mirror of
https://github.com/dobin/SuperMega
synced 2026-06-03 01:27:11 +00:00
Dobin
69 lines
2.4 KiB
Python
69 lines
2.4 KiB
Python
from typing import List, Dict
|
|
import unittest
|
|
import pefile
|
|
|
|
from pe.superpe import SuperPe, PeSection
|
|
from model.defs import *
|
|
|
|
|
|
class SuperPeTest(unittest.TestCase):
|
|
|
|
def test_exe(self):
|
|
pass
|
|
|
|
|
|
def test_dll(self):
|
|
dll_filepath = PATH_EXES + "libbz2-1.dll"
|
|
superpe = SuperPe(dll_filepath)
|
|
|
|
# Properties
|
|
self.assertTrue(superpe.is_dll())
|
|
self.assertTrue(superpe.is_64())
|
|
self.assertFalse(superpe.is_dotnet())
|
|
self.assertEqual(superpe.get_entrypoint(), 0x1350)
|
|
self.assertIsNone(superpe.get_rwx_section())
|
|
|
|
# Text Section 1 (pefile SectionStructure)
|
|
code_sect: pefile.SectionStructure = superpe.get_code_section()
|
|
self.assertEqual(code_sect.Name.decode(), ".text\x00\x00\x00")
|
|
self.assertEqual(code_sect.VirtualAddress, 0x1000)
|
|
self.assertEqual(code_sect.Misc_VirtualSize, 0x12D08)
|
|
|
|
# Text Section 2 (PeSection)
|
|
code_pesect: PeSection = superpe.get_section_by_name(".text")
|
|
self.assertEqual(code_pesect.name, ".text")
|
|
self.assertEqual(code_pesect.virt_addr, 0x1000)
|
|
self.assertEqual(code_pesect.virt_size, 0x12D08)
|
|
|
|
# Relocations
|
|
base_relocs: List[PeRelocEntry] = superpe.get_base_relocs()
|
|
self.assertEqual(len(base_relocs), 54)
|
|
base_reloc = base_relocs[0]
|
|
self.assertEqual(base_reloc.rva, 0x13CE8)
|
|
self.assertEqual(base_reloc.base_rva, 0x13000)
|
|
self.assertEqual(base_reloc.offset, 0xCE8)
|
|
|
|
# IAT
|
|
iat_entries: Dict[str, IatEntry] = superpe.get_iat_entries()
|
|
self.assertEqual(len(iat_entries), 2)
|
|
self.assertTrue("KERNEL32.dll" in iat_entries)
|
|
self.assertTrue("msvcrt.dll" in iat_entries)
|
|
kernel32_entries = iat_entries["KERNEL32.dll"]
|
|
self.assertEqual(len(kernel32_entries), 12)
|
|
entry = kernel32_entries[0]
|
|
self.assertEqual(entry.dll_name, "KERNEL32.dll")
|
|
self.assertEqual(entry.func_name, "DeleteCriticalSection")
|
|
self.assertEqual(entry.iat_vaddr, 0x1f13db1c4)
|
|
|
|
# Exports
|
|
exports = superpe.get_exports_full()
|
|
self.assertEqual(len(exports), 35)
|
|
export = exports[0]
|
|
self.assertEqual(export["name"], "BZ2_blockSort")
|
|
self.assertEqual(export["addr"], 0x2FC0)
|
|
self.assertEqual(export["size"], 416)
|
|
|
|
# VRA/Virt to Phys/Raw
|
|
raw = superpe.get_offset_from_rva(0xD690) # BZ2_bzdopen export
|
|
self.assertEqual(raw, 0xCA90)
|