mirror of
https://github.com/malwarefrank/dnfile
synced 2026-06-08 15:39:09 +00:00
doomedraven
46 lines
1.3 KiB
Python
Executable File
46 lines
1.3 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
#
|
|
# Iterate UserStrings and display one per line.
|
|
|
|
import sys
|
|
|
|
import dnfile
|
|
|
|
|
|
def show_strings(fname):
|
|
# parse .NET executable
|
|
dn = dnfile.dnPE(fname)
|
|
# if no CLR data found, do nothing
|
|
if not hasattr(dn, "net"):
|
|
return
|
|
|
|
# get the (first) UserStrings stream
|
|
us: dnfile.stream.UserStringHeap = dn.net.metadata.streams.get(b"#US", None)
|
|
if us:
|
|
# get size of the stream
|
|
size = us.sizeof()
|
|
# First entry (first byte in stream) is empty string, so skip it
|
|
offset = 1
|
|
# while there is still data in the stream
|
|
while offset < size:
|
|
# read the raw string bytes, and provide number of bytes read (includes encoded length)
|
|
ret = us.get_with_size(offset)
|
|
if ret is None:
|
|
break
|
|
|
|
buf, readlen = ret
|
|
try:
|
|
# convert to a UserString object
|
|
s = dnfile.stream.UserString(buf)
|
|
# display the decoded string
|
|
print(s.value)
|
|
except UnicodeDecodeError:
|
|
print(f"Bad string: {buf}")
|
|
# continue to next entry
|
|
offset += readlen
|
|
|
|
|
|
# for each filepath provided on command-line
|
|
for fname in sys.argv[1:]:
|
|
show_strings(fname)
|