U
|
T ±d¹G ã @ sv d Z ddlZddlZddlZddlZddlZddlZddlZdZ ej
|
Z
|
dZ G dd de Z dd Zd d
|
Zd d ZdS ) zpeutils, Portable Executable utilities module
|
|
|
Copyright (c) 2005-2023 Ero Carrera <ero.carrera@gmail.com>
|
|
All rights reserved.
|
é Nz Ero Carrerazero.carrera@gmail.comc @ s| e Zd ZdZd ddZd ddZd dd Zd d d Zd!ddZd"ddZ dd Z
|
d#ddZ d$ddZ d%ddZ d&dd ZdS )'ÚSignatureDatabasea± This class loads and keeps a parsed PEiD signature database.
|
|
Usage:
|
|
sig_db = SignatureDatabase('/path/to/signature/file')
|
|
and/or
|
|
sig_db = SignatureDatabase()
|
sig_db.load('/path/to/signature/file')
|
|
Signature databases can be combined by performing multiple loads.
|
|
The filename parameter can be a URL too. In that case the
|
signature database will be downloaded from that location.
|
Nc C sR t dt j¡| _t | _d| _t | _d| _t | _ d| _
|
d| _ | j ||d d S )Nzh\[(.*?)\]\s+?signature\s*=\s*(.*?)(\s+\?\?)*\s*ep_only\s*=\s*(\w+)(?:\s*section_start_only\s*=\s*(\w+)|)r ©ÚfilenameÚdata) ÚreÚcompileÚSÚ parse_sigÚdictÚsignature_tree_eponly_trueÚsignature_count_eponly_trueÚsignature_tree_eponly_falseÚ signature_count_eponly_falseÚ signature_tree_section_startÚ signature_count_section_startÚ max_depthÚ_SignatureDatabase__load©Úselfr r © r ú>d:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\peutils.pyÚ__init__& s þzSignatureDatabase.__init__é c C s t }t|jD ]b\}}|j|k r$q|j}d||d t|jd dd |jD ¡f }| | j |||dd|d¡ qd |¡d S )
|
a Generates signatures for all the sections in a PE file.
|
|
If the section contains any data a signature will be created
|
for it. The signature name will be a combination of the
|
parameter 'name' and the section number and its name.
|
z%s Section(%d/%d,%s)é Ú c S s g | ]}|t jkr|qS r )ÚstringÚ printable©Ú.0Úcr r r Ú
|
<listcomp>^ s
|
zASignatureDatabase.generate_section_signatures.<locals>.<listcomp>FT)Úep_onlyÚsection_start_onlyÚ
|
sig_lengthÚ
|
)
|
ÚlistÚ enumerateÚsectionsZ SizeOfRawDataÚPointerToRawDataÚlenÚjoinÚNameÚappendÚ&_SignatureDatabase__generate_signature) r ÚpeÚnamer# Zsection_signaturesÚidxÚsectionÚoffsetZsig_namer r r Úgenerate_section_signaturesH s,
|
üúÿ z-SignatureDatabase.generate_section_signaturesc C s" | |jj¡}| j|||d|dS )z°Generate signatures for the entry point of a PE file.
|
|
Creates a signature whose name will be the parameter 'name'
|
and the section number and its name.
|
T)r! r# )Zget_offset_from_rvaÚOPTIONAL_HEADERÚAddressOfEntryPointr- )r r. r/ r# r2 r r r Úgenerate_ep_signaturen s ÿz'SignatureDatabase.generate_ep_signatureFc
|
C s^ |j |||
}d dd |D ¡}|dkr4d}nd}|dkrFd}nd}d||||f } | S )Nú c S s g | ]}d t | qS )z%02x)Úordr r r r r s z:SignatureDatabase.__generate_signature.<locals>.<listcomp>TÚtrueÚfalsez9[%s]
|
signature = %s
|
ep_only = %s
|
section_start_only = %s
|
)Ú__data__r* )
|
r r. r2 r/ r! r" r# r Úsignature_bytesÚ signaturer r r Z__generate_signature{ s üz&SignatureDatabase.__generate_signatureTc C s8 | |||¡}|r4|dkr(dd |D S |d d S dS )a Matches and returns the exact match(es).
|
|
If ep_only is True the result will be a string with
|
the packer name. Otherwise it will be a list of the
|
form (file_offset, packer_name) specifying where
|
in the file the signature was found.
|
Fc S s g | ]}|d |d d fqS )r r éÿÿÿÿr )r Úmatchr r r r © s z+SignatureDatabase.match.<locals>.<listcomp>r r> N©Ú_SignatureDatabase__match©r r. r! r" Úmatchesr r r r? s zSignatureDatabase.matchc C s* | |||¡}|r&|dkr |S |d S dS )z+Matches and returns all the likely matches.Fr Nr@ rB r r r Ú match_all¯ s zSignatureDatabase.match_allc
|
C s |dkrPz
|
|j }W n$ tk
|
r6 } z W 5 d }~X Y nX | j}dd |jD }nh|dkr z | ¡ }W n$ tk
|
r } z W 5 d }~X Y nX | j}|jj}|g}n|j }| j}t t
|
|}g } |D ]0}
|
| |||
|
|
|
| j
¡} | rÀ| |
|
| f¡ qÀ|dkr
|
| r
|
| d S | S )NTc S s g | ]
|
}|j qS r )r( )r r1 r r r r Õ s z-SignatureDatabase.__match.<locals>.<listcomp>r )r; Ú Exceptionr r' Zget_memory_mapped_imager r4 r5 r Úranger) Ú(_SignatureDatabase__match_signature_treer r, ) r r. r! r" r ZexcpÚ
|
signaturesÚscan_addressesÚeprC r0 Úresultr r r Z__match¿ s<
|
ÿ
|
zSignatureDatabase.__matchc
|
C sz |}dg}|dkr| j }n|dkr(| j}g }|D ]0}| ||||| j
¡} | r0| || f¡ q0|dkrv|rv|d S |S )Nr T)r r rG r r, )
|
r Z code_datar! r" r rI rH rC r0 rK r r r Ú
|
match_data
|
s$ ÿz SignatureDatabase.match_datar c C s2 t }|}tdd |D D ]´\}}|dkr0 qÒ| |d¡}dt | ¡ krt } t | ¡ D ] }
|
|
|
d dkr^| |
|
d ¡ q^| | ¡ d|krÌ| dd¡} ||d d
} | rÌ| | | | || d ¡¡ |}q |dk r.dt | ¡ kr.t } t | ¡ D ]"}
|
|
|
d dkr | |
|
d ¡ q | | ¡ |S )a
|
Recursive function to find matches along the signature tree.
|
|
signature_tree is the part of the tree left to walk
|
data is the data being checked against the signature tree
|
depth keeps track of how far we have gone down the tree
|
c S s" g | ]}t |tr|nt|qS r )Ú
|
isinstanceÚintr8 ©r Úbr r r r D s z<SignatureDatabase.__match_signature_tree.<locals>.<listcomp>Nr r z??)r% r& ÚgetÚvaluesÚitemsr, ÚextendrG ) r Zsignature_treer ÚdepthZ matched_namesr? r0 ÚbyteZ
|
match_nextÚnamesÚitemZmatch_tree_alternateZdata_remainingr r r Z__match_signature_tree6 s>
|
|
ÿÿ
|
z(SignatureDatabase.__match_signature_treec C s | j ||d dS )znLoad a PEiD signature file.
|
|
Invoking this method on different files combines the signatures.
|
r N)r r r r r Úload~ s zSignatureDatabase.loadc sè |d k rt j |¡sNz tj |¡}| ¡ }| ¡ W q tk
|
rJ Y qX qz t |d}| ¡ }| ¡ W q tk
|
r Y qX n|}|sd S dd | j
|
|¡}|D ]6\}}}} }
|
| ¡ ¡ } | dd¡ ¡ } fdd| ¡ D } | dkrúd } nd
|
} |
|
dkrd }
|
nd
|
}
|
d } |
|
d kr6| j} | jd 7 _n4| d krV| j} | jd 7 _n| j} | jd 7 _t| D ]^\}}|d t| kr¬| |t ¡| |< d | | |< n| |t ¡| |< | | } | d 7 } qr| | jkrª| | _qªd S ) NÚrtc S s d| kr | S t | dS )Nú?é )rN )Úvaluer r r Úto_byte¨ s z)SignatureDatabase.__load.<locals>.to_bytez\nr c s g | ] } |qS r r rO ©r^ r r r À s z,SignatureDatabase.__load.<locals>.<listcomp>r9 TFr r )ÚosÚpathÚexistsÚurllibÚrequestÚurlopenÚreadÚcloseÚIOErrorÚopenr ÚfindallÚstripÚlowerÚreplaceÚsplitr r r r r r r& r) rQ r
|
r )r r r Zsig_fZsig_datarC Z packer_namer= Zsuperfluous_wildcardsr! r" r< rU Útreer0 rV r r_ r Z__load sj
|
|
|
ú
|
|
|
|
zSignatureDatabase.__load)NN)r )r )FFr )TF)TF)TF)r )NN)NN)Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__r r3 r6 r- r? rD rA rL rG rY r r r r r r s
|
"
|
&
|
ÿ
|
|
|
K
|
,
|
H
|
r c C s dS )r Nr )r. r r r Úis_validí s rt c C s¢ d}d}t | dr| jD ]p}d}|jD ]`}|j| jj krJ|jd krRn nd}|dk r||j krt|d krn n|d7 }|j}q&qd}| ¡ }|r| dS )zp
|
unusual locations of import tables
|
non recognized section names
|
presence of long ASCII strings
|
Fr ÚDIRECTORY_ENTRY_BASERELOCNé Tr )Úhasattrru ÚentriesZrvar4 r5 Z get_warnings)r. Z relocations_overlap_entry_pointZsequential_relocsZ
|
base_relocZlast_reloc_rvaZrelocZwarnings_while_parsingÚwarningsr r r Ú is_suspiciousò s,
|
|
|
$ÿ þþ
|
|
rz c C s` t | ¡ }|sdS d}d}| jD ](}| ¡ }t | ¡ }|dkr"||7 }q"|| dkr\d}|S )a8 Returns True is there is a high likelihood that a file is packed or contains compressed data.
|
|
The sections of the PE file will be analyzed, if enough sections
|
look like containing compressed data and the data makes
|
up for more than 20% of the total file size, the function will
|
return True.
|
TFr g @gÉ?)r) Ztrimr' Z get_entropyÚget_data)r. Ztotal_pe_data_lengthZ)has_significant_amount_of_compressed_dataZtotal_compressed_datar1 Z s_entropyZs_lengthr r r Úis_probably_packed( s
|
|
r| )rs r` r r Úurllib.requestrc Ú urllib.parseÚ urllib.errorZpefileÚ
|
__author__Ú __version__Z __contact__Úobjectr rt rz r| r r r r Ú<module> s \6
|
