Ë
|
Jñúh¹G ã ó d Z ddlZddlZddlZddlZddlZddlZddlZdZ ej Z
|
dZ G d de « Z d Zd Zd Zy)
|
zpeutils, Portable Executable utilities module
|
|
|
Copyright (c) 2005-2023 Ero Carrera <ero.carrera@gmail.com>
|
|
All rights reserved.
|
é Nz Ero Carrerazero.carrera@gmail.comc óh e Zd ZdZddZddZddZ ddZddZddZ d Z
|
dd
|
Z dd Z dd Z dd Zy)ÚSignatureDatabasea± This class loads and keeps a parsed PEiD signature database.
|
|
Usage:
|
|
sig_db = SignatureDatabase('/path/to/signature/file')
|
|
and/or
|
|
sig_db = SignatureDatabase()
|
sig_db.load('/path/to/signature/file')
|
|
Signature databases can be combined by performing multiple loads.
|
|
The filename parameter can be a URL too. In that case the
|
signature database will be downloaded from that location.
|
Nc ó t j dt j « | _ t « | _ d| _ t « | _ d| _ t « | _ d| _
|
d| _ | j ||¬« y )Nzh\[(.*?)\]\s+?signature\s*=\s*(.*?)(\s+\?\?)*\s*ep_only\s*=\s*(\w+)(?:\s*section_start_only\s*=\s*(\w+)|)r ©ÚfilenameÚdata) ÚreÚcompileÚSÚ parse_sigÚdictÚsignature_tree_eponly_trueÚsignature_count_eponly_trueÚsignature_tree_eponly_falseÚ signature_count_eponly_falseÚ signature_tree_section_startÚ signature_count_section_startÚ max_depthÚ_SignatureDatabase__load©Úselfr r s ú:H:\Change_password\venv_build\Lib\site-packages\peutils.pyÚ__init__zSignatureDatabase.__init__& so ô Ø vÜ DDó
|
ô" +/«&Ô'Ø+,Ô(Ü+/«6Ô(Ø,-Ô)Ü,0«FÔ)Ø-.Ô*ð à X¨D Õ1ó c ó¸ t « }t |j « D ] \ }}|j |k r|j }d||dz t |j « dj |j D cg c] }|t j v s| c}« fz } |j | j ||| dd|¬« « ¢ dj |« dz S c c}w )a Generates signatures for all the sections in a PE file.
|
|
If the section contains any data a signature will be created
|
for it. The signature name will be a combination of the
|
parameter 'name' and the section number and its name.
|
z%s Section(%d/%d,%s)é Ú FT)Úep_onlyÚsection_start_onlyÚ
|
sig_lengthú
|
) ÚlistÚ enumerateÚsectionsÚ SizeOfRawDataÚPointerToRawDataÚlenÚjoinÚNameÚstringÚ printableÚappendÚ&_SignatureDatabase__generate_signature)
|
r ÚpeÚnamer Úsection_signaturesÚidxÚsectionÚoffsetÚcÚsig_names
|
r Úgenerate_section_signaturesz-SignatureDatabase.generate_section_signaturesH så ô "VÐä % b§k¡kÓ 2ò LCà×$Ñ$ zÒ1Øð ×-Ñ-Fà-ØØaÜBKKÓ Ø G§L¡LÖJq°A¼×9IÑ9IÒ4IÒJÓKð 1ñ Hð × %Ñ %Ø×)Ñ)ØØØ Ø !Ø'+Ø )ð *ó õ ð ð4 yyÐ+Ó,¨tÑ3Ð3ùò Ks Á5C Cc óx |j |j j « }| j |||d|¬« S )z°Generate signatures for the entry point of a PE file.
|
|
Creates a signature whose name will be the parameter 'name'
|
and the section number and its name.
|
T)r r )Úget_offset_from_rvaÚOPTIONAL_HEADERÚAddressOfEntryPointr- )r r. r/ r r3 s r Úgenerate_ep_signaturez'SignatureDatabase.generate_ep_signaturen sC ð ×'Ñ'¨×(:Ñ(:×(NÑ(NÓOà×(Ñ(Ø d°zð )ó
|
ð
|
r c óÐ |j |||z }dj |D cg c] }dt |« z c}« } |dk( rd}nd}|dk( rd}nd}d|d| d|d |d
|
}
|
|
|
S c c}w ) Nú z%02xTÚtrueÚfalseú[z]
|
signature = z
|
ep_only = z
|
section_start_only = r! )Ú__data__r( Úord) r r. r3 r/ r r r r r4 Úsignature_bytesÚ signatures r Ú__generate_signaturez&SignatureDatabase.__generate_signature{ s ð {{6 F¨ZÑ$7Ð8à ((¸TÖ#B¸ F¬S°«V£OÒ#BÓCà d?Ø Gà Gà Ò %Ø!'Ñ à!(Ð øò Ú Ú Ú ð
|
ð Ðùò' $Cs ¢A#c ó | j |||« }|r(|dk( r|D cg c] }|d |d d f c}S |d d S yc c}w )a Matches and returns the exact match(es).
|
|
If ep_only is True the result will be a string with
|
the packer name. Otherwise it will be a list of the
|
form (file_offset, packer_name) specifying where
|
in the file the signature was found.
|
Fr r éÿÿÿÿN©Ú_SignatureDatabase__match)r r. r r ÚmatchesÚmatchs r rK zSignatureDatabase.match s` ð ,,r 7Ð,>Ó?ñ
|
Ø%Ò ð ?FÖF°Uq 5¨¡8¨B¡<Ò0ÒFÐFà1:b>Ð !àùò Gs ?c óF | j |||« }|r |dk( r|S |d S y)z+Matches and returns all the likely matches.Fr NrH )r r. r r rJ s r Ú match_allzSignatureDatabase.match_all¯ s6 ð ,,r 7Ð,>Ó?á Ø%Ò ð à1:Ð àr c ó@ |du r= |j }| j }|j D cg c] }|j }}ng|du r7 |j « }| j }|j j } | g}n,|j }| j }t t |« « }g }
|
|D ]: } | j ||| | | j z « } | s(|
|
j | | f« < |du r|
|
r|
|
d S |
|
S # t $ r} d }~ww xY wc c}w # t $ r} d }~ww xY w)NTr )rA Ú Exceptionr r$ r& Úget_memory_mapped_imager r9 r: r Úranger' Ú(_SignatureDatabase__match_signature_treer r, ) r r. r r r ÚexcpÚ
|
signaturesr2 Úscan_addressesÚeprJ r1 Úresults r Ú__matchzSignatureDatabase.__match¿ sJ ð Ñ %ð
|
Ø{{ð ×:Ñ:Jð GIÇkÁkÖ R¸7g× 6Ó 6Ð RNÑ Rà _ð
|
Ø×1Ñ1Ó3ð ×8Ñ8Jð
|
×#Ñ#×7Ñ7Bð !TNð ;;Dà ×9Ñ9Jä "¤3 t£9Ó -Nð Ø!ò .CØ×0Ñ0ØD s¨T¯^©^Ñ';Ð <óFò Ø V}Õ-ð .ð d?ÙØ qzÐ!àøôy ò Øûð üò Søô ò Øûð ús4 C7 ¬D ÁD Ã7 DÄ DÄDÄ D ÄDÄD c óê |}dg}|du r | j }n|du r | j }g }|D ]: }| j |||| j z « } | s(|j || f« < |du r|r|d S |S )Nr T)r r rR r r, )
|
r Ú code_datar r r rU rT rJ r1 rW s
|
r Ú
|
match_dataz SignatureDatabase.match_data
|
s¦ àØð Ñ %ð ×:Ñ:Jð
|
_ð ×8Ñ8Jð Ø!ò .CØ×0Ñ0ØD s¨T¯^©^Ñ';Ð <óFò Ø V}Õ-ð .ð d?ÙØ qzÐ!àr c ó t « }|}t |D cg c] }t |t « r|n
|
t |« ! c}« D ]Ó \ }}| nÌ|j |d« } dt |j « « v rSt « }
|
t |j « « D ] } | d |
|
j | d « |j |
|
« d|v rD|j dd« } ||dz d } | r(|j | j | | ||z dz « « | }Õ |ndt |j « « v rSt « }
|
t |j « « D ] } | d |
|
j | d « |j |
|
« |S c c}w )a
|
Recursive function to find matches along the signature tree.
|
|
signature_tree is the part of the tree left to walk
|
data is the data being checked against the signature tree
|
depth keeps track of how far we have gone down the tree
|
Nr r z??) r" r# Ú
|
isinstanceÚintrB ÚgetÚvaluesÚitemsr, ÚextendrR )r Úsignature_treer ÚdepthÚ matched_namesrK Úbr1 ÚbyteÚ
|
match_nextÚnamesÚitemÚmatch_tree_alternateÚdata_remainings r Ú__match_signature_treez(SignatureDatabase.__match_signature_tree6 s ô Ø ô
|
#ÐQUÖ#VÈA¬°A´sÔ);¡AÄÀQÃÑ$GÒ#VÓWò + ICð }Ùð 4¨Ó.Jð tELLNÓ+Ñ+ô ô ! §¡£ Ó /ò .DØAwØ T¨!¡WÕ-ð.ð ×$Ñ$ UÔ+ð
|
u}Ø',§y¡y°°tÓ'<Ð$Ø!% c¨A¡g i Ù!Ø!×(Ñ(Ø ×3Ñ3Ø 0°.À#ÈÁ+ÐPQÁ/óôð EðW+ ð` Ð ¬¨e¯l©l«nÓ)=Ñ!=äFEÜ U[[]Ó+ò *Ø7?ØLL a¡Õ)ð *ð × Ñ Ô 'à Ð ùòq $Ws $F c ó* | j ||¬« y)znLoad a PEiD signature file.
|
|
Invoking this method on different files combines the signatures.
|
r N)r r s r ÚloadzSignatureDatabase.load~ s ð X¨D Õ1r c ó¤ |t j j |« sA t j j |« }|j « }|j « n0 t |d« }|j « }|j « n|}|sy d }| j j |« }|D ]v \ }}} }
|
} |
|
j « j « }
|
|j dd« j « }|j « D cg c]
|
} || « } } |
|
dk( rd}
|
nd}
|
| dk( rd} nd} d}| du r"| j }| xj" d z c_ nG|
|
du r"| j$ }| xj& d z c_ n!| j( }| xj* d z c_ t- | « D ]c \ }}|d z t/ | « k( r&|j1 |t3 « « ||< d || |< n |j1 |t3 « « ||< || }|d z }e || j4 kD sp|| _ y y # t $ r w xY w# t $ r w xY wc c} w )
|
NÚrtc ó& d| v r| S t | d« S )Nú?é )r^ )Úvalues r Úto_bytez)SignatureDatabase.__load.<locals>.to_byte¨ s Øe|Ø Üub>Ð !r z\nr r> TFr r )ÚosÚpathÚexistsÚurllibÚrequestÚurlopenÚreadÚcloseÚIOErrorÚopenr ÚfindallÚstripÚlowerÚreplaceÚsplitr r r r r r r# r' r_ r r )r r r Úsig_fÚsig_datarv rJ Ú packer_namerD Úsuperfluous_wildcardsr r rf rC rd Útreer1 rg s r Ú__loadzSignatureDatabase.__load sS à Ð ô 77>> (Ô+ðÜ "NN× 2Ñ 2°8Ó <EØ $zz|HØKKMðÜ ¨4Ó 0EØ $zz|HØKKMð
|
Hñ
|
Ø ò "ð ..×(Ñ(¨Ó2ð ó 6 'ñ
|
Ø Ø Ø !Ø Ø ð mmo×+Ñ+Ó-Gà!×)Ñ)¨%°Ó4×:Ñ:Ó<Ià3<·?±?Ó3DÖ E¨aw qzÐ EOÐ Eà&Ò Ø à à! VÒ+Ø%)Ñ"à%*Ð"àEà! TÑ)à×8Ñ8Ø×2Ò2°aÑ7Ö2ð d?Ø ×:Ñ:DØ×4Ò4¸Ñ9Ö4à ×;Ñ;DØ×5Ò5¸Ñ:Õ5ä & Ó 7ò Tà7c /Ó 2Ò2à!%§¡¨$´³Ó!7DJØ.2DJ{Ò+ð "&§¡¨$´³Ó!7DJàDzØ
|
ð ð t~~Ô%Ø!&ñm6 'øôI ò àðûô ò àðüòL Fs £?H1 Á$,H? ÄI È1 H<È? I
|
)NN)é )FFr )TF)r )Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__r r6 r; r- rK rM rI r[ rR ro r © r r r r sM ñó" 2óD$4óL
|
ð UXóó6ó2ò IóV*óXF óP2ôd'r r c ó y)r Nr )r. s r Úis_validr í s àr c ój d}d}t | d« r| j D ]~ }d}|j D ]k }|j | j j
|
cxk r|j dz k rn nd}| ||j cxk r|dz k rn n|dz }|j }m d}| j « }|r| y)zp
|
unusual locations of import tables
|
non recognized section names
|
presence of long ASCII strings
|
Fr ÚDIRECTORY_ENTRY_BASERELOCNé Tr )Úhasattrr ÚentriesÚrvar9 r: Ú get_warnings)r. Ú relocations_overlap_entry_pointÚsequential_relocsÚ
|
base_relocÚlast_reloc_rvaÚrelocÚwarnings_while_parsingÚwarningss r Ú is_suspiciousr¢ ò sË ð ',Ð#ØÐô rÐ.Ô/Ø ×6Ñ6ò +JØ !NØ#×+Ñ+ò
|
+Ø99 × 2Ñ 2× FÑ FÔWÈ%Ï)É)ÐVWÉ-ÕWØ6:Ð3ð #Ð.Ø&¨%¯)©)ÔI°~ÈÑ7IÕIà%¨Ñ*Ð%à!&§¡ñ
|
+ð +ð& #Ðð Ó HÙÙ ð r c óä t | j « « }|syd}d}| j D ]6 }|j « }t |j « « }|dkD s2||z }8 ||z dkD rd}|S )a8 Returns True is there is a high likelihood that a file is packed or contains compressed data.
|
|
The sections of the PE file will be analyzed, if enough sections
|
look like containing compressed data and the data makes
|
up for more than 20% of the total file size, the function will
|
return True.
|
TFr g @gÉ?)r' Útrimr$ Ú get_entropyÚget_data)r. Útotal_pe_data_lengthÚ)has_significant_amount_of_compressed_dataÚtotal_compressed_datar2 Ú s_entropyÚs_lengths r Úis_probably_packedr¬ ( s ô rwwy>Ðá ØØ05Ð-ð
|
ÐØ;;ò .Ø×'Ñ'Ó) Üw×'Ñ'Ó)Ó*ð s?Ø ! XÑ -Ñ !ð .ð Ð 4Ñ4¸Ò;Ø48Ð1à 4Ð4r )r rw r r* Úurllib.requestrz Ú urllib.parseÚ urllib.errorÚpefileÚ
|
__author__Ú __version__Ú __contact__Úobjectr r r¢ r¬ r r r ú<module>rµ sR ðñó
|
Û Û ß 1Ó 1Û à
|
Ø× Ñ Ø% ôV'ô V'òr ò
|
3 ól!5r
|
