diff --git a/ctypes_generation/windef.txt b/ctypes_generation/windef.txt index 7c09958..38788be 100644 --- a/ctypes_generation/windef.txt +++ b/ctypes_generation/windef.txt @@ -953,4 +953,55 @@ #define CERT_E_UNTRUSTEDCA (0x800B0112L) #define CERT_E_INVALID_POLICY (0x800B0113L) #define CERT_E_INVALID_NAME (0x800B0114L) -#define CRYPT_E_FILE_ERROR (0x80092003L) \ No newline at end of file +#define CRYPT_E_FILE_ERROR (0x80092003L) + + + +#define IMAGE_SCN_TYPE_REG 0x00000000 +#define IMAGE_SCN_TYPE_DSECT 0x00000001 +#define IMAGE_SCN_TYPE_NOLOAD 0x00000002 +#define IMAGE_SCN_TYPE_GROUP 0x00000004 +#define IMAGE_SCN_TYPE_NO_PAD 0x00000008 +#define IMAGE_SCN_TYPE_COPY 0x00000010 + +#define IMAGE_SCN_CNT_CODE 0x00000020 +#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 +#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 + +#define IMAGE_SCN_LNK_OTHER 0x00000100 +#define IMAGE_SCN_LNK_INFO 0x00000200 +#define IMAGE_SCN_TYPE_OVER 0x00000400 +#define IMAGE_SCN_LNK_REMOVE 0x00000800 +#define IMAGE_SCN_LNK_COMDAT 0x00001000 +#define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000 +#define IMAGE_SCN_GPREL 0x00008000 +#define IMAGE_SCN_MEM_FARDATA 0x00008000 +#define IMAGE_SCN_MEM_PURGEABLE 0x00020000 +#define IMAGE_SCN_MEM_16BIT 0x00020000 +#define IMAGE_SCN_MEM_LOCKED 0x00040000 +#define IMAGE_SCN_MEM_PRELOAD 0x00080000 + +#define IMAGE_SCN_ALIGN_1BYTES 0x00100000 +#define IMAGE_SCN_ALIGN_2BYTES 0x00200000 +#define IMAGE_SCN_ALIGN_4BYTES 0x00300000 +#define IMAGE_SCN_ALIGN_8BYTES 0x00400000 +#define IMAGE_SCN_ALIGN_16BYTES 0x00500000 +#define IMAGE_SCN_ALIGN_32BYTES 0x00600000 +#define IMAGE_SCN_ALIGN_64BYTES 0x00700000 +#define IMAGE_SCN_ALIGN_128BYTES 0x00800000 +#define IMAGE_SCN_ALIGN_256BYTES 0x00900000 +#define IMAGE_SCN_ALIGN_512BYTES 0x00A00000 +#define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000 +#define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000 +#define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000 +#define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000 +#define IMAGE_SCN_ALIGN_MASK 0x00F00000 + +#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 +#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 +#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 +#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 +#define IMAGE_SCN_MEM_SHARED 0x10000000 +#define IMAGE_SCN_MEM_EXECUTE 0x20000000 +#define IMAGE_SCN_MEM_READ 0x40000000 +#define IMAGE_SCN_MEM_WRITE 0x80000000 \ No newline at end of file diff --git a/windows/generated_def/windef.py b/windows/generated_def/windef.py index f958ca5..97fbf5e 100644 --- a/windows/generated_def/windef.py +++ b/windows/generated_def/windef.py @@ -2649,4 +2649,48 @@ TRUST_E_EXPLICIT_DISTRUST = Flag("TRUST_E_EXPLICIT_DISTRUST", ( 0x800B0111 )) CERT_E_UNTRUSTEDCA = Flag("CERT_E_UNTRUSTEDCA", ( 0x800B0112 )) CERT_E_INVALID_POLICY = Flag("CERT_E_INVALID_POLICY", ( 0x800B0113 )) CERT_E_INVALID_NAME = Flag("CERT_E_INVALID_NAME", ( 0x800B0114 )) -CRYPT_E_FILE_ERROR = Flag("CRYPT_E_FILE_ERROR", ( 0x80092003 )) \ No newline at end of file +CRYPT_E_FILE_ERROR = Flag("CRYPT_E_FILE_ERROR", ( 0x80092003 )) +IMAGE_SCN_TYPE_REG = Flag("IMAGE_SCN_TYPE_REG", 0x00000000) +IMAGE_SCN_TYPE_DSECT = Flag("IMAGE_SCN_TYPE_DSECT", 0x00000001) +IMAGE_SCN_TYPE_NOLOAD = Flag("IMAGE_SCN_TYPE_NOLOAD", 0x00000002) +IMAGE_SCN_TYPE_GROUP = Flag("IMAGE_SCN_TYPE_GROUP", 0x00000004) +IMAGE_SCN_TYPE_NO_PAD = Flag("IMAGE_SCN_TYPE_NO_PAD", 0x00000008) +IMAGE_SCN_TYPE_COPY = Flag("IMAGE_SCN_TYPE_COPY", 0x00000010) +IMAGE_SCN_CNT_CODE = Flag("IMAGE_SCN_CNT_CODE", 0x00000020) +IMAGE_SCN_CNT_INITIALIZED_DATA = Flag("IMAGE_SCN_CNT_INITIALIZED_DATA", 0x00000040) +IMAGE_SCN_CNT_UNINITIALIZED_DATA = Flag("IMAGE_SCN_CNT_UNINITIALIZED_DATA", 0x00000080) +IMAGE_SCN_LNK_OTHER = Flag("IMAGE_SCN_LNK_OTHER", 0x00000100) +IMAGE_SCN_LNK_INFO = Flag("IMAGE_SCN_LNK_INFO", 0x00000200) +IMAGE_SCN_TYPE_OVER = Flag("IMAGE_SCN_TYPE_OVER", 0x00000400) +IMAGE_SCN_LNK_REMOVE = Flag("IMAGE_SCN_LNK_REMOVE", 0x00000800) +IMAGE_SCN_LNK_COMDAT = Flag("IMAGE_SCN_LNK_COMDAT", 0x00001000) +IMAGE_SCN_NO_DEFER_SPEC_EXC = Flag("IMAGE_SCN_NO_DEFER_SPEC_EXC", 0x00004000) +IMAGE_SCN_GPREL = Flag("IMAGE_SCN_GPREL", 0x00008000) +IMAGE_SCN_MEM_FARDATA = Flag("IMAGE_SCN_MEM_FARDATA", 0x00008000) +IMAGE_SCN_MEM_PURGEABLE = Flag("IMAGE_SCN_MEM_PURGEABLE", 0x00020000) +IMAGE_SCN_MEM_16BIT = Flag("IMAGE_SCN_MEM_16BIT", 0x00020000) +IMAGE_SCN_MEM_LOCKED = Flag("IMAGE_SCN_MEM_LOCKED", 0x00040000) +IMAGE_SCN_MEM_PRELOAD = Flag("IMAGE_SCN_MEM_PRELOAD", 0x00080000) +IMAGE_SCN_ALIGN_1BYTES = Flag("IMAGE_SCN_ALIGN_1BYTES", 0x00100000) +IMAGE_SCN_ALIGN_2BYTES = Flag("IMAGE_SCN_ALIGN_2BYTES", 0x00200000) +IMAGE_SCN_ALIGN_4BYTES = Flag("IMAGE_SCN_ALIGN_4BYTES", 0x00300000) +IMAGE_SCN_ALIGN_8BYTES = Flag("IMAGE_SCN_ALIGN_8BYTES", 0x00400000) +IMAGE_SCN_ALIGN_16BYTES = Flag("IMAGE_SCN_ALIGN_16BYTES", 0x00500000) +IMAGE_SCN_ALIGN_32BYTES = Flag("IMAGE_SCN_ALIGN_32BYTES", 0x00600000) +IMAGE_SCN_ALIGN_64BYTES = Flag("IMAGE_SCN_ALIGN_64BYTES", 0x00700000) +IMAGE_SCN_ALIGN_128BYTES = Flag("IMAGE_SCN_ALIGN_128BYTES", 0x00800000) +IMAGE_SCN_ALIGN_256BYTES = Flag("IMAGE_SCN_ALIGN_256BYTES", 0x00900000) +IMAGE_SCN_ALIGN_512BYTES = Flag("IMAGE_SCN_ALIGN_512BYTES", 0x00A00000) +IMAGE_SCN_ALIGN_1024BYTES = Flag("IMAGE_SCN_ALIGN_1024BYTES", 0x00B00000) +IMAGE_SCN_ALIGN_2048BYTES = Flag("IMAGE_SCN_ALIGN_2048BYTES", 0x00C00000) +IMAGE_SCN_ALIGN_4096BYTES = Flag("IMAGE_SCN_ALIGN_4096BYTES", 0x00D00000) +IMAGE_SCN_ALIGN_8192BYTES = Flag("IMAGE_SCN_ALIGN_8192BYTES", 0x00E00000) +IMAGE_SCN_ALIGN_MASK = Flag("IMAGE_SCN_ALIGN_MASK", 0x00F00000) +IMAGE_SCN_LNK_NRELOC_OVFL = Flag("IMAGE_SCN_LNK_NRELOC_OVFL", 0x01000000) +IMAGE_SCN_MEM_DISCARDABLE = Flag("IMAGE_SCN_MEM_DISCARDABLE", 0x02000000) +IMAGE_SCN_MEM_NOT_CACHED = Flag("IMAGE_SCN_MEM_NOT_CACHED", 0x04000000) +IMAGE_SCN_MEM_NOT_PAGED = Flag("IMAGE_SCN_MEM_NOT_PAGED", 0x08000000) +IMAGE_SCN_MEM_SHARED = Flag("IMAGE_SCN_MEM_SHARED", 0x10000000) +IMAGE_SCN_MEM_EXECUTE = Flag("IMAGE_SCN_MEM_EXECUTE", 0x20000000) +IMAGE_SCN_MEM_READ = Flag("IMAGE_SCN_MEM_READ", 0x40000000) +IMAGE_SCN_MEM_WRITE = Flag("IMAGE_SCN_MEM_WRITE", 0x80000000) \ No newline at end of file diff --git a/windows/pe_parse.py b/windows/pe_parse.py index a0cb469..b2e3b34 100644 --- a/windows/pe_parse.py +++ b/windows/pe_parse.py @@ -190,7 +190,18 @@ def GetPEFile(baseaddr, target=None, force_bitness=None): return self.get_NT_HEADER().OptionalHeader def get_DataDirectory(self): - return self.get_OptionalHeader().DataDirectory + # This won't work if we load a PE32 in a 64bit process + # PE32 .NET... + #return self.get_OptionalHeader().DataDirectory + DataDirectory_type = IMAGE_DATA_DIRECTORY * IMAGE_NUMBEROF_DIRECTORY_ENTRIES + SizeOfOptionalHeader = self.get_NT_HEADER().FileHeader.SizeOfOptionalHeader + if target is None: + opt_header_addr = ctypes.addressof(self.get_NT_HEADER().OptionalHeader) + else: + opt_header_addr = self.get_NT_HEADER().OptionalHeader._base_addr + DataDirectory_addr = opt_header_addr + SizeOfOptionalHeader - ctypes.sizeof(DataDirectory_type) + return create_structure_at(DataDirectory_type, DataDirectory_addr) + def get_IMPORT_DESCRIPTORS(self): import_datadir = self.get_DataDirectory()[IMAGE_DIRECTORY_ENTRY_IMPORT] @@ -237,10 +248,12 @@ def GetPEFile(baseaddr, target=None, force_bitness=None): def sections(self): nt_header = self.get_NT_HEADER() nb_section = nt_header.FileHeader.NumberOfSections + SizeOfOptionalHeader = self.get_NT_HEADER().FileHeader.SizeOfOptionalHeader if target is None: - base_section = ctypes.addressof(nt_header) + ctypes.sizeof(nt_header) + opt_header_addr = ctypes.addressof(self.get_NT_HEADER().OptionalHeader) else: - base_section = nt_header._base_addr + ctypes.sizeof(nt_header) + opt_header_addr = self.get_NT_HEADER().OptionalHeader._base_addr + base_section = opt_header_addr + SizeOfOptionalHeader sections_array = create_structure_at((self.PESection * nb_section), base_section) return list(sections_array)