admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
8fa8cf9be182fc19aaf7ecb76a2906ebc8db1475
hakril-PythonForWindows/docs/build/html/_modules/windows/pe_parse.html
T
hakril 596ab22f1f Update doc
2025-05-15 09:32:55 +02:00

563 lines
75 KiB
HTML
Raw Blame History

<!DOCTYPE html>
<html lang="en" data-content_root="../../">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>windows.pe_parse &#8212; PythonForWindows 1.0.3 documentation</title>
<link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
<link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
<script src="../../_static/documentation_options.js?v=baaebd52"></script>
<script src="../../_static/doctools.js?v=9a2dae69"></script>
<script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="../../genindex.html" />
<link rel="search" title="Search" href="../../search.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
<li class="nav-item nav-item-this"><a href="">windows.pe_parse</a></li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<h1>Source code for windows.pe_parse</h1><div class="highlight"><pre>
<span></span><span class="kn">import</span> <span class="nn">ctypes</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.hooks</span> <span class="k">as</span> <span class="nn">hooks</span>
<span class="kn">import</span> <span class="nn">windows.utils</span> <span class="k">as</span> <span class="nn">utils</span>
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
<span class="kn">from</span> <span class="nn">windows.utils</span> <span class="kn">import</span> <span class="n">transform_ctypes_fields</span>
<span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
<span class="n">IMAGE_ORDINAL_FLAG32</span> <span class="o">=</span> <span class="mh">0x80000000</span>
<span class="n">IMAGE_ORDINAL_FLAG64</span> <span class="o">=</span> <span class="mh">0x8000000000000000</span>
<span class="k">def</span> <span class="nf">get_structure_transformer_for_target</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">targetbitness</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="n">current_bitness</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">x</span><span class="p">:</span><span class="n">x</span>
<span class="n">create_structure_at</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">structcls</span><span class="p">,</span> <span class="n">addr</span><span class="p">:</span> <span class="n">structcls</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">,</span> <span class="n">create_structure_at</span>
<span class="k">if</span> <span class="n">targetbitness</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">targetbitness</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="n">current_bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span>
<span class="k">elif</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">current_bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span>
<span class="k">elif</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="n">current_bitness</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote</span>
<span class="k">else</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Parsing </span><span class="si">{0}</span><span class="s2"> PE from </span><span class="si">{1}</span><span class="s2"> Process&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">targetedbitness</span><span class="p">,</span> <span class="n">proc_bitness</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">create_structure_at</span><span class="p">(</span><span class="n">structcls</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span> <span class="c1"># Il reste une closure sur &#39;target&#39; ici !!</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">(</span><span class="n">structcls</span><span class="p">)(</span><span class="n">addr</span><span class="p">,</span> <span class="n">target</span><span class="p">)</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">,</span> <span class="n">create_structure_at</span>
<span class="k">def</span> <span class="nf">get_pe_bitness</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
<span class="c1"># We can force bitness as the field we access are bitness-independant</span>
<span class="n">pe</span> <span class="o">=</span> <span class="n">GetPEFile</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">force_bitness</span><span class="o">=</span><span class="mi">32</span><span class="p">)</span>
<span class="n">machine</span> <span class="o">=</span> <span class="n">pe</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">Machine</span>
<span class="k">if</span> <span class="n">machine</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">:</span>
<span class="k">return</span> <span class="mi">32</span>
<span class="k">elif</span> <span class="n">machine</span> <span class="ow">in</span> <span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">):</span>
<span class="k">return</span> <span class="mi">64</span>
<span class="k">else</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknow PE target machine &lt;0x</span><span class="si">{0:x}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">machine</span><span class="p">))</span>
<span class="c1">## == PEPARSE V2 ==</span>
<span class="kn">import</span> <span class="nn">collections</span>
<span class="n">CtypesStructureTransformers</span> <span class="o">=</span> <span class="n">collections</span><span class="o">.</span><span class="n">namedtuple</span><span class="p">(</span><span class="s2">&quot;CtypesStructureTransformers&quot;</span><span class="p">,</span> <span class="p">[</span><span class="s2">&quot;ctypes_structure_transformer&quot;</span><span class="p">,</span> <span class="s2">&quot;create_structure_at&quot;</span><span class="p">])</span>
<div class="viewcode-block" id="GetPEFile">
<a class="viewcode-back" href="../../process.html#windows.pe_parse.GetPEFile">[docs]</a>
<span class="k">def</span> <span class="nf">GetPEFile</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">force_bitness</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Returns a :class:`PEFile` to explore a PE loaded at `baseaddr` in process `target`.</span>
<span class="sd"> :rtype: :class:`PEFile`</span>
<span class="sd"> .. note::</span>
<span class="sd"> If target is ``None`` it refers to the current process</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">proc_bitness</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">force_bitness</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">targetedbitness</span> <span class="o">=</span> <span class="n">get_pe_bitness</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">targetedbitness</span> <span class="o">=</span> <span class="n">force_bitness</span>
<span class="n">transformers</span> <span class="o">=</span> <span class="n">get_structure_transformer_for_target</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">targetedbitness</span><span class="p">)</span>
<span class="c1">#ctypes_structure_transformer, create_structure_at = transformers</span>
<span class="n">transfor_funcs</span> <span class="o">=</span> <span class="n">CtypesStructureTransformers</span><span class="p">(</span><span class="o">*</span><span class="n">transformers</span><span class="p">)</span> <span class="c1"># TODO: rename</span>
<span class="k">return</span> <span class="n">PEFile</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">baseaddr</span><span class="p">,</span> <span class="n">targetedbitness</span><span class="p">,</span> <span class="n">transfor_funcs</span><span class="p">)</span></div>
<span class="k">class</span> <span class="nc">THUNK_DATA</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Union</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;Ordinal&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;AddressOfData&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span>
<span class="p">]</span>
<span class="c1"># Special case for .NET PE32 rewrite as 64b</span>
<span class="c1"># We may have a PE in a 64b process with a 32b IAT</span>
<span class="k">class</span> <span class="nc">THUNK_DATA_32</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Union</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;Ordinal&quot;</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;AddressOfData&quot;</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">)</span>
<span class="p">]</span>
<span class="k">class</span> <span class="nc">IMPORT_BY_NAME</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;Hint&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;Name&quot;</span><span class="p">,</span> <span class="n">BYTE</span><span class="p">)</span>
<span class="p">]</span>
<span class="k">def</span> <span class="nf">get_string</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span><span class="o">.</span><span class="n">value</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;latin1&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">target</span><span class="o">.</span><span class="n">read_string</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">PESection</span><span class="p">(</span><span class="n">IMAGE_SECTION_HEADER</span><span class="p">):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Name</span><span class="p">))[:</span><span class="mi">8</span><span class="p">]</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_base_addr</span><span class="p">,</span> <span class="mi">8</span><span class="p">)</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span><span class="p">,</span> <span class="mi">1</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;ascii&quot;</span><span class="p">)</span>
<span class="c1"># Decode as UTF-8 as the MS doc say ?</span>
<span class="k">return</span> <span class="n">name</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">size</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">VirtualSize</span>
<span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s2">&quot;&lt;PESection </span><span class="se">\&quot;</span><span class="si">{0}</span><span class="se">\&quot;</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">pefile</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">target</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">class</span> <span class="nc">IATPtr</span><span class="p">(</span><span class="n">PVOID</span><span class="p">):</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">from_iatentry</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">iat_entry</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="bp">cls</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">iat_entry</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">addr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">nonhookvalue</span> <span class="o">=</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">nonhookvalue</span>
<span class="k">return</span> <span class="bp">self</span>
<div class="viewcode-block" id="IATEntry">
<a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry">[docs]</a>
<span class="k">class</span> <span class="nc">IATEntry</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Represent an entry in the IAT of a module</span>
<span class="sd"> Can be used to get resolved value and setup hook</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;value&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)]</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">transformers</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">ord</span> <span class="o">=</span> <span class="nb">ord</span>
<span class="bp">self</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="n">name</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="kc">None</span>
<span class="bp">self</span><span class="o">.</span><span class="n">nonhookvalue</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">value</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">target</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; ordinal </span><span class="si">{2}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">ord</span><span class="p">)</span>
<div class="viewcode-block" id="IATEntry.set_hook">
<a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry.set_hook">[docs]</a>
<span class="k">def</span> <span class="nf">set_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Setup a hook on the entry and return it.</span>
<span class="sd"> You MUST keep a reference to the hook while the hook is enabled.</span>
<span class="sd"> :param callback: the hook</span>
<span class="sd"> .. note::</span>
<span class="sd"> see :ref:`hook_protocol`</span>
<span class="sd"> :rtype: :class:`windows.hooks.IATHook`</span>
<span class="sd"> .. warning::</span>
<span class="sd"> This works only for PEFile with the current process as target.</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Setting hook in remote process (use python code injection)&quot;</span><span class="p">)</span>
<span class="n">hook</span> <span class="o">=</span> <span class="n">hooks</span><span class="o">.</span><span class="n">IATHook</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="p">)</span>
<span class="kn">import</span> <span class="nn">weakref</span>
<span class="bp">self</span><span class="o">.</span><span class="n">whook</span> <span class="o">=</span> <span class="n">weakref</span><span class="o">.</span><span class="n">ref</span><span class="p">(</span><span class="n">hook</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">on_destroy</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="n">hook</span>
<span class="n">hook</span><span class="o">.</span><span class="n">enable</span><span class="p">()</span>
<span class="k">return</span> <span class="n">hook</span></div>
<span class="k">def</span> <span class="nf">on_destroy</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
<span class="c1"># We cannot know if the hook was enabled here..</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;DESTROY: </span><span class="si">{0}</span><span class="s2"> -&gt; &quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">args</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">enabled</span><span class="p">))</span>
<span class="c1"># print(args[0]())</span>
<div class="viewcode-block" id="IATEntry.remove_hook">
<a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry.remove_hook">[docs]</a>
<span class="k">def</span> <span class="nf">remove_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Remove the hook on the entry&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">False</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span><span class="o">.</span><span class="n">disable</span><span class="p">()</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="kc">None</span>
<span class="k">return</span> <span class="kc">True</span></div>
</div>
<span class="c1"># def __del__(self):</span>
<span class="c1"># print(self.hook)</span>
<span class="c1"># if self.hook:</span>
<span class="c1"># print(&quot;LOL BYE {0}&quot;.format(self.hook))</span>
<span class="k">class</span> <span class="nc">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">):</span> <span class="c1"># TODO: use explicite name winstructs.IMAGE_IMPORT_DESCRIPTOR</span>
<span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pe</span><span class="p">):</span>
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="c1"># We may have 32bits PE mapped in 32bits process (thanks to .NET PE)</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">!=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
<span class="k">assert</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">,</span> <span class="s2">&quot;Mapped 64b PE in current process 32b not handled&quot;</span>
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA_32</span>
<span class="n">int_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
<span class="k">if</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&amp;</span> <span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span><span class="p">:</span>
<span class="n">res</span> <span class="o">+=</span> <span class="p">[(</span><span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&amp;</span> <span class="mh">0x7fffffff</span><span class="p">,</span> <span class="kc">None</span><span class="p">)]</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">import_by_name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMPORT_BY_NAME</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span><span class="p">)</span>
<span class="n">name_address</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span> <span class="o">+</span> <span class="nb">type</span><span class="p">(</span><span class="n">import_by_name</span><span class="p">)</span><span class="o">.</span><span class="n">Name</span><span class="o">.</span><span class="n">offset</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">import_by_name</span><span class="o">.</span><span class="n">Hint</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
<span class="n">int_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">int_entry</span><span class="p">))</span>
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pe</span><span class="p">):</span>
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">!=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
<span class="k">assert</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">,</span> <span class="s2">&quot;Mapped 64b PE in current process 32b not handled&quot;</span>
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA_32</span>
<span class="n">iat_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">FirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">IATEntry</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="n">iat_addr</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="s2">&quot;??&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="p">))</span>
<span class="n">iat_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">iat_entry</span><span class="p">))</span>
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">pefile</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">transformers</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span>
<span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">target</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">class</span> <span class="nc">IMAGE_EXPORT_DIRECTORY</span><span class="p">(</span><span class="n">IMAGE_EXPORT_DIRECTORY</span><span class="p">):</span> <span class="c1"># TODO: use explicite name winstructs._IMAGE_EXPORT_DIRECTORY</span>
<span class="k">def</span> <span class="nf">get_exports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">NameOrdinals</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">((</span><span class="n">WORD</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfNames</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfNameOrdinals</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="n">NameOrdinals</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="n">NameOrdinals</span><span class="p">)</span>
<span class="n">Functions</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">((</span><span class="n">DWORD</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfFunctions</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfFunctions</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="n">Names</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">((</span><span class="n">DWORD</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfNames</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfNames</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">for</span> <span class="n">nb</span><span class="p">,</span> <span class="n">func</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">Functions</span><span class="p">):</span>
<span class="n">func</span> <span class="o">+=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="k">if</span> <span class="n">nb</span> <span class="ow">in</span> <span class="n">NameOrdinals</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">Names</span><span class="p">[</span><span class="n">NameOrdinals</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="n">nb</span><span class="p">)]</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="c1"># Export name should be ascii</span>
<span class="c1"># Decode from ascii or return bytes ?</span>
<span class="c1"># https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-address-table</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="kc">None</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">nb</span><span class="p">,</span> <span class="n">func</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">pefile</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">transformers</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">target</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">class</span> <span class="nc">IMAGE_DOS_HEADER</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;e_magic&quot;</span><span class="p">,</span> <span class="n">CHAR</span> <span class="o">*</span> <span class="mi">2</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cblp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_crlc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cparhdr&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_minalloc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_maxalloc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ss&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_sp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_csum&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ip&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cs&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_lfarlc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ovno&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_res&quot;</span><span class="p">,</span> <span class="n">WORD</span> <span class="o">*</span> <span class="mi">4</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_oemid&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_oeminfo&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_res2&quot;</span><span class="p">,</span> <span class="n">WORD</span> <span class="o">*</span> <span class="mi">10</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_lfanew&quot;</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">),</span>
<span class="p">]</span>
<div class="viewcode-block" id="PEFile">
<a class="viewcode-back" href="../../process.html#windows.pe_parse.PEFile">[docs]</a>
<span class="k">class</span> <span class="nc">PEFile</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Represent a PE loaded in a process (current or remote)&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">baseaddr</span><span class="p">,</span> <span class="n">targetedbitness</span><span class="p">,</span> <span class="n">transformers</span><span class="p">):</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">target</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">baseaddr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">=</span> <span class="n">targetedbitness</span>
<span class="bp">self</span><span class="o">.</span><span class="n">transformers</span> <span class="o">=</span> <span class="n">transformers</span>
<span class="k">if</span> <span class="n">targetedbitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span> <span class="o">=</span> <span class="n">IMAGE_ORDINAL_FLAG32</span>
<span class="k">else</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span> <span class="o">=</span> <span class="n">IMAGE_ORDINAL_FLAG64</span>
<span class="k">def</span> <span class="nf">get_DOS_HEADER</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_DOS_HEADER</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_NT_HEADER</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">offset</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DOS_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">e_lfanew</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS32</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS64</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
<span class="n">STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC</span> <span class="o">=</span> <span class="p">{</span>
<span class="n">IMAGE_NT_OPTIONAL_HDR32_MAGIC</span><span class="p">:</span> <span class="n">IMAGE_OPTIONAL_HEADER32</span><span class="p">,</span>
<span class="n">IMAGE_NT_OPTIONAL_HDR64_MAGIC</span><span class="p">:</span> <span class="n">IMAGE_OPTIONAL_HEADER64</span><span class="p">,</span>
<span class="p">}</span>
<span class="n">STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC</span> <span class="o">=</span> <span class="p">(</span>
<span class="p">(</span><span class="n">IMAGE_NT_OPTIONAL_HDR32_MAGIC</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_OPTIONAL_HEADER32</span><span class="p">)),</span>
<span class="p">(</span><span class="n">IMAGE_NT_OPTIONAL_HDR64_MAGIC</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_OPTIONAL_HEADER64</span><span class="p">)),</span>
<span class="p">)</span>
<span class="k">def</span> <span class="nf">get_OptionalHeader</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># We can have a 32bits PE with a 64 bits OptionalHeader</span>
<span class="c1"># Ex : PE32 .NET that allow to be loaded in 64b process</span>
<span class="c1"># See: https://github.com/dotnet/runtime/blob/8bbe33819464216becffb7cf8b7ea8dd3bab5836/src/coreclr/src/vm/peimagelayout.cpp#L599</span>
<span class="c1"># In this case the OptionalHeader is transformed in 64bits &amp; OptionalHeader.Magic is changed accordingly</span>
<span class="c1"># So we cannot just rely on get_NT_HEADER() to give us the correct OptionalHeader type. some re-check are required</span>
<span class="n">default_opth</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
<span class="c1"># Cannot juste compare types with type(default_opth) as it may be a remoteType</span>
<span class="n">current_opth_infos</span> <span class="o">=</span> <span class="p">(</span><span class="n">default_opth</span><span class="o">.</span><span class="n">Magic</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">default_opth</span><span class="p">))</span>
<span class="k">if</span> <span class="n">current_opth_infos</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC</span><span class="p">:</span>
<span class="c1"># The default OptionalHeader structure match what we expect based on the magic (most of the cases)</span>
<span class="k">return</span> <span class="n">default_opth</span>
<span class="c1"># Mismatch -&gt; PE32 remapped as 64b (with OptionalHeader rewrite)</span>
<span class="c1"># Remap the correct OptionalHeader</span>
<span class="n">opt_header_real_type</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC</span><span class="p">[</span><span class="n">default_opth</span><span class="o">.</span><span class="n">Magic</span><span class="p">]</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">default_opth</span><span class="o">.</span><span class="n">_base_addr</span> <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="k">else</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">default_opth</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">opt_header_real_type</span><span class="p">,</span> <span class="n">opt_header_addr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_DataDirectory</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_OptionalHeader</span><span class="p">()</span><span class="o">.</span><span class="n">DataDirectory</span>
<span class="k">def</span> <span class="nf">get_IMPORT_DESCRIPTORS</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">import_datadir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DataDirectory</span><span class="p">()[</span><span class="n">IMAGE_DIRECTORY_ENTRY_IMPORT</span><span class="p">]</span>
<span class="k">if</span> <span class="n">import_datadir</span><span class="o">.</span><span class="n">VirtualAddress</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="k">return</span> <span class="p">[]</span>
<span class="n">import_descriptor_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">import_datadir</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="n">current_import_descriptor</span> <span class="o">=</span> <span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">import_descriptor_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">current_import_descriptor</span><span class="o">.</span><span class="n">FirstThunk</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_import_descriptor</span><span class="p">)</span>
<span class="n">import_descriptor_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">)</span>
<span class="n">current_import_descriptor</span> <span class="o">=</span> <span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">import_descriptor_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="k">def</span> <span class="nf">get_EXPORT_DIRECTORY</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">export_directory_rva</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DataDirectory</span><span class="p">()[</span><span class="n">IMAGE_DIRECTORY_ENTRY_EXPORT</span><span class="p">]</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="k">if</span> <span class="n">export_directory_rva</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="n">export_directory_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">export_directory_rva</span>
<span class="n">exp_dir</span> <span class="o">=</span> <span class="n">IMAGE_EXPORT_DIRECTORY</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">export_directory_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">exp_dir</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">sections</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">nt_header</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span>
<span class="n">nb_section</span> <span class="o">=</span> <span class="n">nt_header</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">NumberOfSections</span>
<span class="n">SizeOfOptionalHeader</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">SizeOfOptionalHeader</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">_base_addr</span>
<span class="n">base_section</span> <span class="o">=</span> <span class="n">opt_header_addr</span> <span class="o">+</span> <span class="n">SizeOfOptionalHeader</span>
<span class="c1">#pe_section_type = IMAGE_SECTION_HEADER</span>
<span class="k">return</span> <span class="p">[</span><span class="n">PESection</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">base_section</span> <span class="o">+</span> <span class="p">(</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_SECTION_HEADER</span><span class="p">)</span> <span class="o">*</span> <span class="n">i</span><span class="p">))</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="n">nb_section</span><span class="p">)]</span>
<span class="c1">#sections_array = self.transformers.create_structure_at((self.PESection * nb_section), base_section)</span>
<span class="c1">#return list(sections_array)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">exports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The exports of the PE in a dict. Keys are ordinal (:class:`int`) and name (:class:`str`).</span>
<span class="sd"> The values are the addresses of the exports.</span>
<span class="sd"> :type: {(:class:`int` or :class:`str`) : :class:`int`}&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
<span class="n">exp_dir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_EXPORT_DIRECTORY</span><span class="p">()</span>
<span class="n">export_datadir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DataDirectory</span><span class="p">()[</span><span class="n">IMAGE_DIRECTORY_ENTRY_EXPORT</span><span class="p">]</span>
<span class="n">export_start</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">export_datadir</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="n">export_end</span> <span class="o">=</span> <span class="n">export_start</span> <span class="o">+</span> <span class="n">export_datadir</span><span class="o">.</span><span class="n">Size</span>
<span class="k">if</span> <span class="n">exp_dir</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">res</span>
<span class="n">raw_exports</span> <span class="o">=</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">get_exports</span><span class="p">()</span>
<span class="k">for</span> <span class="nb">id</span><span class="p">,</span> <span class="n">rva_addr</span><span class="p">,</span> <span class="n">rva_name</span> <span class="ow">in</span> <span class="n">raw_exports</span><span class="p">:</span>
<span class="k">if</span> <span class="n">export_start</span> <span class="o">&lt;=</span> <span class="n">rva_addr</span> <span class="o">&lt;</span> <span class="n">export_end</span><span class="p">:</span>
<span class="c1"># Export proxy...</span>
<span class="c1"># Contains the string to another Dll.Function</span>
<span class="n">rva_addr</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">rva_addr</span><span class="p">)</span> <span class="c1"># Put the string proxy instead</span>
<span class="n">res</span><span class="p">[</span><span class="nb">id</span><span class="p">]</span> <span class="o">=</span> <span class="n">rva_addr</span>
<span class="k">if</span> <span class="n">rva_name</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">res</span><span class="p">[</span><span class="n">rva_name</span><span class="p">]</span> <span class="o">=</span> <span class="n">rva_addr</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">export_name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The Name attribute of the ``EXPORT_DIRECTORY``&quot;&quot;&quot;</span>
<span class="n">exp_dir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_EXPORT_DIRECTORY</span><span class="p">()</span>
<span class="k">if</span> <span class="n">exp_dir</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">Name</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">return</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">Name</span><span class="p">)</span>
<span class="c1"># TODO: get imports by parsing other modules exports if no INT</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">imports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The imports of the PE in a dict.</span>
<span class="sd"> Keys are the names of DLL to import from and values are :class:`list`</span>
<span class="sd"> of :class:`IATEntry`</span>
<span class="sd"> :type: {:class:`str` : [:class:`IATEntry`]}&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
<span class="k">for</span> <span class="n">import_descriptor</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_IMPORT_DESCRIPTORS</span><span class="p">():</span>
<span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
<span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
<span class="k">if</span> <span class="n">INT</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">for</span> <span class="n">iat_entry</span><span class="p">,</span> <span class="p">(</span><span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="n">IAT</span><span class="p">,</span> <span class="n">INT</span><span class="p">):</span>
<span class="c1"># str(name.decode()) -&gt; python2 and python3 compatible for str result</span>
<span class="n">iat_entry</span><span class="o">.</span><span class="n">ord</span> <span class="o">=</span> <span class="nb">ord</span>
<span class="n">iat_entry</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="nb">str</span><span class="p">(</span><span class="n">name</span><span class="p">)</span> <span class="k">if</span> <span class="n">name</span> <span class="k">else</span> <span class="s2">&quot;&quot;</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">Name</span><span class="p">)</span>
<span class="n">res</span><span class="o">.</span><span class="n">setdefault</span><span class="p">(</span><span class="n">name</span><span class="o">.</span><span class="n">lower</span><span class="p">(),</span> <span class="p">[])</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">IAT</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">binid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Return the hex-string {TimeStamp}{SizeOfCode} used by PDB to identify a PE.</span>
<span class="sd"> I do not know the official name of this value...</span>
<span class="sd"> :type: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">nth</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span>
<span class="n">timestamp</span> <span class="o">=</span> <span class="n">nth</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">TimeDateStamp</span>
<span class="n">image_size</span> <span class="o">=</span> <span class="n">nth</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">SizeOfImage</span>
<span class="k">return</span> <span class="s2">&quot;</span><span class="si">{timestamp:08x}{image_size:x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">timestamp</span><span class="o">=</span><span class="n">timestamp</span><span class="p">,</span> <span class="n">image_size</span><span class="o">=</span><span class="n">image_size</span><span class="p">)</span></div>
</pre></div>
<div class="clearer"></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../../search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
<li class="nav-item nav-item-this"><a href="">windows.pe_parse</a></li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015-2020, Clement Rouault.
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.3.7.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink