admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
f53cd00bc481224e4d2dc1d280d5e43206751e63
hakril-PythonForWindows/docs/build/html/_modules/windows/pe_parse.html
T
hakril f53cd00bc4 cosmetic changes to doc + generate html doc
2019-01-03 22:20:19 +01:00

835 lines
88 KiB
HTML
Raw Blame History

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>windows.pe_parse &#8212; PythonForWindows 0.5 documentation</title>
<link rel="stylesheet" href="../../_static/classic.css" type="text/css" />
<link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="../../_static/css/mbasic.css" type="text/css" />
<script type="text/javascript" id="documentation_options" data-url_root="../../" src="../../_static/documentation_options.js"></script>
<script type="text/javascript" src="../../_static/jquery.js"></script>
<script type="text/javascript" src="../../_static/underscore.js"></script>
<script type="text/javascript" src="../../_static/doctools.js"></script>
<link rel="index" title="Index" href="../../genindex.html" />
<link rel="search" title="Search" href="../../search.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.5 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<h1>Source code for windows.pe_parse</h1><div class="highlight"><pre>
<span></span><span class="kn">import</span> <span class="nn">ctypes</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.hooks</span> <span class="k">as</span> <span class="nn">hooks</span>
<span class="kn">import</span> <span class="nn">windows.utils</span> <span class="k">as</span> <span class="nn">utils</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="kn">from</span> <span class="nn">windows.utils</span> <span class="k">import</span> <span class="n">transform_ctypes_fields</span>
<span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
<span class="n">IMAGE_ORDINAL_FLAG32</span> <span class="o">=</span> <span class="mh">0x80000000</span>
<span class="n">IMAGE_ORDINAL_FLAG64</span> <span class="o">=</span> <span class="mh">0x8000000000000000</span>
<span class="k">def</span> <span class="nf">get_structure_transformer_for_target</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">targetbitness</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="n">current_bitness</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">x</span><span class="p">:</span><span class="n">x</span>
<span class="n">create_structure_at</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">structcls</span><span class="p">,</span> <span class="n">addr</span><span class="p">:</span> <span class="n">structcls</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">,</span> <span class="n">create_structure_at</span>
<span class="k">if</span> <span class="n">targetbitness</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">targetbitness</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="n">current_bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span>
<span class="k">elif</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">current_bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span>
<span class="k">elif</span> <span class="n">targetbitness</span> <span class="o">==</span> <span class="n">current_bitness</span><span class="p">:</span>
<span class="n">ctypes_structure_transformer</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote</span>
<span class="k">else</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Parsing </span><span class="si">{0}</span><span class="s2"> PE from </span><span class="si">{1}</span><span class="s2"> Process&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">targetedbitness</span><span class="p">,</span> <span class="n">proc_bitness</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">create_structure_at</span><span class="p">(</span><span class="n">structcls</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span> <span class="c1"># Il reste une closure sur &#39;target&#39; ici !!</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">(</span><span class="n">structcls</span><span class="p">)(</span><span class="n">addr</span><span class="p">,</span> <span class="n">target</span><span class="p">)</span>
<span class="k">return</span> <span class="n">ctypes_structure_transformer</span><span class="p">,</span> <span class="n">create_structure_at</span>
<span class="k">def</span> <span class="nf">get_pe_bitness</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
<span class="c1"># We can force bitness as the field we access are bitness-independant</span>
<span class="n">pe</span> <span class="o">=</span> <span class="n">GetPEFile</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">force_bitness</span><span class="o">=</span><span class="mi">32</span><span class="p">)</span>
<span class="n">machine</span> <span class="o">=</span> <span class="n">pe</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">Machine</span>
<span class="k">if</span> <span class="n">machine</span> <span class="o">==</span> <span class="mh">0x14c</span><span class="p">:</span>
<span class="k">return</span> <span class="mi">32</span>
<span class="k">elif</span> <span class="n">machine</span> <span class="o">==</span> <span class="mh">0x8664</span><span class="p">:</span>
<span class="k">return</span> <span class="mi">64</span>
<span class="k">else</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknow PE target machine &lt;0x</span><span class="si">{0:x}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">machine</span><span class="p">))</span>
<span class="c1"># def GetPEFile(baseaddr, target=None, force_bitness=None):</span>
<span class="c1"># &quot;&quot;&quot;Returns a :class:`PEFile` to explore a PE loaded at `baseaddr` in process `target`.</span>
<span class="c1">#</span>
<span class="c1"># :rtype: :class:`PEFile`</span>
<span class="c1">#</span>
<span class="c1"># .. note::</span>
<span class="c1">#</span>
<span class="c1"># If target is ``None`` it refers to the curent process</span>
<span class="c1"># &quot;&quot;&quot;</span>
<span class="c1"># proc_bitness = windows.current_process.bitness</span>
<span class="c1">#</span>
<span class="c1"># if force_bitness is None:</span>
<span class="c1"># targetedbitness = get_pe_bitness(baseaddr, target)</span>
<span class="c1"># else:</span>
<span class="c1"># targetedbitness = force_bitness</span>
<span class="c1">#</span>
<span class="c1"># transformers = get_structure_transformer_for_target(target, targetedbitness)</span>
<span class="c1"># ctypes_structure_transformer, create_structure_at = transformers</span>
<span class="c1">#</span>
<span class="c1"># if targetedbitness == 32:</span>
<span class="c1"># IMAGE_ORDINAL_FLAG = IMAGE_ORDINAL_FLAG32</span>
<span class="c1"># else:</span>
<span class="c1"># IMAGE_ORDINAL_FLAG = IMAGE_ORDINAL_FLAG64</span>
<span class="c1">#</span>
<span class="c1"># def get_string(addr):</span>
<span class="c1"># if target is None:</span>
<span class="c1"># return ctypes.c_char_p(addr).value</span>
<span class="c1"># return target.read_string(addr)</span>
<span class="c1">#</span>
<span class="c1"># class RVA(DWORD):</span>
<span class="c1"># @property</span>
<span class="c1"># def addr(self):</span>
<span class="c1"># return baseaddr + self.value</span>
<span class="c1">#</span>
<span class="c1"># def __repr__(self):</span>
<span class="c1"># return &quot;&lt;DWORD {0} (RVA to &#39;{1}&#39;)&gt;&quot;.format(self.value, hex(self.addr))</span>
<span class="c1">#</span>
<span class="c1"># class StringRVa(RVA):</span>
<span class="c1"># if target is None:</span>
<span class="c1"># @property</span>
<span class="c1"># def str(self):</span>
<span class="c1"># return get_string(self.addr).decode()</span>
<span class="c1"># else:</span>
<span class="c1"># @property</span>
<span class="c1"># def str(self):</span>
<span class="c1"># return get_string(self.addr).decode()</span>
<span class="c1">#</span>
<span class="c1"># def __repr__(self):</span>
<span class="c1"># return &quot;&lt;DWORD {0} (String RVA to &#39;{1}&#39;)&gt;&quot;.format(self.value, self.str)</span>
<span class="c1">#</span>
<span class="c1"># def __int__(self):</span>
<span class="c1"># return self.value</span>
<span class="c1">#</span>
<span class="c1"># class IMPORT_BY_NAME(ctypes.Structure):</span>
<span class="c1"># _fields_ = [</span>
<span class="c1"># (&quot;Hint&quot;, WORD),</span>
<span class="c1"># (&quot;Name&quot;, BYTE)</span>
<span class="c1"># ]</span>
<span class="c1">#</span>
<span class="c1"># class THUNK_DATA(ctypes.Union):</span>
<span class="c1"># _fields_ = [</span>
<span class="c1"># (&quot;Ordinal&quot;, PVOID),</span>
<span class="c1"># (&quot;AddressOfData&quot;, PVOID)</span>
<span class="c1"># ]</span>
<span class="c1">#</span>
<span class="c1"># class IATEntry(ctypes.Structure):</span>
<span class="c1"># &quot;&quot;&quot;Represent an entry in the IAT of a module</span>
<span class="c1"># Can be used to get resolved value and setup hook</span>
<span class="c1"># &quot;&quot;&quot;</span>
<span class="c1"># _fields_ = [</span>
<span class="c1"># (&quot;value&quot;, PVOID)]</span>
<span class="c1">#</span>
<span class="c1">#</span>
<span class="c1">#</span>
<span class="c1"># @classmethod</span>
<span class="c1"># def create(cls, addr, ord, name):</span>
<span class="c1"># self = create_structure_at(cls, addr)</span>
<span class="c1"># self.addr = addr</span>
<span class="c1"># self.ord = ord</span>
<span class="c1"># self.name = name</span>
<span class="c1"># self.hook = None</span>
<span class="c1"># self.nonhookvalue = self.value</span>
<span class="c1"># return self</span>
<span class="c1">#</span>
<span class="c1"># def __repr__(self):</span>
<span class="c1"># return &#39;&lt;{0} &quot;{1}&quot; ordinal {2}&gt;&#39;.format(self.__class__.__name__, self.name, self.ord)</span>
<span class="c1">#</span>
<span class="c1"># def set_hook(self, callback, types=None):</span>
<span class="c1"># &quot;&quot;&quot;Setup a hook on the entry and return it.</span>
<span class="c1"># You MUST keep a reference to the hook while the hook is enabled.</span>
<span class="c1">#</span>
<span class="c1"># :param callback: the hook</span>
<span class="c1">#</span>
<span class="c1"># .. note::</span>
<span class="c1">#</span>
<span class="c1"># see :ref:`hook_protocol`</span>
<span class="c1">#</span>
<span class="c1"># :rtype: :class:`windows.hooks.IATHook`</span>
<span class="c1">#</span>
<span class="c1"># .. warning::</span>
<span class="c1">#</span>
<span class="c1"># This works only for PEFile with the current process as target.</span>
<span class="c1"># &quot;&quot;&quot;</span>
<span class="c1"># if target is not None:</span>
<span class="c1"># raise NotImplementedError(&quot;Setting hook in remote process (use python code injection)&quot;)</span>
<span class="c1">#</span>
<span class="c1"># hook = hooks.IATHook(self, callback, types)</span>
<span class="c1"># self.hook = hook</span>
<span class="c1"># hook.enable()</span>
<span class="c1"># return hook</span>
<span class="c1">#</span>
<span class="c1"># def remove_hook(self):</span>
<span class="c1"># &quot;&quot;&quot;Remove the hook on the entry&quot;&quot;&quot;</span>
<span class="c1"># if self.hook is None:</span>
<span class="c1"># return False</span>
<span class="c1"># self.hook.disable()</span>
<span class="c1"># self.hook = None</span>
<span class="c1"># return True</span>
<span class="c1">#</span>
<span class="c1"># class PEFile(object):</span>
<span class="c1"># &quot;&quot;&quot;Represent a PE loaded in a process (current or remote)&quot;&quot;&quot;</span>
<span class="c1"># #def __del__(self):</span>
<span class="c1"># # print(&quot;YOLODEL&quot;)</span>
<span class="c1"># # import pprint</span>
<span class="c1"># # pprint.pprint(vars(self))</span>
<span class="c1">#</span>
<span class="c1"># def __init__(self):</span>
<span class="c1"># self.baseaddr = baseaddr</span>
<span class="c1"># self.bitness = targetedbitness</span>
<span class="c1">#</span>
<span class="c1"># def get_DOS_HEADER(self):</span>
<span class="c1"># return create_structure_at(IMAGE_DOS_HEADER, baseaddr)</span>
<span class="c1">#</span>
<span class="c1"># def get_NT_HEADER(self):</span>
<span class="c1"># return self.get_DOS_HEADER().get_NT_HEADER()</span>
<span class="c1">#</span>
<span class="c1"># def get_OptionalHeader(self):</span>
<span class="c1"># return self.get_NT_HEADER().OptionalHeader</span>
<span class="c1">#</span>
<span class="c1"># def get_DataDirectory(self):</span>
<span class="c1"># # This won&#39;t work if we load a PE32 in a 64bit process</span>
<span class="c1"># # PE32 .NET...</span>
<span class="c1"># #return self.get_OptionalHeader().DataDirectory</span>
<span class="c1"># DataDirectory_type = IMAGE_DATA_DIRECTORY * IMAGE_NUMBEROF_DIRECTORY_ENTRIES</span>
<span class="c1"># SizeOfOptionalHeader = self.get_NT_HEADER().FileHeader.SizeOfOptionalHeader</span>
<span class="c1"># if target is None:</span>
<span class="c1"># opt_header_addr = ctypes.addressof(self.get_NT_HEADER().OptionalHeader)</span>
<span class="c1"># else:</span>
<span class="c1"># opt_header_addr = self.get_NT_HEADER().OptionalHeader._base_addr</span>
<span class="c1"># DataDirectory_addr = opt_header_addr + SizeOfOptionalHeader - ctypes.sizeof(DataDirectory_type)</span>
<span class="c1"># return create_structure_at(DataDirectory_type, DataDirectory_addr)</span>
<span class="c1">#</span>
<span class="c1">#</span>
<span class="c1"># def get_IMPORT_DESCRIPTORS(self):</span>
<span class="c1"># import_datadir = self.get_DataDirectory()[IMAGE_DIRECTORY_ENTRY_IMPORT]</span>
<span class="c1"># if import_datadir.VirtualAddress == 0:</span>
<span class="c1"># return []</span>
<span class="c1"># import_descriptor_addr = RVA(import_datadir.VirtualAddress).addr</span>
<span class="c1"># current_import_descriptor = create_structure_at(self.IMAGE_IMPORT_DESCRIPTOR, import_descriptor_addr)</span>
<span class="c1"># res = []</span>
<span class="c1"># while current_import_descriptor.FirstThunk:</span>
<span class="c1"># res.append(current_import_descriptor)</span>
<span class="c1"># import_descriptor_addr += ctypes.sizeof(self.IMAGE_IMPORT_DESCRIPTOR)</span>
<span class="c1"># current_import_descriptor = create_structure_at(self.IMAGE_IMPORT_DESCRIPTOR, import_descriptor_addr)</span>
<span class="c1"># return res</span>
<span class="c1">#</span>
<span class="c1"># def get_EXPORT_DIRECTORY(self):</span>
<span class="c1"># export_directory_rva = self.get_DataDirectory()[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress</span>
<span class="c1"># if export_directory_rva == 0:</span>
<span class="c1"># return None</span>
<span class="c1"># export_directory_addr = baseaddr + export_directory_rva</span>
<span class="c1"># return create_structure_at(self._IMAGE_EXPORT_DIRECTORY, export_directory_addr)</span>
<span class="c1">#</span>
<span class="c1"># class PESection((IMAGE_SECTION_HEADER)):</span>
<span class="c1"># if target is None:</span>
<span class="c1"># @property</span>
<span class="c1"># def name(self):</span>
<span class="c1"># return get_string(ctypes.addressof(self.Name))[:8]</span>
<span class="c1"># else:</span>
<span class="c1"># @property</span>
<span class="c1"># def name(self):</span>
<span class="c1"># return get_string(self._base_addr)[:8]</span>
<span class="c1">#</span>
<span class="c1"># @property</span>
<span class="c1"># def start(self):</span>
<span class="c1"># return baseaddr + self.VirtualAddress</span>
<span class="c1">#</span>
<span class="c1"># @property</span>
<span class="c1"># def size(self):</span>
<span class="c1"># return self.VirtualSize</span>
<span class="c1">#</span>
<span class="c1"># def __repr__(self):</span>
<span class="c1"># return &quot;&lt;PESection \&quot;{0}\&quot;&gt;&quot;.format(self.name)</span>
<span class="c1">#</span>
<span class="c1"># @utils.fixedpropety</span>
<span class="c1"># def sections(self):</span>
<span class="c1"># nt_header = self.get_NT_HEADER()</span>
<span class="c1"># nb_section = nt_header.FileHeader.NumberOfSections</span>
<span class="c1"># SizeOfOptionalHeader = self.get_NT_HEADER().FileHeader.SizeOfOptionalHeader</span>
<span class="c1"># if target is None:</span>
<span class="c1"># opt_header_addr = ctypes.addressof(self.get_NT_HEADER().OptionalHeader)</span>
<span class="c1"># else:</span>
<span class="c1"># opt_header_addr = self.get_NT_HEADER().OptionalHeader._base_addr</span>
<span class="c1"># base_section = opt_header_addr + SizeOfOptionalHeader</span>
<span class="c1"># sections_array = create_structure_at((self.PESection * nb_section), base_section)</span>
<span class="c1"># return list(sections_array)</span>
<span class="c1">#</span>
<span class="c1"># @utils.fixedpropety</span>
<span class="c1"># def exports(self):</span>
<span class="c1"># &quot;&quot;&quot;The exports of the PE in a dict. Keys are ordinal (:class:`int`) and name (:class:`str`).</span>
<span class="c1"># The values are the addresses of the exports.</span>
<span class="c1">#</span>
<span class="c1"># :type: {(:class:`int` or :class:`str`) : :class:`int`}&quot;&quot;&quot;</span>
<span class="c1"># res = {}</span>
<span class="c1"># exp_dir = self.get_EXPORT_DIRECTORY()</span>
<span class="c1"># if exp_dir is None:</span>
<span class="c1"># return res</span>
<span class="c1"># raw_exports = exp_dir.get_exports()</span>
<span class="c1"># for id, rva_addr, rva_name in raw_exports:</span>
<span class="c1"># res[id] = rva_addr.addr</span>
<span class="c1"># if rva_name is not None:</span>
<span class="c1"># res[rva_name.str] = rva_addr.addr</span>
<span class="c1"># return res</span>
<span class="c1">#</span>
<span class="c1"># @utils.fixedpropety</span>
<span class="c1"># def export_name(self):</span>
<span class="c1"># &quot;&quot;&quot;The Name attribute of the ``EXPORT_DIRECTORY``&quot;&quot;&quot;</span>
<span class="c1"># try:</span>
<span class="c1"># return self.get_EXPORT_DIRECTORY().Name.str</span>
<span class="c1"># except AttributeError:</span>
<span class="c1"># return None</span>
<span class="c1">#</span>
<span class="c1"># # TODO: get imports by parsing other modules exports if no INT</span>
<span class="c1"># @utils.fixedpropety</span>
<span class="c1"># def imports(self):</span>
<span class="c1"># &quot;&quot;&quot;The imports of the PE in a dict.</span>
<span class="c1"># Keys are the names of DLL to import from and values are :class:`list`</span>
<span class="c1"># of :class:`IATEntry`</span>
<span class="c1">#</span>
<span class="c1"># :type: {:class:`str` : [:class:`IATEntry`]}&quot;&quot;&quot;</span>
<span class="c1"># res = {}</span>
<span class="c1"># for import_descriptor in self.get_IMPORT_DESCRIPTORS():</span>
<span class="c1"># INT = import_descriptor.get_INT()</span>
<span class="c1"># IAT = import_descriptor.get_IAT()</span>
<span class="c1"># if INT is not None:</span>
<span class="c1"># for iat_entry, (ord, name) in zip(IAT, INT):</span>
<span class="c1"># # str(name.decode()) -&gt; python2 and python3 compatible for str result</span>
<span class="c1"># iat_entry.ord = ord</span>
<span class="c1"># iat_entry.name = str(name.decode()) if name else &quot;&quot;</span>
<span class="c1"># res.setdefault(import_descriptor.Name.str.lower(), []).extend(IAT)</span>
<span class="c1"># return res</span>
<span class="c1">#</span>
<span class="c1"># # Will be usable as `self.IMAGE_IMPORT_DESCRIPTOR`</span>
<span class="c1"># class IMAGE_IMPORT_DESCRIPTOR(ctypes.Structure):</span>
<span class="c1"># _fields_ = transform_ctypes_fields(IMAGE_IMPORT_DESCRIPTOR, {&quot;Name&quot;: StringRVa, &quot;OriginalFirstThunk&quot;: RVA, &quot;FirstThunk&quot;: RVA})</span>
<span class="c1">#</span>
<span class="c1"># def get_INT(self):</span>
<span class="c1"># if not self.OriginalFirstThunk.value:</span>
<span class="c1"># return None</span>
<span class="c1"># int_addr = self.OriginalFirstThunk.addr</span>
<span class="c1"># int_entry = create_structure_at(THUNK_DATA, int_addr)</span>
<span class="c1"># res = []</span>
<span class="c1"># while int_entry.Ordinal:</span>
<span class="c1"># if int_entry.Ordinal &amp; IMAGE_ORDINAL_FLAG:</span>
<span class="c1"># res += [(int_entry.Ordinal &amp; 0x7fffffff, None)]</span>
<span class="c1"># else:</span>
<span class="c1"># import_by_name = create_structure_at(IMPORT_BY_NAME, baseaddr + int_entry.AddressOfData)</span>
<span class="c1"># name_address = baseaddr + int_entry.AddressOfData + type(import_by_name).Name.offset</span>
<span class="c1"># if target is None:</span>
<span class="c1"># name = get_string(name_address)</span>
<span class="c1"># else:</span>
<span class="c1"># name = get_string(name_address).decode()</span>
<span class="c1"># res.append((import_by_name.Hint, name))</span>
<span class="c1"># int_addr += ctypes.sizeof(type(int_entry))</span>
<span class="c1"># int_entry = create_structure_at(THUNK_DATA, int_addr)</span>
<span class="c1"># return res</span>
<span class="c1">#</span>
<span class="c1"># def get_IAT(self):</span>
<span class="c1"># iat_addr = self.FirstThunk.addr</span>
<span class="c1"># iat_entry = create_structure_at(THUNK_DATA, iat_addr)</span>
<span class="c1"># res = []</span>
<span class="c1"># while iat_entry.Ordinal:</span>
<span class="c1"># res.append(IATEntry.create(iat_addr, -1, &quot;??&quot;))</span>
<span class="c1"># iat_addr += ctypes.sizeof(type(iat_entry))</span>
<span class="c1"># iat_entry = create_structure_at(THUNK_DATA, iat_addr)</span>
<span class="c1"># return res</span>
<span class="c1">#</span>
<span class="c1"># # Will be usable as `self._IMAGE_EXPORT_DIRECTORY`</span>
<span class="c1"># class _IMAGE_EXPORT_DIRECTORY(ctypes.Structure):</span>
<span class="c1"># _fields_ = transform_ctypes_fields(IMAGE_EXPORT_DIRECTORY, {&quot;Name&quot;: StringRVa, &quot;AddressOfFunctions&quot;: RVA, &quot;AddressOfNames&quot;: RVA, &quot;AddressOfNameOrdinals&quot;: RVA})</span>
<span class="c1">#</span>
<span class="c1"># def get_exports(self):</span>
<span class="c1"># NameOrdinals = create_structure_at((WORD * self.NumberOfNames), self.AddressOfNameOrdinals.addr)</span>
<span class="c1"># NameOrdinals = list(NameOrdinals)</span>
<span class="c1"># Functions = create_structure_at((RVA * self.NumberOfFunctions), self.AddressOfFunctions.addr)</span>
<span class="c1"># Names = create_structure_at((StringRVa * self.NumberOfNames), self.AddressOfNames.addr)</span>
<span class="c1"># res = []</span>
<span class="c1"># for nb, func in enumerate(Functions):</span>
<span class="c1"># if nb in NameOrdinals:</span>
<span class="c1"># name = Names[NameOrdinals.index(nb)]</span>
<span class="c1"># else:</span>
<span class="c1"># name = None</span>
<span class="c1"># res.append((nb, func, name))</span>
<span class="c1"># return res</span>
<span class="c1">#</span>
<span class="c1"># current_pe = PEFile()</span>
<span class="c1">#</span>
<span class="c1"># class IMAGE_DOS_HEADER(ctypes.Structure):</span>
<span class="c1"># _fields_ = [</span>
<span class="c1"># (&quot;e_magic&quot;, CHAR * 2),</span>
<span class="c1"># (&quot;e_cblp&quot;, WORD),</span>
<span class="c1"># (&quot;e_cp&quot;, WORD),</span>
<span class="c1"># (&quot;e_crlc&quot;, WORD),</span>
<span class="c1"># (&quot;e_cparhdr&quot;, WORD),</span>
<span class="c1"># (&quot;e_minalloc&quot;, WORD),</span>
<span class="c1"># (&quot;e_maxalloc&quot;, WORD),</span>
<span class="c1"># (&quot;e_ss&quot;, WORD),</span>
<span class="c1"># (&quot;e_sp&quot;, WORD),</span>
<span class="c1"># (&quot;e_csum&quot;, WORD),</span>
<span class="c1"># (&quot;e_ip&quot;, WORD),</span>
<span class="c1"># (&quot;e_cs&quot;, WORD),</span>
<span class="c1"># (&quot;e_lfarlc&quot;, WORD),</span>
<span class="c1"># (&quot;e_ovno&quot;, WORD),</span>
<span class="c1"># (&quot;e_res&quot;, WORD * 4),</span>
<span class="c1"># (&quot;e_oemid&quot;, WORD),</span>
<span class="c1"># (&quot;e_oeminfo&quot;, WORD),</span>
<span class="c1"># (&quot;e_res2&quot;, WORD * 10),</span>
<span class="c1"># (&quot;e_lfanew&quot;, DWORD),</span>
<span class="c1"># ]</span>
<span class="c1">#</span>
<span class="c1"># def get_NT_HEADER(self):</span>
<span class="c1"># if targetedbitness == 32:</span>
<span class="c1"># return create_structure_at(IMAGE_NT_HEADERS32, baseaddr + self.e_lfanew)</span>
<span class="c1"># return create_structure_at(IMAGE_NT_HEADERS64, baseaddr + self.e_lfanew)</span>
<span class="c1"># return current_pe</span>
<span class="c1">## == PEPARSE V2 ==</span>
<span class="kn">import</span> <span class="nn">collections</span>
<span class="n">CtypesStructureTransformers</span> <span class="o">=</span> <span class="n">collections</span><span class="o">.</span><span class="n">namedtuple</span><span class="p">(</span><span class="s2">&quot;CtypesStructureTransformers&quot;</span><span class="p">,</span> <span class="p">[</span><span class="s2">&quot;ctypes_structure_transformer&quot;</span><span class="p">,</span> <span class="s2">&quot;create_structure_at&quot;</span><span class="p">])</span>
<div class="viewcode-block" id="GetPEFile"><a class="viewcode-back" href="../../process.html#windows.pe_parse.GetPEFile">[docs]</a><span class="k">def</span> <span class="nf">GetPEFile</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">force_bitness</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Returns a :class:`PEFile` to explore a PE loaded at `baseaddr` in process `target`.</span>
<span class="sd"> :rtype: :class:`PEFile`</span>
<span class="sd"> .. note::</span>
<span class="sd"> If target is ``None`` it refers to the current process</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">proc_bitness</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">if</span> <span class="n">force_bitness</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">targetedbitness</span> <span class="o">=</span> <span class="n">get_pe_bitness</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">targetedbitness</span> <span class="o">=</span> <span class="n">force_bitness</span>
<span class="n">transformers</span> <span class="o">=</span> <span class="n">get_structure_transformer_for_target</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">targetedbitness</span><span class="p">)</span>
<span class="c1">#ctypes_structure_transformer, create_structure_at = transformers</span>
<span class="n">transfor_funcs</span> <span class="o">=</span> <span class="n">CtypesStructureTransformers</span><span class="p">(</span><span class="o">*</span><span class="n">transformers</span><span class="p">)</span> <span class="c1"># TODO: rename</span>
<span class="k">return</span> <span class="n">PEFile</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">baseaddr</span><span class="p">,</span> <span class="n">targetedbitness</span><span class="p">,</span> <span class="n">transfor_funcs</span><span class="p">)</span></div>
<span class="k">class</span> <span class="nc">THUNK_DATA</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Union</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;Ordinal&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;AddressOfData&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span>
<span class="p">]</span>
<span class="k">class</span> <span class="nc">IMPORT_BY_NAME</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;Hint&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;Name&quot;</span><span class="p">,</span> <span class="n">BYTE</span><span class="p">)</span>
<span class="p">]</span>
<span class="k">def</span> <span class="nf">get_string</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="n">target</span><span class="o">.</span><span class="n">read_string</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">PESection</span><span class="p">(</span><span class="n">IMAGE_SECTION_HEADER</span><span class="p">):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Name</span><span class="p">))[:</span><span class="mi">8</span><span class="p">]</span>
<span class="k">return</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_base_addr</span><span class="p">)[:</span><span class="mi">8</span><span class="p">]</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">size</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">VirtualSize</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s2">&quot;&lt;PESection </span><span class="se">\&quot;</span><span class="si">{0}</span><span class="se">\&quot;</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">pefile</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">target</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">class</span> <span class="nc">IATPtr</span><span class="p">(</span><span class="n">PVOID</span><span class="p">):</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">from_iatentry</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">iat_entry</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="bp">cls</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">iat_entry</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">addr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">nonhookvalue</span> <span class="o">=</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">nonhookvalue</span>
<span class="k">return</span> <span class="bp">self</span>
<div class="viewcode-block" id="IATEntry"><a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry">[docs]</a><span class="k">class</span> <span class="nc">IATEntry</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Represent an entry in the IAT of a module</span>
<span class="sd"> Can be used to get resolved value and setup hook</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;value&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)]</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">transformers</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">ord</span> <span class="o">=</span> <span class="nb">ord</span>
<span class="bp">self</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="n">name</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="kc">None</span>
<span class="bp">self</span><span class="o">.</span><span class="n">nonhookvalue</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">value</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">target</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; ordinal </span><span class="si">{2}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">ord</span><span class="p">)</span>
<div class="viewcode-block" id="IATEntry.set_hook"><a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry.set_hook">[docs]</a> <span class="k">def</span> <span class="nf">set_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Setup a hook on the entry and return it.</span>
<span class="sd"> You MUST keep a reference to the hook while the hook is enabled.</span>
<span class="sd"> :param callback: the hook</span>
<span class="sd"> .. note::</span>
<span class="sd"> see :ref:`hook_protocol`</span>
<span class="sd"> :rtype: :class:`windows.hooks.IATHook`</span>
<span class="sd"> .. warning::</span>
<span class="sd"> This works only for PEFile with the current process as target.</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Setting hook in remote process (use python code injection)&quot;</span><span class="p">)</span>
<span class="n">hook</span> <span class="o">=</span> <span class="n">hooks</span><span class="o">.</span><span class="n">IATHook</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="p">)</span>
<span class="kn">import</span> <span class="nn">weakref</span>
<span class="bp">self</span><span class="o">.</span><span class="n">whook</span> <span class="o">=</span> <span class="n">weakref</span><span class="o">.</span><span class="n">ref</span><span class="p">(</span><span class="n">hook</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">on_destroy</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="n">hook</span>
<span class="n">hook</span><span class="o">.</span><span class="n">enable</span><span class="p">()</span>
<span class="k">return</span> <span class="n">hook</span></div>
<span class="k">def</span> <span class="nf">on_destroy</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
<span class="c1"># We cannot know if the hook was enabled here..</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;DESTROY: </span><span class="si">{0}</span><span class="s2"> -&gt; &quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">args</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">enabled</span><span class="p">))</span>
<span class="c1"># import pdb;pdb.set_trace()</span>
<span class="c1"># print(args[0]())</span>
<div class="viewcode-block" id="IATEntry.remove_hook"><a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry.remove_hook">[docs]</a> <span class="k">def</span> <span class="nf">remove_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Remove the hook on the entry&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">False</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span><span class="o">.</span><span class="n">disable</span><span class="p">()</span>
<span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="kc">None</span>
<span class="k">return</span> <span class="kc">True</span></div></div>
<span class="c1"># def __del__(self):</span>
<span class="c1"># print(self.hook)</span>
<span class="c1"># if self.hook:</span>
<span class="c1"># print(&quot;LOL BYE {0}&quot;.format(self.hook))</span>
<span class="k">class</span> <span class="nc">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">):</span> <span class="c1"># TODO: use explicite name winstructs.IMAGE_IMPORT_DESCRIPTOR</span>
<span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="n">int_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
<span class="k">if</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&amp;</span> <span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span><span class="p">:</span>
<span class="n">res</span> <span class="o">+=</span> <span class="p">[(</span><span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&amp;</span> <span class="mh">0x7fffffff</span><span class="p">,</span> <span class="kc">None</span><span class="p">)]</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">import_by_name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMPORT_BY_NAME</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span><span class="p">)</span>
<span class="n">name_address</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span> <span class="o">+</span> <span class="nb">type</span><span class="p">(</span><span class="n">import_by_name</span><span class="p">)</span><span class="o">.</span><span class="n">Name</span><span class="o">.</span><span class="n">offset</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">import_by_name</span><span class="o">.</span><span class="n">Hint</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
<span class="n">int_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">int_entry</span><span class="p">))</span>
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">iat_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">FirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">IATEntry</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="n">iat_addr</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="s2">&quot;??&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="p">))</span>
<span class="n">iat_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">iat_entry</span><span class="p">))</span>
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">pefile</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">transformers</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span>
<span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">target</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">class</span> <span class="nc">IMAGE_EXPORT_DIRECTORY</span><span class="p">(</span><span class="n">IMAGE_EXPORT_DIRECTORY</span><span class="p">):</span> <span class="c1"># TODO: use explicite name winstructs._IMAGE_EXPORT_DIRECTORY</span>
<span class="k">def</span> <span class="nf">get_exports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">NameOrdinals</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">((</span><span class="n">WORD</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfNames</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfNameOrdinals</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="n">NameOrdinals</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="n">NameOrdinals</span><span class="p">)</span>
<span class="n">Functions</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">((</span><span class="n">DWORD</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfFunctions</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfFunctions</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="n">Names</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">((</span><span class="n">DWORD</span> <span class="o">*</span> <span class="bp">self</span><span class="o">.</span><span class="n">NumberOfNames</span><span class="p">),</span> <span class="bp">self</span><span class="o">.</span><span class="n">AddressOfNames</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">for</span> <span class="n">nb</span><span class="p">,</span> <span class="n">func</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">Functions</span><span class="p">):</span>
<span class="n">func</span> <span class="o">+=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="k">if</span> <span class="n">nb</span> <span class="ow">in</span> <span class="n">NameOrdinals</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">Names</span><span class="p">[</span><span class="n">NameOrdinals</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="n">nb</span><span class="p">)]</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">name</span> <span class="o">=</span> <span class="kc">None</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">nb</span><span class="p">,</span> <span class="n">func</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">pefile</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="bp">self</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">transformers</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">transformers</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">target</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">pefile</span><span class="o">.</span><span class="n">baseaddr</span>
<span class="k">return</span> <span class="bp">self</span>
<span class="k">class</span> <span class="nc">IMAGE_DOS_HEADER</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;e_magic&quot;</span><span class="p">,</span> <span class="n">CHAR</span> <span class="o">*</span> <span class="mi">2</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cblp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_crlc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cparhdr&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_minalloc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_maxalloc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ss&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_sp&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_csum&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ip&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_cs&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_lfarlc&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_ovno&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_res&quot;</span><span class="p">,</span> <span class="n">WORD</span> <span class="o">*</span> <span class="mi">4</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_oemid&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_oeminfo&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_res2&quot;</span><span class="p">,</span> <span class="n">WORD</span> <span class="o">*</span> <span class="mi">10</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;e_lfanew&quot;</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">),</span>
<span class="p">]</span>
<div class="viewcode-block" id="PEFile"><a class="viewcode-back" href="../../process.html#windows.pe_parse.PEFile">[docs]</a><span class="k">class</span> <span class="nc">PEFile</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Represent a PE loaded in a process (current or remote)&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">baseaddr</span><span class="p">,</span> <span class="n">targetedbitness</span><span class="p">,</span> <span class="n">transformers</span><span class="p">):</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">target</span>
<span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">=</span> <span class="n">baseaddr</span>
<span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">=</span> <span class="n">targetedbitness</span>
<span class="bp">self</span><span class="o">.</span><span class="n">transformers</span> <span class="o">=</span> <span class="n">transformers</span>
<span class="k">if</span> <span class="n">targetedbitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span> <span class="o">=</span> <span class="n">IMAGE_ORDINAL_FLAG32</span>
<span class="k">else</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span> <span class="o">=</span> <span class="n">IMAGE_ORDINAL_FLAG64</span>
<span class="k">def</span> <span class="nf">get_string</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="o">.</span><span class="n">read_string</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_DOS_HEADER</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_DOS_HEADER</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_NT_HEADER</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">offset</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DOS_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">e_lfanew</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS32</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS64</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_OptionalHeader</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
<span class="k">def</span> <span class="nf">get_DataDirectory</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># This won&#39;t work if we load a PE32 in a 64bit process</span>
<span class="c1"># PE32 .NET...</span>
<span class="c1"># return self.get_OptionalHeader().DataDirectory</span>
<span class="n">DataDirectory_type</span> <span class="o">=</span> <span class="n">IMAGE_DATA_DIRECTORY</span> <span class="o">*</span> <span class="n">IMAGE_NUMBEROF_DIRECTORY_ENTRIES</span>
<span class="n">SizeOfOptionalHeader</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">SizeOfOptionalHeader</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">_base_addr</span>
<span class="n">DataDirectory_addr</span> <span class="o">=</span> <span class="n">opt_header_addr</span> <span class="o">+</span> <span class="n">SizeOfOptionalHeader</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">,</span> <span class="n">DataDirectory_addr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_IMPORT_DESCRIPTORS</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">import_datadir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DataDirectory</span><span class="p">()[</span><span class="n">IMAGE_DIRECTORY_ENTRY_IMPORT</span><span class="p">]</span>
<span class="k">if</span> <span class="n">import_datadir</span><span class="o">.</span><span class="n">VirtualAddress</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="k">return</span> <span class="p">[]</span>
<span class="n">import_descriptor_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">import_datadir</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="n">current_import_descriptor</span> <span class="o">=</span> <span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">import_descriptor_addr</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="n">current_import_descriptor</span><span class="o">.</span><span class="n">FirstThunk</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_import_descriptor</span><span class="p">)</span>
<span class="n">import_descriptor_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">)</span>
<span class="n">current_import_descriptor</span> <span class="o">=</span> <span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">import_descriptor_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="k">def</span> <span class="nf">get_EXPORT_DIRECTORY</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">export_directory_rva</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_DataDirectory</span><span class="p">()[</span><span class="n">IMAGE_DIRECTORY_ENTRY_EXPORT</span><span class="p">]</span><span class="o">.</span><span class="n">VirtualAddress</span>
<span class="k">if</span> <span class="n">export_directory_rva</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="n">export_directory_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">export_directory_rva</span>
<span class="n">exp_dir</span> <span class="o">=</span> <span class="n">IMAGE_EXPORT_DIRECTORY</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">export_directory_addr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">exp_dir</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">sections</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">nt_header</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span>
<span class="n">nb_section</span> <span class="o">=</span> <span class="n">nt_header</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">NumberOfSections</span>
<span class="n">SizeOfOptionalHeader</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">SizeOfOptionalHeader</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">_base_addr</span>
<span class="n">base_section</span> <span class="o">=</span> <span class="n">opt_header_addr</span> <span class="o">+</span> <span class="n">SizeOfOptionalHeader</span>
<span class="c1">#pe_section_type = IMAGE_SECTION_HEADER</span>
<span class="k">return</span> <span class="p">[</span><span class="n">PESection</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">base_section</span> <span class="o">+</span> <span class="p">(</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_SECTION_HEADER</span><span class="p">)</span> <span class="o">*</span> <span class="n">i</span><span class="p">))</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="n">nb_section</span><span class="p">)]</span>
<span class="c1">#sections_array = self.transformers.create_structure_at((self.PESection * nb_section), base_section)</span>
<span class="c1">#return list(sections_array)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">exports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The exports of the PE in a dict. Keys are ordinal (:class:`int`) and name (:class:`str`).</span>
<span class="sd"> The values are the addresses of the exports.</span>
<span class="sd"> :type: {(:class:`int` or :class:`str`) : :class:`int`}&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
<span class="n">exp_dir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_EXPORT_DIRECTORY</span><span class="p">()</span>
<span class="k">if</span> <span class="n">exp_dir</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">res</span>
<span class="n">raw_exports</span> <span class="o">=</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">get_exports</span><span class="p">()</span>
<span class="k">for</span> <span class="nb">id</span><span class="p">,</span> <span class="n">rva_addr</span><span class="p">,</span> <span class="n">rva_name</span> <span class="ow">in</span> <span class="n">raw_exports</span><span class="p">:</span>
<span class="n">res</span><span class="p">[</span><span class="nb">id</span><span class="p">]</span> <span class="o">=</span> <span class="n">rva_addr</span>
<span class="k">if</span> <span class="n">rva_name</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">res</span><span class="p">[</span><span class="n">rva_name</span><span class="p">]</span> <span class="o">=</span> <span class="n">rva_addr</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">export_name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The Name attribute of the ``EXPORT_DIRECTORY``&quot;&quot;&quot;</span>
<span class="n">exp_dir</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_EXPORT_DIRECTORY</span><span class="p">()</span>
<span class="k">if</span> <span class="n">exp_dir</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">Name</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">return</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">Name</span><span class="p">)</span>
<span class="c1"># TODO: get imports by parsing other modules exports if no INT</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">imports</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The imports of the PE in a dict.</span>
<span class="sd"> Keys are the names of DLL to import from and values are :class:`list`</span>
<span class="sd"> of :class:`IATEntry`</span>
<span class="sd"> :type: {:class:`str` : [:class:`IATEntry`]}&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
<span class="k">for</span> <span class="n">import_descriptor</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_IMPORT_DESCRIPTORS</span><span class="p">():</span>
<span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">()</span>
<span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">()</span>
<span class="k">if</span> <span class="n">INT</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">for</span> <span class="n">iat_entry</span><span class="p">,</span> <span class="p">(</span><span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="n">IAT</span><span class="p">,</span> <span class="n">INT</span><span class="p">):</span>
<span class="c1"># str(name.decode()) -&gt; python2 and python3 compatible for str result</span>
<span class="n">iat_entry</span><span class="o">.</span><span class="n">ord</span> <span class="o">=</span> <span class="nb">ord</span>
<span class="n">iat_entry</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="nb">str</span><span class="p">(</span><span class="n">name</span><span class="o">.</span><span class="n">decode</span><span class="p">())</span> <span class="k">if</span> <span class="n">name</span> <span class="k">else</span> <span class="s2">&quot;&quot;</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">Name</span><span class="p">)</span>
<span class="n">res</span><span class="o">.</span><span class="n">setdefault</span><span class="p">(</span><span class="n">name</span><span class="o">.</span><span class="n">lower</span><span class="p">(),</span> <span class="p">[])</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">IAT</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span></div>
</pre></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../../search.html" method="get">
<input type="text" name="q" />
<input type="submit" value="Go" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.5 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015, Clement Rouault.
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.7.5.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink