refactor: removed DataReuser

This commit is contained in:
Dobin
2024-02-25 20:28:57 +00:00
parent 462f23d8cf
commit 5301ef7b2e
5 changed files with 25 additions and 146 deletions
-96
View File
@@ -6,23 +6,6 @@ import os
from model.exehost import DataReuseEntry
class PeSection():
def __init__(self, pefile_section):
self.name: str = pefile_section.Name.rstrip(b'\x00').decode("utf-8")
self.raw_addr: int = pefile_section.PointerToRawData
self.raw_size: int = pefile_section.SizeOfRawData
self.virt_addr: int = pefile_section.VirtualAddress
self.virt_size: int = pefile_section.Misc_VirtualSize
#self.permissions = pefile_section.Characteristics
class PeRelocation():
def __init__(self, reloc):
self.rva: int = reloc.rva
self.base_rva: int = reloc.base_rva
self.offset: int = reloc.rva - reloc.base_rva
self.type: str = pefile.RELOCATION_TYPE[reloc.type][0]
def bytes_to_asm_db(byte_data: bytes) -> bytes:
# Convert each byte to a string in hexadecimal format
@@ -120,82 +103,3 @@ class ReusedataAsmFileParser():
for line in self.lines:
asmfile.write(line + "\n")
class DataReuser():
def __init__(self, filepath):
self.pe = pefile.PE(filepath)
self.pe_sections: List[PeSection] = []
self.base_relocs: List[PeRelocation] = []
def init(self):
# Sections
for section in self.pe.sections:
self.pe_sections.append(PeSection(section))
# Base Relocations
if hasattr(self.pe, 'DIRECTORY_ENTRY_BASERELOC'):
for base_reloc in self.pe.DIRECTORY_ENTRY_BASERELOC:
for entry in base_reloc.entries:
self.base_relocs.append(PeRelocation(entry))
#self.pe.close()
def get_section_by_name(self, name: str) -> PeSection:
for section in self.pe_sections:
print("{} {}".format(section.name, name))
if section.name == name:
return section
return None
def get_relocations_all(self) -> List[PeRelocation]:
return self.base_relocs
def get_relocations_for_section(self, section_name) -> List[PeRelocation]:
section = self.get_section_by_name(section_name)
if section is None:
return []
return [reloc for reloc in self.base_relocs if reloc.base_rva == section.virt_addr]
def get_reloc_largest_gap(self, section_name=".rdata"):
tree = IntervalTree()
section = self.get_section_by_name(section_name)
#print("MOTHERFUCKER: {}".format(section))
#print("MOTHERFUCKER: {}".format(self.base_relocs))
print("-- Relocations: {}".format(len(self.base_relocs)))
print("-- section: 0x{:x}".format(section.virt_addr))
for reloc in self.base_relocs:
#print("FUCK: 0x{:x} 0x{:x}".format(reloc.base_rva, section.virt_addr))
if reloc.base_rva == section.virt_addr:
print("Adding reloc: {} {}".format(reloc.offset, reloc.offset + 8))
tree.add(Interval(reloc.offset, reloc.offset + 8))
tree.add(Interval(section.virt_size, section.virt_size + 1))
# Initialize variables to track the largest gap and its bounds
max_gap = 0
gap_start = None
gap_end = None
# Sort intervals for sequential comparison
sorted_intervals = sorted(tree)
for i in range(len(sorted_intervals) - 1):
current_end = sorted_intervals[i].end
next_start = sorted_intervals[i + 1].begin
gap = next_start - current_end
if gap > max_gap:
max_gap = gap
gap_start = current_end # Adjusted for the actual start of the gap
gap_end = next_start - 1 # Adjusted for the actual end of the gap
# Adjust for the artificial +1 in interval ends
if gap_start is not None and gap_end is not None:
gap_start -= 1
return max_gap - 1, gap_start, gap_end