admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix pe_parse to handle 32bits PE in 64bits process (PE32 .NET)

Browse Source
This commit is contained in:
Clement Rouault
2016-04-08 16:11:55 +02:00
parent ef9b2486ec
commit 18bba9b24e
3 changed files with 113 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ctypes_generation/windef.txt
+52 -1
View File
@@ -953,4 +953,55 @@
#define CERT_E_UNTRUSTEDCA (0x800B0112L)
#define CERT_E_INVALID_POLICY (0x800B0113L)
#define CERT_E_INVALID_NAME (0x800B0114L)
#define CRYPT_E_FILE_ERROR (0x80092003L)
#define CRYPT_E_FILE_ERROR (0x80092003L)
#define IMAGE_SCN_TYPE_REG 0x00000000
#define IMAGE_SCN_TYPE_DSECT 0x00000001
#define IMAGE_SCN_TYPE_NOLOAD 0x00000002
#define IMAGE_SCN_TYPE_GROUP 0x00000004
#define IMAGE_SCN_TYPE_NO_PAD 0x00000008
#define IMAGE_SCN_TYPE_COPY 0x00000010
#define IMAGE_SCN_CNT_CODE 0x00000020
#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
#define IMAGE_SCN_LNK_OTHER 0x00000100
#define IMAGE_SCN_LNK_INFO 0x00000200
#define IMAGE_SCN_TYPE_OVER 0x00000400
#define IMAGE_SCN_LNK_REMOVE 0x00000800
#define IMAGE_SCN_LNK_COMDAT 0x00001000
#define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000
#define IMAGE_SCN_GPREL 0x00008000
#define IMAGE_SCN_MEM_FARDATA 0x00008000
#define IMAGE_SCN_MEM_PURGEABLE 0x00020000
#define IMAGE_SCN_MEM_16BIT 0x00020000
#define IMAGE_SCN_MEM_LOCKED 0x00040000
#define IMAGE_SCN_MEM_PRELOAD 0x00080000
#define IMAGE_SCN_ALIGN_1BYTES 0x00100000
#define IMAGE_SCN_ALIGN_2BYTES 0x00200000
#define IMAGE_SCN_ALIGN_4BYTES 0x00300000
#define IMAGE_SCN_ALIGN_8BYTES 0x00400000
#define IMAGE_SCN_ALIGN_16BYTES 0x00500000
#define IMAGE_SCN_ALIGN_32BYTES 0x00600000
#define IMAGE_SCN_ALIGN_64BYTES 0x00700000
#define IMAGE_SCN_ALIGN_128BYTES 0x00800000
#define IMAGE_SCN_ALIGN_256BYTES 0x00900000
#define IMAGE_SCN_ALIGN_512BYTES 0x00A00000
#define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000
#define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000
#define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000
#define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000
#define IMAGE_SCN_ALIGN_MASK 0x00F00000
#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
#define IMAGE_SCN_MEM_SHARED 0x10000000
#define IMAGE_SCN_MEM_EXECUTE 0x20000000
#define IMAGE_SCN_MEM_READ 0x40000000
#define IMAGE_SCN_MEM_WRITE 0x80000000
windows/generated_def/windef.py
+45 -1
View File
@@ -2649,4 +2649,48 @@ TRUST_E_EXPLICIT_DISTRUST = Flag("TRUST_E_EXPLICIT_DISTRUST", ( 0x800B0111 ))
CERT_E_UNTRUSTEDCA = Flag("CERT_E_UNTRUSTEDCA", ( 0x800B0112 ))
CERT_E_INVALID_POLICY = Flag("CERT_E_INVALID_POLICY", ( 0x800B0113 ))
CERT_E_INVALID_NAME = Flag("CERT_E_INVALID_NAME", ( 0x800B0114 ))
CRYPT_E_FILE_ERROR = Flag("CRYPT_E_FILE_ERROR", ( 0x80092003 ))
CRYPT_E_FILE_ERROR = Flag("CRYPT_E_FILE_ERROR", ( 0x80092003 ))
IMAGE_SCN_TYPE_REG = Flag("IMAGE_SCN_TYPE_REG", 0x00000000)
IMAGE_SCN_TYPE_DSECT = Flag("IMAGE_SCN_TYPE_DSECT", 0x00000001)
IMAGE_SCN_TYPE_NOLOAD = Flag("IMAGE_SCN_TYPE_NOLOAD", 0x00000002)
IMAGE_SCN_TYPE_GROUP = Flag("IMAGE_SCN_TYPE_GROUP", 0x00000004)
IMAGE_SCN_TYPE_NO_PAD = Flag("IMAGE_SCN_TYPE_NO_PAD", 0x00000008)
IMAGE_SCN_TYPE_COPY = Flag("IMAGE_SCN_TYPE_COPY", 0x00000010)
IMAGE_SCN_CNT_CODE = Flag("IMAGE_SCN_CNT_CODE", 0x00000020)
IMAGE_SCN_CNT_INITIALIZED_DATA = Flag("IMAGE_SCN_CNT_INITIALIZED_DATA", 0x00000040)
IMAGE_SCN_CNT_UNINITIALIZED_DATA = Flag("IMAGE_SCN_CNT_UNINITIALIZED_DATA", 0x00000080)
IMAGE_SCN_LNK_OTHER = Flag("IMAGE_SCN_LNK_OTHER", 0x00000100)
IMAGE_SCN_LNK_INFO = Flag("IMAGE_SCN_LNK_INFO", 0x00000200)
IMAGE_SCN_TYPE_OVER = Flag("IMAGE_SCN_TYPE_OVER", 0x00000400)
IMAGE_SCN_LNK_REMOVE = Flag("IMAGE_SCN_LNK_REMOVE", 0x00000800)
IMAGE_SCN_LNK_COMDAT = Flag("IMAGE_SCN_LNK_COMDAT", 0x00001000)
IMAGE_SCN_NO_DEFER_SPEC_EXC = Flag("IMAGE_SCN_NO_DEFER_SPEC_EXC", 0x00004000)
IMAGE_SCN_GPREL = Flag("IMAGE_SCN_GPREL", 0x00008000)
IMAGE_SCN_MEM_FARDATA = Flag("IMAGE_SCN_MEM_FARDATA", 0x00008000)
IMAGE_SCN_MEM_PURGEABLE = Flag("IMAGE_SCN_MEM_PURGEABLE", 0x00020000)
IMAGE_SCN_MEM_16BIT = Flag("IMAGE_SCN_MEM_16BIT", 0x00020000)
IMAGE_SCN_MEM_LOCKED = Flag("IMAGE_SCN_MEM_LOCKED", 0x00040000)
IMAGE_SCN_MEM_PRELOAD = Flag("IMAGE_SCN_MEM_PRELOAD", 0x00080000)
IMAGE_SCN_ALIGN_1BYTES = Flag("IMAGE_SCN_ALIGN_1BYTES", 0x00100000)
IMAGE_SCN_ALIGN_2BYTES = Flag("IMAGE_SCN_ALIGN_2BYTES", 0x00200000)
IMAGE_SCN_ALIGN_4BYTES = Flag("IMAGE_SCN_ALIGN_4BYTES", 0x00300000)
IMAGE_SCN_ALIGN_8BYTES = Flag("IMAGE_SCN_ALIGN_8BYTES", 0x00400000)
IMAGE_SCN_ALIGN_16BYTES = Flag("IMAGE_SCN_ALIGN_16BYTES", 0x00500000)
IMAGE_SCN_ALIGN_32BYTES = Flag("IMAGE_SCN_ALIGN_32BYTES", 0x00600000)
IMAGE_SCN_ALIGN_64BYTES = Flag("IMAGE_SCN_ALIGN_64BYTES", 0x00700000)
IMAGE_SCN_ALIGN_128BYTES = Flag("IMAGE_SCN_ALIGN_128BYTES", 0x00800000)
IMAGE_SCN_ALIGN_256BYTES = Flag("IMAGE_SCN_ALIGN_256BYTES", 0x00900000)
IMAGE_SCN_ALIGN_512BYTES = Flag("IMAGE_SCN_ALIGN_512BYTES", 0x00A00000)
IMAGE_SCN_ALIGN_1024BYTES = Flag("IMAGE_SCN_ALIGN_1024BYTES", 0x00B00000)
IMAGE_SCN_ALIGN_2048BYTES = Flag("IMAGE_SCN_ALIGN_2048BYTES", 0x00C00000)
IMAGE_SCN_ALIGN_4096BYTES = Flag("IMAGE_SCN_ALIGN_4096BYTES", 0x00D00000)
IMAGE_SCN_ALIGN_8192BYTES = Flag("IMAGE_SCN_ALIGN_8192BYTES", 0x00E00000)
IMAGE_SCN_ALIGN_MASK = Flag("IMAGE_SCN_ALIGN_MASK", 0x00F00000)
IMAGE_SCN_LNK_NRELOC_OVFL = Flag("IMAGE_SCN_LNK_NRELOC_OVFL", 0x01000000)
IMAGE_SCN_MEM_DISCARDABLE = Flag("IMAGE_SCN_MEM_DISCARDABLE", 0x02000000)
IMAGE_SCN_MEM_NOT_CACHED = Flag("IMAGE_SCN_MEM_NOT_CACHED", 0x04000000)
IMAGE_SCN_MEM_NOT_PAGED = Flag("IMAGE_SCN_MEM_NOT_PAGED", 0x08000000)
IMAGE_SCN_MEM_SHARED = Flag("IMAGE_SCN_MEM_SHARED", 0x10000000)
IMAGE_SCN_MEM_EXECUTE = Flag("IMAGE_SCN_MEM_EXECUTE", 0x20000000)
IMAGE_SCN_MEM_READ = Flag("IMAGE_SCN_MEM_READ", 0x40000000)
IMAGE_SCN_MEM_WRITE = Flag("IMAGE_SCN_MEM_WRITE", 0x80000000)
windows/pe_parse.py
+16 -3
View File
@@ -190,7 +190,18 @@ def GetPEFile(baseaddr, target=None, force_bitness=None):
return self.get_NT_HEADER().OptionalHeader
def get_DataDirectory(self):
return self.get_OptionalHeader().DataDirectory
# This won't work if we load a PE32 in a 64bit process
# PE32 .NET...
#return self.get_OptionalHeader().DataDirectory
DataDirectory_type = IMAGE_DATA_DIRECTORY * IMAGE_NUMBEROF_DIRECTORY_ENTRIES
SizeOfOptionalHeader = self.get_NT_HEADER().FileHeader.SizeOfOptionalHeader
if target is None:
opt_header_addr = ctypes.addressof(self.get_NT_HEADER().OptionalHeader)
else:
opt_header_addr = self.get_NT_HEADER().OptionalHeader._base_addr
DataDirectory_addr = opt_header_addr + SizeOfOptionalHeader - ctypes.sizeof(DataDirectory_type)
return create_structure_at(DataDirectory_type, DataDirectory_addr)
def get_IMPORT_DESCRIPTORS(self):
import_datadir = self.get_DataDirectory()[IMAGE_DIRECTORY_ENTRY_IMPORT]
@@ -237,10 +248,12 @@ def GetPEFile(baseaddr, target=None, force_bitness=None):
def sections(self):
nt_header = self.get_NT_HEADER()
nb_section = nt_header.FileHeader.NumberOfSections
SizeOfOptionalHeader = self.get_NT_HEADER().FileHeader.SizeOfOptionalHeader
if target is None:
base_section = ctypes.addressof(nt_header) + ctypes.sizeof(nt_header)
opt_header_addr = ctypes.addressof(self.get_NT_HEADER().OptionalHeader)
else:
base_section = nt_header._base_addr + ctypes.sizeof(nt_header)
opt_header_addr = self.get_NT_HEADER().OptionalHeader._base_addr
base_section = opt_header_addr + SizeOfOptionalHeader
sections_array = create_structure_at((self.PESection * nb_section), base_section)
return list(sections_array)