j tkr0t}| j}n
|
t}| j}t| ¡ }d}d} d}
|
d} t } t } |}|rZ|d k r||| kr| j
|
d¡ qZ| j t kr´| j
|
d| j t f ¡ qZ| j d7 _ | |
|
krÎg S | ¡ |krÞg S | ¡ |krîg S d}z| ||¡}W n tk
|
r d }Y nX |s2t||krF| j
|
d
|
| ¡ d S | j||| |¡d }|r| |j¡|_| |j¡|_| |j¡|_| |j¡|_|rÌ|j|krÌ|j|krÌ| j
|
d | ¡ qZ|r.|jr.|j}||@ rþ|d @ dkr.g S n0|| kr| }n| }||kr$| d7 } | |¡ |rZ| ¡ rBqZ|| ¡ 7 }| |¡ qf|S )NrY ì rP r z9Error parsing the import table. Entries go beyond bounds.z$Excessive number of imports %d (>%s)r0 FTz9Error parsing the import table. Invalid data at RVA: 0x%xrý z\Error parsing the import table. AddressOfData overlaps with THUNK_DATA for THUNK at RVA 0x%xrÎ rÐ )rÓ rÔ rÕ Ú__IMAGE_THUNK_DATA_format__rÖ r× Ú __IMAGE_THUNK_DATA64_format__r; rL rÞ r° rý r· r£ ré r rû rÀ rÇ r r rÚ rÜ rÛ rÙ rç rK )rä r rø rª rÅ râ rþ Z expected_sizeZMAX_ADDRESS_SPREADZADDR_4GBZMAX_REPEATED_ADDRESSESZrepeated_addressZaddresses_of_data_set_64Zaddresses_of_data_set_32Z start_rvaÚfailedr( Z
|
thunk_dataZ addr_of_dataZthe_setr r r rà l s²
|
|
ÿ
|
ÿÿ
|
ÿ ÿÿÿÿþýþÿ
|
|
|
|
zPE.get_import_tablerZ c
|
C s |dk r| j }| |¡ | j dd
}| jD ]Ä}|jdkrF|jdkrFq,|j}| |j| jj¡}| |j
|
| jj | jj¡}|t | j ks,|t | j ks,|| t | j ks,||kr®q,|t | } | dkrÐ|d| 7 }n| dk rä|d|
}|| ¡ 7 }q,|dk r|| _ |S )a´ Returns the data corresponding to the memory layout of the PE file.
|
|
The data includes the PE header and the sections loaded at offsets
|
corresponding to their relative virtual addresses. (the VirtualAddress
|
section header member).
|
Any offset in this data corresponds to the absolute memory address
|
ImageBase+offset.
|
|
The optional argument 'max_virtual_address' provides with means of limiting
|
which sections are processed.
|
Any section with their VirtualAddress beyond this value will be skipped.
|
Normally, sections with values beyond this range are just there to confuse
|
tools. It's a common trick to see in packed executables.
|
|
If the 'ImageBase' optional argument is supplied, the file's relocations
|
will be applied to the image by calling the 'relocate_image()' method. Beware
|
that the relocation information is applied permanently.
|
Nr r` )r Úrelocate_imager¯ rv ru r{ rs r| r} r rt r rÀ r )
|
rä Zmax_virtual_addressr Z original_dataZ mapped_datar ZsrdZprdrx rù r r r Úget_memory_mapped_imageð sF
|
|
ÿý ÿ þýü
|
zPE.get_memory_mapped_imagec C sv g }t | drr| jjD ]Z}t |dr|jjD ]B}t |dr,t |jdr,|jjr,t|jj ¡ D ]}| |¡ q^q,q|S )a Returns a list of all the strings found withing the resources (if any).
|
|
This method will scan all entries in the resources directory of the PE, if
|
there is one, and will return a [] with the strings.
|
|
An empty list will be returned otherwise.
|
ÚDIRECTORY_ENTRY_RESOURCEre rs )r rÌ r re rs r r rý )rä Zresources_stringsÚres_typerz Ú
|
res_stringr r r Úget_resources_strings9 s
|
|
|
|
ÿþ
|
ÿzPE.get_resources_stringsc C sl | |¡}|r|| }nd}|s`|t| jk r<| j||
S |t| jk rX| j||
S td| ||¡S )zÌGet data regardless of the section where it lies on.
|
|
Given a RVA and the size of the chunk to retrieve, this method
|
will find the section where the data lies and return the data.
|
Nz-data at RVA can't be fetched. Corrupt header?)rò rÀ rñ r rû r )rä r r r$ r r r r r U s
|
|
z PE.get_datac sJ |¡}|s@ jr<t fdd jD }||k r8|S dS |S | |¡S )z.Get the RVA corresponding to this file offset.c s$ g | ] } |j jj jj¡qS r )r rt r| r r} rX rã r r r4 ~ s ûýz*PE.get_rva_from_offset.<locals>.<listcomp>N)r6 r¯ rá r )rä r6 r$ Z
|
lowest_rvar rã r r w s
|
|
úÿ
|
zPE.get_rva_from_offsetc C s< | |¡}|s2|t| jk r |S td|dd| |¡S )z³Get the file offset corresponding to this RVA.
|
|
Given a RVA , this method will find the section where the
|
data lies and return the offset within the file.
|
zdata at RVA 0xrÝ z can't be fetched)rò rÀ r rû r )rä r r$ r r r r s
|
zPE.get_offset_from_rvac C sJ |dkr dS | |¡}|s4| d| j|||
¡S | d|j||d¡S )z1Get an ASCII string located at the given address.Nr )r )rò r8 r r )rä r rø r$ r r r r « s
|
zPE.get_string_at_rvac C s2 |t |krdS ||d
}t|tr.t|S |S )r² r N)rÀ rË rÚ rÍ )rä r6 r( r# r r r Úget_bytes_from_data¶ s
|
zPE.get_bytes_from_datac C s. | ||¡}| d¡}|dkr*|d|
}|S )z Get an ASCII string from data.r` r N)rÐ r )rä r6 r( r$ r r r r r8 ¿ s
|
|
zPE.get_string_from_datarW c
|
C s |dkr dS | |d¡}|dK }t|d}| ||¡}d}| d|d ¡}|dkrt|}||k sj||krxt|d? }q¶|| || || ¡7 }|d }|}q:|d dkr:|dL }q¶q:t d |¡|d |d
¡}d
|
tt |¡} |røt
|
| |d ¡S t
|
| d d ¡S ) z3Get an Unicode string located at the given address.r r r; r0 rS rü rU z<{:d}HNrõ r ró ) r rá r rÀ rÁ r rþ r Úmapra rà rÜ )
|
rä r rø r r( Ú requestedZ
|
null_indexZ data_lengthZuchrsr$ r r r rù Ç s0
|
zPE.get_string_u_at_rvac C s" | j D ]}| |¡r| S qdS )z1Get the section containing the given file offset.N)r¯ r )rä r6 r r r r r6 ò s
|
|
|
zPE.get_section_by_offsetc C sD | j dk r | j |¡r | j S | jD ] }| |¡r"|| _ | S q"dS )z-Get the section containing the given address.N)r® r r¯ )rä r r r r r rò û s
|
|
|
|
zPE.get_section_by_rvac C s | ¡ S r )Ú dump_inforã r r r rô s z
|
PE.__str__c C s
|
t | dS )z.Checks if the PE file has relocation directoryÚDIRECTORY_ENTRY_BASERELOC)r rã r r r Ú
|
has_relocs s z PE.has_relocsc C s t | dr| jjrdS dS )NÚDIRECTORY_ENTRY_LOAD_CONFIGTF)r rÖ r= rã r r r Úhas_dynamic_relocs s
|
zPE.has_dynamic_relocsró c C s t | j|d dS )z=Print all the PE header information in a human readable from.r N)r rÓ )rä r r r r Ú
|
print_info s z PE.print_infor c ! sÊ dkrt | ¡ }|r@ d¡ |D ]} |¡ ¡ q( d¡ | j ¡ ¡ ¡ d¡ | j ¡ ¡ ¡ d¡ | j ¡ ¡ t
|
t d} d¡ g }t |D ]"}t| j |d r¾| |d ¡ q¾ d |¡¡ ¡ t| d
|
r,| jdk r, d
|
¡ | j ¡ ¡ t
|
td } d ¡ g }t |D ]&}t| j|d rL| |d ¡ qL d |¡¡ ¡ d ¡ t
|
td} | jD ]î}
|
|
|
¡ ¡ d¡ g }t | D ]$}t|
|
|d rÎ| |d ¡ qÎ d |¡¡ d |
|
¡ ¡¡ tdk r6 d |
|
¡ ¡¡ tdk rR d|
|
¡ ¡ t dk rn d|
|
¡ ¡ t dk r d|
|
¡ ¡ ¡ q¦t| d
|
rêt| jdrê d¡ | jj D ] } | dk r | ¡ ¡ q ¡ t| dræt!| j"D ]â\} } t#| j"dkr0 d| d ¡ n
|
d¡ | dk rR | ¡ ¡ ¡ t| dr | j$| ¡ ¡ ¡ t| dr t#| j%| kr | j%| D ]6} | ¡ ¡ ¡ t|d rd|j&D ]} fd d | ¡ D d |j' (|d ¡¡¡ ¡ t t)|j* +¡ D ]0} d! |d (|d ¡|d (|d ¡¡¡ q$qÖ ¡ nzt|d"r¨|j,D ]^}t|d#rv fd$d | ¡ D d! t)|j- .¡ d (d%d ¡t)|j- /¡ d ¡¡ qv ¡ q¨q t| d&r¨ d'¡ | j0j1 ¡ ¡ ¡ d(d) ¡ | j0j2D ]r}|j3dk r,t4d*}|j5rR|j5} d+|j6|j3| (|¡f ¡ |j7r d, |j7 (|d ¡¡¡ n ¡ q, ¡ t| d-rÚ d.¡ | j8D ]} |j1 ¡ ¡ |j9s d/ | :|j1j;¡ (|d ¡¡¡ ¡ ¡ |j9D ]²}|j<d0kr||j5dk r^ d1 |j= (d%¡|j5 (d%¡|j6¡¡ n d2 |j= (d%¡|j6¡¡ n* d3 |j= (|d ¡|j5 (|d ¡|j>¡¡ |j?r d4 |j?¡¡ n ¡ q ¡ qÄt| d5rt d6¡ | j@D ]|} |j1 ¡ ¡ d7 |j5 (|d ¡¡¡ ¡ |j*D ]<} |j1 ¡ d8¡ d7 |j5 (|d ¡¡d8¡ ¡ q2qöt| d9r@ d:¡ | jAD ]®} |j1 ¡ ¡ ¡ |j9D ]}|j<d0krâ d; |j= (|d ¡|j6¡¡ n* d< |j= (|d ¡|j5 (|d ¡|j>¡¡ |j?r( d4 |j?¡¡ n ¡ q² ¡ qt| d=
|
r d>¡ | jBj1 ¡ ¡ | jBj*D ]}|j5dk r¦|j5 (|d ¡} d?| d@dA¡ n0tC D|j1jEdB¡} dC|j1jEdDdE| dFdA¡ |j1 ¡ dA¡ t|dG
|
rx |jFj1 ¡ d8¡ |jFj*D ]d}|j5dk rF|j5 (d%d ¡} d?| d@dH¡ n dC|j1jEdDd@dH¡ |j1 ¡ dH¡ t|dG r |jFj1 ¡ dI¡ |jFj*D ]r}t|dJ r dK|jGjH|jGjItJ D|jGjHdL¡tK|jGjH|jGjIf dI¡ |j1 ¡ dM¡ |jGj1 ¡ dN¡ qt|jFdO r|jFjL r dPdM¡ t)t |jFjL +¡ D ],\} } dQ | | MdRdS¡ (dT¡¡dN¡
|
qF q ¡ qp ¡ t| dU
|
rÎ| jN
|
rÎ| jNj1
|
rÎ dV¡ | jNj1 ¡ ¡ ¡ t| dW r| jO r| jOj1 r dX¡ | jOj1 ¡ ¡ ¡ t| dY r´ dZ¡ | jPD ]} | j1 ¡ ¡ z d[tQ| j1jR ¡ W n* tSk
|
r d\ | j1jR¡¡ Y nX ¡ | j- r, | j- ¡ d8¡ ¡ q,| T¡ rT d]¡ | jUD ]} | j1 ¡ ¡ | j*D ]^} z( d^| jVtW| jX d_d
f d8¡ W n. tSk
|
rB d`| jV| jXf d8¡ Y nX qè ¡ qÎt| da rÂt#| jYdk r db¡ | jYD ]@} | j1 ¡ ¡ t| dc r| jZdk r | jZ ¡ d8¡ q [¡ S )dz>Dump all the PE header information into human readable string.NúParsing WarningsrÙ rÝ rä rÌ r r r r| rÍ zDllCharacteristics: ú PE Sectionsr z!Entropy: {0:f} (Min=0.0, Max=8.0)zMD5 hash: {0}zSHA-1 hash: %szSHA-256 hash: %szSHA-512 hash: %srë Ú Directoriesr r0 zVersion Information úVersion Informationr r r c s g | ]} d | ¡qS ©z r ©r2 r ©rW r r r4 s z PE.dump_info.<locals>.<listcomp>z LangID: {0}r z {0}: {1}r r c s g | ]} d | ¡qS rÝ r rÞ rß r r r4 ¢ s ÿró r¹ úExported symbolsz%-10s %-10s %s©rÙ ÚRVAr ÚNonez%-10d 0x%08X %sz forwarder: {0}r± úImported symbolsz Name -> {0}Tz*{0}.{1} Ordinal[{2}] (Imported by Ordinal)z&{0} Ordinal[{1}] (Imported by Ordinal)z{0}.{1} Hint[{2:d}]z Bound: 0x{0:08X}Ú DIRECTORY_ENTRY_BOUND_IMPORTú Bound importszDLL: {0}r? Ú DIRECTORY_ENTRY_DELAY_IMPORTúDelay Imported symbolsz({0} Ordinal[{1:d}] (Imported by Ordinal)z{0}.{1} Hint[{2}]rÌ úResource directoryzName: [ú]r; rW zId: [0xrX z] (r» re rC rE r( z\--- LANG [%d,%d][%s,%s]r¸ rI rL rs z [STRINGS]z {0:6d}: {1}úunicode-escaper r ÚDIRECTORY_ENTRY_TLSÚTLSrÖ Ú LOAD_CONFIGÚDIRECTORY_ENTRY_DEBUGúDebug informationzType: zType: 0x{0:x}(Unknown)úBase relocationsz%08Xh %sr. z0x%08X 0x%x(Unknown)ÚDIRECTORY_ENTRY_EXCEPTIONz"Unwind data for exception handlingr/ )\r rü r r r r rÙ rW rÝ rä rÒ rå rç ÚsortedrR rý r r r| ré r r¯ rþ r r r r r r r r r rë rM r rÀ r r r r rÄ r r rÊ r r rÑ r r¹ rÁ r rÑ rà r? rÎ ræ r± r r r r¾ r r¿ rÏ rå rç rÌ rp rº ru re r( rg rh r¹ r¾ rs rÜ rì rÖ rï Ú
|
DEBUG_TYPEr[ rî rÕ rÔ r ÚRELOCATION_TYPErò rò r/ r )!rä rW r Úwarningsr
|
rø rÕ rÏ rú r r re rO Z vinfo_entryr r Ú str_entryÚ var_entryÚexportr? ÚmodulerD Úbound_imp_descÚ bound_imp_refrÍ Z res_type_idrz r{ rÎ ra Ú
|
base_relocÚrelocr3 r rß r rÓ sÒ
|
|
|
|
|
|
|
|
|
ÿ
|
|
|
|
|
ÿ
|
|
|
|
ÿ
|
|
|
|
|
ÿÿÿ ÿ ÿüÿ
|
|
|
þ ÿüÿ
|
ÿÿ ÿÿ
|
ÿÿÿ
|
|
|
ýÿ
|
ÿÿ ýÿ
|
|
ÿÿ
|
ÿü
|
|
|
þÿ ýÿ
|
|
þþ
|
þ ÿþúÿ ó
|
ÿþ ÿ ÿþþù
|
ÿþý
|
ÿþý
|
|
|
|
|
|
|
þ ÿ ÿ þ
|
|
z PE.dump_infoc .
|
C sb i }| ¡ }|r||d< | j ¡ |d< | j ¡ |d< | j ¡ |d< ttd}g |d< |D ]&}t| j|d rX|d |d ¡ qXt | dr¢| j
|
d k r¢| j
|
¡ |d< tt d
|
}g |d < |D ]&}t| j
|
|d r¸|d |d ¡ q¸g |d < tt d }| j D ]²}| ¡ }|d |¡ g |d< |D ](}t||d r |d |d ¡ q | ¡ |d< td k rj| ¡ |d< td k r| ¡ |d< td k r| ¡ |d< td k rø| ¡ |d< qøt | drt | j
|
drg |d< t| j
|
jD ]&\} }
|
|
|
d k rÚ|d |
|
¡ ¡ qÚt | drg |d< t| jD ]b\} } g } | | ¡ ¡ t | dr\| | j| ¡ ¡ t | drtt| j | krtg } | | ¡ | j | D ]â}| | ¡ ¡ t |dr
|
i }|j D ]D}| | ¡ ¡ |j |d< t |j! "¡ D ]}|d ||d < qâq¸| |¡ nft |d r|j#D ]R}i }t |d r | | ¡ ¡ t |j$ %¡ d |t |j$ &¡ d < | |¡ q q|d | ¡ q t | d rg |d < |d | j'j( ¡ ¡ | j'j)D ]N}i }|j*d k rö| +|j,|j*|j-d ¡ |j.rö|j.|d!< |d |¡ q¸t | d"rºg |d#< | j/D ]}g }|d# |¡ | |j( ¡ ¡ |j0D ]f}i }|j1d$krx|j2|d%< |j,|d&< n |j2|d%< |j-|d'< |j3|d(< |j4r¨|j4|d)< | |¡ qNq"t | d*r4g |d+< | j5D ]^}i }|d+ |¡ | +|j( ¡ ¡ |j-|d%< |j!D ]$} i } | +| j( ¡ ¡ | j-| d%< q
|
qÔt | d,ræg |d-< | j6D ]}g } |d- | ¡ | |j( ¡ ¡ |j0D ]f}i }|j1d$kr¤|j2|d%< |j,|d&< n |j2|d%< |j-|d'< |j3|d(< |j4rÔ|j4|d)< | |¡ qzqNt | d.rg |d/< |d/ | j7j( ¡ ¡ | j7j!D ]æ} i } | j-d k r:| j-| d'< n | j(j8t9 :| j(j8d0¡f| d1< | +| j( ¡ ¡ |d/ | ¡ t | d2rg }!|! | j;j( ¡ ¡ |d/ |!¡ | j;j!D ]N}"i }#|"j-d k rÎ|"j-|#d'< n |"j(j8|#d1< |# +|"j( ¡ ¡ |! |#¡ t |"d2r¬g }$|$ |"j;j( ¡ ¡ |! |$¡ |"j;j!D ]}%t |%d3r(i }&|%j<j=|&d4< |%j<j>|&d5< t? :|%j<j=d6¡|&d7< t@|%j<j=|%j<j>|&d8< |& +|%j( ¡ ¡ |& +|%j<j( ¡ ¡ |$ |&¡ q(t |"j;d9r¬|"j;jAr¬t |"j;jA "¡ D ]"\} }'|$ |' Bd:d;¡ Cd<¡¡ qÖq¬qt | d=r0| jDr0| jDj(r0| jDj( ¡ |d>< t | d?r^| jEr^| jEj(r^| jEj( ¡ |d@< t | dArºg |dB< | jFD ]@}(i })|dB |)¡ |) +|(j( ¡ ¡ tG :|(j(jH|(j(jH¡|)dC< qx| I¡ r^g |dD< | jJD ]}*g }+|dD |+¡ |+ |*j( ¡ ¡ |*j!D ]Z},i }-|+ |-¡ |,jK|-dE< ztL|,jM dFd
|-dC< W n tNk
|
rT |,jM|-dC< Y nX qþqÒ|S )Gz5Dump all the PE header information into a dictionary.rÙ rÙ rÝ rä rÌ r
|
r r| NrÍ rê rÚ r ZEntropyÚMD5ÚSHA1ÚSHA256ÚSHA512rë rÛ r rÜ r r r r r0 r r r¹ rà rá ræ r± rä TZDLLrÙ r ZHintZBoundrå ræ rç rè rÌ ré rW ru re r( r¹ r» r¸ Z LANG_NAMEZ SUBLANG_NAMErs rë r r rì rí rÖ rî rï rð r[ rñ râ r. )Orü rÙ rq rÝ rä rÒ rå rR rý r r| ré r r¯ r r r r r r r r r rM rë r r rÀ r r r³ r r r rÊ r r r rÑ r¹ rÁ r rÑ rr rÎ r? ræ r± r r¾ r r¿ rÏ rå rç rÌ ru rp rº re r( rg rh r¹ r¾ rs rÜ rÄ rì rÖ rï rô r[ rÕ rÔ r rõ rò rî ).rä rq rö rø rÏ rú r r Z section_dictrO re Zvs_vinfoZversion_info_listZ fileinfo_listr Zstringtable_dictr r÷ rø Zvar_dictrù Z export_dictrú Z import_listrD Z symbol_dictrû Zbound_imp_desc_dictrü Zbound_imp_ref_dictZ module_listrÍ Zresource_type_dictZdirectory_listrz Zresource_id_dictZresource_id_listr{ Zresource_lang_dictrÎ ra Zdbg_dictrý Zbase_reloc_listrþ Z
|
reloc_dictr r r rq ¼ sú
|
ÿ
|
|
|
|
|
ÿ
|
|
|
|
|
ÿþ
|
ÿ ýÿ
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ÿ þ
|
|
ÿ
|
þÿ ÿþþÿÿ
|
ÿ
|
ÿþ
|
ÿ ÿþÿÿþýÿþý
|
þÿ
|
|
|
|
|
|
z PE.dump_dictc C s( z | |¡W S tk
|
r" Y dS X dS )z;Gets the physical address in the PE file from an RVA value.N)r rÕ r r r r Úget_physical_by_rvaâ s zPE.get_physical_by_rvac C s t d|d@ ¡S )zMReturn a four byte string representing the double word value (little endian).rý ì ÿÿ ©rÁ rS )rä Údwordr r r Úget_data_from_dwordí s zPE.get_data_from_dwordc C s< |d d t |krdS t d||d |d d
¡d S )a Convert four bytes of data to a double word (little endian)
|
|
'offset' is assumed to index into a dword array. So setting it to
|
N will return a dword out of the data starting at offset N*4.
|
|
Returns None if the data can't be turned into a double word.
|
r0 r? Nr r ©rÀ rÁ r ©rä r( r6 r r r r ñ s zPE.get_dword_from_datac C s2 z| | |d¡d¡W S tk
|
r, Y dS X dS )z Return the double word value at the given RVA.
|
|
Returns None if the value can't be read, i.e. the RVA can't be mapped
|
to a file offset.
|
r? r N)r r rû r r r r r> ÿ s zPE.get_dword_at_rvac C s0 |d t | jkrdS | | j||d
d¡S )zFReturn the double word value at the given file offset. (little endian)r? Nr )rÀ r r rI r r r Úget_dword_from_offset s zPE.get_dword_from_offsetc C s | || |¡¡S )zLSet the double word value at the file offset corresponding to the given RVA.)Úset_bytes_at_rvar )rä r r r r r Úset_dword_at_rva s zPE.set_dword_at_rvac C s | || |¡¡S )z3Set the double word value at the given file offset.)rá r )rä r6 r r r r rß s zPE.set_dword_at_offsetc C s t d|¡S )zFReturn a two byte string representing the word value. (little endian).r r ©rä rö r r r Úget_data_from_word s zPE.get_data_from_wordc C s< |d d t |krdS t d||d |d d
¡d S )a Convert two bytes of data to a word (little endian)
|
|
'offset' is assumed to index into a word array. So setting it to
|
N will return a dword out of the data starting at offset N*2.
|
|
Returns None if the data can't be turned into a word.
|
r0 r; Nr r r r r r r r # s zPE.get_word_from_datac C s8 z | | |¡dd
d¡W S tk
|
r2 Y dS X dS )zReturn the word value at the given RVA.
|
|
Returns None if the value can't be read, i.e. the RVA can't be mapped
|
to a file offset.
|
Nr; r )r r rû r r r r Úget_word_at_rva1 s zPE.get_word_at_rvac C s0 |d t | jkrdS | | j||d
d¡S )z?Return the word value at the given file offset. (little endian)r; Nr )rÀ r r rI r r r Úget_word_from_offset= s zPE.get_word_from_offsetc C s | || |¡¡S )zESet the word value at the file offset corresponding to the given RVA.)r r )rä r rö r r r Úset_word_at_rvaE s zPE.set_word_at_rvac C s | || |¡¡S )z,Set the word value at the given file offset.)rá r )rä r6 rö r r r rç I s zPE.set_word_at_offsetc C s t d|¡S )zMReturn an eight byte string representing the quad-word value (little endian).ú<Qr r r r r Úget_data_from_qwordQ s zPE.get_data_from_qwordc C s< |d d t |krdS t d||d |d d
¡d S )a Convert eight bytes of data to a word (little endian)
|
|
'offset' is assumed to index into a word array. So setting it to
|
N will return a dword out of the data starting at offset N*8.
|
|
Returns None if the data can't be turned into a quad word.
|
r0 rE Nr r r r r r r Úget_qword_from_dataU s zPE.get_qword_from_datac C s8 z | | |¡dd
d¡W S tk
|
r2 Y dS X dS )zReturn the quad-word value at the given RVA.
|
|
Returns None if the value can't be read, i.e. the RVA can't be mapped
|
to a file offset.
|
NrE r )r r rû r r r r Úget_qword_at_rvac s zPE.get_qword_at_rvac C s0 |d t | jkrdS | | j||d
d¡S )zDReturn the quad-word value at the given file offset. (little endian)rE Nr )rÀ r r rI r r r Úget_qword_from_offseto s zPE.get_qword_from_offsetc C s | || |¡¡S )zJSet the quad-word value at the file offset corresponding to the given RVA.)r r )rä r Úqwordr r r Úset_qword_at_rvaw s zPE.set_qword_at_rvac C s | || |¡¡S )z1Set the quad-word value at the given file offset.)rá r )rä r6 r r r r Úset_qword_at_offset{ s zPE.set_qword_at_offsetc C s0 t |tstd| |¡}|s$dS | ||¡S )zèOverwrite, with the given string, the bytes at the file offset corresponding
|
to the given RVA.
|
|
Return True if successful, False otherwise. It can fail if the
|
offset is outside the file's boundaries.
|
ú data should be of type: bytesF)rË rÍ Ú TypeErrorr rá )rä r r( r6 r r r r s
|
|
zPE.set_bytes_at_rvac C sF t |tstdd| kr,t| jk r>n n| ||¡ ndS dS )zÅOverwrite the bytes at the given file offset with the given string.
|
|
Return True if successful, False otherwise. It can fail if the
|
offset is outside the file's boundaries.
|
r r FT)rË rÍ r rÀ r Úset_data_bytes©rä r6 r( r r r rá s
|
zPE.set_bytes_at_offset)r6 r( c C s2 t | jtst| j| _|| j||t|
< d S r )rË r rÚ rÀ r r r r r ¥ s zPE.set_data_bytesc C sX | j D ]L}| |j| jj¡}||j }|t| jk r|t| jk r| || ¡ ¡ qdS )zeUpdate the PE image content with any individual section data that has been
|
modified.
|
N)
|
r¯ r{ rs r| r} ru rÀ r r r )rä r Zsection_data_startZsection_data_endr r r Úmerge_modified_section_data« s
|
ÿ
|
ÿz PE.merge_modified_section_datac
|
C st || j j }t| j jdkrp| j jd jrpt| dsJ| jtd gd t| dsd| j d¡ n\| j
|
D ]R}d}|t|j k rj|j | }|d7 }|j t d kr¤qt|j t d
|
krÖ| |j| |j¡| d ? d @ ¡ qt|j t d kr| |j| |j¡| d @ ¡ qt|j t d kr2| |j| |j¡| ¡ qt|j t d kr|t|j krTqj|j | }|d7 }| |j| |j¡d > |j | d@ d ? ¡ qt|j t d krt| |j| |j¡| ¡ qtqj|| j _t| drþ| jD ]"}|jD ]}| j|7 _qäqÚt| drR| jj j|7 _| jj j|7 _| jj j |7 _ | jj j |7 _ t| drp| j j} t| dr| j r| j |7 _ t| drª| j rª| j |7 _ t| drÌ| j!rÌ| j!|7 _!t| drî| j"rî| j"|7 _"t| dr| j#r| j#|7 _#t| dr2| j$r2| j$|7 _$t| drT| j%rT| j%|7 _%t| d rv| j&rv| j&|7 _&t| d r| j'r| j'|7 _'t| d rº| j(rº| j(|7 _(| j)t*krèt| d rè| j+rè| j+|7 _+t| d r
|
| j,r
|
| j,|7 _,t| d!r,| j-r,| j.|7 _.t| d"rN| j.rN| j.|7 _.t| d#rp| j/rp| j/|7 _/d$S )%a2 Apply the relocation information to the image using the provided image base.
|
|
This method will apply the relocation information to the image. Given the new
|
base, all the relocations will be processed and both the raw data and the
|
section's data will be fixed accordingly.
|
The resulting image can be retrieved as well through the method:
|
|
get_memory_mapped_image()
|
|
In order to get something that would more closely match what could be found in
|
memory once the Windows loader finished its work.
|
rC rA rÔ r@ ©r. zZRelocating image but PE does not have (or pefile cannot parse) a DIRECTORY_ENTRY_BASERELOCr r0 rd re r. rÐ rf rg rh r} ri r± rì rÖ ÚLockPrefixTableÚEditListÚSecurityCookieÚSEHandlerTableÚGuardCFCheckFunctionPointerÚ GuardCFDispatchFunctionPointerÚGuardCFFunctionTableÚ GuardAddressTakenIatEntryTableÚGuardLongJumpTargetTableÚDynamicValueRelocTableÚCHPEMetadataPointerÚGuardRFFailureRoutineÚ$GuardRFFailureRoutineFunctionPointerÚ(GuardRFVerifyStackPointerFunctionPointerÚEnclaveConfigurationPointerN)0r| r rÀ rë rQ r r rí r° rý rÔ r rò rõ r r r r r> r r r± r rÑ rì rÁ ZStartAddressOfRawDataZEndAddressOfRawDataZAddressOfIndexZAddressOfCallBacksrÖ r r! r" r# r$ r% r& r' r( r) rÓ rÖ r* r+ r, r- r. )
|
rä Z new_ImageBaseZrelocation_differencerþ Z entry_idxr Z
|
next_entryr ÚfuncZ load_configr r r rÊ º sN ÿ þ
|
ÿ
|
ÿ
|
|
ÿþûþ
|
|
ÿüþ
|
ÿþ
|
|
ÿþýúþ
|
ÿþ
|
|
|
ÿ
|
ÿ
|
ÿ ÿþÿþÿþÿþÿþÿþÿþÿþÿþÿþýÿþÿþÿÿþÿÿþzPE.relocate_imagec C s | j j| ¡ kS r )r| ZCheckSumÚgenerate_checksumrã r r r Úverify_checksum s zPE.verify_checksumc C s( | ¡ | _| j ¡ d }d}t| jd }t| jd| |dk }tt|d D ] }|t|d krjqT|d t|d kr®|r®t d| j|d d
dd| ¡d }n&t d| j|d |d d
¡d }||7 }|dkrT|d@ |d ? }qT|d
|
@ |d ? }||d ? }|d
|
@ }|t| j S ) NrR r r? r0 r r` rÆ r r- rÐ r. ) r r r| rH rÀ rº r rÁ r )rä Zchecksum_offsetr Ú remainderZdata_lenrÈ r r r r r0 s.
|
ÿþ& zPE.generate_checksumc C s0 t d }| ¡ s,| ¡ s,|| jj@ |kr,dS dS )zùCheck whether the file is a standard executable.
|
|
This will return true only if the file has the IMAGE_FILE_EXECUTABLE_IMAGE flag
|
set and the IMAGE_FILE_DLL not set and the file does not appear to be a driver
|
either.
|
rQ TF)rå Úis_dllr rä r
)rä ZEXE_flagr r r Úis_exeÌ s ÿþýz PE.is_exec C s t d }|| jj@ |kr dS dS )zCheck whether the file is a standard DLL.
|
|
This will return true only if the image has the IMAGE_FILE_DLL flag set.
|
rU TF)rå rä r
)rä ZDLL_flagr r r r3 ß s z PE.is_dllc C s t | ds | jtd gd t | ds*dS td}| dd | jD ¡rLdS td }| d
|
d | jD ¡r| jjt d t d fkrdS dS ) zCheck whether the file is a Windows driver.
|
|
This will return true only if there are reliable indicators of the image
|
being a driver.
|
r± r9 r F)s ntoskrnl.exes hal.dlls ndis.syss bootvid.dlls kdcom.dllc S s g | ]}|j ¡ qS r )r r§ )r2 r· r r r r4 s z PE.is_driver.<locals>.<listcomp>T)s pages pagedc S s g | ]}|j ¡ d ¡qS )r` )r r§ rj )r2 r r r r r4 s r^ r_ )
|
r r rí r^ Ú intersectionr± r¯ r| Z SubsystemÚSUBSYSTEM_TYPE)rä Z system_DLLsZdriver_like_section_namesr r r r ì s2
|
ÿ
|
ÿÿÿþÿý z PE.is_driverc sÒ d t | jf fdd }t| dr:|| j ¡ | jjf | jD ]}||j|j f q@t
|
d g}t | jj D ]F\}}||kr~qlz|| |j¡|jf W ql tk
|
r° Y qlY qlX qlt | jt krÎt S dS )zoGet the offset of data appended to the file and not contained within
|
the area described in the headers.rÈ c s$ t | |kr t | t kr | S S r )Úsum)Zoffset_and_sizeÚ file_size©Zlargest_offset_and_sizer r Ú'update_if_sum_is_larger_and_within_file, s
|
ÿzQPE.get_overlay_data_start_offset.<locals>.update_if_sum_is_larger_and_within_filer| r> N)rÀ r r r| rH rä ræ r¯ rs ru rí rM rë r rt rQ rû r7 )rä r: r Zskip_directoriesrO re r r9 r Ú get_overlay_data_start_offset& s4 ÿ
|
þÿ
|
|
ÿ
|
ÿ z PE.get_overlay_data_start_offsetc C s" | ¡ }|dk r | j|d
S dS )zeGet the data appended to the file and not contained within the area described
|
in the headers.N©r; r ©rä Zoverlay_data_offsetr r r Ú get_overlayT s zPE.get_overlayc C s, | ¡ }|dk r | jd|
S | jdd
S )zKReturn the just data defined by the PE headers, removing any overlaid data.Nr< r= r r r Útrim_ s zPE.trimc C s: |t kr0| jdkr0t|s0| j d| ¡ d| _t||S )NFz=If FileAlignment > 0x200 it should be a power of 2. Value: %xT)r r³ rØ r° rý r" )rä r r! r r r r{ v s ÿÿzPE.adjust_FileAlignmentc C s@ |t k r4||kr4| jdkr4| j d||f ¡ d| _t|||S )NFzAIf FileAlignment(%x) < 0x200 it should equal SectionAlignment(%x)T)r r´ r° rý r% )rä r r$ r! r r r r s ÿþÿÿzPE.adjust_SectionAlignment)N)NFF)N)r Nr N)F)r )F)NF)NF)rZ N)r N)rW N)ró )Nr )rê rë rì r rØ rã rì rç rè rÜ r r¡ r½ r rj r~ r| r r r r r r rÇ rÈ rZ rL rR r¸ r¹ rº r; r< r? r@ rF rG rH Z&__IMAGE_DYNAMIC_RELOCATION_V2_format__Z(__IMAGE_DYNAMIC_RELOCATION64_V2_format__r5 r7 r2 ÚMAX_SYMBOL_EXPORT_COUNTrà r¿ rÁ r¾ rÇ rÈ r½ r rü r ró r rð r r+ r* r' r( rA r& rI rN rO r% r$ rt rl rv r# r r r) r¯ r¸ rº r" r¢ rà rË rÏ r r r r9 r rÐ r8 rù r6 rò rô rÕ r× rØ rÓ rq r r r r> r
|
r rß r r r r r rç r r r r r r r rá r rÍ r r rÊ r1 r0 r4 r3 r r; r> r? r{ r r r r r rd s< H $# 12ú
|
6 rQ
|
|
7 ÿ
|
bZw 5Z
|
=,( ,
|
9 8
|
m
|
0
|
o ú
|
|
|
I
|
"
|
+
|
|
" ( _0 :. rd c C s dd l } d}| jdd
s$t| nx| jd dkr| jdd
sJ| d¡ t| jd }|jjD ]"}tt|jj |j
|
|j |j q`ntt| jd ¡ d S )Nr z1pefile.py <filename>
|
pefile.py exports <filename>r0 r r; zerror: <filename> required)r° Úargvr Úexitrd r¹ r r r| r rÑ r? rÎ rÓ )r° Úusagerï r r r r Úmain s
|
|
ÿrD Ú__main__)r
|
FF)F) r Ú
|
__author__Ú __version__Z __contact__r rÏ rÁ rÛ rf r rñ r r\ r Útypingr Úhashlibr r r r r r r r¥ Úregister_errorÚ lookup_errorr re r r" r% r) r« r9 r£ rÄ r¤ r r rk ri r@ rÛ rÚ rÞ rß rà rá râ Z IMAGE_NUMBEROF_DIRECTORY_ENTRIESrÕ r× rÔ rÖ r7 Zdirectory_entry_typesrí Zimage_characteristicsrå Zsection_characteristicsr Z debug_typesrô Zsubsystem_typesr6 Z machine_typesr1 Zrelocation_typesrõ Zdll_characteristicsré r r r Z registersr( r& r+ r2 r4 r9 r@ rM rE rI rK Z resource_typerp rg r¹ rh r» r5 r½ r¼ rý r¾ rÊ rÒ r× rØ rà r^ rÞ rî rÕ rû r r( r* r: r; rr r· r° rÉ rË rÍ rä rå rë rì rí rî rï rð rñ r÷ rø rù rú rû rü r r% r* r1 r3 r8 r? rD rH rJ rL r Úascii_lowercaseÚascii_uppercaser& r\ r_ ra rÌ rÍ rÚ Úboolrc rd rD rê r r r r Ú<module> sþ
|
|
ïðÒ1îòÜ'ôñýðë¢aj
|
K
|
*ñ
|
+ J I Ql B1 ! -
|
@"ÿþýÿ ÿÿ þ .
|
