admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
4183646b28bd1fa91dc74372a9dc502c8545ea53
hakril-PythonForWindows/docs/build/html/_modules/windows/pe_parse.html
T

471 lines
59 KiB
HTML
Raw Blame History

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>windows.pe_parse &mdash; PythonForWindows 0.2 documentation</title>
<link rel="stylesheet" href="../../_static/classic.css" type="text/css" />
<link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
<script type="text/javascript">
var DOCUMENTATION_OPTIONS = {
URL_ROOT: '../../',
VERSION: '0.2',
COLLAPSE_INDEX: false,
FILE_SUFFIX: '.html',
HAS_SOURCE: true
};
</script>
<script type="text/javascript" src="../../_static/jquery.js"></script>
<script type="text/javascript" src="../../_static/underscore.js"></script>
<script type="text/javascript" src="../../_static/doctools.js"></script>
<link rel="top" title="PythonForWindows 0.2 documentation" href="../../index.html" />
<link rel="up" title="Module code" href="../index.html" />
</head>
<body role="document">
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.2 documentation</a> &raquo;</li>
<li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &raquo;</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<h1>Source code for windows.pe_parse</h1><div class="highlight"><pre>
<span></span><span class="kn">import</span> <span class="nn">ctypes</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.hooks</span> <span class="k">as</span> <span class="nn">hooks</span>
<span class="kn">import</span> <span class="nn">windows.utils</span> <span class="k">as</span> <span class="nn">utils</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="kn">from</span> <span class="nn">windows.utils</span> <span class="k">import</span> <span class="n">transform_ctypes_fields</span>
<span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
<span class="c1"># This must go to windefs</span>
<span class="n">IMAGE_DIRECTORY_ENTRY_EXPORT</span> <span class="o">=</span> <span class="mi">0</span>
<span class="n">IMAGE_DIRECTORY_ENTRY_IMPORT</span> <span class="o">=</span> <span class="mi">1</span>
<span class="n">IMAGE_ORDINAL_FLAG32</span> <span class="o">=</span> <span class="mh">0x80000000</span>
<span class="n">IMAGE_ORDINAL_FLAG64</span> <span class="o">=</span> <span class="mh">0x8000000000000000</span>
<span class="k">def</span> <span class="nf">get_structure_transformer_for_target</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">targetbitness</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="n">current_bitness</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">x</span><span class="p">:</span><span class="n">x</span>
<span class="n">create_structure_at</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">structcls</span><span class="p">,</span> <span class="n">addr</span><span class="p">:</span> <span class="n">structcls</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">,</span> <span class="n">create_structure_at</span>
<span class="k">if</span> <span class="n">targetbitness</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">targetbitness</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="n">current_bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span>
<span class="k">elif</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">current_bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span>
<span class="k">elif</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="n">current_bitness</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote</span>
<span class="k">else</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Parsing </span><span class="si">{0}</span><span class="s2"> PE from </span><span class="si">{1}</span><span class="s2"> Process&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">targetedbitness</span><span class="p">,</span> <span class="n">proc_bitness</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">create_structure_at</span><span class="p">(</span><span class="n">structcls</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">(</span><span class="n">structcls</span><span class="p">)(</span><span class="n">addr</span><span class="p">,</span> <span class="n">target</span><span class="p">)</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">,</span> <span class="n">create_structure_at</span>
<span class="k">def</span> <span class="nf">get_pe_bitness</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
<span class="c1"># We can force bitness as the filed we access are bitness-independant</span>
<span class="n">pe</span> <span class="o">=</span> <span class="n">GetPEFile</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">force_bitness</span><span class="o">=</span><span class="mi">32</span><span class="p">)</span>
<span class="n">machine</span> <span class="o">=</span> <span class="n">pe</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">Machine</span>
<span class="k">if</span> <span class="n">machine</span> <span class="o">==</span> <span class="mh">0x14c</span><span class="p">:</span>
<span class="k">return</span> <span class="mi">32</span>
<span class="k">elif</span> <span class="n">machine</span> <span class="o">==</span> <span class="mh">0x8664</span><span class="p">:</span>
<span class="k">return</span> <span class="mi">64</span>
<span class="k">else</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknow PE target machine &lt;0x</span><span class="si">{0:x}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">machine</span><span class="p">))</span>
<div class="viewcode-block" id="GetPEFile"><a class="viewcode-back" href="../../process.html#windows.pe_parse.GetPEFile">[docs]</a><span class="k">def</span> <span class="nf">GetPEFile</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">force_bitness</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Returns a :class:`PEFile` to explore a PE loaded at `baseaddr` in process `target`.</span>
<span class="sd"> :rtype: :class:`PEFile`</span>
<span class="sd"> .. note::</span>
<span class="sd"> If target is ``None`` it refers to the curent process</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">proc_bitness</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">force_bitness</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">targetedbitness</span> <span class="o">=</span> <span class="n">get_pe_bitness</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">targetedbitness</span> <span class="o">=</span> <span class="n">force_bitness</span>
<span class="n">transformers</span> <span class="o">=</span> <span class="n">get_structure_transformer_for_target</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">targetedbitness</span><span class="p">)</span>
<span class="n">ctypes_structure_transformer</span><span class="p">,</span> <span class="n">create_structure_at</span> <span class="o">=</span> <span class="n">transformers</span>
<span class="k">if</span> <span class="n">targetedbitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">IMAGE_ORDINAL_FLAG</span> <span class="o">=</span> <span class="n">IMAGE_ORDINAL_FLAG32</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">IMAGE_ORDINAL_FLAG</span> <span class="o">=</span> <span class="n">IMAGE_ORDINAL_FLAG64</span>
<span class="k">def</span> <span class="nf">get_string</span><span class="p">(</span><span class="n">addr</span><span class="p">):</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="n">target</span><span class="o">.</span><span class="n">read_string</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">RVA</span><span class="p">(</span><span class="n">DWORD</span><span class="p">):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">baseaddr</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">value</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s2">&quot;&lt;DWORD </span><span class="si">{0}</span><span class="s2"> (RVA to &#39;</span><span class="si">{1}</span><span class="s2">&#39;)&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">addr</span><span class="p">))</span>
<span class="k">class</span> <span class="nc">StringRVa</span><span class="p">(</span><span class="n">RVA</span><span class="p">):</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">str</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">str</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s2">&quot;&lt;DWORD </span><span class="si">{0}</span><span class="s2"> (String RVA to &#39;</span><span class="si">{1}</span><span class="s2">&#39;)&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">str</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">__int__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">value</span>
<span class="k">class</span> <span class="nc">IMPORT_BY_NAME</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;Hint&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;Name&quot;</span><span class="p">,</span> <span class="n">BYTE</span><span class="p">)</span>
<span class="p">]</span>
<span class="k">class</span> <span class="nc">THUNK_DATA</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Union</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;Ordinal&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;AddressOfData&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span>
<span class="p">]</span>
<span class="k">class</span> <span class="nc">IATEntry</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Represent an entry in the IAT of a module</span>
<span class="sd"> Can be used to get resolved value and setup hook</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;value&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)]</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="n">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">ord</span> <span class="o">=</span> <span class="nb">ord</span>
<span class="bp">self</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="n">name</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="kc">None</span>
<span class="bp">self</span><span class="o">.</span><span class="n">nonhookvalue</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; ordinal </span><span class="si">{2}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">__class__</span><span class="o">.</span><span class="n">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">ord</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">set_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Setup a hook on the entry and return it.</span>
<span class="sd"> You MUST keep a reference to the hook while the hook is enabled.</span>
<span class="sd"> :param callback: the hook</span>
<span class="sd"> .. note::</span>
<span class="sd"> see :ref:`hook_protocol`</span>
<span class="sd"> :rtype: :class:`windows.hooks.IATHook`</span>
<span class="sd"> .. warning::</span>
<span class="sd"> This works only for PEFile with the current process as target.</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Setting hook in remote process (use python code injection)&quot;</span><span class="p">)</span>
<span class="n">hook</span> <span class="o">=</span> <span class="n">hooks</span><span class="o">.</span><span class="n">IATHook</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="n">hook</span>
<span class="n">hook</span><span class="o">.</span><span class="n">enable</span><span class="p">()</span>
<span class="k">return</span> <span class="n">hook</span>
<span class="k">def</span> <span class="nf">remove_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Remove the hook on the entry&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">False</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span><span class="o">.</span><span class="n">disable</span><span class="p">()</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="kc">None</span>
<span class="k">return</span> <span class="kc">True</span>
<span class="k">class</span> <span class="nc">PEFile</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Represent a PE loaded in a process (current or remote)&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">baseaddr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">=</span> <span class="n">targetedbitness</span>
<span class="k">def</span> <span class="nf">get_DOS_HEADER</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_DOS_HEADER</span><span class="p">,</span> <span class="n">baseaddr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_NT_HEADER</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DOS_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span>
<span class="k">def</span> <span class="nf">get_OptionalHeader</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
<span class="k">def</span> <span class="nf">get_DataDirectory</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># This won&#39;t work if we load a PE32 in a 64bit process</span>
<span class="c1"># PE32 .NET...</span>
<span class="c1">#return self.get_OptionalHeader().DataDirectory</span>
<span class="n">DataDirectory_type</span> <span class="o">=</span> <span class="n">IMAGE_DATA_DIRECTORY</span> <span class="o">*</span> <span class="n">IMAGE_NUMBEROF_DIRECTORY_ENTRIES</span>
<span class="n">SizeOfOptionalHeader</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">SizeOfOptionalHeader</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">_base_addr</span>
<span class="n">DataDirectory_addr</span> <span class="o">=</span> <span class="n">opt_header_addr</span> <span class="o">+</span> <span class="n">SizeOfOptionalHeader</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">)</span>
<span class="k">return</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">,</span> <span class="n">DataDirectory_addr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_IMPORT_DESCRIPTORS</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">import_datadir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DataDirectory</span><span class="p">()[</span><span class="n">IMAGE_DIRECTORY_ENTRY_IMPORT</span><span class="p">]</span>
<span class="k">if</span> <span class="n">import_datadir</span><span class="o">.</span><span class="n">VirtualAddress</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="k">return</span> <span class="p">[]</span>
<span class="n">import_descriptor_addr</span> <span class="o">=</span> <span class="n">RVA</span><span class="p">(</span><span class="n">import_datadir</span><span class="o">.</span><span class="n">VirtualAddress</span><span class="p">)</span><span class="o">.</span><span class="n">addr</span>
<span class="n">current_import_descriptor</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">,</span> <span class="n">import_descriptor_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">current_import_descriptor</span><span class="o">.</span><span class="n">FirstThunk</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_import_descriptor</span><span class="p">)</span>
<span class="n">import_descriptor_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">)</span>
<span class="n">current_import_descriptor</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">,</span> <span class="n">import_descriptor_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="k">def</span> <span class="nf">get_EXPORT_DIRECTORY</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">export_directory_rva</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DataDirectory</span><span class="p">()[</span><span class="n">IMAGE_DIRECTORY_ENTRY_EXPORT</span><span class="p">]</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="k">if</span> <span class="n">export_directory_rva</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="n">export_directory_addr</span> <span class="o">=</span> <span class="n">baseaddr</span> <span class="o">+</span> <span class="n">export_directory_rva</span>
<span class="k">return</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_IMAGE_EXPORT_DIRECTORY</span><span class="p">,</span> <span class="n">export_directory_addr</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">PESection</span><span class="p">((</span><span class="n">IMAGE_SECTION_HEADER</span><span class="p">)):</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">get_string</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Name</span><span class="p">))[:</span><span class="mi">8</span><span class="p">]</span>
<span class="k">else</span><span class="p">:</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_base_addr</span><span class="p">)[:</span><span class="mi">8</span><span class="p">]</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">baseaddr</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">size</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">VirtualSize</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s2">&quot;&lt;PESection </span><span class="se">\&quot;</span><span class="si">{0}</span><span class="se">\&quot;</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">sections</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">nt_header</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span>
<span class="n">nb_section</span> <span class="o">=</span> <span class="n">nt_header</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">NumberOfSections</span>
<span class="n">SizeOfOptionalHeader</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">SizeOfOptionalHeader</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">_base_addr</span>
<span class="n">base_section</span> <span class="o">=</span> <span class="n">opt_header_addr</span> <span class="o">+</span> <span class="n">SizeOfOptionalHeader</span>
<span class="n">sections_array</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">((</span><span class="bp">self</span><span class="o">.</span><span class="n">PESection</span> <span class="o">*</span> <span class="n">nb_section</span><span class="p">),</span> <span class="n">base_section</span><span class="p">)</span>
<span class="k">return</span> <span class="nb">list</span><span class="p">(</span><span class="n">sections_array</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">exports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The exports of the PE in a dict. Keys are ordinal (:class:`int`) and name (:class:`str`).</span>
<span class="sd"> The values are the addresses of the exports.</span>
<span class="sd"> :type: {(:class:`int` or :class:`str`) : :class:`int`}&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
<span class="n">exp_dir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_EXPORT_DIRECTORY</span><span class="p">()</span>
<span class="k">if</span> <span class="n">exp_dir</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">res</span>
<span class="n">raw_exports</span> <span class="o">=</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">get_exports</span><span class="p">()</span>
<span class="k">for</span> <span class="nb">id</span><span class="p">,</span> <span class="n">rva_addr</span><span class="p">,</span> <span class="n">rva_name</span> <span class="ow">in</span> <span class="n">raw_exports</span><span class="p">:</span>
<span class="n">res</span><span class="p">[</span><span class="nb">id</span><span class="p">]</span> <span class="o">=</span> <span class="n">rva_addr</span><span class="o">.</span><span class="n">addr</span>
<span class="k">if</span> <span class="n">rva_name</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">res</span><span class="p">[</span><span class="n">rva_name</span><span class="o">.</span><span class="n">str</span><span class="p">]</span> <span class="o">=</span> <span class="n">rva_addr</span><span class="o">.</span><span class="n">addr</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">export_name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The Name attribute of the ``EXPORT_DIRECTORY``&quot;&quot;&quot;</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_EXPORT_DIRECTORY</span><span class="p">()</span><span class="o">.</span><span class="n">Name</span><span class="o">.</span><span class="n">str</span>
<span class="k">except</span> <span class="ne">AttributeError</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="c1"># TODO: get imports by parsing other modules exports if no INT</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">imports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The imports of the PE in a dict.</span>
<span class="sd"> Keys are the names of DLL to import from and values are :class:`list`</span>
<span class="sd"> of :class:`IATEntry`</span>
<span class="sd"> :type: {:class:`str` : [:class:`IATEntry`]}&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
<span class="k">for</span> <span class="n">import_descriptor</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_IMPORT_DESCRIPTORS</span><span class="p">():</span>
<span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">()</span>
<span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">()</span>
<span class="k">if</span> <span class="n">INT</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">for</span> <span class="n">iat_entry</span><span class="p">,</span> <span class="p">(</span><span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="n">IAT</span><span class="p">,</span> <span class="n">INT</span><span class="p">):</span>
<span class="c1"># str(name.decode()) -&gt; python2 and python3 compatible for str result</span>
<span class="n">iat_entry</span><span class="o">.</span><span class="n">ord</span> <span class="o">=</span> <span class="nb">ord</span>
<span class="n">iat_entry</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="nb">str</span><span class="p">(</span><span class="n">name</span><span class="o">.</span><span class="n">decode</span><span class="p">())</span> <span class="k">if</span> <span class="n">name</span> <span class="k">else</span> <span class="s2">&quot;&quot;</span>
<span class="n">res</span><span class="o">.</span><span class="n">setdefault</span><span class="p">(</span><span class="n">import_descriptor</span><span class="o">.</span><span class="n">Name</span><span class="o">.</span><span class="n">str</span><span class="o">.</span><span class="n">lower</span><span class="p">(),</span> <span class="p">[])</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">IAT</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="c1"># Will be usable as `self.IMAGE_IMPORT_DESCRIPTOR`</span>
<span class="k">class</span> <span class="nc">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="n">transform_ctypes_fields</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">,</span> <span class="p">{</span><span class="s2">&quot;Name&quot;</span><span class="p">:</span> <span class="n">StringRVa</span><span class="p">,</span> <span class="s2">&quot;OriginalFirstThunk&quot;</span><span class="p">:</span> <span class="n">RVA</span><span class="p">,</span> <span class="s2">&quot;FirstThunk&quot;</span><span class="p">:</span> <span class="n">RVA</span><span class="p">})</span>
<span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="n">int_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span><span class="o">.</span><span class="n">addr</span>
<span class="n">int_entry</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
<span class="k">if</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&amp;</span> <span class="n">IMAGE_ORDINAL_FLAG</span><span class="p">:</span>
<span class="n">res</span> <span class="o">+=</span> <span class="p">[(</span><span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&amp;</span> <span class="mh">0x7fffffff</span><span class="p">,</span> <span class="kc">None</span><span class="p">)]</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">import_by_name</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMPORT_BY_NAME</span><span class="p">,</span> <span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span><span class="p">)</span>
<span class="n">name_address</span> <span class="o">=</span> <span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span> <span class="o">+</span> <span class="nb">type</span><span class="p">(</span><span class="n">import_by_name</span><span class="p">)</span><span class="o">.</span><span class="n">Name</span><span class="o">.</span><span class="n">offset</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="n">name_address</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="n">name_address</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">import_by_name</span><span class="o">.</span><span class="n">Hint</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
<span class="n">int_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">int_entry</span><span class="p">))</span>
<span class="n">int_entry</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">iat_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">FirstThunk</span><span class="o">.</span><span class="n">addr</span>
<span class="n">iat_entry</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">IATEntry</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="n">iat_addr</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="s2">&quot;??&quot;</span><span class="p">))</span>
<span class="n">iat_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">iat_entry</span><span class="p">))</span>
<span class="n">iat_entry</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="c1"># Will be usable as `self._IMAGE_EXPORT_DIRECTORY`</span>
<span class="k">class</span> <span class="nc">_IMAGE_EXPORT_DIRECTORY</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="n">transform_ctypes_fields</span><span class="p">(</span><span class="n">IMAGE_EXPORT_DIRECTORY</span><span class="p">,</span> <span class="p">{</span><span class="s2">&quot;Name&quot;</span><span class="p">:</span> <span class="n">StringRVa</span><span class="p">,</span> <span class="s2">&quot;AddressOfFunctions&quot;</span><span class="p">:</span> <span class="n">RVA</span><span class="p">,</span> <span class="s2">&quot;AddressOfNames&quot;</span><span class="p">:</span> <span class="n">RVA</span><span class="p">,</span> <span class="s2">&quot;AddressOfNameOrdinals&quot;</span><span class="p">:</span> <span class="n">RVA</span><span class="p">})</span>
<span class="k">def</span> <span class="nf">get_exports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">NameOrdinals</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">((</span><span class="n">WORD</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfNames</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfNameOrdinals</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span>
<span class="n">NameOrdinals</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="n">NameOrdinals</span><span class="p">)</span>
<span class="n">Functions</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">((</span><span class="n">RVA</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfFunctions</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfFunctions</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span>
<span class="n">Names</span> <span class="o">=</span> <span class="n">create_structure_at</span><span class="p">((</span><span class="n">StringRVa</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfNames</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfNames</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">for</span> <span class="n">nb</span><span class="p">,</span> <span class="n">func</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">Functions</span><span class="p">):</span>
<span class="k">if</span> <span class="n">nb</span> <span class="ow">in</span> <span class="n">NameOrdinals</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">Names</span><span class="p">[</span><span class="n">NameOrdinals</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="n">nb</span><span class="p">)]</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="kc">None</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">nb</span><span class="p">,</span> <span class="n">func</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span>
<span class="n">current_pe</span> <span class="o">=</span> <span class="n">PEFile</span><span class="p">()</span>
<span class="k">class</span> <span class="nc">IMAGE_DOS_HEADER</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;e_magic&quot;</span><span class="p">,</span> <span class="n">CHAR</span> <span class="o">*</span> <span class="mi">2</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cblp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_crlc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cparhdr&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_minalloc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_maxalloc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ss&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_sp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_csum&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ip&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cs&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_lfarlc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ovno&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_res&quot;</span><span class="p">,</span> <span class="n">WORD</span> <span class="o">*</span> <span class="mi">4</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_oemid&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_oeminfo&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_res2&quot;</span><span class="p">,</span> <span class="n">WORD</span> <span class="o">*</span> <span class="mi">10</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_lfanew&quot;</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">),</span>
<span class="p">]</span>
<span class="k">def</span> <span class="nf">get_NT_HEADER</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="n">targetedbitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS32</span><span class="p">,</span> <span class="n">baseaddr</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">e_lfanew</span><span class="p">)</span>
<span class="k">return</span> <span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS64</span><span class="p">,</span> <span class="n">baseaddr</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">e_lfanew</span><span class="p">)</span>
<span class="k">return</span> <span class="n">current_pe</span></div>
</pre></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<form class="search" action="../../search.html" method="get">
<div><input type="text" name="q" /></div>
<div><input type="submit" value="Go" /></div>
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.2 documentation</a> &raquo;</li>
<li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &raquo;</li>
</ul>
</div>
<div class="footer" role="contentinfo">
&copy; Copyright 2015, Clement Rouault.
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.4.5.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink