feature: iat support tmp

This commit is contained in:
Dobin
2024-02-09 13:43:42 +00:00
parent e1f499030d
commit d7c8e1525f
6 changed files with 173 additions and 46 deletions
+1 -30
View File
@@ -1,4 +1,5 @@
import pefile
import pprint
from helper import *
from config import config
@@ -26,33 +27,3 @@ def make_shc_from_asm(asm_file, exe_file, shc_file):
return code
#print("---[ Shellcode from {} written to: {} (size: {}) ]".format(exe_file, shc_file, len(code)))
def get_code_section(pe_file):
try:
# Load the PE file
pe = pefile.PE(pe_file)
# Iterate over the sections
for section in pe.sections:
# Check if this is the code section
if '.text' in section.Name.decode().rstrip('\x00'):
data = section.get_data()
data = remove_trailing_null_bytes(data)
print(" > Code Size: {} (raw code section size: {})".format(
len(data), section.SizeOfRawData))
return data
else:
print("Code section not found.")
except FileNotFoundError:
print(f"File not found: {pe_file}")
except pefile.PEFormatError:
print(f"Invalid PE file: {pe_file}")
def remove_trailing_null_bytes(data):
for i in range(len(data) - 1, -1, -1):
if data[i] != b'\x00'[0]: # Check for a non-null byte
return data[:i + 1]
return b'' # If the entire sequence is null bytes