Ë
|
Jñúh¥t ã ót d Z dZdZdZddlZddlZddlZddlZddlZddl Z ddl
|
Z
|
ddl Z ddl Z ddlm Z ddlmZ ddlmZ dd lmZ dd
|
lmZ dd lmZ ddlZddlZddlZ ej2 d ej4 d « « eZ ddZ e d¬« d « Z e d¬« d « Z d Z dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,d Z-d Z.d Z/d Z0d Z1d!Z2d"Z3d#Z4d$Z5d%Z6d& Z7g d'¢Z8 e7e8« Z9g d(¢Z: e7e:« Z;g d)¢Z< e7e<« Z=g d*¢Z> e7e>« Z?g d+¢Z@ e7e@« ZAg d,¢ZB e7eB« ZCg d-¢ZD e7eD« ZEg d.¢ZF e7eF« ZGdZHg d/¢ZI e7eI« ZJg d0¢ZK e7eK« ZLdZMd1ZNd2ZOd3ZPd4ZQd5ZRd6ZSd7ZTd8ZUd9ZVg d:¢ZW e7eW« ZXg d;¢ZY e7eY« ZZg d<¢Z[ e7e[« Z\ e]e[« Z\e[D ]$ \ Z^Z_e_e\v re\e_ jÁ e^« e^ge\e_< & d= Zad> Zbd? Zcd@ ZddA ZedB Zf G dC dDeg« Zh G dE dF« Zi G dG dHej« Zk G dI dJ« Zld1d1d1d1d2d2d4d4d4d4d4d7d7d7d1dKZm e d¬« dL « Zn e ddM¬N« dO « Zo G dP dQ« Zp G dR dSep« Zq e dd¬N« dT « Zr G dU dVep« Zs G dW dX« Zt G dY dZet« Zu G d[ d\et« Zv G d] d^et« Zw G d_ d`et« Zx G da dbet« Zy G dc ddet« Zz G de dfet« Z{ G dg dhet« Z| G di djet« Z} G dk dlet« Z~ G dm dnet« Z G do dpet« Z G dq dret« Z G ds dtet« Z G du dvet« Z G dw dxet« Z G dy dzes« Z
G d{ d|« Z G d} d~e« Z G d de« Z G d de« Z G d de« Z G d
de« Z G d de« Z G d de« Z G d de« Z G d de« Z G d de« Z G d d« Z efe
|
j$ e
|
j& z e
|
j( z dz « Zd Z efe
|
j$ e
|
j& z e
|
j( z « Z e d¬« ddeeeef dedefd« Z G d d« Zd Zedk( r e« yy)ab pefile, Portable Executable reader module
|
|
All the PE file basic structures are available with their default names as
|
attributes of the instance returned.
|
|
Processed elements such as the import table are made available with lowercase
|
names, to differentiate them from the upper case basic structure names.
|
|
pefile has been tested against many edge cases such as corrupted and malformed
|
PEs as well as malware, which often attempts to abuse the format way beyond its
|
standard use. To the best of my knowledge most of the abuse is handled
|
gracefully.
|
|
Copyright (c) 2005-2023 Ero Carrera <ero.carrera@gmail.com>
|
z Ero Carreraz2023.2.7zero.carrera@gmail.comé N)ÚCounter)ÚUnion)Úsha1)Úsha256)Úsha512©Úmd5Úbackslashreplace_ÚbackslashreplaceFc óF |st j « S fd}|S )Nc ó| t j « | « t j | « fd« }|S )Nc ó: t j | i |¤« S ©N)ÚcopymodÚcopy)ÚargsÚkwargsÚ cached_funcs ú9H:\Change_password\venv_build\Lib\site-packages\pefile.pyÚwrapperz-lru_cache.<locals>.decorator.<locals>.wrapper; s ø ô <<¡ ¨TÐ <°VÑ <Ó=Ð =ó )Ú functoolsÚ lru_cacheÚwraps)Úfr r ÚmaxsizeÚtypeds @r Ú decoratorz lru_cache.<locals>.decorator8 s> ù Ø9i×)Ñ)¨'°5Ó9¸!Ó< ä Ó ó >ó
|
ð >ð r )r r )r r r r s `` r r r 4 s& ù Ù Ü×"Ñ" 7¨EÓ2Ð2õð Ðr é )r c ó: |t k r| S t | dz « dz S )Né )Ú FILE_ALIGNMENT_HARDCODED_VALUEÚint)ÚvalÚfile_alignments r Úcache_adjust_FileAlignmentr& E s$ àÔ6Ò6Ø
|
Ü e Ó Ñ %Ð%r c óD |dk r|}|r| |z r|t | |z « z S | S )Né )r# )r$ Úsection_alignmentr% s r Ú cache_adjust_SectionAlignmentr* L s8 à6Ò!Ø *Ðñ SÐ#4Ò 4Ø ¤C¨Ð.?Ñ(?Ó$@ÑAÐAØ Jr c ó$ | j d« S ©Nr )Úcount)Údatas r Ú count_zeroesr/ \ s Ø ::a=Ðr é é r! é é iMZ iZM iNE iLE iLX iVZ iPE é ì l i i c óT t | D cg c] }|d |d f c}| z « S c c}w )Né r )Údict)ÚpairsÚes r Ú two_way_dictr; s, Ü uÖ- !!A$! Ò-°Ñ5Ó 6Ð6ùÒ-s %))Ú IMAGE_DIRECTORY_ENTRY_EXPORTr )Ú IMAGE_DIRECTORY_ENTRY_IMPORTr7 )Ú IMAGE_DIRECTORY_ENTRY_RESOURCEé )Ú IMAGE_DIRECTORY_ENTRY_EXCEPTIONé )Ú IMAGE_DIRECTORY_ENTRY_SECURITYé )Ú IMAGE_DIRECTORY_ENTRY_BASERELOCé )ÚIMAGE_DIRECTORY_ENTRY_DEBUGé )Ú IMAGE_DIRECTORY_ENTRY_COPYRIGHTé )Ú IMAGE_DIRECTORY_ENTRY_GLOBALPTRé )ÚIMAGE_DIRECTORY_ENTRY_TLSé )Ú!IMAGE_DIRECTORY_ENTRY_LOAD_CONFIGé
|
)Ú"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORTé )ÚIMAGE_DIRECTORY_ENTRY_IATé )Ú"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORTé )Ú$IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTORé )Ú IMAGE_DIRECTORY_ENTRY_RESERVEDé ))ÚIMAGE_FILE_RELOCS_STRIPPEDr7 )ÚIMAGE_FILE_EXECUTABLE_IMAGEr? )Ú IMAGE_FILE_LINE_NUMS_STRIPPEDrC )Ú IMAGE_FILE_LOCAL_SYMS_STRIPPEDrK )Ú IMAGE_FILE_AGGRESIVE_WS_TRIMr4 )Ú IMAGE_FILE_LARGE_ADDRESS_AWAREr3 )ÚIMAGE_FILE_16BIT_MACHINEé@ )Ú IMAGE_FILE_BYTES_REVERSED_LOé )ÚIMAGE_FILE_32BIT_MACHINEé )ÚIMAGE_FILE_DEBUG_STRIPPEDr! )Ú"IMAGE_FILE_REMOVABLE_RUN_FROM_SWAPé )Ú IMAGE_FILE_NET_RUN_FROM_SWAPr )ÚIMAGE_FILE_SYSTEMr( )ÚIMAGE_FILE_DLLr1 )ÚIMAGE_FILE_UP_SYSTEM_ONLYé @ )Ú IMAGE_FILE_BYTES_REVERSED_HIr2 ).)ÚIMAGE_SCN_TYPE_REGr )ÚIMAGE_SCN_TYPE_DSECTr7 )ÚIMAGE_SCN_TYPE_NOLOADr? )ÚIMAGE_SCN_TYPE_GROUPrC )ÚIMAGE_SCN_TYPE_NO_PADrK )ÚIMAGE_SCN_TYPE_COPYr4 )ÚIMAGE_SCN_CNT_CODEr3 )Ú IMAGE_SCN_CNT_INITIALIZED_DATAra )Ú IMAGE_SCN_CNT_UNINITIALIZED_DATArc )ÚIMAGE_SCN_LNK_OTHERre )ÚIMAGE_SCN_LNK_INFOr! )ÚIMAGE_SCN_LNK_OVERrh )ÚIMAGE_SCN_LNK_REMOVEr )ÚIMAGE_SCN_LNK_COMDATr( )ÚIMAGE_SCN_MEM_PROTECTEDrm )ÚIMAGE_SCN_NO_DEFER_SPEC_EXCrm )ÚIMAGE_SCN_GPRELr2 )ÚIMAGE_SCN_MEM_FARDATAr2 )ÚIMAGE_SCN_MEM_SYSHEAPé )ÚIMAGE_SCN_MEM_PURGEABLEé )ÚIMAGE_SCN_MEM_16BITr )ÚIMAGE_SCN_MEM_LOCKEDi )ÚIMAGE_SCN_MEM_PRELOADi )ÚIMAGE_SCN_ALIGN_1BYTESr0 )ÚIMAGE_SCN_ALIGN_2BYTESi )ÚIMAGE_SCN_ALIGN_4BYTESi 0 )ÚIMAGE_SCN_ALIGN_8BYTESi @ )ÚIMAGE_SCN_ALIGN_16BYTESi P )ÚIMAGE_SCN_ALIGN_32BYTESi ` )ÚIMAGE_SCN_ALIGN_64BYTESi p )ÚIMAGE_SCN_ALIGN_128BYTESi )ÚIMAGE_SCN_ALIGN_256BYTESi )ÚIMAGE_SCN_ALIGN_512BYTESi )ÚIMAGE_SCN_ALIGN_1024BYTESi ° )ÚIMAGE_SCN_ALIGN_2048BYTESi À )ÚIMAGE_SCN_ALIGN_4096BYTESi Ð )ÚIMAGE_SCN_ALIGN_8192BYTESi à )ÚIMAGE_SCN_ALIGN_MASKi ð )ÚIMAGE_SCN_LNK_NRELOC_OVFLi )ÚIMAGE_SCN_MEM_DISCARDABLEi )ÚIMAGE_SCN_MEM_NOT_CACHEDi )ÚIMAGE_SCN_MEM_NOT_PAGEDé )ÚIMAGE_SCN_MEM_SHAREDé )ÚIMAGE_SCN_MEM_EXECUTEi )ÚIMAGE_SCN_MEM_READi @)ÚIMAGE_SCN_MEM_WRITEr5 ))ÚIMAGE_DEBUG_TYPE_UNKNOWNr )ÚIMAGE_DEBUG_TYPE_COFFr7 )ÚIMAGE_DEBUG_TYPE_CODEVIEWr? )ÚIMAGE_DEBUG_TYPE_FPOrA )ÚIMAGE_DEBUG_TYPE_MISCrC )ÚIMAGE_DEBUG_TYPE_EXCEPTIONrE )ÚIMAGE_DEBUG_TYPE_FIXUPrG )Ú IMAGE_DEBUG_TYPE_OMAP_TO_SRCrI )Ú IMAGE_DEBUG_TYPE_OMAP_FROM_SRCrK )ÚIMAGE_DEBUG_TYPE_BORLANDrM )ÚIMAGE_DEBUG_TYPE_RESERVED10rO )ÚIMAGE_DEBUG_TYPE_CLSIDrQ )ÚIMAGE_DEBUG_TYPE_VC_FEATURErS )ÚIMAGE_DEBUG_TYPE_POGOrU )ÚIMAGE_DEBUG_TYPE_ILTCGrW )ÚIMAGE_DEBUG_TYPE_MPXrY )ÚIMAGE_DEBUG_TYPE_REPROr4 )Ú&IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICSé ))ÚIMAGE_SUBSYSTEM_UNKNOWNr )ÚIMAGE_SUBSYSTEM_NATIVEr7 )ÚIMAGE_SUBSYSTEM_WINDOWS_GUIr? )ÚIMAGE_SUBSYSTEM_WINDOWS_CUIrA )ÚIMAGE_SUBSYSTEM_OS2_CUIrE )ÚIMAGE_SUBSYSTEM_POSIX_CUIrI )Ú IMAGE_SUBSYSTEM_NATIVE_WINDOWSrK )Ú IMAGE_SUBSYSTEM_WINDOWS_CE_GUIrM )Ú IMAGE_SUBSYSTEM_EFI_APPLICATIONrO )Ú'IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVERrQ )Ú"IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVERrS )ÚIMAGE_SUBSYSTEM_EFI_ROMrU )ÚIMAGE_SUBSYSTEM_XBOXrW )Ú(IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATIONr4 )$)ÚIMAGE_FILE_MACHINE_UNKNOWNr )ÚIMAGE_FILE_MACHINE_I386iL )ÚIMAGE_FILE_MACHINE_R3000ib )ÚIMAGE_FILE_MACHINE_R4000if )ÚIMAGE_FILE_MACHINE_R10000ih )Ú IMAGE_FILE_MACHINE_WCEMIPSV2ii )ÚIMAGE_FILE_MACHINE_ALPHAi )ÚIMAGE_FILE_MACHINE_SH3i¢ )ÚIMAGE_FILE_MACHINE_SH3DSPi£ )ÚIMAGE_FILE_MACHINE_SH3Ei¤ )ÚIMAGE_FILE_MACHINE_SH4i¦ )ÚIMAGE_FILE_MACHINE_SH5i¨ )ÚIMAGE_FILE_MACHINE_ARMiÀ )ÚIMAGE_FILE_MACHINE_THUMBi )ÚIMAGE_FILE_MACHINE_ARMNTiÄ )ÚIMAGE_FILE_MACHINE_AM33iÓ )ÚIMAGE_FILE_MACHINE_POWERPCið )Ú IMAGE_FILE_MACHINE_POWERPCFPiñ )ÚIMAGE_FILE_MACHINE_IA64r! )ÚIMAGE_FILE_MACHINE_MIPS16if )ÚIMAGE_FILE_MACHINE_ALPHA64é )ÚIMAGE_FILE_MACHINE_AXP64r× )ÚIMAGE_FILE_MACHINE_MIPSFPUif )Ú IMAGE_FILE_MACHINE_MIPSFPU16if )ÚIMAGE_FILE_MACHINE_TRICOREi )ÚIMAGE_FILE_MACHINE_CEFiï )ÚIMAGE_FILE_MACHINE_EBCi¼ )ÚIMAGE_FILE_MACHINE_RISCV32i2P )ÚIMAGE_FILE_MACHINE_RISCV64idP )ÚIMAGE_FILE_MACHINE_RISCV128i(Q )Ú IMAGE_FILE_MACHINE_LOONGARCH32i2b )Ú IMAGE_FILE_MACHINE_LOONGARCH64idb )ÚIMAGE_FILE_MACHINE_AMD64id )ÚIMAGE_FILE_MACHINE_M32RiA )ÚIMAGE_FILE_MACHINE_ARM64idª )ÚIMAGE_FILE_MACHINE_CEEiîÀ ) )ÚIMAGE_REL_BASED_ABSOLUTEr )ÚIMAGE_REL_BASED_HIGHr7 )ÚIMAGE_REL_BASED_LOWr? )ÚIMAGE_REL_BASED_HIGHLOWrA )ÚIMAGE_REL_BASED_HIGHADJrC )Ú IMAGE_REL_BASED_MIPS_JMPADDRrE )ÚIMAGE_REL_BASED_SECTIONrG )ÚIMAGE_REL_BASED_RELrI )Ú IMAGE_REL_BASED_MIPS_JMPADDR16rM )ÚIMAGE_REL_BASED_IA64_IMM64rM )ÚIMAGE_REL_BASED_DIR64rO )ÚIMAGE_REL_BASED_HIGH3ADJrQ ))ÚIMAGE_LIBRARY_PROCESS_INITr7 )ÚIMAGE_LIBRARY_PROCESS_TERMr? )ÚIMAGE_LIBRARY_THREAD_INITrC )ÚIMAGE_LIBRARY_THREAD_TERMrK )Ú(IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VAr3 )Ú%IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASEra )Ú(IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITYrc )Ú"IMAGE_DLLCHARACTERISTICS_NX_COMPATre )Ú%IMAGE_DLLCHARACTERISTICS_NO_ISOLATIONr! )Ú IMAGE_DLLCHARACTERISTICS_NO_SEHrh )Ú IMAGE_DLLCHARACTERISTICS_NO_BINDr )Ú%IMAGE_DLLCHARACTERISTICS_APPCONTAINERr( )Ú#IMAGE_DLLCHARACTERISTICS_WDM_DRIVERr1 )Ú!IMAGE_DLLCHARACTERISTICS_GUARD_CFrm )Ú.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWAREr2 ))ÚUNW_FLAG_EHANDLERr7 )ÚUNW_FLAG_UHANDLERr? )ÚUNW_FLAG_CHAININFOrC ))ÚRAXr )ÚRCXr7 )ÚRDXr? )ÚRBXrA )ÚRSPrC )ÚRBPrE )ÚRSIrG )ÚRDIrI )ÚR8rK )ÚR9rM )ÚR10rO )ÚR11rQ )ÚR12rS )ÚR13rU )ÚR14rW )ÚR15rY r7 r? rA rC rE rG rK rM rO ))Ú RT_CURSORr7 )Ú RT_BITMAPr? )ÚRT_ICONrA )ÚRT_MENUrC )Ú RT_DIALOGrE )Ú RT_STRINGrG )Ú
|
RT_FONTDIRrI )ÚRT_FONTrK )ÚRT_ACCELERATORrM )Ú RT_RCDATArO )ÚRT_MESSAGETABLErQ )ÚRT_GROUP_CURSORrS )Ú RT_GROUP_ICONrW )Ú
|
RT_VERSIONr4 )Ú RT_DLGINCLUDEé )Ú RT_PLUGPLAYé )ÚRT_VXDr³ )Ú RT_ANICURSORé )Ú
|
RT_ANIICONé )ÚRT_HTMLé )Ú RT_MANIFESTé )^)Ú LANG_NEUTRALr )ÚLANG_INVARIANTé )ÚLANG_AFRIKAANSé6 )Ú LANG_ALBANIANé )Ú LANG_ARABICr7 )Ú LANG_ARMENIANé+ )Ú LANG_ASSAMESEéM )Ú
|
LANG_AZERIé, )Ú LANG_BASQUEé- )ÚLANG_BELARUSIANé# )Ú LANG_BENGALIéE )ÚLANG_BULGARIANr? )Ú LANG_CATALANrA )Ú LANG_CHINESErC )Ú LANG_CROATIANé )Ú
|
LANG_CZECHrE )Ú LANG_DANISHrG )Ú LANG_DIVEHIée )Ú
|
LANG_DUTCHr& )Ú LANG_ENGLISHrM )Ú LANG_ESTONIANé% )Ú LANG_FAEROESEé8 )Ú
|
LANG_FARSIé) )Ú LANG_FINNISHrQ )Ú LANG_FRENCHrS )Ú LANG_GALICIANéV )Ú LANG_GEORGIANé7 )Ú LANG_GERMANrI )Ú
|
LANG_GREEKrK )Ú LANG_GUJARATIéG )Ú LANG_HEBREWrU )Ú
|
LANG_HINDIé9 )ÚLANG_HUNGARIANrW )ÚLANG_ICELANDICrY )ÚLANG_INDONESIANé! )Ú LANG_ITALIANr4 )Ú LANG_JAPANESEr$ )Ú LANG_KANNADAéK )Ú LANG_KASHMIRIé` )Ú
|
LANG_KAZAKé? )Ú LANG_KONKANIéW )Ú LANG_KOREANé )Ú LANG_KYRGYZra )Ú LANG_LATVIANé& )ÚLANG_LITHUANIANé' )ÚLANG_MACEDONIANé/ )Ú
|
LANG_MALAYé> )ÚLANG_MALAYALAMéL )Ú LANG_MANIPURIéX )Ú LANG_MARATHIéN )ÚLANG_MONGOLIANéP )Ú LANG_NEPALIéa )ÚLANG_NORWEGIANr³ )Ú
|
LANG_ORIYAéH )Ú LANG_POLISHr) )ÚLANG_PORTUGUESEr+ )Ú LANG_PUNJABIéF )Ú LANG_ROMANIANr/ )Ú LANG_RUSSIANé )Ú LANG_SANSKRITéO )Ú LANG_SERBIANrH )Ú LANG_SINDHIéY )Ú LANG_SLOVAKé )ÚLANG_SLOVENIANé$ )Ú LANG_SPANISHrO )Ú LANG_SWAHILIéA )Ú LANG_SWEDISHé )Ú LANG_SYRIACéZ )Ú
|
LANG_TAMILéI )Ú
|
LANG_TATARéD )Ú LANG_TELUGUéJ )Ú LANG_THAIé )Ú LANG_TURKISHé )ÚLANG_UKRAINIANé" )Ú LANG_URDUr3 )Ú
|
LANG_UZBEKéC )ÚLANG_VIETNAMESEé* )Ú LANG_GAELICé< )Ú LANG_MALTESEé: )Ú
|
LANG_MAORIé( )ÚLANG_RHAETO_ROMANCEr- )Ú
|
LANG_SAAMIé; )Ú LANG_SORBIANé. )Ú LANG_SUTUé0 )Ú LANG_TSONGAé1 )Ú LANG_TSWANAé2 )Ú
|
LANG_VENDAé3 )Ú
|
LANG_XHOSAé4 )Ú LANG_ZULUé5 )ÚLANG_ESPERANTOé )Ú
|
LANG_WALONé )Ú LANG_CORNISHé )Ú
|
LANG_WELSHé )Ú LANG_BRETONé )g)ÚSUBLANG_NEUTRALr )ÚSUBLANG_DEFAULTr7 )ÚSUBLANG_SYS_DEFAULTr? )ÚSUBLANG_ARABIC_SAUDI_ARABIAr7 )ÚSUBLANG_ARABIC_IRAQr? )ÚSUBLANG_ARABIC_EGYPTrA )ÚSUBLANG_ARABIC_LIBYArC )ÚSUBLANG_ARABIC_ALGERIArE )ÚSUBLANG_ARABIC_MOROCCOrG )ÚSUBLANG_ARABIC_TUNISIArI )ÚSUBLANG_ARABIC_OMANrK )ÚSUBLANG_ARABIC_YEMENrM )ÚSUBLANG_ARABIC_SYRIArO )ÚSUBLANG_ARABIC_JORDANrQ )ÚSUBLANG_ARABIC_LEBANONrS )ÚSUBLANG_ARABIC_KUWAITrU )ÚSUBLANG_ARABIC_UAErW )ÚSUBLANG_ARABIC_BAHRAINrY )ÚSUBLANG_ARABIC_QATARr4 )ÚSUBLANG_AZERI_LATINr7 )ÚSUBLANG_AZERI_CYRILLICr? )ÚSUBLANG_CHINESE_TRADITIONALr7 )ÚSUBLANG_CHINESE_SIMPLIFIEDr? )ÚSUBLANG_CHINESE_HONGKONGrA )ÚSUBLANG_CHINESE_SINGAPORErC )ÚSUBLANG_CHINESE_MACAUrE )Ú SUBLANG_DUTCHr7 )ÚSUBLANG_DUTCH_BELGIANr? )ÚSUBLANG_ENGLISH_USr7 )ÚSUBLANG_ENGLISH_UKr? )ÚSUBLANG_ENGLISH_AUSrA )ÚSUBLANG_ENGLISH_CANrC )ÚSUBLANG_ENGLISH_NZrE )ÚSUBLANG_ENGLISH_EIRErG )Ú SUBLANG_ENGLISH_SOUTH_AFRICArI )ÚSUBLANG_ENGLISH_JAMAICArK )ÚSUBLANG_ENGLISH_CARIBBEANrM )ÚSUBLANG_ENGLISH_BELIZErO )ÚSUBLANG_ENGLISH_TRINIDADrQ )ÚSUBLANG_ENGLISH_ZIMBABWErS )ÚSUBLANG_ENGLISH_PHILIPPINESrU )ÚSUBLANG_FRENCHr7 )ÚSUBLANG_FRENCH_BELGIANr? )ÚSUBLANG_FRENCH_CANADIANrA )ÚSUBLANG_FRENCH_SWISSrC )ÚSUBLANG_FRENCH_LUXEMBOURGrE )ÚSUBLANG_FRENCH_MONACOrG )ÚSUBLANG_GERMANr7 )ÚSUBLANG_GERMAN_SWISSr? )ÚSUBLANG_GERMAN_AUSTRIANrA )ÚSUBLANG_GERMAN_LUXEMBOURGrC )Ú SUBLANG_GERMAN_LIECHTENSTEINrE )ÚSUBLANG_ITALIANr7 )ÚSUBLANG_ITALIAN_SWISSr? )ÚSUBLANG_KASHMIRI_SASIAr? )ÚSUBLANG_KASHMIRI_INDIAr? )ÚSUBLANG_KOREANr7 )ÚSUBLANG_LITHUANIANr7 )ÚSUBLANG_MALAY_MALAYSIAr7 )Ú SUBLANG_MALAY_BRUNEI_DARUSSALAMr? )ÚSUBLANG_NEPALI_INDIAr? )ÚSUBLANG_NORWEGIAN_BOKMALr7 )ÚSUBLANG_NORWEGIAN_NYNORSKr? )ÚSUBLANG_PORTUGUESEr? )Ú SUBLANG_PORTUGUESE_BRAZILIANr7 )ÚSUBLANG_SERBIAN_LATINr? )ÚSUBLANG_SERBIAN_CYRILLICrA )ÚSUBLANG_SPANISHr7 )ÚSUBLANG_SPANISH_MEXICANr? )ÚSUBLANG_SPANISH_MODERNrA )ÚSUBLANG_SPANISH_GUATEMALArC )ÚSUBLANG_SPANISH_COSTA_RICArE )ÚSUBLANG_SPANISH_PANAMArG )Ú"SUBLANG_SPANISH_DOMINICAN_REPUBLICrI )ÚSUBLANG_SPANISH_VENEZUELArK )ÚSUBLANG_SPANISH_COLOMBIArM )ÚSUBLANG_SPANISH_PERUrO )ÚSUBLANG_SPANISH_ARGENTINArQ )ÚSUBLANG_SPANISH_ECUADORrS )ÚSUBLANG_SPANISH_CHILErU )ÚSUBLANG_SPANISH_URUGUAYrW )ÚSUBLANG_SPANISH_PARAGUAYrY )ÚSUBLANG_SPANISH_BOLIVIAr4 )ÚSUBLANG_SPANISH_EL_SALVADORr$ )ÚSUBLANG_SPANISH_HONDURASrq )ÚSUBLANG_SPANISH_NICARAGUAr& )ÚSUBLANG_SPANISH_PUERTO_RICOr³ )ÚSUBLANG_SWEDISHr7 )ÚSUBLANG_SWEDISH_FINLANDr? )ÚSUBLANG_URDU_PAKISTANr7 )ÚSUBLANG_URDU_INDIAr? )ÚSUBLANG_UZBEK_LATINr7 )ÚSUBLANG_UZBEK_CYRILLICr? )ÚSUBLANG_DUTCH_SURINAMrA )ÚSUBLANG_ROMANIANr7 )ÚSUBLANG_ROMANIAN_MOLDAVIAr? )ÚSUBLANG_RUSSIANr7 )ÚSUBLANG_RUSSIAN_MOLDAVIAr? )ÚSUBLANG_CROATIANr7 )ÚSUBLANG_LITHUANIAN_CLASSICr? )ÚSUBLANG_GAELICr7 )ÚSUBLANG_GAELIC_SCOTTISHr? )ÚSUBLANG_GAELIC_MANXrA c ó¨ t j | d« }t j |g « D ]
|
}||v s|c S t j |dg« d S )Nú *unknown*r )ÚLANGÚgetÚSUBLANG)Ú
|
lang_valueÚ sublang_valueÚ lang_nameÚ sublang_names r Úget_sublang_name_for_langrA sV Ü [Ó1IÜ M°2Ó6ò ð Ò $Ø Ò ð ô ;;} { mÓ 4°QÑ 7Ð7r c ó d}d}|t | « k r| ||dz }t |« dk ry t j d|« d }|dz }|dk7 rOd|dz cxk rt | « k r8n n5 t | |||dz z « j d« ||< |dk\ ry ||dz z }|dz }|t | « k ry y # t
|
$ r |dz }Y 4w xY w)Nr r? z<húutf-16ler7 rA )ÚlenÚstructÚunpackÚbÚdecodeÚUnicodeDecodeError)r. ÚcounterÚlÚiÚ error_countÚ
|
data_sliceÚlen_s r Ú parse_stringsrP sé Ø AØKØ
|
c$i-à!a !e_
|
Ü z?QÒ Ø ä}}T :Ó.¨qÑ1Ø QØ 19d QhÔ3¬#¨d«)Õ3ð Ü t A¨¨D°1©H© Ð 5Ó 6× =Ñ =¸jÓ I'
|
ð aÒ ØØ MAØ1 ð# c$i-øô &ò ØqÑ Ùð ús Á(&B2 Â2CÃCc ó | j « D cg c]0 }t |t t f« r|j |« r|| | f2 c}S c c}w )z´Read the flags from a dictionary and return them in a usable form.
|
|
Will return a list of (flag, value) for all flags in "flag_dict"
|
matching the filter "flag_filter".
|
)ÚkeysÚ
|
isinstanceÚstrÚbytesÚ
|
startswith)Ú flag_dictÚ flag_filterÚflags r Úretrieve_flagsrZ ¶ sM ð NNÓ$ö à Ü dS¤%LÔ )¨d¯o©o¸kÔ.Jð
|
yÒ ò ð ùò s 5A c ó` |D ]) \ }}||z rd| j |< d| j |< + y)a
|
Will process the flags and set attributes in the object accordingly.
|
|
The object "obj" will gain attributes named after the flags provided in
|
"flags" and valued True/False, matching the results of applying each
|
flag value from "flags" to flag_field.
|
TFN)Ú__dict__)ÚobjÚ
|
flag_fieldÚflagsrY Úvalues r Ú set_flagsra Ä s; ð ò ' eØ :Ò Ø!%CLLÒ à!&CLLÒ ñ 'r c ó& | dk7 xr | | dz
|
z dk( S )Nr r7 © )r$ s r Ú power_of_tword Ó s Ø !8Ò . a¡ ¨QÑ.Ð.r c ó t | t « r| S t | t « r t | « S t j | d« S )NÚcp1252)rS rU Ú bytearrayÚcodecsÚencode)Úxs r rG rG × s5 Ü!UÔØÜ AyÔ !ÜQxä}}Q Ó)Ð)r c ó. e Zd Z fdZ fdZd Z xZS )Ú
|
AddressSetc ó> t | « d | _ d | _ y r )ÚsuperÚ__init__ÚminÚmax)ÚselfÚ __class__s r ro zAddressSet.__init__á s ø Ü ÑÔØØr c óÔ t | |« | j |nt | j |« | _ | j || _ y t | j |« | _ y r )rn Úaddrp rq )rr r` rs s r ru zAddressSet.addæ sM ø Ü EÔØ HHÐ ,5´#°d·h±hÀÓ2FØ HHÐ ,5´#°d·h±hÀÓ2Fr c óh | j | j dS | j | j z
|
S r, )rp rq ©rr s r ÚdiffzAddressSet.diffë s, ØHHÐ$¨¯©Ð(8qÐQ¸d¿h¹hÈÏÉÑ>QÐQr )Ú__name__Ú
|
__module__Ú __qualname__ro ru rx Ú __classcell__©rs s @r rl rl à s ø ôô
|
Gö
|
Rr rl c óL e Zd ZdZd Zd Zd Zd Zd Zd Z d Z
|
d Z d
|
Z d Z y ) Ú!UnicodeStringWrapperPostProcessorzæThis class attempts to help the process of identifying strings
|
that might be plain Unicode or Pascal. A list of strings will be
|
wrapped on it with the hope the overlappings will help make the
|
decision about their type.c ó. || _ || _ d | _ y r )ÚpeÚrva_ptrÚstring)rr r r s r ro z*UnicodeStringWrapperPostProcessor.__init__õ s ØØ Ø r c ó | j S )zGet the RVA of the string.)r rw s r Úget_rvaz)UnicodeStringWrapperPostProcessor.get_rvaú s à||Ðr c ó& | j dd« S )z6Return the escaped UTF-8 representation of the string.úutf-8r
|
)rH rw s r Ú__str__z)UnicodeStringWrapperPostProcessor.__str__þ s à{{7Ð$7Ó8Ð8r c óN | j sy | j j | S )NÚ )r rH )rr r s r rH z(UnicodeStringWrapperPostProcessor.decode s# Ø{{ØØ!t{{×!Ñ! 4Ð(Ð(r c ó d} y)z>Make this instance None, to express it's no known string type.Nrc rw s r Ú
|
invalidatez,UnicodeStringWrapperPostProcessor.invalidate s àr c ó( | j j | j dz | j « ¬« | _ y # t
|
$ rH | j j « j dj | j dz « « Y y w xY w)Nr? ©Ú
|
max_lengthzCFailed rendering pascal string, attempting to read from RVA 0x{0:x}) r Úget_string_u_at_rvar Úget_pascal_16_lengthr Ú PEFormatErrorÚ get_warningsÚappendÚformatrw s r Úrender_pascal_16z2UnicodeStringWrapperPostProcessor.render_pascal_16 s} ð Ø ''×5Ñ5Ø qÑ ¨T×-FÑ-FÓ-Hð 6ó DKøô ò Ø GG× Ñ Ó "× )Ñ )ð6ß6<±f¸T¿\¹\ÈAÑ=MÓ6Nö ð ús =A Á ABÂBc ó8 | j | j « S r )Ú9_UnicodeStringWrapperPostProcessor__get_word_value_at_rvar rw s r r z6UnicodeStringWrapperPostProcessor.get_pascal_16_length s Ø×+Ñ+¨D¯L©LÓ9Ð9r c óª | j j |d« }t |« dk ryt j
|
d|« d S # t $ r Y yw xY w)Nr? Fú<Hr )r Úget_datar rD rE rF )rr Úrvar. s r Ú__get_word_value_at_rvaz9UnicodeStringWrapperPostProcessor.__get_word_value_at_rva sW ð Ø77×#Ñ# C¨Ó+Dô t9q=Øä}}T 4Ó(¨Ñ+Ð+øô ò Ùð ús A Á AÁAc ó\ | j |dz
|
« dk( r|| j z
|
| _ yy)zÙThe next RVA is taken to be the one immediately following this one.
|
|
Such RVA could indicate the natural end of the string and will be checked
|
to see if there's a Unicode NULL character there.
|
r? r TF)r r Úlength)rr Ú next_rva_ptrs r Úask_unicode_16z0UnicodeStringWrapperPostProcessor.ask_unicode_16$ s2 ð × 'Ñ '¨ °qÑ(8Ó 9¸QÒ >Ø&¨¯ © Ñ5DKØàr c óü | j j | j « | _ y # t $ rE | j j « j dj | j « « Y y w xY w)NzDFailed rendering unicode string, attempting to read from RVA 0x{0:x})r r r r r r r r rw s r Úrender_unicode_16z3UnicodeStringWrapperPostProcessor.render_unicode_160 s^ ð Ø ''×5Ñ5°d·l±lÓCDKøÜ ò Ø GG× Ñ Ó "× )Ñ )ð6ß6<±f¸T¿\¹\Ó6Jö ð ús *- A A;Á:A;N)ry rz r{ Ú__doc__ro r
r rH r r r r r¡ r£ rc r r r r ï s9 ñ"ò
|
ò
|
ò9ò)ò
|
ò ò:ò ,ò
|
ór r c ó e Zd ZdZd Zd Zy)r z"Generic PE format error exception.c ó || _ y r )r` )rr r` s r ro zPEFormatError.__init__= s Ø
|
r c ó, t | j « S r )Úreprr` rw s r r zPEFormatError.__str__@ s ÜDJJÓ Ð r N)ry rz r{ r¤ ro r rc r r r r : s Ù,òó r r c ó@ e Zd ZdZd Zd
|
dZd
|
dZd
|
dZd Zd Z d Z
|
y ) ÚDumpz1Convenience class for dumping the PE information.c ó g | _ y r )Útextrw s r ro z Dump.__init__G s Ø r c ó6 |D ] }| j ||« y)zeAdds a list of lines.
|
|
The list can be indented with the optional argument 'indent'.
|
N)Úadd_line)rr ÚtxtÚindentÚlines r Ú add_lineszDump.add_linesJ s! ð
|
ò (DØ MM$ Õ 'ñ (r c ó. | j |dz |« y)z\Adds a line.
|
|
The line can be indented with the optional argument 'indent'.
|
ú
|
N)ru ©rr r¯ r° s r r® z Dump.add_lineR s ð
|
tVÕ$r c ó` | j j dj d|z |« « y)z|Adds some text, no newline will be appended.
|
|
The text can be indented with the optional argument 'indent'.
|
z{0}{1}ú N)r¬ r r rµ s r ru zDump.addY s% ð
|
×Ñ ¨¨v© °sÓ;Õ<r c óF | j dj d|« « y)zAdds a header element.z
|
{0}{1}{0}
|
z
|
----------N)r® r )rr r¯ s r Ú
|
add_headerzDump.add_header` s à m×*Ñ*¨8°SÓ9Õ:r c ó: | j j d« y)zAdds a newline.r´ N)r¬ r rw s r Ú add_newlinezDump.add_newlined s à ×ÑÕ r c óF dj d | j D « « S )z"Get the text in its current state.r c 3 ó> K | ] }d j |« yw)ú{0}N)r )Ú.0rG s r ú <genexpr>z Dump.get_text.<locals>.<genexpr>j s è ø Ò:¨1u|| AÑ:ùs )Újoinr¬ rw s r Úget_textz Dump.get_texth s àwwÑ:°· ± Ô:Ó:Ð:r N©r ) ry rz r{ r¤ ro r² r® ru r¹ r» r rc r r rª rª D s( Ù;òó(ó%ó=ò;ò ó;r rª )rj ÚcrG ÚBÚhÚHrL ÚIrK ÚLr ÚqÚQÚdÚsc ó: d}| }| d t j v rmt dj | D cg c] }|t j v s| c}« « }dj | D cg c] }|t j vs| c}« }t | |z S c c}w c c}w )Nr7 r r )r Údigitsr# rÁ ÚSTRUCT_SIZEOF_TYPES)Útr- Ú_trÌ s r Ú sizeof_typerÓ s à EØ
|
BØtv}}Ñ äBGG¨Ö @ 1¨Q´&·-±-Ò-?QÒ @ÓAÓBØ WW Ö=A a¬v¯}©}Ò&<aÒ=Ó >Ü rÑ " UÑ *Ð*ùò AùÚ=s ®B ÁB Á$BÁ<BT)r r c
|
óì d}g }i }g }d}d}| D ]Ã }d|v s|j dd« \ }} ||z }|j d « | j d« }
|
g } |
|
D ]Z } | |v r>|D cg c] } | d t | « } } | j | « }dj | |« } | j | « ||| < \ |t |« z }|j | « Å t j |« }|||||fS c c} w )Nú<r ú,r7 z {0}_{1:d})Úsplitr rD r- r rÓ rE Úcalcsize)r Ú__format_str__Ú__unpacked_data_elms__Ú__field_offsets__Ú__keys__Ú__format_length__ÚoffsetÚelmÚelm_typeÚelm_nameÚ elm_namesÚnamesrj Ú search_listÚ occ_counts r Ú
|
set_formatræ s: ð NØ ÐØÐØHØÐà FØò #Ø #:Ø!$§¡¨3°Ó!2Ñ HhØ hÑ &NØ "× )Ñ )¨$Ô /à sÓ+IØEØ %ò 5ØxÑ'Ø?GÖ"H¸! 1 _¤s¨8£}Ò#5Ð"HKÐ"HØ +× 1Ñ 1°(Ó ;IØ *× 1Ñ 1°(¸IÓ FHØ XÔ&Ø.4Ð! (Ò+ð 5ð k (Ó+Ñ +Fð
|
OOEÕ "ð+#ô. ¨Ó7Ðð Ø ØØØð ð ùò #Is Á"C1c ón e Zd ZdZddZdefdZd Zd Zd Z d Z
|
d
|
Z d Z d Z d Zd Zd ZddZd Zy)Ú StructurezPrepare structure object to extract members from data.
|
|
Format is a list containing definitions for the elements
|
of the structure.
|
Nc ó" d| _ g | _ d| _ i | _ g | _ |d }t |t « s t |« }t |« \ | _ | _ | _ | _ | _ d| _ || _ |r|| _
|
y |d | _
|
y )NrÕ r r7 F) rÙ rÜ rÝ rÛ rÚ rS Útupleræ Ú__all_zeroes__Ú__file_offset__Úname)rr r rí Ú file_offsetrÌ s r ro zStructure.__init__¾ s à !ÔØ Ø!"Ô Ø!#Ô Ø&(Ô#à 1Iä!UÔ#ÜaAô qMñ
|
Ø Ô Ø Ô 'Ø Ô "Ø MØ Ô "ð $ÔØ *Ô Ù Ø DIà q DIr Úreturnc ó | j S r )rÙ rw s r Ú__get_format__zStructure.__get_format__Ú ó Ø×"Ñ"Ð"r c ó: | j | j | z S )zLReturn the offset within the field for the requested field in the structure.)rì rÛ ©rr Ú
|
field_names r Úget_field_absolute_offsetz#Structure.get_field_absolute_offsetÝ s à×#Ñ# d×&<Ñ&<¸ZÑ&HÑHÐHr c ó | j | S )z?Return the offset within the structure for the requested field.)rÛ rô s r Úget_field_relative_offsetz#Structure.get_field_relative_offsetá s à×%Ñ% jÑ1Ð1r c ó | j S r ©rì rw s r Úget_file_offsetzStructure.get_file_offsetå s Ø×#Ñ#Ð#r c ó || _ y r rú ©rr rÞ s r Úset_file_offsetzStructure.set_file_offsetè s
|
Ø %Õ r c ó | j S )z/Returns true is the unpacked data is all zeros.)rë rw s r Ú
|
all_zeroeszStructure.all_zeroesë s ð ×"Ñ"Ð"r c ó | j S )z Return size of the structure.)rÝ rw s r ÚsizeofzStructure.sizeofð s ð ×%Ñ%Ð%r c ó² t |« }t |« | j kD r|d | j }n#t |« | j k r t d« t |« t |« k( rd| _ t j | j |« | _ t | j « D ]& \ }}| j | D ] }t | ||« ( y )Nz-Data length less than expected header length.T) rG rD rÝ r r/ rë rE rF rÙ rÚ Ú enumeraterÜ Úsetattr)rr r. Úidxr$ Úkeys r Ú
|
__unpack__zStructure.__unpack__õ sÄ äwä t9t×-Ñ-Ò -ØÐ0$×0Ñ0Ð1Dô Y×/Ñ/Ò /Ü Ð OÓPÐ Pä Ó ¤ T£Ò *Ø"&DÔ ä&,§m¡m°D×4GÑ4GÈÓ&NÔ#Ü! $×"=Ñ"=Ó>ò (HCØ}} SÑ)ò (Üc 3Õ'ñ (ñ (r c óô g }t | j « D ]? \ }}d }| j | D ] }t | |« }||k7 s n |j |« A t j | j g|¢ S r )r rÚ rÜ Úgetattrr rE ÚpackrÙ )rr Ú
|
new_valuesr r$ Únew_valr s r Ú__pack__zStructure.__pack__ s à
|
ä! $×"=Ñ"=Ó>ò 'HCØGØ}} SÑ)ò Ü! $¨Ó,ð c>Ùð ð × Ñ gÕ &ð 'ô {{4×.Ñ.Ð<°Ò<Ð<r c ó@ dj | j « « S )Nr´ )rÁ Údumprw s r r zStructure.__str__ s ØyyÓ%Ð%r c
|
ó¦ ddj | j « D cg c]! }dj |j « « # c}« z S c c}w )Nz<Structure: %s>r· )rÁ r r× )rr rÍ s r Ú__repr__zStructure.__repr__ s> Ø Ø HH°4·9±9³;Ö?¨achhqwwyÕ)Ò?Ó @ñ
|
ð
|
ùÚ?s &A
|
c
|
ó> g }|j dj | j « « t j D cg c] }|t j
|
vst |« " }}| j D ] }|D ]{ }t | |« }t |t t f« rn|j d« rdj |« }ndj |« }|dk( s|dk( rÖ |dt j t j |« « z z }n¦t# |« }|j d « r>d
|
j% |j' d « D cg c] }d j |« c}« }nLd
|
j% |j' d « D cg c]" }||v r t) |« nd j |« $ c}« }|j d| j* | | j, z | j* | |dz |fz « ~ |S c c}w # t $ r |dz }Y _w xY wc c}w c c}w )z1Returns a string representation of the structure.z[{0}]Ú
|
Signature_z{:<8X}z0x{:<8X}Ú TimeDateStampÚ dwTimeStampz [%s UTC]z [INVALID TIME]Ú Signaturer ó z{:02X}z \x{0:02x}z0x%-8X 0x%-3X %-30s %sú:)r r rí r Ú printableÚ
|
whitespaceÚordrÜ r
|
rS r# ÚlongrV ÚtimeÚasctimeÚgmtimeÚ
|
ValueErrorrg rÁ ÚrstripÚchrrÛ rì ) rr Ú indentationr rL Úprintable_bytesrR r r$ Úval_strs r r zStructure.dump$ s ð à GNN 4§9¡9Ó-Ô.ô #× ,Ñ ,ö
|
Ø°¼×9JÑ9JÒ0JCFð
|
ð
|
ð MMó & DØó % ä d CÓ(Ü c¤C¬ ;Ô/Ø~~ lÔ3Ø"*§/¡/°#Ó"6à",×"3Ñ"3°CÓ"8ØoÒ-°¸ Ò1Eð9Ø # {´T·\±\Ä$Ç+Á+ÈcÓBRÓ5SÑ'SÑ SGô (¨nGØ~~ kÔ2Ø"$§'¡'Ø9@¿ ¹ ÈÓ9PÖ Q°AX__¨QÕ /Ò Qó#ð #%§'¡'ð
|
*1¯ © ¸Ó)@ö ð %&ð %&¨ Ñ$8ô !$ A¤à%1×%8Ñ%8¸Ó%;ñ!<ò ó#ð Ø,à ×.Ñ.¨sÑ3°d×6JÑ6JÑJØ ×.Ñ.¨sÑ3Øc Ø ð ñöò;% ð& ðP ùò]
|
øô$ *ò 9Ø #Ð'8Ñ 8Gð9üò Rùò s) ¿G<Á G<Ã .HÅH Æ'H ÈHÈHc ó" i }| j |d< | j D ]Õ }|D ]Î }t | |« }t |t t
|
f« r9|dk( s|dk( rp d|t j t j |« « fz }nAdj d |D cg c] }t |t « s t |« n|! c}D « « }| j | | j z | j | |d||< Ð × |S # t $ r d|z }Y Fw xY wc c}w ) z5Returns a dictionary representation of the structure.rè r r z0x%-8X [%s UTC]z0x%-8X [INVALID TIME]r c 3 ór K | ]/ }t |« t j v r t |« nd |z 1 yw)z\x%02xN)r# r r )r¿ rÌ s r rÀ z&Structure.dump_dict.<locals>.<genexpr>r s6 è ø ò "à ô #& a£&¬F×,<Ñ,<Ñ"<AÀ)ÈaÁ-ÓOñ"ùs 57)Ú
|
FileOffsetÚOffsetÚValue)rí rÜ r
|
rS r# r r r r r! rÁ r rÛ rì )rr Ú dump_dictrR r r$ rÄ s r r, zStructure.dump_dict[ s, ð à!%§¡ +Ñ ð MMò DØò ä d CÓ(Ü c¤C¬ ;Ô/ØoÒ-°¸ Ò1Eð@Ø"3Ø #Ü $§ ¡ ¬T¯[©[¸Ó-=Ó >ð7 ñ # Cð ''ñ "àSVÖ!WÈa´
|
¸1¼cÔ0B¤# a¤&ÈÑ"IÒ!Wô"ó Cð #'×"8Ñ"8¸Ñ"=À×@TÑ@TÑ"TØ "× 4Ñ 4°SÑ 9Ø ñ" #ñ% ð ð2 Ðøô *ò @Ø"9¸CÑ"?Cð@üò
|
"Xs Á-C8Â$D Ã8D ÄD ©NNrà )ry rz r{ r¤ ro rT rñ rö rø rû rþ r r r r r r r r, rc r r rè rè · sV ñó "ð8# ó #òIò2ò$ò&ò#ò
|
&ò
|
(ò.=ò &ò
|
ó
|
5ón"r rè c ór e Zd ZdZd Zd Zd ZddZd Zd Z d Z
|
d
|
Z d Z d Z d Zd Zd Zd Zd Zd Zy)ÚSectionStructurez#Convenience section handling class.c óÈ d|v r |d | _ |d= d | _ d | _ d | _ d | _ t j | g|¢i |¤ d | _ d | _ d | _ d | _
|
y )Nr ) r ÚPointerToRawDataÚVirtualAddressÚ SizeOfRawDataÚMisc_VirtualSizerè ro ÚPointerToRawData_adjÚVirtualAddress_adjÚsection_min_addrÚsection_max_addr)rr ÚarglÚargds r ro zSectionStructure.__init__ ss Ø 4<Ø4jDGØT
|
à $Ô Ø "ÔØ !ÔØ $Ô Ü×Ñ4Ð/ $Ò/¨$Ò/Ø$(Ô!Ø"&Ô Ø $Ô Ø $Õ r c óÜ | j U| j I| j j | j | j j j
|
« | _ | j S r )r5 r1 r Úadjust_FileAlignmentÚOPTIONAL_HEADERÚ FileAlignmentrw s r Úget_PointerToRawData_adjz)SectionStructure.get_PointerToRawData_adj sZ Ø × $Ñ $Ð ,Ø×$Ñ$Ð0Ø,0¯G©G×,HÑ,HØ×)Ñ)¨4¯7©7×+BÑ+B×+PÑ+Pó-Ô)ð ×(Ñ(Ð(r c ó | j t| j h| j j | j | j j j
|
| j j j « | _ | j S r )r6 r2 r Úadjust_SectionAlignmentr= ÚSectionAlignmentr> rw s r Úget_VirtualAddress_adjz'SectionStructure.get_VirtualAddress_adj sn Ø × "Ñ "Ð *Ø×"Ñ"Ð.Ø*.¯'©'×*IÑ*IØ×'Ñ'ØGG×+Ñ+×<Ñ<ØGG×+Ñ+×9Ñ9ó+Ô'ð
|
×&Ñ&Ð&r Nc óÆ || j « }n$|| j « z
|
| j « z }|||z }n | j || j z }n|}|r ||t ||| j z « }| j
|
A| j 5|| j
|
| j z kD r| j
|
| j z }| j j || S )a Get data chunk from a section.
|
|
Allows to query data from the section by passing the
|
addresses where the PE file would be loaded by default.
|
It is then possible to retrieve code and data by their real
|
addresses as they would be if loaded.
|
|
Note that sections on disk can include padding that would
|
not be loaded to memory. That is the case if `section.SizeOfRawData`
|
is greater than `section.Misc_VirtualSize`, and that means
|
that data past `section.Misc_VirtualSize` is padding.
|
In case you are not interested in this padding, passing
|
`ignore_padding=True` will truncate the result in order
|
not to return the padding (if any).
|
|
Returns bytes() under Python 3.x and set() under Python 2.7
|
)r? rC r3 rp r4 r1 r Ú__data__)rr Ústartr Úignore_paddingrÞ Úends r r zSectionStructure.get_data¤ sñ ð& =Ø×2Ñ2Ó4Fð ×3Ñ3Ó5Ñ5Ø×-Ñ-Ó/ñ0Fð Ð Ø6/CØ × Ñ Ð +Ø4×-Ñ-Ñ-CàCá co°&Ð2DÜc6 D×$9Ñ$9Ñ9Ó:Cð
|
× Ñ Ð ,°×1CÑ1CÐ1OØT×*Ñ*¨T×-?Ñ-?Ñ?Ò?Ø×+Ñ+¨d×.@Ñ.@Ñ@Øww× Ñ sÐ+Ð+r c ó |dk( r t t d« }t | ||« nOd|v rKt | |« r?|r | j dxx t | z cc< n | j dxx t | z cc< || j |< y )NÚCharacteristicsÚ
|
IMAGE_SCN_)rZ ÚSECTION_CHARACTERISTICSra Úhasattrr\ )rr rí r$ Ú section_flagss r Ú __setattr__z SectionStructure.__setattr__Ð s~ à Ð$Ò $Ü *Ô+BÀLÓ QMô dC Õ /à TÑ !¤g¨d°DÔ&9ÙØ Ð /Ó0Ô4KÈDÑ4QÑQÔ0à Ð /Ó0Ô4KÈDÑ4QÑQÓ0à ! dÒr c óJ || j « z
|
| j « z S r )r? rC rý s r Úget_rva_from_offsetz$SectionStructure.get_rva_from_offsetà s$ Ø×5Ñ5Ó7Ñ7¸$×:UÑ:UÓ:WÑWÐWr c óJ || j « z
|
| j « z S r )rC r? ©rr r s r Úget_offset_from_rvaz$SectionStructure.get_offset_from_rvaã s$ ØT×0Ñ0Ó2Ñ2°T×5RÑ5RÓ5TÑTÐTr c óv | j y| j « }||cxk xr || j z k S c S )z<Check whether the section contains the file offset provided.F)r1 r? r3 )rr rÞ r5 s r Úcontains_offsetz SectionStructure.contains_offsetæ sJ ð × Ñ Ð (ð Ø #× <Ñ <Ó >Ð à FÖ VÐ-AÀD×DVÑDVÑ-VÑ Vð
|
Ù Vð
|
r c óB | j 0| j $| j |cxk xr | j k S c S | j « }t | j j
|
« | j « z
|
| j k r | j }n t | j | j « }| j :| j | j kD r!||z | j kD r| j |z
|
}|| _ ||z | _ ||cxk xr ||z k S c S )z8Check whether the section contains the address provided.) r7 r8 rC rD r rE r? r3 r4 rq Ú next_section_virtual_addressr2 )rr r r6 Úsizes r Ú contains_rvaz SectionStructure.contains_rvaò s ð × Ñ Ð ,°×1FÑ1FÐ1RØ×(Ñ(¨CÖG°$×2GÑ2GÑGÐ GÑGÐ Gà !× 8Ñ 8Ó :Ðô tww× Ñ Ó 4×#@Ñ#@Ó#BÑ BÀT×EWÑEWÒ Wð ×(Ñ(Dät×)Ñ)¨4×+@Ñ+@ÓADð × -Ñ -Ð 9Ø×1Ñ1°D×4GÑ4GÒGØ" TÑ)¨D×,MÑ,MÒMà×4Ñ4Ð7IÑIDà 2Ô Ø 2°TÑ 9Ô Ø! SÖDÐ+=ÀÑ+DÑDÐDÑDÐDr c ó$ | j |« S r )rZ rS s r ÚcontainszSectionStructure.contains s Ø× Ñ Ó%Ð%r c ó@ | j | j « « S )z1Calculate and return the entropy for the section.)Ú entropy_Hr rw s r Ú get_entropyz SectionStructure.get_entropy s ð ~~dmmoÓ.Ð.r c ó^ t 't | j « « j « S y)z/Get the SHA-1 hex-digest of the section's data.N)r r Ú hexdigestrw s r Ú get_hash_sha1z SectionStructure.get_hash_sha1 s) ô Ð Ü Ó(×2Ñ2Ó4Ð 4ð r c ó^ t 't | j « « j « S y)z1Get the SHA-256 hex-digest of the section's data.N)r r ra rw s r Úget_hash_sha256z SectionStructure.get_hash_sha256& ó) ô Ð Ü$--/Ó*×4Ñ4Ó6Ð 6ð r c ó^ t 't | j « « j « S y)z1Get the SHA-512 hex-digest of the section's data.N)r r ra rw s r Úget_hash_sha512z SectionStructure.get_hash_sha512, re r c ó^ t 't | j « « j « S y)z-Get the MD5 hex-digest of the section's data.N)r r ra rw s r Ú get_hash_md5z SectionStructure.get_hash_md52 s( ô ?Üt}}Ó'×1Ñ1Ó3Ð 3ð r c óÈ |syt t |« « }d}|j « D ]5 }t |« t |« z }||t j |d« z z }7 |S )z)Calculate the entropy of a chunk of data.g r r? )r rg ÚvaluesÚfloatrD ÚmathÚlog)rr r. Ú
|
occurencesÚentropyrj Úp_xs r r^ zSectionStructure.entropy_H8 sh ñ Øä Y t_Ó-
|
àØ×"Ñ"Ó$ò .AÜ(S YÑ&CØ sTXX c¨1Ó -Ñ-Ñ -Gð .ð r )NNF)ry rz r{ r¤ ro r? rC r rO rQ rT rV rZ r\ r_ rb rd rg ri r^ rc r r r/ r/ sZ Ù-ò %ò )ò'ó*,òX"ò XòUò
|
|
ò$EòL&ò/ò
|
5ò 7ò 7ò 4ó r r/ c ó, G d d« }g }i } |||« }| d D ]Å }d|vr"|j « |j |« )|j dd« \ }}d|v r t d« |j dd« \ }}t |« }||j « k7 s||j « kD r!|j « |j |« |j ||« Ç |j « t t |« « \ } }
|
} } } g }t | « D ]j \ }}||vr|j |« || \ }
|
}|D cg c] }|t j g }}|j |« |D ] }| |d | |d < l | | | | ||fS c c}w )Nc ó6 e Zd Zd Zd Zd Zd Zd Zd Zd Z y) ú)set_bitfields_format.<locals>.Accumulatorc óX g | _ d| _ d | _ d| _ || _ || _ y )Nú~r )Ú
|
_subfieldsÚ_nameÚ_typeÚ
|
_bits_leftÚ _comp_fieldsÚ_format)rr ÚfmtÚ comp_fieldss r ro z2set_bitfields_format.<locals>.Accumulator.__init__K s/ Ø DOð DJØ DJØ DOØ +DÔ Ø DLr c ó( | j y | j j | j dz | j z « | j | j f| j
|
t | j « dz
|
< d| _ d | _ g | _ y )NrÖ r7 rv )ry r| r rx rw r{ rD rw s r Úwrap_upz1set_bitfields_format.<locals>.Accumulator.wrap_upU ss ØzzÐ!ØØ LL× Ñ §
|
¡
|
¨SÑ 0°4·:±:Ñ =Ô >Ø8<¿
|
¹
|
ÀDÇOÁOÐ7TD× Ñ c $§,¡,Ó /°!Ñ 3Ñ 4Ø DJØ DJØ DOr c ó4 t | dz | _ || _ y ©NrK )rÐ rz ry )rr Útps r Únew_typez2set_bitfields_format.<locals>.Accumulator.new_type^ s Ü 1°"Ñ 5¸Ñ 9DOØDJr c ó | xj |z c_ | xj |z c_ | j j ||f« y r )rx rz rw r )rr rí Úbitcnts r Ú add_subfieldz6set_bitfields_format.<locals>.Accumulator.add_subfieldb s4 Ø JJ$Ñ JØ OOvÑ %OØ OO× "Ñ " D¨& >Õ 2r c ó | j S r )ry rw s r Úget_typez2set_bitfields_format.<locals>.Accumulator.get_typeg ó Ø::Ð r c ó | j S r )rx rw s r Úget_namez2set_bitfields_format.<locals>.Accumulator.get_namej r r c ó | j S r )rz rw s r Ú get_bits_leftz7set_bitfields_format.<locals>.Accumulator.get_bits_leftm s Ø??Ð "r N)
|
ry rz r{ ro r r r r r r rc r r Ú Accumulatorrt J s% ò ò !ò ò 3ò
|
ò ó #r r r7 r rÖ z3Structures with bitfields do not support unions yetr )r r r× ÚNotImplementedErrorr# r r r r ræ rê r ÚStructureWithBitfieldsÚ BTF_NAME_IDXÚextend)r r Úold_fmtr~ Úacrß rà rá Úelm_bitsÚ
|
format_strÚ_Ú field_offsetsrR Ú format_lengthÚ extended_keysr r$ Úsbfr Úbf_namesÚns r Úset_bitfields_formatr H s¼ ÷$#ñ $#ðL GØKÙ WkÓ *Bàayò ,ØczØ JJLØ NN3Ô Ø à YY s¨AÓ .Ñ(à (?Ü%ØEóð ð &^^¨C°Ó 3Ñ(Üx=Ø r{{}Ò $¨°2×3CÑ3CÓ3EÒ(EØ JJLØ KKÔ !à
|
(Õ+ð',ð( JJLä8BÄ5ÈÃ>Ó8RÑ5J= $¨ àMÜ dOò 8SØkÑ!Ø × Ñ Ô %Ø Ø SÑ!3ØFIÖJÀQÔ-×:Ñ:Ñ;Ò<ÐJÐJØ× Ñ XÔ&Øò 8AØ"/°°A±Ñ"7M!A$Ò ñ 8ð8ð }°d¸MÈ;Ð WÐWùò Ks ÅFc óf e Zd ZdZdZdZdZdZd dZ fdZ fdZ
|
d fd Z fdZ d Z d
|
Z xZS ) r aV
|
Extends Structure's functionality with support for bitfields such as:
|
('B:4,LowerHalf', 'B:4,UpperHalf')
|
To this end, two lists are maintained:
|
* self.__keys__ that contains compound fields, for example
|
('B,~LowerHalfUpperHalf'), and is used during packing/unpaking
|
* self.__keys_ext__ containing a separate key for each field (ex., LowerHalf,
|
UpperHalf) to simplify implementation of dump()
|
This way the implementation of unpacking/packing and dump() from Structure can be
|
reused.
|
|
In addition, we create a dictionary:
|
<comound_field_index_in_keys> -->
|
(data type, [ (subfield name, length in bits)+ ] )
|
that facilitates bitfield paking and unpacking.
|
|
With lru_cache() creating only once instance per format string, the memory
|
overhead is negligible.
|
r r7 c ó t |« \ | _ | _ | _ | _ | _ | _ t | j « D cg c] }d c}| _ d| _ || _
|
|d k7 r|| _ y |d | _ y c c}w )NFr ) r rÙ rÝ rÛ rÜ Ú __keys_ext__Ú__compound_fields__ÚrangerÚ rë rì rí )rr r rí rî rL s r ro z StructureWithBitfields.__init__´ s ô ! Ó (ñ
|
Ø Ô Ø Ô "Ø Ô "Ø MØ Ô Ø Ô $ô 6;¸4×;QÑ;QÓ5RÖ&S°¢tÒ&SÔ#Ø #ÔØ *Ô Ø DLD ¨f°Q©i ùò 'Ts Á A?c óL t t | |« | j « y r )rn r r Ú_unpack_bitfield_attributes©rr r. rs s r r z!StructureWithBitfields.__unpack__Ä s! ø ô Ô$ dÑ6°tÔ<Ø ×(Ñ(Õ*r c ó | j « t t | « }| j « |S # | j « w xY wr )Ú_pack_bitfield_attributesrn r r r¦ r§ s r r z StructureWithBitfields.__pack__Ê sE ø Ø ×&Ñ&Ô(ð /ÜÔ/°Ñ?ÓADà × ,Ñ ,Ô .Ø øð × ,Ñ ,Õ .ús 7 ·A c ó | j }| j | _ t t | |« }|| _ |S # || _ w xY wr )rÜ r¢ rn r r )rr r$ ÚtkÚretrs s r r zStructureWithBitfields.dumpÒ sG ø Ø ]]Ø ×)Ñ) ð ÜÔ.°Ñ:¸;ÓGCà DMØ
|
øð DMús < ¼ Ac ó | j }| j | _ t t | « }|| _ |S # || _ w xY wr )rÜ r¢ rn r r, )rr r« r¬ rs s r r, z StructureWithBitfields.dump_dictÛ sE ø Ø ]]Ø ×)Ñ) ð ÜÔ.°Ñ?ÓACà DMØ
|
øð DMús ; » Ac ó | j j « D ]« }| j | d }t | |« }t | |« d}| j | t
|
j D ]Z }d|t
|
j z dz
|
}||z }t | |t
|
j ||z |z « ||t
|
j z }\ y)zaReplace compound attributes corresponding to bitfields with separate
|
sub-fields.
|
r r7 N)
|
r£ rR rÜ r
|
Údelattrr Ú CF_SUBFLD_IDXÚBTF_BITCNT_IDXr r )rr rL Úcf_nameÚcvalÚoffstÚsfÚmasks r r¦ z2StructureWithBitfields._unpack_bitfield_attributesä sÜ ð ×)Ñ)×.Ñ.Ó0ò CAØmm AÑ& qÑ)GÜ4 Ó)DÜ D'Ô "ØEØ×.Ñ.¨qÑ1Ô2H×2VÑ2VÑWò CØRÔ 6× EÑ EÑ FÑFÈ!ÑKØÜØØÔ-×:Ñ:Ñ;ØD[ UÑ*ôð
|
Ô 2× AÑ AÑBÑBñ Cñ Cr c ó | j j « D ]¢ }| j | d }d\ }}| j | t j D ]Y }d|t j
|
z dz
|
}t | |t j « |z }|||z z }||t j
|
z }[ t | ||« ¤ y)z(Pack attributes into a compound bitfieldr ©r r r7 N) r£ rR rÜ r r° r± r
|
r r )rr rL r² r´ Úacc_valrµ r¶ Ú field_vals r r© z0StructureWithBitfields._pack_bitfield_attributes÷ sÔ à×)Ñ)×.Ñ.Ó0ò
|
,AØmm AÑ& qÑ)GØ !NE7Ø×.Ñ.¨qÑ1Ô2H×2VÑ2VÑWò CØRÔ 6× EÑ EÑ FÑFÈ!ÑKäD "Ô%;×%HÑ%HÑ"IÓJÈTÑQð ð 9¨Ñ-Ñ-ØÔ 2× AÑ AÑBÑBð Cô D' 7Õ +ñ
|
,r r- rà )ry rz r{ r¤ r r± Ú CF_TYPE_IDXr° ro r r r r, r¦ r© r| r} s @r r r sB ø ñð( LØNØKØMó8ô +ô õôòCö& ,r r c ó" e Zd ZdZ fdZ xZS )Ú DataContainerzGeneric data container.c ód t t |
|
}|j « D ] \ }} |||« y r )rn r½ rO Úitems)rr r Ú bare_setattrr r` rs s r ro zDataContainer.__init__ s2 ø Ü ]¨DÑ= Ø **,ò %JCÙ eÕ $ñ %r )ry rz r{ r¤ ro r| r} s @r r½ r½ s ø Ù!÷%ð %r r½ c ó e Zd ZdZy)ÚImportDescDatazÅHolds import descriptor information.
|
|
dll: name of the imported DLL
|
imports: list of imported symbols (ImportData instances)
|
struct: IMAGE_IMPORT_DESCRIPTOR structure
|
N©ry rz r{ r¤ rc r r r r ó òr r c ó e Zd ZdZd Zy)Ú
|
ImportDatazÆHolds imported symbol's information.
|
|
ordinal: Ordinal of the symbol
|
name: Name of the symbol
|
bound: If the symbol is bound, this contains
|
the address.
|
c ó® t | d« r¹t | d« r¬t | d« r|dk( rÏ| j j t k( rt }n#| j j t
|
k( rt }|dz z | j _ | j j | j _ | j j | j _
|
| j j | j _ nË|dk( r| j ¹|| j _ | j j | j _ | j j | j _
|
| j j | j _ n7|dk( r|| j _ | j j | j _ | j j | j _
|
| j j | j _ n±|dk( r¬| j r | j j | j « }| j j | j d|z « t# |« t# | j$ « kD r t' d« | j j) | j |« || j* |< y )NÚordinalÚboundrí éÿÿ Úaddressr ú9The export name provided is longer than the existing one.)rM r ÚPE_TYPEÚOPTIONAL_HEADER_MAGIC_PEÚIMAGE_ORDINAL_FLAGÚ OPTIONAL_HEADER_MAGIC_PE_PLUSÚIMAGE_ORDINAL_FLAG64Ú struct_tableÚOrdinalÚ AddressOfDataÚFunctionÚForwarderStringÚ
|
struct_iatÚ name_offsetrQ Úset_dword_at_offsetÚordinal_offsetrD rí r Úset_bytes_at_offsetr\ )rr rí r$ Ú ordinal_flagÚname_rvas r rO zImportData.__setattr__! s ô D)Õ $ÜgÕ&ÜfÕ%ð yÒ à77??Ô&>Ò>Ü#5LØWW__Ô(EÒEÜ#7Lð -9¸CÀ&¹LÑ,I×!Ñ!Ô)Ø26×2CÑ2C×2KÑ2K×!Ñ!Ô/Ø-1×->Ñ->×-FÑ-F×!Ñ!Ô*Ø48×4EÑ4E×4MÑ4M×!Ñ!Ö1Ø Ø??Ñ.Ø47DOOÔ1Ø48·O±O×4QÑ4QDOOÔ1Ø/3¯©×/LÑ/LDOOÔ,Ø6:·o±o×6SÑ6SDOOÖ3ØÒ"Ø25×!Ñ!Ô/Ø,0×,=Ñ,=×,KÑ,K×!Ñ!Ô)Ø-1×->Ñ->×-LÑ-L×!Ñ!Ô*Ø48×4EÑ4E×4SÑ4S×!Ñ!Õ1Ø ð ×#Ò#à #ww× :Ñ :¸4×;KÑ;KÓ LHØGG×/Ñ/Ø ×+Ñ+¨g¸Ñ-Aôô 3x¤# d§i¡i£.Ò0Ü +Ø Wó ð ð GG×/Ñ/°×0@Ñ0@À#ÔFà ! dÒr N©ry rz r{ r¤ rO rc r r rÆ rÆ s ñó6"r rÆ c ó e Zd ZdZy)Ú ExportDirDatazHolds export directory information.
|
|
struct: IMAGE_EXPORT_DIRECTORY structure
|
symbols: list of exported symbols (ExportData instances)Nrà rc r r rà rà Z s òCr rà c ó e Zd ZdZd Zy)Ú
|
ExportDataad Holds exported symbols' information.
|
|
ordinal: ordinal of the symbol
|
address: address of the symbol
|
name: name of the symbol (None if the symbol is
|
exported by ordinal only)
|
forwarder: if the symbol is forwarded it will
|
contain the name of the target symbol,
|
None otherwise.
|
c ó t | d« r.t | d« r!t | d« rt | d« r|dk( r'| j j | j |« nÛ|dk( r'| j j | j
|
|« n¯|dk( rSt |« t | j « kD r t d« | j j | j |« nW|dk( rRt |« t | j « kD r t d« | j j | j |« || j |< y )NrÈ rË Ú forwarderrí rÌ z<The forwarder name provided is longer than the existing one.)rM r Úset_word_at_offsetrÚ rÙ Úaddress_offsetrD rí r rÛ rØ rä Úforwarder_offsetr\ ©rr rí r$ s r rO zExportData.__setattr__m s ô D)Õ $ÜiÕ(ÜkÕ*ÜfÕ%ð yÒ Ø×*Ñ*¨4×+>Ñ+>ÀÕDØÒ"Ø×+Ñ+¨D×,?Ñ,?ÀÕEØ ô s8c $§)¡)nÒ,Ü'ØSóð ð ×+Ñ+¨D×,<Ñ,<¸cÕBØÒ$ô s8c $§.¡.Ó 1Ò1Ü'ØVóð ð ×+Ñ+¨D×,AÑ,AÀ3ÔGà ! dÒr NrÞ rc r r râ râ a s ñ ó""r râ c ó e Zd ZdZy)ÚResourceDirDatazHolds resource directory information.
|
|
struct: IMAGE_RESOURCE_DIRECTORY structure
|
entries: list of entries (ResourceDirEntryData instances)
|
Nrà rc r r rê rê ó òr rê c ó e Zd ZdZy)ÚResourceDirEntryDataaF Holds resource directory entry data.
|
|
struct: IMAGE_RESOURCE_DIRECTORY_ENTRY structure
|
name: If the resource is identified by name this
|
attribute will contain the name string. None
|
otherwise. If identified by id, the id is
|
available at 'struct.Id'
|
id: the id, also in struct.Id
|
directory: If this entry has a lower level directory
|
this attribute will point to the
|
ResourceDirData instance representing it.
|
data: If this entry has no further lower directories
|
and points to the actual resource data, this
|
attribute will reference the corresponding
|
ResourceDataEntryData instance.
|
(Either of the 'directory' or 'data' attribute will exist,
|
but not both.)
|
Nrà rc r r rí rí s òr rí c ó e Zd ZdZy)ÚResourceDataEntryDataz£Holds resource data entry information.
|
|
struct: IMAGE_RESOURCE_DATA_ENTRY structure
|
lang: Primary language ID
|
sublang: Sublanguage ID
|
Nrà rc r r rï rï ¯ rÄ r rï c ó e Zd ZdZy)Ú DebugDatazHolds debug information.
|
|
struct: IMAGE_DEBUG_DIRECTORY structure
|
entries: list of entries (IMAGE_DEBUG_TYPE instances)
|
Nrà rc r r rñ rñ ¸ rë r rñ c ó e Zd ZdZy)ÚDynamicRelocationDataa Holds dynamic relocation information.
|
|
struct: IMAGE_DYNAMIC_RELOCATION structure
|
symbol: Symbol to which dynamic relocations must be applied
|
relocations: List of dynamic relocations for this symbol (BaseRelocationData instances)
|
Nrà rc r r ró ró À rÄ r ró c ó e Zd ZdZy)ÚBaseRelocationDatazHolds base relocation information.
|
|
struct: IMAGE_BASE_RELOCATION structure
|
entries: list of relocation data (RelocationData instances)
|
Nrà rc r r rõ rõ É rë r rõ c ó e Zd ZdZd Zy)ÚRelocationDatazÅHolds relocation information.
|
|
type: Type of relocation
|
The type string can be obtained by
|
RELOCATION_TYPE[type]
|
rva: RVA of the relocation
|
c óü t | d« ra| j j }|dk( r |dz |dz z }n)|dk( r$t || j z
|
d« }|dz |dz z }|| j _ || j
|
|< y )NrE ÚtyperS éÿ r r i ð )rM rE ÚDatarq Úbase_rvar\ )rr rí r$ ÚwordrÞ s r rO zRelocationData.__setattr__Ú s ô 4Ô "ð ;;×#Ñ#Dàv~Ør d¨U¡lÑ3Ø Ü S 4§=¡=Ñ 0°!Ó4Ø v ¨&°5©.Ñ9ð $DKKÔ à ! dÒr NrÞ rc r r r÷ r÷ Ñ s ñó"r r÷ c ó e Zd ZdZy)ÚTlsDatazJHolds TLS information.
|
|
struct: IMAGE_TLS_DIRECTORY structure
|
Nrà rc r r rÿ rÿ ò s òr rÿ c ó e Zd ZdZy)ÚBoundImportDescDataaà Holds bound import descriptor data.
|
|
This directory entry will provide information on the
|
DLLs this PE file has been bound to (if bound at all).
|
The structure will contain the name and timestamp of the
|
DLL at the time of binding so that the loader can know
|
whether it differs from the one currently present in the
|
system and must, therefore, re-bind the PE's imports.
|
|
struct: IMAGE_BOUND_IMPORT_DESCRIPTOR structure
|
name: DLL name
|
entries: list of entries (BoundImportRefData instances)
|
the entries will exist if this DLL has forwarded
|
symbols. If so, the destination DLL will have an
|
entry in this list.
|
Nrà rc r r r r ù s òr r c ó e Zd ZdZy)ÚLoadConfigDataz°Holds Load Config data.
|
|
struct: IMAGE_LOAD_CONFIG_DIRECTORY structure
|
name: dll name
|
dynamic_relocations: dynamic relocation information, if present
|
Nrà rc r r r r rÄ r r c ó e Zd ZdZy)ÚBoundImportRefDatazÞHolds bound import forwarder reference data.
|
|
Contains the same information as the bound descriptor but
|
for forwarded DLLs, if any.
|
|
struct: IMAGE_BOUND_FORWARDER_REF structure
|
name: dll name
|
Nrà rc r r r r s òr r c ó e Zd ZdZy)ÚExceptionsDirEntryDataz¢Holds the data related to SEH (and stack unwinding, in particular)
|
|
struct an instance of RUNTIME_FUNTION
|
unwindinfo an instance of UNWIND_INFO
|
Nrà rc r r r r rë r r c óf e Zd ZdZd fd Z fdZd fd Z fdZd Zd Z fdZ
|
d Z d
|
Z xZ S ) Ú
|
UnwindInfozHandles the complexities of UNWIND_INFO structure:
|
* variable number of UWIND_CODEs
|
* optional ExceptionHandler and FunctionEntry fields
|
c ó¬ t t | d|¬« t t | « | _ d | _ t dd¬« | _ d | _ d| _ y )N)Ú UNWIND_INFO)z B:3,Versionz B:5,FlagszB,SizeOfPrologzB,CountOfCodeszB:4,FrameRegisterzB:4,FrameOffset©rî ©Ú UNWIND_CODE)ú B,CodeOffsetú B:4,UnwindOpú
|
B:4,OpInfor F)
|
rn r ro r Ú
|
_full_sizeÚ_opt_field_namer Ú
|
_code_infoÚ_chained_entryÚ_finished_unpacking)rr rî rs s r ro zUnwindInfo.__init__. s` ø Ü j$Ñ(ð
|
ð $ð )ô
|
ô ¤
|
¨DÑ8Ó:Ø #Ô Ü0Ø KØô
|
ð #ÔØ#(Õ r c ó | j ryt t | |« | j dz dz }t t | « || j j « z z }|| j dk( rdnt d z | _ t |« | j k ry| j dk7 r'| j dk7 rdt | j « z S g | _ t t | « }| j }|dkD r | j j |||| j j « z « t j! | j « }|dt | j |z « z S |j# | j | « }| j j « |z }|j% | j ||||z | | j |z « ||z }||z }| j j' |« |dkD r | j( s | j* rd | _ | j. rd
|
| _ | j, dk7 r;t1 | | j, t3 j4 d |||t d z « d « d | _ y) z§Unpacks the UNWIND_INFO "in two calls", with the first call establishing
|
a full size of the structure and the second, performing the actual unpacking.
|
Nr7 éþÿÿÿr rÈ r? z&Unsupported version of UNWIND_INFO at zUnknown UNWIND_CODE at ÚExceptionHandlerÚ FunctionEntryú<IT)r rn r r Ú CountOfCodesr r ÚFlagsrÐ r rD ÚVersionÚhexrì Ú UnwindCodesÚPrologEpilogOpsFactoryÚcreateÚlength_in_code_structuresÚ
|
initializer r r r r r rE rF )
|
rr r. Ú codes_cnt_maxÚ hdlr_offsetÚroÚ
|
codes_leftÚucodeÚ len_in_codesÚopc_sizers s
|
r Úunpack_in_stageszUnwindInfo.unpack_in_stagesF sd ø ð × #Ò #Øä j$Ñ*¨4Ô0Ø ×*Ñ*¨QÑ.°"Ñ4 ä *dÑ *Ó ,¨}¸t¿¹×?UÑ?UÓ?WÑ/WÑ Wð ð &Øq AÔ&9¸#Ñ&>ñ
|
ô t9tÒ &Øà <<1Ò § ¡ °Ò!2Ø;¼cÀ$×BVÑBVÓ>WÑWÐ Wà ÔÜ :tÑ +Ó -Ø×&Ñ&
|
Ø1nØ OO× &Ñ & t¨B°°d·o±o×6LÑ6LÓ6NÑ1NÐ'OÔ PÜ*×1Ñ1°$·/±/ÓBEØ}Ø0´3°t×7KÑ7KÈbÑ7PÓ3QÑQÐQà ×:Ñ:¸4¿?¹?ÈDÓQLØ×-Ñ-Ó/°,Ñ>HØ × Ñ ØØR"x-Ð(ØØ×$Ñ$ rÑ)ô ð (NBØ ,Ñ &JØ × Ñ × #Ñ # EÔ *ð! 1nð$ × !Ò ! T×%;Ò%;Ø#5DÔ à × "Ò "Ø#2DÔ à × Ñ 4Ò 'Ü ØØ×$Ñ$Ü Ø${¨[Ô;NÈsÑ;SÑ-SÐTóàñô ð $(Ô àr c óô | j d k7 rS| j t d z
|
| j | j < | j j | j g« t t | # |« }| j d k7 r| j j « |j ddj t D cg c] }t | |d « s|d c}« z « |j ddj | j D cg c] }|j « st |« c}« z « |S # | j d k7 r| j j « w w xY wc c}w c c}w )NrÈ úFlags: ú, r zUnwind codes: z; )r r rÐ rÛ r¢ r rn r r ÚpoprÁ Úunwind_info_flagsr
|
r Úis_validrT )rr r$ r rÍ rÄ rs s r r zUnwindInfo.dump sI ø ð × Ñ 4Ò 'àÔ"5°cÑ":Ñ:ð × "Ñ " 4×#7Ñ#7Ñ 8ð × Ñ × $Ñ $ d×&:Ñ&:Ð%;Ô <ð (Ü TÑ/° Ó<Dà×#Ñ# tÒ+Ø×!Ñ!×%Ñ%Õ'à Ø ØiiÔ'8ÖP !¼GÀDÈ!ÈAÉ$Õ<O1ÒPÓQñ Rô
|
ð Ø Øii¨×)9Ñ)9ÖJ A¸Q¿Z¹Z½\QÒJÓKñ Lô
|
ð øð ×#Ñ# tÒ+Ø×!Ñ!×%Ñ%Õ'ð ,üò
|
Qùò Ks$ Á%E ÃE0ÃE0ÄE5Ä% E5Å,E-c ó¢ | j d k7 rS| j t d z
|
| j | j < | j j | j g« t t | # « }| j d k7 r| j j « |S # | j d k7 r| j j « w w xY w)NrÈ )
|
r r rÐ rÛ r¢ r rn r r, r0 )rr r¬ rs s r r, zUnwindInfo.dump_dict sº ø Ø × Ñ 4Ò 'àÔ"5°cÑ":Ñ:ð × "Ñ " 4×#7Ñ#7Ñ 8ð × Ñ × $Ñ $ d×&:Ñ&:Ð%;Ô <ð (Ü
|
DÑ3Ó5Cà×#Ñ# tÒ+Ø×!Ñ!×%Ñ%Ô'Ø
|
øð ×#Ñ# tÒ+Ø×!Ñ!×%Ñ%Õ'ð ,ús Á%B" Â",Cc óî |dk( rt | |t « nOd|v rKt | |« r?|r | j dxx t | z cc< n | j dxx t | z cc< || j |< y )Nr Ú UNW_FLAG_)ra r1 rM r\ ÚUNWIND_INFO_FLAGSrè s r rO zUnwindInfo.__setattr__¬ sl Ø 7?Ü dCÔ!2Õ 3Ø DÑ ¤W¨T°4Ô%8ÙØ gÓ&Ô*;¸DÑ*AÑAÔ&à gÓ&Ô*;¸DÑ*AÑAÓ&Ø ! dÒr c ó | j S r )r rw s r r zUnwindInfo.sizeof¶ s ØÐ r c óx t | j « }t t | « |dt t | « t t | « }| j D ] }||j j « z | j kD r nW|j j « ||||j j « z ||j j « z }
| j d k7 rKt j dt | | j « « || j t d z
|
| j |S )Nr r rÈ ) rg r rn r r r r rE r r r
|
rÐ )rr r. Ú
|
cur_offsetÚucrs s r r zUnwindInfo.__pack__¹ s ø Ü Ó)Ü5:¼:ÀtÑ5UÓ5WQz 4Ñ/Ó1Ð2Ü: tÑ3Ó5
|
à×"Ñ"ò -BØBII× ,Ñ ,Ó .Ñ.°· ± Ò@ÙØACÇÁ×ASÑASÓAUDj¨2¯9©9×+;Ñ+;Ó+=Ñ =Ð >Ø "))×*Ñ*Ó,Ñ ,Jð -ð × Ñ 4Ò 'ô D¤'¨$°×0DÑ0DÓ"EÓFð ØÔ"5°cÑ":Ñ:¸T¿_¹_ð ð r c ó | j S r )r rw s r Úget_chained_function_entryz%UnwindInfo.get_chained_function_entryË rò r c óF | j d k7 r t d« || _ y )Nz(Chained function entry cannot be changed)r r )rr Úentrys r Úset_chained_function_entryz%UnwindInfo.set_chained_function_entryÎ s$ Ø × Ñ $Ò &Ü Ð JÓKÐ KØ #Õr rà )ry rz r{ r¤ ro r, r r, rO r r r< r? r| r} s @r r r ( s6 ø ñõ
|
)ô0<õ|ô6 ò"ò ôò$#ö$r r c ó( e Zd ZdZd Zd Zd Zd Zy)ÚPrologEpilogOpzMeant as an abstract class representing a generic unwind code.
|
There is a subclass of PrologEpilogOp for each member of UNWIND_OP_CODES enum.
|
c ó| t | j |« |¬« | _ | j j |« y )Nr )r Ú _get_formatrE r )rr Úunw_coder. Úunw_inforî s r r$ zPrologEpilogOp.initializeÙ s2 Ü,Ø × Ñ XÓ &°Kô
|
ð × Ñ tÕ$r c ó y)zÄComputes how many UNWIND_CODE structures UNWIND_CODE occupies.
|
May be called before initialize() and, for that reason, should not rely on
|
the values of intance attributes.
|
r7 rc ©rr rD rE s r r# z(PrologEpilogOp.length_in_code_structuresß s ð
|
r c ó y)NTrc rw s r r2 zPrologEpilogOp.is_validæ s Ør c ó y)Nr rc ©rr rD s r rC zPrologEpilogOp._get_formaté s ØNr N)ry rz r{ r¤ r$ r# r2 rC rc r r rA rA Ô s ñò%ò òóOr rA c ó e Zd ZdZd Zd Zy)ÚPrologEpilogOpPushRegÚUWOP_PUSH_NONVOLc ó y)N)ÚUNWIND_CODE_PUSH_NONVOL)r r úB:4,Regrc rJ s r rC z!PrologEpilogOpPushReg._get_formatð s ØWr c óB dt | j j z S )Nz .PUSHREG )Ú REGISTERSrE ÚRegrw s r r z PrologEpilogOpPushReg.__str__ó s ØY t§{¡{§¡Ñ 7Ñ7Ð7r N)ry rz r{ r¤ rC r rc r r rL rL í s ÙòXó8r rL c ó( e Zd ZdZd Zd Zd Zd Zy)ÚPrologEpilogOpAllocLargeÚUWOP_ALLOC_LARGEc ó8 dddd|j dk( rdffS dffS )NÚUNWIND_CODE_ALLOC_LARGEr r r r zH,AllocSizeInQwordsz I,AllocSize©ÚOpInforJ s r rC z$PrologEpilogOpAllocLarge._get_formatú sB à %à Ø Ø Ø)1¯ © ¸AÒ)=Ð%ð ð
|
ð
|
ð DQð ð
|
ð
|
r c ó( |j dk( rdS dS )Nr r? rA rY rG s r r# z2PrologEpilogOpAllocLarge.length_in_code_structures s Ø OO qÒ(qÐ/¨aÐ/r c ó | j j dk( r| j j dz S | j j S )Nr rK )rE rZ ÚAllocSizeInQwordsÚ AllocSizerw s r Úget_alloc_sizez'PrologEpilogOpAllocLarge.get_alloc_size sC ð {{×!Ñ! QÒ&ð KK× )Ñ )¨AÑ -ð
|
ð ×&Ñ&ð
|
r c ó: dt | j « « z S ©Nz .ALLOCSTACK ©r r_ rw s r r z PrologEpilogOpAllocLarge.__str__ ó Ø ¤ D×$7Ñ$7Ó$9Ó :Ñ:Ð:r N)ry rz r{ r¤ rC r# r_ r rc r r rU rU ÷ s Ùò
|
ò0ò
|
ó;r rU c ó" e Zd ZdZd Zd Zd Zy)ÚPrologEpilogOpAllocSmallÚUWOP_ALLOC_SMALLc ó y)N)ÚUNWIND_CODE_ALLOC_SMALL)r r zB:4,AllocSizeInQwordsMinus8rc rJ s r rC z$PrologEpilogOpAllocSmall._get_format ó ð
|
r c ó: | j j dz dz S r )rE ÚAllocSizeInQwordsMinus8rw s r r_ z'PrologEpilogOpAllocSmall.get_alloc_size s Ø{{×2Ñ2°QÑ6¸Ñ:Ð:r c ó: dt | j « « z S ra rb rw s r r z PrologEpilogOpAllocSmall.__str__ rc r N)ry rz r{ r¤ rC r_ r rc r r re re s Ùò
|
ò ;ó;r re c ó( e Zd ZdZ fdZd Z xZS )ÚPrologEpilogOpSetFPÚUWOP_SET_FPREGc ó| t t | ||||« |j | _ |j
|
dz | _ y ©Nr4 )rn rn r$ Ú FrameRegisterÚ_frame_registerÚ FrameOffsetÚ _frame_offset©rr rD r. rE rî rs s r r$ z PrologEpilogOpSetFP.initialize& s? ø Ü Ô! 4Ñ3Ø dH kô
|
ð (× 5Ñ 5Ô Ø %× 1Ñ 1°BÑ 6Õr c ó` dt | j z dz t | j « z S )Nz
|
.SETFRAME r/ )rR rs r ru rw s r r zPrologEpilogOpSetFP.__str__- s: à Ü×,Ñ,Ñ-ñ .àñ ô $×$Ñ$Ó%ñ &ð
|
r )ry rz r{ r¤ r$ r r| r} s @r rn rn # s ø Ùô7ö
|
r rn c ó( e Zd ZdZd Zd Zd Zd Zy)ÚPrologEpilogOpSaveRegÚUWOP_SAVE_NONVOLc ó y©Nr? rc )rr ÚunwcoderE s r r# z/PrologEpilogOpSaveReg.length_in_code_structures9 ó Ør c ó4 | j j dz S r )rE ÚOffsetInQwordsrw s r Ú
|
get_offsetz PrologEpilogOpSaveReg.get_offset< s Ø{{×)Ñ)¨AÑ-Ð-r c ó y)N)ÚUNWIND_CODE_SAVE_NONVOL)r r rP zH,OffsetInQwordsrc rJ s r rC z!PrologEpilogOpSaveReg._get_format? ri r c ó| dt | j j z dz t | j « « z S ©Nz .SAVEREG r/ )rR rE rS r r rw s r r z PrologEpilogOpSaveReg.__str__E s0 ØY t§{¡{§¡Ñ 7Ñ7¸$Ñ>ÄÀTÇ_Á_ÓEVÓAWÑWÐWr N©ry rz r{ r¤ r# r rC r rc r r ry ry 6 s Ùòò.ò
|
ó Xr ry c ó( e Zd ZdZd Zd Zd Zd Zy)ÚPrologEpilogOpSaveRegFarÚUWOP_SAVE_NONVOL_FARc ó y©NrA rc rG s r r# z2PrologEpilogOpSaveRegFar.length_in_code_structuresL r~ r c ó. | j j S r ©rE r* rw s r r z#PrologEpilogOpSaveRegFar.get_offsetO ó Ø{{×!Ñ!Ð!r c ó y)N)ÚUNWIND_CODE_SAVE_NONVOL_FAR©r r rP zI,Offsetrc rJ s r rC z$PrologEpilogOpSaveRegFar._get_formatR ri r c ó dt | j j z dz t | j j « z S r
)rR rE rS r r* rw s r r z PrologEpilogOpSaveRegFar.__str__X s3 ØY t§{¡{§¡Ñ 7Ñ7¸$Ñ>ÄÀTÇ[Á[×EWÑEWÓAXÑXÐXr Nr rc r r r r I s Ù òò"ò
|
ó Yr r c ó( e Zd ZdZd Zd Zd Zd Zy)ÚPrologEpilogOpSaveXMMÚUWOP_SAVE_XMM128c ó y)N)ÚUNWIND_CODE_SAVE_XMM128)r r rP zH,OffsetIn2Qwordsrc rJ s r rC z!PrologEpilogOpSaveXMM._get_format_ ri r c ó yr| rc rG s r r# z/PrologEpilogOpSaveXMM.length_in_code_structurese r~ r c ó4 | j j dz S rq )rE ÚOffsetIn2Qwordsrw s r r z PrologEpilogOpSaveXMM.get_offseth s Ø{{×*Ñ*¨RÑ/Ð/r c ó dt | j j « z dz t | j « « z S ©Nz.SAVEXMM128 XMMr/ )rT rE rS r r rw s r r z PrologEpilogOpSaveXMM.__str__k s0 Ø ¤3 t§{¡{§¡Ó#7Ñ7¸$Ñ>ÄÀTÇ_Á_ÓEVÓAWÑWÐWr N©ry rz r{ r¤ rC r# r r rc r r r r \ s Ùò
|
ò ò0óXr r c ó( e Zd ZdZd Zd Zd Zd Zy)ÚPrologEpilogOpSaveXMMFarÚUWOP_SAVE_XMM128_FARc ó y)N)ÚUNWIND_CODE_SAVE_XMM128_FARr rc rJ s r rC z$PrologEpilogOpSaveXMMFar._get_formatr ri r c ó yr rc rG s r r# z2PrologEpilogOpSaveXMMFar.length_in_code_structuresx r~ r c ó. | j j S r r rw s r r z#PrologEpilogOpSaveXMMFar.get_offset{ r r c ó dt | j j « z dz t | j j « z S r )rT rE rS r r* rw s r r z PrologEpilogOpSaveXMMFar.__str__~ s3 Ø ¤3 t§{¡{§¡Ó#7Ñ7¸$Ñ>ÄÀTÇ[Á[×EWÑEWÓAXÑXÐXr Nr rc r r r r o s Ù ò
|
ò ò"óYr r c ó e Zd ZdZd Zy)ÚPrologEpilogOpPushFrameÚUWOP_PUSH_MACHFRAMEc ó@ d| j j rdz S dz S )Nz
|
.PUSHFRAMEz <code>r )rE rZ rw s r r z PrologEpilogOpPushFrame.__str__
s! بD¯K©K×,>Ò,>yÑGÐGÀBÑGÐGr N)ry rz r{ r¤ r rc r r r§ r§ s Ù óHr r§ c ó@ e Zd ZdZ fdZd Zd Zd Zd Zd Z xZ
|
S )ÚPrologEpilogOpEpilogMarkerÚ UWOP_EPILOGc ó d| _ t |d« | _ t t | ||||« | j r8t |d| j j « |j dz dk( | _ |j | _ y )NTÚ SizeOfEpilogr7 r ) Ú _long_offstrM Ú_firstrn r« r$ r rE ÚSizerZ r® Ú _epilog_sizerv s r r$ z%PrologEpilogOpEpilogMarker.initialize sx ø Ø ÔÜ! (¨NÓ;Ð; Ü Ô(¨$Ñ:Ø dH kô
|
ð ;;Ü Hn¨d¯k©k×.>Ñ.>Ô ?Ø '°Ñ 2°aÑ 7DÔ Ø $× 1Ñ 1Õr c óN | j rd|j dz dk( rdfS dfS y)NÚUNWIND_CODE_EPILOGr7 )zB,OffsetLow,Sizer ú B:4,Flags)zB,Sizer rµ ú B,OffsetLowz
|
B:4,UnusedúB:4,OffsetHigh)r´ )r¶ r r· )r° rZ rJ s r rC z&PrologEpilogOpEpilogMarker._get_format sC ð ;;à$à?? QÑ&¨!Ò+ð Bð ð ðð ð ð r c óF t |d« s|j dz dk( rdS dS )Nr® r7 r r? )rM rZ rG s r r# z4PrologEpilogOpEpilogMarker.length_in_code_structures® s3 ô 8 ^Ô4¸(¿/¹/ÈAÑ:MÐRSÒ9Sð ð
|
ð ð
|
r c ó | j j | j r| j j dz z S dz S )NrK r )rE Ú OffsetLowr¯ Ú
|
OffsetHighrw s r r z%PrologEpilogOpEpilogMarker.get_offsetµ s@ Ø{{×$Ñ$Ø+/×+;Ò+;DKK× "Ñ " aÑ 'ñ
|
ð
|
ØABñ
|
ð
|
r c ó( | j « dkD S r, )r rw s r r2 z#PrologEpilogOpEpilogMarker.is_validº s ØÓ 1Ñ$Ð$r c ó | j « dkD r5dt | j « z dz t | j « « z S dS )Nr z EPILOG: size=z, offset from the end=-r )r r r² rw s r r z"PrologEpilogOpEpilogMarker.__str__½ sX ð Ó 1Ò$ð Ü$×#Ñ#Ó$ñ %à'ñ (ô $//Ó#Ó$ñ %ð
|
ð ð
|
r ) ry rz r{ r¤ r$ rC r# r r2 r r| r} s @r r« r« s$ ø Ùô 2òò.
|
ò
|
ò
|
%ö
|
r r« c óL e Zd ZdZeeeeee e
|
e e e eeeeeeeeeei
|
Zed « Zy)r! zBA factory for creating unwind codes based on the value of UnwindOpc óp | j }|t j v rt j | « S d S r )ÚUnwindOpr! Ú _class_dict)r} Úcodes r r" z PrologEpilogOpsFactory.createÙ s@ à× Ñ ð Ô-×9Ñ9Ñ9ô #× .Ñ .¨tÑ 4Ó 6ð
|
ð ð
|
r N)ry rz r{ r¤ rM rL rV rU rf re ro rn rz ry r r r r r r r¨ r§ r¬ r« rÁ Ú staticmethodr" rc r r r! r! É s^ ÙLð Ð/ØÐ2ØÐ2ØÐ+ØÐ/Ø Ð 6ØÐ/Ø Ð 6ØÐ 4ØÐ/ð Kð ñ
|
ó ñ
|
r r! z!#$%&'()-@^_`{}~+,.;=[]c ó | t | t t t f« syt dz t fdt | « D « « S )NFs \/c 3 ó& K | ] }|v
|
y wr rc )r¿ rÄ Úalloweds r rÀ z(is_valid_dos_filename.<locals>.<genexpr>ø s øè ø Ò, qG|Ñ,ùs )rS rT rU rg Úallowed_filenameÚallÚset)rÍ rÆ s @r Úis_valid_dos_filenamerÊ ó s: ø Øy
|
1¤s¬E´9Ð&=Ô>Øä Ñ'GÜ Ó,¤S¨£VÔ,Ó ,Ð,r rÍ Úrelax_allowed_charactersrï c ó d|rd| d uxr: t | t t t f« xr t fdt | « D « « S )Ns ._?@$()<>s !"#$%&'()*+,-./:<>?[\]^_`{|}~@c 3 ó: K | ] }|t v xs |v y wr )Úallowed_function_name)r¿ rÄ Ú allowed_extras r rÀ z)is_valid_function_name.<locals>.<genexpr> s$ øè ø ÒSÀqÔ+Ð+ÒA¨q°MÐ/AÓAÑSùs )rS rT rU rg rÈ rÉ )rÍ rË rÏ s @r Úis_valid_function_namerÐ sN ø ð !MÙ Ø; à ò TÜ q3¤¤yÐ1Ó 2ò Tä ÓSÌCÐPQËFÔSÓ Sðr c óþ e Zd ZdZdZdZdZdZdZdZ dZ
|
d Z d
|
Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Z*d)d)d)e+d*fd+Z,d, Z-d- Z.d. Z/d/ Z0d0 Z1d1 Z2d2 Z3d3 Z4d4 Z5d5 Z6dd6Z7d7 Z8 dd8Z9d9 Z:d: Z;d; Z<d< Z=d= Z>d> Z?dd?Z@d@ ZAdA ZBdB ZCddCZDdD ZEdE ZFdF ZGddGZHdH ZIdI ZJdJ ZKddKZLdL ZMdM ZNddNZO ddOZPddPZQddQZRdR ZSddSZTdT ZUdU ZVeWfdVZXdW ZYdX ZZddYZ[dZ Z\d[ Z]d\ Z^d] Z_d^ Z`dd_Zadd`Zbda Zcdb Zddc Zedd Zfde Zgdf Zhdg Zidh Zjdi Zkdj Zldk Zmdl Zndm Zodn Zpdo Zqdp Zrdq Zsdr Ztds Zudt Zvdu Zwdv ZxdweydxezfdyZ{dz Z|d{ Z}d| Z~d} Zd~ Zd Zd Zd Zd Zd Z
d Zd
Zy))ÚPEa A Portable Executable representation.
|
|
This class provides access to most of the information in a PE file.
|
|
It expects to be supplied the name of the file to load or PE data
|
to process and an optional argument 'fast_load' (False by default)
|
which controls whether to load all the directories information,
|
which can be quite time consuming.
|
|
pe = pefile.PE('module.dll')
|
pe = pefile.PE(name='module.dll')
|
|
would load 'module.dll' and process it. If the data is already
|
available in a buffer the same can be achieved with:
|
|
pe = pefile.PE(data=module_dll_data)
|
|
The "fast_load" can be set to a default by setting its value in the
|
module itself by means, for instance, of a "pefile.fast_load = True".
|
That will make all the subsequent instances not to load the
|
whole PE structure. The "full_load" method can be used to parse
|
the missing data at a later stage.
|
|
Basic headers information will be available in the attributes:
|
|
DOS_HEADER
|
NT_HEADERS
|
FILE_HEADER
|
OPTIONAL_HEADER
|
|
All of them will contain among their attributes the members of the
|
corresponding structures as defined in WINNT.H
|
|
The raw data corresponding to the header (from the beginning of the
|
file up to the start of the first section) will be available in the
|
instance's attribute 'header' as a string.
|
|
The sections will be available as a list in the 'sections' attribute.
|
Each entry will contain as attributes all the structure's members.
|
|
Directory entries will be available as attributes (if they exist):
|
(no other entries are processed at this point)
|
|
DIRECTORY_ENTRY_IMPORT (list of ImportDescData instances)
|
DIRECTORY_ENTRY_EXPORT (ExportDirData instance)
|
DIRECTORY_ENTRY_RESOURCE (ResourceDirData instance)
|
DIRECTORY_ENTRY_DEBUG (list of DebugData instances)
|
DIRECTORY_ENTRY_BASERELOC (list of BaseRelocationData instances)
|
DIRECTORY_ENTRY_TLS
|
DIRECTORY_ENTRY_BOUND_IMPORT (list of BoundImportData instances)
|
|
The following dictionary attributes provide ways of mapping different
|
constants. They will accept the numeric value and return the string
|
representation and the opposite, feed in the string and get the
|
numeric constant:
|
|
DIRECTORY_ENTRY
|
IMAGE_CHARACTERISTICS
|
SECTION_CHARACTERISTICS
|
DEBUG_TYPE
|
SUBSYSTEM_TYPE
|
MACHINE_TYPE
|
RELOCATION_TYPE
|
RESOURCE_TYPE
|
LANG
|
SUBLANG
|
)ÚIMAGE_DOS_HEADER)z H,e_magiczH,e_cblpzH,e_cpzH,e_crlcz H,e_cparhdrz H,e_minallocz H,e_maxalloczH,e_sszH,e_spzH,e_csumzH,e_ipzH,e_csz
|
H,e_lfarlczH,e_ovnoz8s,e_resz H,e_oemidz H,e_oeminfoz
|
20s,e_res2z
|
I,e_lfanew)ÚIMAGE_FILE_HEADER)z H,MachinezH,NumberOfSectionsúI,TimeDateStampzI,PointerToSymbolTablezI,NumberOfSymbolszH,SizeOfOptionalHeaderzH,Characteristics)ÚIMAGE_DATA_DIRECTORY)úI,VirtualAddressúI,Size)ÚIMAGE_OPTIONAL_HEADER) úH,MagicúB,MajorLinkerVersionúB,MinorLinkerVersionú I,SizeOfCodeúI,SizeOfInitializedDataúI,SizeOfUninitializedDataúI,AddressOfEntryPointú I,BaseOfCodez I,BaseOfDataz I,ImageBaseúI,SectionAlignmentúI,FileAlignmentú H,MajorOperatingSystemVersionú H,MinorOperatingSystemVersionúH,MajorImageVersionúH,MinorImageVersionúH,MajorSubsystemVersionúH,MinorSubsystemVersionú I,Reserved1ú I,SizeOfImageúI,SizeOfHeadersú
|
I,CheckSumú H,SubsystemúH,DllCharacteristicszI,SizeOfStackReservezI,SizeOfStackCommitzI,SizeOfHeapReservezI,SizeOfHeapCommitú I,LoaderFlagsúI,NumberOfRvaAndSizes)ÚIMAGE_OPTIONAL_HEADER64) rÚ rÛ rÜ rÝ rÞ rß rà rá z Q,ImageBaserâ rã rä rå ræ rç rè ré rê rë rì rí rî rï zQ,SizeOfStackReservezQ,SizeOfStackCommitzQ,SizeOfHeapReservezQ,SizeOfHeapCommitrð rñ )ÚIMAGE_NT_HEADERS)ú I,Signature)ÚIMAGE_SECTION_HEADER)
|
z8s,Namez,I,Misc,Misc_PhysicalAddress,Misc_VirtualSizer× zI,SizeOfRawDataúI,PointerToRawDatazI,PointerToRelocationszI,PointerToLinenumberszH,NumberOfRelocationszH,NumberOfLinenumbersúI,Characteristics)Ú IMAGE_DELAY_IMPORT_DESCRIPTOR)z I,grAttrszI,szNamezI,phmodzI,pIATzI,pINTz I,pBoundIATz I,pUnloadIATz I,dwTimeStamp)ÚIMAGE_IMPORT_DESCRIPTOR)z$I,OriginalFirstThunk,CharacteristicsrÕ zI,ForwarderChainúI,Namez I,FirstThunk)ÚIMAGE_EXPORT_DIRECTORY) r÷ rÕ úH,MajorVersionúH,MinorVersionrú zI,BasezI,NumberOfFunctionszI,NumberOfNameszI,AddressOfFunctionszI,AddressOfNameszI,AddressOfNameOrdinals)ÚIMAGE_RESOURCE_DIRECTORY)r÷ rÕ rü rý zH,NumberOfNamedEntrieszH,NumberOfIdEntries)Ú IMAGE_RESOURCE_DIRECTORY_ENTRY)rú úI,OffsetToData)ÚIMAGE_RESOURCE_DATA_ENTRY)r rØ z
|
I,CodePagez
|
I,Reserved)ÚVS_VERSIONINFO©zH,Lengthz H,ValueLengthzH,Type)ÚVS_FIXEDFILEINFO) rô zI,StrucVersionzI,FileVersionMSzI,FileVersionLSzI,ProductVersionMSzI,ProductVersionLSzI,FileFlagsMaskz I,FileFlagszI,FileOSz
|
I,FileTypez I,FileSubtypez I,FileDateMSz I,FileDateLS)ÚStringFileInfor )Ú StringTabler )ÚStringr )ÚVarr )ÚIMAGE_THUNK_DATA)z0I,ForwarderString,Function,Ordinal,AddressOfData)r )z0Q,ForwarderString,Function,Ordinal,AddressOfData)ÚIMAGE_DEBUG_DIRECTORY)r÷ rÕ rü rý zI,Typez I,SizeOfDatazI,AddressOfRawDatarö )ÚIMAGE_BASE_RELOCATION)r× z I,SizeOfBlock)ÚIMAGE_BASE_RELOCATION_ENTRY)zH,Data)Ú0IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION)úI:12,PageRelativeOffsetúI:1,IndirectCallz I:19,IATIndex)Ú/IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION)r r zI:1,RexWPrefixz I:1,CfgCheckz I:1,Reserved)Ú+IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION)r zI:4,RegisterNumber)ÚIMAGE_TLS_DIRECTORY)zI,StartAddressOfRawDatazI,EndAddressOfRawDatazI,AddressOfIndexzI,AddressOfCallBacksúI,SizeOfZeroFillr÷ )r )zQ,StartAddressOfRawDatazQ,EndAddressOfRawDatazQ,AddressOfIndexzQ,AddressOfCallBacksr r÷ )ÚIMAGE_LOAD_CONFIG_DIRECTORY)+rØ rÕ rü rý úI,GlobalFlagsClearúI,GlobalFlagsSetú I,CriticalSectionDefaultTimeoutz I,DeCommitFreeBlockThresholdz I,DeCommitTotalFreeThresholdzI,LockPrefixTablezI,MaximumAllocationSizezI,VirtualMemoryThresholdúI,ProcessHeapFlagszI,ProcessAffinityMaskú H,CSDVersionú H,Reserved1z
|
I,EditListzI,SecurityCookiezI,SEHandlerTablezI,SEHandlerCountz I,GuardCFCheckFunctionPointerz I,GuardCFDispatchFunctionPointerzI,GuardCFFunctionTablezI,GuardCFFunctionCountú I,GuardFlagsúH,CodeIntegrityFlagsúH,CodeIntegrityCatalogú I,CodeIntegrityCatalogOffsetúI,CodeIntegrityReservedz I,GuardAddressTakenIatEntryTablez I,GuardAddressTakenIatEntryCountzI,GuardLongJumpTargetTablezI,GuardLongJumpTargetCountzI,DynamicValueRelocTablezI,CHPEMetadataPointerzI,GuardRFFailureRoutinez&I,GuardRFFailureRoutineFunctionPointerú I,DynamicValueRelocTableOffsetú H,DynamicValueRelocTableSectionú H,Reserved2z?I,GuardRFVerifyStackPointerFunctionPointerI,HotPatchTableOffsetú I,Reserved3z I,EnclaveConfigurationPointer)r ),rØ rÕ rü rý r r r z Q,DeCommitFreeBlockThresholdz Q,DeCommitTotalFreeThresholdzQ,LockPrefixTablezQ,MaximumAllocationSizezQ,VirtualMemoryThresholdzQ,ProcessAffinityMaskr r r z
|
Q,EditListzQ,SecurityCookiezQ,SEHandlerTablezQ,SEHandlerCountz Q,GuardCFCheckFunctionPointerz Q,GuardCFDispatchFunctionPointerzQ,GuardCFFunctionTablezQ,GuardCFFunctionCountr r r r r z Q,GuardAddressTakenIatEntryTablez Q,GuardAddressTakenIatEntryCountzQ,GuardLongJumpTargetTablezQ,GuardLongJumpTargetCountzQ,DynamicValueRelocTablezQ,CHPEMetadataPointerzQ,GuardRFFailureRoutinez&Q,GuardRFFailureRoutineFunctionPointerr r! r" z*Q,GuardRFVerifyStackPointerFunctionPointerzI,HotPatchTableOffsetr# z Q,EnclaveConfigurationPointer)Ú IMAGE_DYNAMIC_RELOCATION_TABLE)z I,VersionrØ )ÚIMAGE_DYNAMIC_RELOCATION)úI,SymbolúI,BaseRelocSize)ÚIMAGE_DYNAMIC_RELOCATION64)úQ,Symbolr' )ÚIMAGE_DYNAMIC_RELOCATION_V2)ú I,HeaderSizeúI,FixupInfoSizer& ú I,SymbolGroupúI,Flags)Ú IMAGE_DYNAMIC_RELOCATION64_V2)r+ r, r) r- r. )Ú IMAGE_BOUND_IMPORT_DESCRIPTOR)rÕ úH,OffsetModuleNamez H,NumberOfModuleForwarderRefs)ÚIMAGE_BOUND_FORWARDER_REF)rÕ r1 z
|
H,Reserved)ÚRUNTIME_FUNCTION)zI,BeginAddressz I,EndAddressz I,UnwindDataNéx c ó¸ || _ || _ d | _ g | _ g | _ d | _ | | t d« g | _ d | _ d| _ d| _
|
d| _ d| _ d| _ t j t j t j" d| _ ||n t' « d } | j) |||« y # | j+ « xY w)Nz Must supply either name or dataFr )rA rC rE Ú fast_load)Úmax_symbol_exportsÚmax_repeated_symbolÚ _get_section_by_rva_last_usedÚsectionsÚ _PE__warningsrÍ r! Ú__structures__Ú_PE__from_fileÚFileAlignment_WarningÚSectionAlignment_WarningÚ!_PE__total_resource_entries_countÚ_PE__total_resource_bytesÚ_PE__total_import_symbolsrÒ Ú;__IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION_format__Ú:__IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION_format__Ú6__IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION_format__Ú#dynamic_relocation_format_by_symbolÚglobalsÚ __parse__Úclose)rr rí r. r6 r7 r8 s r ro z PE.__init__ sê ð #5Ô Ø#6Ô à-1Ô*à à à à <DLÜ Ð >Ó?Ð ?ð
|
!ÔØ Ôð &+Ô"Ø(-Ô%ð /0Ô+ð '(Ô#à&'Ô#ô ×MÑMÜ×LÑLÜ×HÑHñ4
|
Ô0ð "+Ð!6I¼G»IÀkÑ<R ð Ø NN4 yÕ 1øð Ø JJLØ ús Â2C ÃCc ó | S r rc rw s r Ú __enter__z PE.__enter__T s Ø r c ó$ | j « y r )rI )rr rù r` Ú tracebacks r Ú__exit__z PE.__exit__W s Ø
|
|
r c ó: | j du rt | d« rt t j t « r$t | j
|
t j « s dt t | j
|
« « v r | j
|
j « | `y y y y )NTrE z mmap.mmap)r= rM rS Úmmaprù rE r¨ rI rw s r rI zPE.closeZ su à × Ñ Ñ $ÜjÔ)äDII¤tÔ,´¸D¿M¹MÌ4Ï9É9Ô1UØ ¤$¤t¨D¯M©MÓ':Ó";Ñ;ð MM× Ñ Ô !Ø ð <ð *ð %r c ó t ||¬« } |j |« | j j |« |S # t $ r9}| j j dj |d ||« « Y d}~yd}~ww xY w©zyApply structure format to raw data.
|
|
Returns an unpacked structure object if successful, None otherwise.
|
r z7Corrupt header "{0}" at file offset {1}. Exception: {2}r N)rè r r r; r r r< ©rr r r. rî Ú structureÚerrs r Ú__unpack_data__zPE.__unpack_data__f s ô f°+Ô> ð Ø × Ñ Ô &ð ×Ñ×"Ñ" 9Ô-àÐøô ò Ø OO× "Ñ "ØI×PÑPØ1I{¨Cóô ô
|
ûð úó = ½ A?Á/A:Á:A?c ó t ||¬« } |j |« | j j |« |S # t $ r9}| j j dj |d ||« « Y d}~yd}~ww xY wrR )r r r r; r r r< rS s r Ú __unpack_data_with_bitfields__z!PE.__unpack_data_with_bitfields__| s ô +¨6¸{ÔK ð Ø × Ñ Ô &ð ×Ñ×"Ñ" 9Ô-àÐøô ò Ø OO× "Ñ "ØI×PÑPØ1I{¨Cóô ô
|
ûð úrW c
|
óX |èt j |« }|j dk( r t d« d} t |d« }|j « | _ t t d« r5t j | j
|
dt j « | _ n5t j | j
|
dt j ¬« | _ d| _ |!|j « n||| _ d | _ t! | j « | _ d | _ |sºt' t) | j « « j+ « D ] \ }} |dk( r| t! | j « z d kD s"|dk7 s,| t! | j « z d kD sH| j, j/ dj |d| z t! | j « z « « | j dd }
|
t! |
|
« dk7 r t d« | j1 | j2 |
|
d¬« | _ | j4 j6 t8 k( r t d« | j4 r | j4 j6 t: k7 r t d« | j4 j< t! | j « kD r t d« | j4 j< } | j1 | j> | j | | dz | ¬« | _ | j@ r| j@ jB s t d« d| j@ jB z tD k( r t d« d| j@ jB z tF k( r t d« d| j@ jB z tH k( r t d« d| j@ jB z tJ k( r t d « | j@ jB tL k7 r t d « | j1 | jN | j | d z | d z d z | d z ¬« | _( tS tT d « } | jP s t d!« tW | jP | jP jX | « | d z | jP j[ « z } | | jP j\ z }| j1 | j^ | j | | d"z | ¬« | _0 d#}| j` [t! | j | | d$z « |k\ r=d%}| j | | d$z d&|z z }| j1 | j^ || ¬« | _0 | j` í| j` jb td k( r td | _3 nÄ| j` jb th k( r§th | _3 | j1 | jj | j | | d$z | ¬« | _0 d'}| j` [t! | j | | d$z « |k\ r=d%}| j | | d$z d&|z z }| j1 | jj || ¬« | _0 | jP s t d!« | j` t d(« | jf >| j, j/ d)j | j` jb « « tS tl d*« }tW | j` | j` jn |« g | j` _8 | | j` j[ « z }| jP | j@ _( | j` | j@ _0 | j` jr | j` jt k r| j, j/ d+« | j` jv d,kD r2| j, j/ d-| j` jv z « d"}ty t{ d.| j` jv z « « D ]í }t! | j « |z
|
dk( r nÐt! | j « |z
|
dk r| j |d d/z }n| j |||z }| j1 | j| ||¬« }| nn t~ | |_@ ||j[ « z }| j` jp j/ |« || | j` j[ « z d%z k\ sí n | j |« }| j D cg c]A }|j dkD r0| j |j | j` j « C }}t! |« dkD r t |« }nd}|r||k r| j d| | _I n| j d| | _I | j | j` jr « p| j | j` jr « }|t! | j « kD re| j, j/ d0| j` jr z « n2| j, j/ d1| j` jr z « |s| j « yy# t $ r:}dj |« }|xr d |z }t d
|
j ||« « d}~ww xY w# ||j « w w xY w# t t f$ r Y w xY wc c}w )2z¤Parse a Portable Executable file.
|
|
Loads a PE file, parsing all its structures and making them available
|
through the instance's attributes.
|
Nr zThe file is emptyÚrbÚ MAP_PRIVATE)ÚaccessTr¾ z: %sz Unable to access file '{0}'{1}Fg à?g333333Ã?zeByte 0x{0:02x} makes up {1:.4f}% of the file's contents. This may indicate truncation / malformation.g Y@ra z9Unable to read the DOS Header, possibly a truncated file.r z)Probably a ZM Executable (not a PE file).zDOS Header magic not found.z.Invalid e_lfanew value, probably not a PE filerK zNT Headers not found.rÊ z0Invalid NT Headers signature. Probably a NE filez0Invalid NT Headers signature. Probably a LE filez0Invalid NT Headers signature. Probably a LX filez0Invalid NT Headers signature. Probably a TE filez Invalid NT Headers signature.rC r3 Ú IMAGE_FILE_zFile Header missingre rC r! rc r r z5No Optional Header found, invalid PE32 or PE32+ file.z*Invalid type 0x{0:04x} in Optional Header.ÚIMAGE_DLLCHARACTERISTICS_zXSizeOfHeaders is smaller than AddressOfEntryPoint: this file cannot run under Windows 8.r4 zsSuspicious NumberOfRvaAndSizes in the Optional Header. Normal values are never larger than 0x10, the value is: 0x%xéÿÿÿs z[Possibly corrupt file. AddressOfEntryPoint lies outside the file. AddressOfEntryPoint: 0x%xzTAddressOfEntryPoint lies outside the sections' boundaries. AddressOfEntryPoint: 0x%x)MÚosÚstatÚst_sizer ÚopenÚfilenorM rP r\ rE Ú ACCESS_READr= ÚIOErrorr Ú ExceptionrI rD Ú$_PE__resource_size_limit_upperboundsÚ _PE__resource_size_limit_reachedr rg r¿ r; r rV Ú__IMAGE_DOS_HEADER_format__Ú
|
DOS_HEADERÚe_magicÚIMAGE_DOSZM_SIGNATUREÚIMAGE_DOS_SIGNATUREÚe_lfanewÚ__IMAGE_NT_HEADERS_format__Ú
|
NT_HEADERSr ÚIMAGE_NE_SIGNATUREÚIMAGE_LE_SIGNATUREÚIMAGE_LX_SIGNATUREÚIMAGE_TE_SIGNATUREÚIMAGE_NT_SIGNATUREÚ __IMAGE_FILE_HEADER_format__Ú FILE_HEADERrZ ÚIMAGE_CHARACTERISTICSra rJ r ÚSizeOfOptionalHeaderÚ __IMAGE_OPTIONAL_HEADER_format__r= ÚMagicrÎ rÍ rÐ Ú"__IMAGE_OPTIONAL_HEADER64_format__ÚDLL_CHARACTERISTICSÚDllCharacteristicsÚDATA_DIRECTORYÚAddressOfEntryPointÚ SizeOfHeadersÚNumberOfRvaAndSizesr¤ r# Ú __IMAGE_DATA_DIRECTORY_format__ÚDIRECTORY_ENTRYrí ÚKeyErrorÚAttributeErrorÚparse_sectionsr: r1 r< r> rp ÚheaderÚget_section_by_rvarT Ú full_load)rr Úfnamer. r6 rb ÚfdÚexcpÚ exception_msgÚbyteÚ
|
byte_countÚdos_header_dataÚnt_headers_offsetÚ image_flagsÚoptional_header_offsetÚsections_offsetÚ&MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZEÚpadding_lengthÚ padded_dataÚdll_characteristics_flagsrÞ Ú)MAX_ASSUMED_VALID_NUMBER_OF_RVA_AND_SIZESrL Ú dir_entryrÍ ÚrawDataPointersÚlowest_section_offsetÚ ep_offsets r rH z PE.__parse__ s
|
ð Ð Ü775>DØ||qÒ Ü#Ð$7Ó8Ð8ØBð Ü% Ó&Ø iik Ü4 Ô/ä$(§I¡I¨d¯k©k¸1¼d×>NÑ>NÓ$ODMô %)§I¡I¨d¯k©k¸1ÄT×EUÑEUÔ$VDMØ#'Õ ð >ØHHJØ Ð Ø DMØ $DÔ ô 25°T·]±]Ó1CÔ.Ø-2Ô*áÜ$+¬I°d·m±mÓ,DÓ$E×$KÑ$KÓ$Mò Ñ jð
|
AI *¬s°4·=±=Ó/AÑ"AÀCÒ"GØAI *¬s°4·=±=Ó/AÑ"AÀDÓ"HàOO×*Ñ*ð Lç & u¨zÑ'9¼CÀÇ Á Ó<NÑ'NÓOõ ð ð --¨¨Ð,Ü Ó 2Ò %Ü ØKóð ð ×.Ñ.Ø × ,Ñ ,¨oÈ1ð /ó
|
ð ??× "Ñ "Ô&;Ò ;Ü Ð KÓLÐ LØ $§/¡/×"9Ñ"9Ô=PÒ"PÜ Ð =Ó>Ð >ð
|
??× #Ñ #¤c¨$¯-©-Ó&8Ò 8Ü Ð PÓQÐ Qà OO× 4Ñ 4Ðà ×.Ñ.Ø × ,Ñ ,Ø MMÐ+Ð.?À!Ñ.CÐ DØ)ð /ó
|
ð d§o¡o×&?Ò&?Ü Ð 7Ó8Ð 8à T__×.Ñ.Ñ .Ô3EÒ EÜ Ð RÓSÐ SØ T__×.Ñ.Ñ .Ô3EÒ EÜ Ð RÓSÐ SØ T__×.Ñ.Ñ .Ô3EÒ EÜ Ð RÓSÐ SØ T__×.Ñ.Ñ .Ô3EÒ EÜ Ð RÓSÐ SØ ??× $Ñ $Ô(:Ò :Ü Ð ?Ó@Ð @à ×/Ñ/Ø × -Ñ -Ø MMÐ+¨aÑ/Ð2CÀaÑ2GÈ"Ñ2LÐ MØ)¨AÑ-ð 0ó
|
Ôô
|
%Ô%:¸MÓJ à× Ò Ü Ð 5Ó6Ð 6ô $×"Ñ" D×$4Ñ$4×$DÑ$DÀkÔRà!2°QÑ!6¸×9IÑ9I×9PÑ9PÓ9RÑ!RÐ ð 1°4×3CÑ3C×3XÑ3XÑXà #× 3Ñ 3Ø × 1Ñ 1à MMÐ0Ð3IÈCÑ3OÐ PØ.ð 4ó
|
Ô ð 24Ð.ð × Ñ Ð (ÜØ Ð 4Ð7MÐPUÑ7UÐVóð 6ò6ð !Nð --Ø&Ð)?À%Ñ)Gðà Ñ'ñ)Kð $(×#7Ñ#7Ø×5Ñ5ØØ 2ð $8ó $DÔ ð × Ñ Ð +à×#Ñ#×)Ñ)Ô-EÒEä 7 à×%Ñ%×+Ñ+Ô/LÒLä < à'+×';Ñ';Ø×;Ñ;ØMMØ.Ð1GÈ%Ñ1Oðð !7ð (<ó (Ô$ð :@Ð6ð ×(Ñ(Ð0ÜØ Ø 2Ð5KÈeÑ5Sðóð
|
>ò >ð &)NØ"&§-¡-Ø.Ð1GÈ%Ñ1Oð#à Ñ/ñ#1Kð ,0×+?Ñ+?Ø ×?Ñ?Ø#Ø$:ð ,@ó ,DÔ(ð × Ò Ü Ð 5Ó6Ð 6ð
|
× Ñ Ð 'Ü Ð WÓXÐ XØ <<Ð Ø OO× "Ñ "Ø<×CÑCØ×(Ñ(×.Ñ.óô ô %3Ü Ð!<ó%
|
Ð!ô
|
Ø × Ñ Ø × Ñ × 3Ñ 3Ø %ô
|
ð /1× Ñ Ô+à'¨$×*>Ñ*>×*EÑ*EÓ*GÑGà&*×&6Ñ&6Ô#Ø*.×*>Ñ*>Ô'ð
|
× Ñ × 4Ñ 4Ø×"Ñ"×0Ñ0ò 1ð OO× "Ñ "ð.ô ð × Ñ × 3Ñ 3°dÒ :Ø OO× "Ñ "ðOà×&Ñ&×:Ñ:ñ;ô ð 5:Ð1Üs:¨×(<Ñ(<×(PÑ(PÑPÓQÓRò + Aä4==Ó! FÑ*¨aÒ/Ùä4==Ó! FÑ*¨QÒ.Ø}} V WÐ-° Ñ9à}}ØVÐ&OÑ Oðð ×,Ñ,Ø×4Ñ4°dÈð -ó Ið Ð Ùð Ü!0°Ñ!3 ð i×&Ñ&Ó(Ñ (Fà × Ñ × /Ñ /× 6Ñ 6°yÔ Að Ø&¨×)=Ñ)=×)DÑ)DÓ)FÑFÈÑOóñ ðW+ ðZ ×$Ñ$ _Ó5ð ]]ö
|
ð Ø×!Ñ! AÒ%ð × %Ñ %Ø×"Ñ" D×$8Ñ$8×$FÑ$Fõ ð
|
ð
|
ô Ó !Ò #Ü$'¨Ó$8Ñ !à$(Ð !á$Ð(=ÀÒ(FØ --¨¨Ð0DKà --Ð(>Ð)>Ð?DKð
|
× #Ñ # D×$8Ñ$8×$LÑ$LÓ MØð ð ×0Ñ0Ø×$Ñ$×8Ñ8óIð 3t}}Ó-Ò-à×&Ñ&ð7à×*Ñ*×>Ñ>ñ?õð OO× "Ñ "ð,Ø.2×.BÑ.B×.VÑ.VñWô ñ
|
Ø NNÕ ð øôo
|
ò Ø %§ ¡ ¨TÓ 2 Ø -Ò J°6¸MÑ3I Ü Ø4×;Ñ;¸EÀ=ÓQóð ûð ûð >ØHHJð "ûôH nÐ-ò Ûð üò>
|
s= µB"j2 â6låAl'ê2 k5ê;5k0ë0k5ë5k8 ë8l ìl$ì#l$c ó2 d}d}| j j dd| j j « « }|dk( ry | j d|dz }|ddt t |« dz « z }t t j d j t t |« dz « « |« « }||vry t j d
|
||j |« d z « }d |i}|d|j d« }||d < d } t « }
|
t |« D ]4 \ } } |
|
j | | « | || t |« z « z « 6 t! |
|
« |d< |d } |d | z |k7 s|d | k7 s|d | k7 ry| |d< g }||d< |dd }t# t t |« dz « « D ]U }|d|z |k( r,|d|z d z | k7 r| j$ j d« |S ||d|z | z |d|z d z | z gz }W |S # t $ r Y yw xY w)a" Parses the rich header
|
see http://www.ntcore.com/files/richsign.htm for more information
|
|
Structure:
|
00 DanS ^ checksum, checksum, checksum, checksum
|
10 Symbol RVA ^ checksum, Symbol size ^ checksum...
|
...
|
XX Rich, checksum, 0, 0,...
|
iDanSiRichs Richrc éÿÿÿÿNrK rC z<{0}Iú<Lr7 r Úraw_datac ó< t | t « s t | « S | S r )rS r# r )rÄ s r ú<lambda>z&PE.parse_rich_header.<locals>.<lambda>0 s ¤z°!´SÔ'9Q ¸q r Ú
|
clear_datar r? rA Úchecksumrk zRich Header is malformed)rE Úfindr= rû r# rD ÚlistrE rF r r r Úindexrg r r rU r¤ r; )rr ÚDANSÚRICHÚ
|
rich_indexÚ rich_datar. r Úresultr¤ Úord_r§ r r$ r¨ Ú headervaluesrL s r Úparse_rich_headerzPE.parse_rich_header s{ ð Øà]]×'Ñ'Ø T4×/Ñ/×?Ñ?ÓAó
|
|
ð Ò Øð ð d¨Z¸!©^Ð<Ið "Ð"? A¬¬C° «N¸QÑ,>Ó(?Ñ$?Ð@IÜÜ gnn¬S´°Y³ À!Ñ1CÓ-DÓ EÀyÓQóDð 4Ñ Øð ô kk$ T§Z¡Z°Ó%5¸Ñ%9Ñ :Ó;Ø à Ð 6y~~¨gÓ 6Ð7Ø %zÑá@ä [
|
Ü! (Ó+ò GHCØ × Ñ t Cy©4°°C¼#¸c»(±NÑ0CÓ+DÑ DÕ Fð Gä $ ZÓ 0|Ñ ð 7Ø 7XÑ Ò %¨¨a©°HÒ)<ÀÀQÁÈ8Ò@SØà %zÑØ Ø'xÑàABxÜs3t9 q=Ó)Ó*ò QAð AE{dÒ"ð A ? hÒ.ØOO×*Ñ*Ð+EÔFØð
|
ð T ! a¡%[¨8Ñ 3°T¸!¸a¹%À!¹)±_ÀxÑ5OÐ PÑ PLð Qð øôW ò Ùð ús ÁA6H
|
È
|
HÈHc ó | j S )zºReturn the list of warnings.
|
|
Non-critical problems found when parsing the PE file are
|
appended to a list of warnings. This method returns the
|
full list.
|
)r; rw s r r zPE.get_warningsS s ð Ð r c ó> | j D ] }t d|« y)zËPrint the list of warnings.
|
|
Non-critical problems found when parsing the PE file are
|
appended to a list of warnings. This method prints the
|
full list to standard output.
|
ú>N)r; Úprint)rr Úwarnings r Ú show_warningszPE.show_warnings] s! ð ò GÜ #wÕ ñ r c óÎ | j « G d d« }| j « }|r² |« | _ |j dd« | j _ |j dd« | j _ |j dd« | j _ |j dd« | j _ |j dd« | j _ yd| _ y) z§Process the data directories.
|
|
This method will load the data directories which might not have
|
been loaded if the "fast_load" option was used.
|
c ó e Zd Zy)ú PE.full_load.<locals>.RichHeaderN)ry rz r{ rc r r Ú
|
RichHeaderr¼ q s Ø r r½ r¨ Nrk r r¤ r§ ) Úparse_data_directoriesr³ Ú RICH_HEADERr; r¨ rk r r¤ r§ )rr r½ Ú rich_headers r r z PE.full_loadh s¼ ð ×#Ñ#Ô%÷ ñ ð ×,Ñ,Ó. Ù Ù )|DÔ Ø(3¯©¸
|
ÀDÓ(ID× Ñ Ô %Ø&1§o¡o°hÀÓ&ED× Ñ Ô #Ø#.§?¡?°5¸$Ó#?D× Ñ Ô Ø(3¯©¸
|
ÀDÓ(ID× Ñ Ô %Ø*5¯/©/¸,ÈÓ*MD× Ñ Õ 'à #DÕ r c óh t | j « }| j D ]< }t |j « « }|j « }||||t |« z > t | d« rt | d« r| j D ]ö }|D ]ï }t |d« s|j D ]Ñ }t |j j « « D ]© \ } }|j | }
|
|j | } t |« | d kD r>|j d« j d« } | d| d dz ||
|
d |
|
d | d dz z s|j d« j d« } | ||
|
d |
|
d t | « z « Ó ñ ø |}|s|S t! |d « }|j# |« |j% « y)
|
a
Write the PE file.
|
|
This function will process all headers and components
|
of the PE file and include all changes made (by just
|
assigning to attributes in the PE objects) and write
|
the changes back to a file whose name is provided as
|
an argument. The filename is optional, if not
|
provided the data will be returned as a 'str' object.
|
r ÚFileInfor r7 r rC Nr? zwb+)rg rE r< r rû rD rM r r rª Úentriesr¿ Úentries_offsetsÚentries_lengthsrH ri rd ÚwriterI )rr ÚfilenameÚ file_datarT Ú struct_datarÞ Úfinfor> Úst_entryr ÚoffsetsÚlengthsrK Ú encoded_dataÚ new_file_datar s r rÆ zPE.write sÜ ô dmmÓ, à ×,Ñ,ò HIÜ# I×$6Ñ$6Ó$8Ó9KØ ×.Ñ.Ó0FØ<GIfv¬¨KÓ(8Ñ 8Ñ 9ð Hô
|
4Ð)Õ *ÜtZÕ(Ø !]]ò 9EØ!&ò 9Ü" 5¨-Õ8Ø,1×,=Ñ,=ò 9 Ü26°x×7GÑ7G×7MÑ7MÓ7OÓ2Pò !9¡J C¨ð /7×.FÑ.FÀsÑ.K GØ.6×.FÑ.FÀsÑ.K Gä'*¨5£z°G¸A±JÒ'>Ø,1¯L©L¸Ó,A×,HÑ,HÈÓ,T¨ð -.Ð.>°¸±
|
¸Q±Ð,?ð )2Ø,3°A©J¸À¹ÀgÈaÁjÐSTÁnÑ9Tñ)*ð 8=·|±|ÀGÓ7L×7SÑ7SØ,6ó8*¨ ð
|
-9ð )2Ø,3°A©J¸À¹ÄcÈ,ÓFWÑ9Wñ)*ñ%!9ñ 9ñ9ð9ð4 " ÙØ Ð ä 5Ó !Ø Ô Ø Ør c óî g | _ d}t | j j « D ]î }|t k\ rF| j
|
j dj | j j t « « nd}t | j | ¬« }|s n||j « |z z }|j |« | j |||j « z }t |« |j « k( r"| j
|
j d| d« nü|s"| j
|
j d| d« nØ|j |« | j j |« |j |j" z t% | j « kD r$|dz }| j
|
j d | d
|
« | j' |j" | j( j* « t% | j « kD r$|dz }| j
|
j d | d « |j, d kD r$|dz }| j
|
j d | d« | j/ |j0 | j( j2 | j( j* « d kD r$|dz }| j
|
j d | d« | j( j* dk7 rJ|j" | j( j* z dk7 r$|dz }| j
|
j d | d« ||k\ r | j
|
j d« nËt5 t6 d« }t9 ||j: |« |j< j? dd« rj|j< j? dd« rN|j@ jC d« dk( r| jE « rn | j
|
j d| d« | j j |« ñ | j jG d ¬« tI | j « D ]I \ } }| t% | j « dz
|
k( rd |_% )| j | dz j0 |_% K | j j dkD rC| j r7|| j d j « | j j z z S |S ) a Fetch the PE file sections.
|
|
The sections will be readily available in the "sections" attribute.
|
Its attributes will contain all the section information plus "data"
|
a buffer containing the section's data.
|
|
The "Characteristics" member will be processed and attributes
|
representing the section characteristics (with the 'IMAGE_SCN_'
|
string trimmed from the constant's names) will be added to the
|
section instance.
|
|
Refer to the SectionStructure class for additional info.
|
rA z Too many sections {0} (>={1})r )r zInvalid section z. Contents are null-bytes.z8. No data in the file (is this corkami's virtsectblXP?).r7 zError parsing section z$. SizeOfRawData is larger than file.z5. PointerToRawData points beyond the end of the file.r z'Suspicious value found parsing section z*. VirtualSize is extremely large > 256MiB.z&. VirtualAddress is beyond 0x10000000.z. PointerToRawData should normally be a multiple of FileAlignment, this might imply the file is trying to confuse tools which parse this incorrectly.z,Too many warnings parsing section. Aborting.rK r Fr r s PAGEz!Suspicious flags set for section zf. Both IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE are set. This might indicate a packed executable.c ó | j S r )r2 )Úas r r¦ z#PE.parse_sections.<locals>.<lambda>4 s ¨×)9Ñ)9 r )r N)&r: r¤ ry ÚNumberOfSectionsÚ MAX_SECTIONSr; r r r/ Ú __IMAGE_SECTION_HEADER_format__r rþ rE r/ r r< r3 r1 rD r< r= r> r4 rA r2 rB rZ rL ra rJ r\ r; ÚNamer" Ú is_driverÚsortr rX )
|
rr rÞ ÚMAX_SIMULTANEOUS_ERRORSrL Úsimultaneous_errorsÚsectionÚsection_offsetÚ section_datarN r s
|
r r zPE.parse_sections¶ s¸ ð Ø"#Ð Üt×'Ñ'×8Ñ8Ó9ó h *AØLÒ Ø×&Ñ&Ø3×:Ñ:Ø ×(Ñ(×9Ñ9¼<óôò
|
Ø"#Ð Ü& t×'KÑ'KÐPTÔUGÙÚØ # g§n¡nÓ&6¸Ñ&:Ñ :NØ × #Ñ # NÔ 3Ø ==Ø °'·.±.Ó2BÑ!Bð Lô LÓ)¨W¯^©^Ó-=Ò=Ø×&Ñ&Ð)9¸!¸Ð<VÐ'WÔXÚÙ Ø×&Ñ&Ø& q cð *&ð &ôò Ø × Ñ |Ô ,Ø × Ñ × &Ñ & wÔ /à×$Ñ$ w×'?Ñ'?Ñ?Ä#ÀdÇmÁmÓBTÒTØ# qÑ(Ð#Ø×&Ñ&Ø,¨Q¨CÐ/SÐTôð ×(Ñ(Ø×(Ñ(¨$×*>Ñ*>×*LÑ*LóäDMMÓ"ò#ð $ qÑ(Ð#Ø×&Ñ&Ø,¨Q¨Cð 0+ð +ôð
|
×'Ñ'¨*Ò4Ø# qÑ(Ð#Ø×&Ñ&Ø=¸a¸Sð A0ð 0ôð ×,Ñ,Ø×*Ñ*Ø×(Ñ(×9Ñ9Ø×(Ñ(×6Ñ6óð
|
ò ð $ qÑ(Ð#Ø×&Ñ&Ø=¸a¸Sð A)ð )ôð ×$Ñ$×2Ñ2°aÒ7Ø ×-Ñ-°×0DÑ0D×0RÑ0RÑRÐWXÒXà# qÑ(Ð#Ø×&Ñ&à0°°ð 4Sð Sôð #Ð&=Ò=Ø×&Ñ&Ð'UÔVÙä *Ô+BÀLÓ QMô gw× 6Ñ 6¸ Ô Fà× Ñ ×#Ñ#Ø% uôà×"Ñ"×&Ñ&Ð'>ÀÔFà<<×&Ñ& wÓ/°7Ò:¸t¿~¹~Ô?Oð àOO×*Ñ*Ø;¸A¸3ð ?Cð Côð MM× Ñ Ö )ðQh *ðZ ×ÑÑ 9ÐÔ:Ü % d§m¡mÓ 4ò !LCØc$--Ó(¨1Ñ,Ò,Ø7;Õ4à7;·}±}Ø!Gñ8ç .ð Õ4ð !ð × Ñ × ,Ñ ,¨qÒ 0°T·]²]à qÑ)×0Ñ0Ó2°T×5EÑ5E×5VÑ5VÑVÑVð ð Mr c óÒ d| j fd| j fd| j fd| j fd| j fd| j
|
fd| j fd| j fd | j fd
|
| j ff
|
}|t |t t f« s|g}|D ]ù } t |d }| j j | }|||v rd }|j" r|r+|d dk( r# |d |j" |j$ d¬« }nN|r+|d dk( r# |d |j" |j$ d¬« }n! |d |j" |j$ « }|rt- | |d dd |« |Ðt |t « sá|d |v sé|j/ |« û y # t $ r Y y w xY w# t& $ r.} | j( j+ d|d d| « Y d } ~ d } ~ ww xY w)aS Parse and process the PE file's data directories.
|
|
If the optional argument 'directories' is given, only
|
the directories at the specified indexes will be parsed.
|
Such functionality allows parsing of areas of interest
|
without the burden of having to parse all others.
|
The directories can then be specified as:
|
|
For export / import only:
|
|
directories = [ 0, 1 ]
|
|
or (more verbosely):
|
|
directories = [ DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'],
|
DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'] ]
|
|
If 'directories' is a list, the ones that are processed will be removed,
|
leaving only the ones that are not present in the image.
|
|
If `forwarded_exports_only` is True, the IMAGE_DIRECTORY_ENTRY_EXPORT
|
attribute will only contain exports that are forwarded to another DLL.
|
|
If `import_dllnames_only` is True, symbols will not be parsed from
|
the import table and the entries in the IMAGE_DIRECTORY_ENTRY_IMPORT
|
attribute will not have a `symbols` attribute.
|
r= r< r> rF rD rL rN rT rP r@ Nr r7 T)Úforwarded_only)Ú dllnames_onlyz Failed to process directoty "z": rG )Úparse_import_directoryÚparse_export_directoryÚparse_resources_directoryÚparse_debug_directoryÚparse_relocations_directoryÚparse_directory_tlsÚparse_directory_load_configÚ parse_delay_import_directoryÚ parse_directory_bound_importsÚparse_exceptions_directoryrS rê rª r r= r Ú
|
IndexErrorr2 r± r r; r r Úremove)
|
rr Ú directoriesÚforwarded_exports_onlyÚimport_dllnames_onlyÚdirectory_parsingr> Údirectory_indexr r` r s
|
r r¾ zPE.parse_data_directoriesD s+ ð@ ,¨T×-HÑ-HÐ IØ +¨T×-HÑ-HÐ IØ -¨t×/MÑ/MÐ NØ *¨D×,FÑ,FÐ GØ .°×0PÑ0PÐ QØ (¨$×*BÑ*BÐ CØ 0°$×2RÑ2RÐ SØ 1°4×3TÑ3TÐ UØ 1°4×3UÑ3UÐ VØ .°×0OÑ0OÐ Pð
|
Ðð Ð "Ü k¬E´4¨=Ô9Ø *m à&ò 0 4Eð Ü"1°%¸±(Ñ";Ø × 0Ñ 0× ?Ñ ?ÀÑ P ð Ð" o¸Ñ&Dà Ø ×+Ò+á.Ø ! !HÐ(FÒ Fà ( a¡Ø %× 4Ñ 4Ø %NNØ+/ô!ñ -Ø ! !HÐ(FÒ Fà ( a¡Ø %× 4Ñ 4°i·n±nÐTXô!ð
|
Ø$, E¨!¡H¨Y×-EÑ-EÀyÇ~Á~Ó$VEñ
|
Ü e¨A¡h¨q¨r l°EÔ:ð Ñ(Ü {¬DÕ1Ø1X Ò,à×"Ñ" ?Õ3ña0 4øô ò Úð ûô< -ò Ø OO× 2Ñ 2Ø"?ÀÀaÁ¸zÈÈTÈFÐ S÷ ñ ûð ús* Â&%F Ä: F/Æ F,Æ+F,Æ/ G&Æ8$G!Ç!G&c ó^ | j j t d k7 r!| j j t d k7 ryt | j « }|j « }i }g }i }t ||z « D ]¯ }| j | j | j ||« | j |« ¬« }| nmd} |j dz dk( r#|j |v r||j } n4t | j |j « ¬« } | ||j < | j | j |j | j « « « }
|
|
|
dk7 r | j j |
|
« n«| j | j |j | j « « « }
|
|
|
dk7 r | j j |
|
« nP| j j | « t! || ¬« } |j | « | ||j" < ||z }² |D ]ª }|j$ t' |j$ d« s'|j$ j( |vr9| j j d |j* j- « d
|
d « x |j$ j/ ||j$ j( « ¬ |S # t0 $ rD} | j j d |j* j- « d
|
d | « Y d} ~ ÷d} ~ ww xY w)zØParses exception directory
|
|
All the code related to handling exception directories is documented in
|
https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details
|
rã rÔ Nr r7 r )rE Ú
|
unwindinfor z FunctionEntry of UNWIND_INFO at rj z' points to an entry that does not existz/Failed parsing FunctionEntry of UNWIND_INFO at z: )ry ÚMachineÚ MACHINE_TYPErè Ú__RUNTIME_FUNCTION_format__r r¤ rV r rT Ú
|
UnwindDatar r, r; r r< r Ú BeginAddressró rM r rE rû r? r ) rr r rY ÚrfÚrf_sizeÚrva2rtÚrt_funcsÚ rva2infosr ÚuiÚwsr> r s r rê z PE.parse_exceptions_directory¦ s× ð × Ñ × $Ñ $¬ Ð5OÑ(PÒ PØ× Ñ ×(Ñ(¬LÐ9RÑ,SÒSàä t×7Ñ7Ó 8Ø))+ØØØ ÜtwÓ'ó ( AØ×%Ñ%Ø×0Ñ0Ø c 7Ó+Ø × 4Ñ 4°SÓ 9ð &ó Bð zÚàBà Ñ#¨Ó)ð MM YÑ.à" 2§=¡=Ñ1Bä#°×0HÑ0HÈÏ É Ó0WÔXBØ/1IbmmÑ,à×(Ñ(¨¯ © °r·}±}ÀbÇiÁiÃkÓ)RÓSØ:ØOO×*Ñ*¨2Ô.ÙØ×(Ñ(¨¯ © °r·}±}ÀbÇiÁiÃkÓ)RÓSØ:ØOO×*Ñ*¨2Ô.Ùà×#Ñ#×*Ñ*¨2Ô.ä*°"ÀÔDEØ OOEÔ "à&+F2??Ñ #Ø 7NCðQ( ðV ò BØ}}Ð$ð
|
Ü2==¨/Ô:ØØ==×.Ñ.°&Ñ8Ø×&Ñ&Ø6°r·y±y×7PÑ7PÓ7RÐSTÐ6UØ=ð>ôð ð Ø ×8Ñ8Ø2==×6Ñ6Ñ7õð! ð4 øô !ò Ø×&Ñ&ØEØyy×0Ñ0Ó2°1Ð5°R¸°vð?ôô ûð ús Ê)2K Ë L,Ë(:L'Ì'L,c ó¶ t | j « }|j « }|}g } | j | j | j |||z |¬« }| | j
|
j d« y|j « r |S ||j « z }| j |« }| j |« }|zt | j « |z
|
} | j D
|
cg c] }
|
|
|
j |kD r |
|
j } }
|
| rWt | « } | j | « }|9|j |z
|
} n)|j t |j « « z |z
|
} |s+| j
|
j dj |« « yg } t! t |j" t% | dz « « « D ]é }| j | j& | j |||z |¬« }|s t) d« ||j « z }||j* z }| j- d| j ||t. z « }|rFt1 |« D cg c] }t3 |« t4 j6 vs |" }}t |« dkD s|r n | j t9 ||¬ « « ë ||j* z }| j- d| j ||t. z « }|rGt1 |« D cg c] }t3 |« t4 j6 vs |" }}t |« dkD s|r |S |s |S |j t; ||| ¬
|
« « !c c}
|
w c c}w c c}w ) r r Nz7The Bound Imports directory exists but can't be parsed.zHRVA of IMAGE_BOUND_IMPORT_DESCRIPTOR points to an invalid address: {0:x}rK z(IMAGE_BOUND_FORWARDER_REF cannot be readr re )rE rí )rE rí rà ) rè Ú(__IMAGE_BOUND_IMPORT_DESCRIPTOR_format__r rV rE r; r r Úget_section_by_offsetrT rD r: r1 rp r r r¤ ÚNumberOfModuleForwarderRefsr# Ú$__IMAGE_BOUND_FORWARDER_REF_format__r ÚOffsetModuleNameÚget_string_from_dataÚMAX_STRING_LENGTHrg r# r r r r )rr r rY Ú bnd_descrÚbnd_descr_sizerF Ú bound_importsrÛ rî Úsafety_boundaryrÍ Úsections_after_offsetÚfirst_section_after_offsetÚforwarder_refsr Ú bnd_frwd_refrÞ Úname_strrÄ Ú invalid_charss r ré z PE.parse_directory_bound_imports s¤ ô d× KÑ KÓL Ø"×)Ñ)Ó+Øà ØØ ×,Ñ,Ø×=Ñ=Ø c C¨.Ñ$8Ð9Ø ð -ó Ið
|
Ð ð
|
×&Ñ&ØMôð à×#Ñ#Ô%Øðv Ð ðs 9×#Ñ#Ó%Ñ %Cà×0Ñ0°Ó5GØ ×2Ñ2°3Ó7KØÜ"% d§m¡mÓ"4°{Ñ"Bð "]]ö)àØ×)Ñ)¨KÒ7ð ×&Ó&ð)Ð%ð )ñ
|
)ô 25Ð5JÓ1KÐ.Ø "× 8Ñ 8Ð9SÓ TGØ Ð*Ø*1×*BÑ*BÀ[Ñ*Pð ×,Ñ,¬s°7×3CÑ3CÓ3EÓ/FÑFÈÑTð ñ Ø×&Ñ&ð7ç fSkô ð à NäÜI×9Ñ9¼3¸ÐQRÑ?RÓ;SÓTóò " ð
|
$× 3Ñ 3Ø×=Ñ=ØMM #¨¨nÑ(<Ð=Ø #ð 4ó ñ $Ü'Ð(RÓSÐSØ|×*Ñ*Ó,Ñ,à ×!>Ñ!>Ñ>Ø ×4Ñ4Øt}} V¨fÔ7HÑ.HÐIó ñ ä#,¨XÓ#6ö%Ø ¼#¸a»&Ì×HXÑHXÒ:Xð%Mð %ô 8} sÒ*©mÙ à ×%Ñ%Ü&¨lÀÔJõðA" ðH Y× 7Ñ 7Ñ7FØ×0Ñ0Ø4== ¨&Ô3DÑ*DÐEóHñ ä (¨Ó 2ö!Ø´c¸!³fÄF×DTÑDTÒ6TAð! ð !ô x= 3Ò&©-Øð Ð ñ Øð Ð ð × Ñ Ü#Ø$¨8¸^ôô ñO ùò4)ùòj%ùò !s Ã'"M É MÉ4MË. MÌMc ój | j }| j t k( r | j } | j || j |t |« j « « | j |« ¬« }|syt |¬« S # t $ r# | j j d|z « d}Y :w xY w)r r z5Invalid TLS information. Can't read data at RVA: 0x%xN)rE ) Ú __IMAGE_TLS_DIRECTORY_format__rÍ rÐ Ú __IMAGE_TLS_DIRECTORY64_format__rV r rè r rT r r; r rÿ )rr r rY r Ú
|
tls_structs r ræ zPE.parse_directory_tlsw s³ ð ×4Ñ4à <<Ô8Ò 8Ø×:Ñ:Fð
|
Ø ×-Ñ-ØØ c¤9¨VÓ#4×#;Ñ#;Ó#=Ó>Ø × 4Ñ 4°SÓ 9ð .ó Jñ ØäjÔ)Ð)øô ò Ø OO× "Ñ "ØJÈSÑPô ð Jð ús A
|
B Â)B2Â1B2c óö | j t k( r | j |« }| j }nM| j t k( r | j |« }| j
|
}n | j j d« yd}d}|d D ], }|dz }|t |j d« d z }||k( s, n |d |d d| f}d} | j || j |t |« j « « | j |« ¬« }|syd} |dkD r&| j! |j" |j$ « } t' || ¬ « S # t $ r! | j j d|z « Y fw xY w)
|
r zGDon't know how to parse LOAD_CONFIG information for non-PE32/PE32+ fileNr r7 rÖ r z=Invalid LOAD_CONFIG information. Can't read data at RVA: 0x%xrA )rE Údynamic_relocations)rÍ rÎ Úget_dword_at_rvaÚ&__IMAGE_LOAD_CONFIG_DIRECTORY_format__rÐ Ú(__IMAGE_LOAD_CONFIG_DIRECTORY64_format__r; r rÐ r× rV r rè r rT r Úparse_dynamic_relocationsÚ DynamicValueRelocTableOffsetÚ DynamicValueRelocTableSectionr )
|
rr r rY Úload_config_dir_szr Úfields_counterÚ cumulative_szÚfieldÚload_config_structr s
|
r rç z PE.parse_directory_load_config s¨ ð <<Ô3Ò 3Ø!%×!6Ñ!6°sÓ!;Ð Ø×@Ñ@FØ \\Ô :Ò :Ø!%×!6Ñ!6°sÓ!;Ð Ø×BÑBFà OO× "Ñ "ð ô ð ð Ø ØAYò EØ aÑ NØ Ô 0°·±¸SÓ1AÀ!Ñ1DÑ EÑ EMØ Ð 2Ó2Ùð ð
|
)V AY ¨Ð 7Ð8à !Ðð Ø!%×!5Ñ!5ØØ c¤9¨VÓ#4×#;Ñ#;Ó#=Ó>Ø × 4Ñ 4°SÓ 9ð "6ó "Ð ñ "Øà "ÐØ BÒ Ø"&×"@Ñ"@Ø"×?Ñ?Ø"×@Ñ@ó#Ð ô
|
Ø%Ð;Nô
|
ð
|
øô ò Ø OO× "Ñ "ØRÐUXÑXö ð ús ÃA
|
E Å'E8Å7E8c óö |sy |sy |t | j « kD ry | j |dz
|
}|j |z }d }t | j « j « } | j | j | j ||« | j |« ¬« }|j dk7 r'| j j d|j « y ||z }||j z }g }||k r%| j } | j t k( r | j" } t | « j « }
|
| j | | j ||
|
« | j |« ¬« } | s |S ||
|
z }| j$ } | j& } d| cxk rdk r@n n=| j) || | j* | « }|j t- | | |¬« « | dkD r/| j) || « }|j t- | | |¬« « || z }||k r%|S # t $ r" | j j d|z « Y £w xY w# t $ r$ | j j d|z « d } Y w xY w) Nr7 r zPInvalid IMAGE_DYNAMIC_RELOCATION_TABLE information. Can't read data at RVA: 0x%xzDNo pasring available for IMAGE_DYNAMIC_RELOCATION_TABLE.Version = %dú<Invalid relocation information. Can't read data at RVA: 0x%xrA rE )rE ÚsymbolÚ relocations)rD r: r2 rè Ú)__IMAGE_DYNAMIC_RELOCATION_TABLE_format__r rV r rT r r; r r r± Ú#__IMAGE_DYNAMIC_RELOCATION_format__rÍ rÐ Ú%__IMAGE_DYNAMIC_RELOCATION64_format__ÚSymbolÚ BaseRelocSizeÚ parse_image_base_relocation_listrF ró )rr Ú dynamic_value_reloc_table_offsetÚ!dynamic_value_reloc_table_sectionrÛ r Ú image_dynamic_reloc_table_structÚreloc_table_sizerH r r Úrlc_sizeÚ dynamic_rlcr% rY r& s r r z PE.parse_dynamic_relocationsÈ sµ ñ 0ØÙ0Øà ,¬s°4·=±=Ó/AÒ AØà--Ð AÀAÑ EÑFØ×$Ñ$Ð'GÑGØ+/Ð(Ü$Ø × :Ñ :ó
|
ç
|
&(ð ð
|
Ø/3×/CÑ/CØ×>Ñ>Ø cÐ#3Ó4Ø × 4Ñ 4°SÓ 9ð 0Dó 0Ð ,ð ,× 3Ñ 3°qÒ 8Ø OO× "Ñ "ØVØ0×8Ñ8ô ð à Ð Ñ ØÐ4×9Ñ9Ñ9Ø ÐàCiØ×=Ñ=Fà||Ô <Ò<Ø ×CÑCä Ó(×/Ñ/Ó1Hð #Ø "× 2Ñ 2ØØMM # xÓ0Ø $× 8Ñ 8¸Ó =ð 3ó ñ Øð4 #Ð"ð1 8OCØ ×'Ñ'FØ ×,Ñ,DàFÔ aÕ Ø "× CÑ CØt× GÑ GÈÑ Oó ð $×*Ñ*Ü)Ø *°6À{ôôð zØ "× CÑ CÀCÈÓ N Ø#×*Ñ*Ü)Ø *°6À{ôôð 4KCð] Cið` #Ð"øôC ò Ø OO× "Ñ "ð$Ø&)ñ*÷ ð ûô> !ò #Ø×&Ñ&ð(Ø*-ñ.ôð # ð #ús$ Á'=H Ä;3I È 'IÉIÉ )I8É7I8c ó& | j ||« S )r )r, )rr r rY s r rå z PE.parse_relocations_directory" s ð ×4Ñ4°S¸$Ó?Ð?r c ó t | j « j « }||z }g }||k r~ | j | j | j ||« | j |« ¬« }|s |S |j | j j kD r+| j j d|j z « |S |j | j j kD r+| j j d|j z « |S |.| j ||z |j |j |z
|
« }n.| j ||z |j |j |z
|
|« }|j t ||¬« « |j s |S ||j z }||k r~|S # t $ r$ | j j d|z « d }Y nw xY w)Nr r$ zEInvalid relocation information. VirtualAddress outside of Image: 0x%xz9Invalid relocation information. SizeOfBlock too large: %d©rE rà )rè Ú __IMAGE_BASE_RELOCATION_format__r rV r rT r r; r r2 r= Ú SizeOfImageÚ SizeOfBlockÚparse_relocationsÚ parse_relocations_with_formatrõ ) rr r rY r} r1 rH r& ÚrlcÚ reloc_entriess r r, z#PE.parse_image_base_relocation_list' sý Ü T× BÑ BÓC×JÑJÓLØDjà ØCið Ø×*Ñ*Ø×9Ñ9ØMM # xÓ0Ø $× 8Ñ 8¸Ó =ð +ó ñ ØðD Ðð? ×!Ñ! D×$8Ñ$8×$DÑ$DÒDØ×&Ñ&ð&Ø(+×(:Ñ(:ñ;ôð ð4 Ðð- ×!5Ñ!5×!AÑ!AÒAØ×&Ñ&ðØ __ñ-ôð ð" Ðð {Ø $× 6Ñ 6Ø(N C×$6Ñ$6¸¿¹È(Ñ8Ró! ð !%× BÑ BØ(N C×$6Ñ$6¸¿¹È(Ñ8RÐTWó! ð × Ñ Ô 1¸ÀmÔ TÔ Uà??Øð Ðð 3??Ñ "Cði Ciðl ÐøôU !ò Ø×&Ñ&ð(Ø*-ñ.ôð ð ús ²=F1 Æ1)G Ç G c
|
ó| | j ||« }| j |« }g }t « }t t t |« dz « « D ]¸ }| j | j ||dz |dz dz |¬« } | s |S | j }
|
|
|
dz } |
|
dz } | | f|v r$| j j d| |z z « |S |j | | f« |j t | | || |z ¬ « « || j « z }º |S # t $ r$ | j j d|d« g cY S w xY w)
|
r ú Bad RVA in relocation data: 0xrj r? r7 r rS rú ú3Overlapping offsets in relocation data at RVA: 0x%x)rE rù rü r )r rT r r; r rÉ r¤ r# rD rV Ú&__IMAGE_BASE_RELOCATION_ENTRY_format__rû ru r÷ r ) rr Údata_rvar rY r. rî rà Úoffsets_and_typer r> rý Ú
|
reloc_typeÚ reloc_offsets r r9 zPE.parse_relocationsd s| ð Ø== ¨4Ó0DØ ×2Ñ2°8Ó<Kð
|
Ü 5ÐÜS Y¨]Ó+Ó,ò *Cà×(Ñ(Ø×;Ñ;ØS1W a¡¨1}Ð-Ø 'ð )ó Eñ Øð* ð) ::Dà JØ &=LØ jÐ)Ð-=Ñ=Ø×&Ñ&ð#Ø&2°SÑ&8ñ:ôð ð ð × Ñ ,°
|
Ð!;Ô <à NNÜ Ø z¸CÀ\ÐTWÑEWôô ð
|
5<<>Ñ )Kð9 *ð< øôI ò Ø OO× "Ñ "Ð%CÀHÈQÀ<Ð#PÔ QØIð ús #D Ä*D;Ä:D;c ó` | j ||« }| j |« }t |« j « }g }t « } t t t |« |z « « D ] }
|
| j |||
|
|z |
|
dz |z |¬« } | s |S | j } | | v r$| j j d| |z z « |S | j | « |j t | || |z ¬« « ||z } |S # t $ r$ | j j d|d« g cY S w xY w)r r> rj r7 r r? )rE rü r )r rT r r; r r r rÉ r¤ r# rD rY ÚPageRelativeOffsetru r÷ ) rr rA r rY r r. rî Ú
|
entry_sizerà rÌ r r> rD s r r: z PE.parse_relocations_with_format sb ð Ø== ¨4Ó0DØ ×2Ñ2°8Ó<Kô
|
,¨FÓ3×:Ñ:Ó<
|
ØÜ%ÜS Y¨Ñ 3Ó4Ó5ò &Cà×7Ñ7ØØS:Ñ%¨¨q©°JÑ(>Ð?Ø 'ð 8ó Eñ Øð ð !×3Ñ3LØwÑ&Ø×&Ñ&ð#Ø&2°SÑ&8ñ:ôð ð ð KK Ô %à NNÜ e°c¸|ÈcÑ?QÔRô ð :Ñ %Kð/ &ð2 øôA ò Ø OO× "Ñ "Ð%CÀHÈQÀ<Ð#PÔ QØIð ús #D Ä *D-Ä,D-c óì t | j « j « }g }t t ||z « « D ] } | j |||z z |« }| j | j || j |||z z « ¬« }|s yd}|j dk( rn|j dk( rº|j } |j }
|
| j | | |
|
z } | dd dk( r dg d ¢g} |
|
t | « j « z
|
} | d
|
kD r#| d j d j | « « | j | | | « }|àt! j" d d |j$ z « d
|
|_ t) t+ j, |j. |j0 |j2 |j4 |j6 |j& f¬« « j9 dd « j; « |j< dz |_ n | dd dk( rdg d¢g}|
|
t |« j « z
|
} | d
|
kD r#|d j d j | « « | j || | « }n¹|j dk( rª|j } |j }
|
| j | | |
|
z } dg d¢g}| j || | « }|re|j@ dv rW|
|
t |« j « z
|
}|d
|
kD r#|d j dj |« « | j || | « }|j tC ||¬« « |S # t $ r" | j j d|z « Y yw xY w)r z7Invalid debug information. Can't read data at RVA: 0x%xNr r7 r? rC s RSDSÚ CV_INFO_PDB70)z4s,CvSignaturezI,Signature_Data1zH,Signature_Data2zH,Signature_Data3zB,Signature_Data4zB,Signature_Data5z6s,Signature_Data6úI,Ager z{0}s,PdbFileNamez>Qó )Úfieldsú-ÚXs NB10Ú CV_INFO_PDB20)zI,CvHeaderSignaturezI,CvHeaderOffsetrô rJ ÚIMAGE_DEBUG_MISC)z
|
I,DataTypezI,Lengthz B,Unicodez B,Reserved1r" ©r r7 z {0}s,Data)rE r> )"rè Ú __IMAGE_DEBUG_DIRECTORY_format__r r¤ r# r r r; r rV rT ÚTyper1 Ú
|
SizeOfDatarE r rE rF ÚSignature_Data6ÚSignature_Data6_valuerT ÚuuidÚUUIDÚSignature_Data1ÚSignature_Data2ÚSignature_Data3ÚSignature_Data4ÚSignature_Data5ÚreplaceÚupperÚAgeÚSignature_StringÚUnicoderñ )rr r rY Údbg_sizeÚdebugr r. ÚdbgÚdbg_typeÚdbg_type_offsetÚ dbg_type_sizeÚ dbg_type_dataÚ__CV_INFO_PDB70_format__ÚpdbFileName_sizeÚ__CV_INFO_PDB20_format__Ú ___IMAGE_DEBUG_MISC_format__Údbg_type_partialÚ data_sizes r rä zPE.parse_debug_directory¸ sÖ ô T× BÑ BÓC×JÑJÓLàÜT H_Ó-Ó.ó a @Cð Ø}} S¨8°c©>Ñ%9¸8ÓDð ×&Ñ&Ø×5Ñ5ØØ × 4Ñ 4°S¸8Àc¹>Ñ5IÓ Jð 'ó Cñ Ùð
|
Hàxx1}áàQ à"%×"6Ñ"6Ø #§¡ Ø $§ ¡ Ø# o¸ Ñ&Eð! ð ! !Ð$¨Ó/ð (ò ð 0Ð,ð &¬ Ð2JÓ(K×(RÑ(RÓ(TÑTð %ð (¨!Ò+Ø0°Ñ3×:Ñ:Ø .× 5Ñ 5Ð6FÓ Gôð $× 3Ñ 3Ø0°-À ó Hð Ñ+Ü9?¿ ¹ Ø '¨H×,DÑ,DÑ"Dó:àñ: Ô6ô Ü $§ ¡ à(0×(@Ñ(@Ø(0×(@Ñ(@Ø(0×(@Ñ(@Ø(0×(@Ñ(@Ø(0×(@Ñ(@Ø(0×(FÑ(Fð ,&ô !"ó ÷ %W S¨"Ó -ß "UWØ!)§ ¡ ¨aÐ 0ñ 2ð !Ö1ð$ # 2 AÐ&¨'Ó1ð (òð0Ð,ð &¬ Ð2JÓ(K×(RÑ(RÓ(TÑTð %ð (¨!Ò+à0°Ñ3×:Ñ:Ø .× 5Ñ 5Ð6FÓ Gôð $× 3Ñ 3Ø0°-À ó Hð Q à"%×"6Ñ"6Ø #§¡ Ø $§ ¡ Ø# o¸ Ñ&Eð! ð 'òð 0Ð,ð $(×#7Ñ#7Ø0°-À ó$Ð ñ $à'×/Ñ/°6Ñ9à )Ü 'Ð(DÓ E× LÑ LÓ Nñ Oð "ð % q=Ø 8¸Ñ ;× BÑ BØ +× 2Ñ 2°9Ó =ô ð $(×#7Ñ#7Ø 8¸-È ó$ð LL¨#°XÔ>Ö ?ðCa @ðF øôA !ò Ø×&Ñ&ØPÐSVÑVôò ð ús ÁMÍ'M3Í2M3c
|
óR ||g}||}|t kD r%| j j d|t fz « y | j |t | j
|
« j « « }| j | j
|
|| j |« ¬« }| | j j d|z « yg }||j « z }|j |j z } d}
|
| |
|
kD r!| j j d| |
|
fz « y| xj | z c_ | j t kD r/| j j d| j t fz « yg } d} t | « D ]. } | j sT| j | j" kD r;d | _ | j j d
|
| j | j" fz « | j% |« }|#| j j d | |fz « nd}d}|j& d z d z }|s |j& }n¨||j( z } t+ | |« }| xj |j- « z c_ | rA| d |k r9| d |k\ r1| j/ « | j j d|z « nñ|||j- « z f} | j |« |j0 r||j2 z |v r nª| j5 ||j2 z |||z
|
z
|
||dz |||j2 z gz ¬« }|s nhd}|t6 d k( ri }|j8 D ] }t; |d« si }|j< j8 D ]É }|8t; |d« r,|j> j@ jB |jD >|j> j@ jF }|j> j@ jB }|jD } | j ||« }tI |tK |« dz
|
dz |« |jM |« Ë ||j< _' |j tQ ||||¬« « n| jS ||j2 z « } | rf| xj | jB z c_ tU | |j& dz |j& d z ¬ « } |j tQ |||| ¬ « « n n|dk( r|jV t6 d k( rj|r|d } j< j8 d j< j8 } | D ]/ } d}! | j> j@ }!|! | jY |!« 1 ||j « z }1 | D "cg c] }"|"j[ « }#}"|#j] « t_ | « D ] \ } }"|"ja « tc ||¬!« }$|$S # t $ r! | j j d|z « Y yw xY w# t $ r" | j j d|z « Y w xY w# t $ r& | j j d|dd| « Y
|
w xY w# Y xY w# Y xY wc c}"w )"aØ Parse the resources directory.
|
|
Given the RVA of the resources directory, it will process all
|
its entries.
|
|
The root will have the corresponding member of its structure,
|
IMAGE_RESOURCE_DIRECTORY plus 'entries', a list of all the
|
entries in the directory.
|
|
Those entries will have, correspondingly, all the structure's
|
members (IMAGE_RESOURCE_DIRECTORY_ENTRY) and an additional one,
|
"directory", pointing to the IMAGE_RESOURCE_DIRECTORY structure
|
representing upper layers of the tree. This one will also have
|
an 'entries' attribute, pointing to the 3rd, and last, level.
|
Another directory with more entries. Those last entries will
|
have a new attribute (both 'leaf' or 'data_entry' can be used to
|
access it). This structure finally points to the resource data.
|
All the members of this structure, IMAGE_RESOURCE_DATA_ENTRY,
|
are available as its attributes.
|
NzNError parsing the resources directory. Excessively nested table depth %d (>%s)zCInvalid resources directory. Can't read directory data at RVA: 0x%xr zDInvalid resources directory. Can't parse directory data at RVA: 0x%xr( zNError parsing the resources directory. The directory contains %d entries (>%s)zRError parsing the resources directory. The file contains at least %d entries (>%d)TzGResource size 0x%x exceeds file size 0x%x, overlapping resources found.zHError parsing the resources directory, Entry %d is invalid, RVA = 0x%x. r5 r¨ r r7 z^Error parsing the resources directory, attempting to read entry name. Entry names overlap 0x%xznError parsing the resources directory, attempting to read entry name. Can't read unicode string at offset 0x%x)rü ÚlevelÚdirsr Ú directoryr. z2Error parsing resource of type RT_STRING at RVA 0xrj z with size r4 )rE rí Úidrs iÿ rO )rE ÚlangÚsublang)rE rí rt r. r" r¢ r5 )2ÚMAX_RESOURCE_DEPTHr; r r rè Ú#__IMAGE_RESOURCE_DIRECTORY_format__r r rV rT ÚNumberOfNamedEntriesÚNumberOfIdEntriesr@ ÚMAX_RESOURCE_ENTRIESr¤ rj rA ri Úparse_resource_entryrÖ Ú
|
NameOffsetr r r0 ÚDataIsDirectoryÚOffsetToDirectoryrã Ú RESOURCE_TYPErà rM rs r. rE r± rt Ú OffsetToDatarP r# ÚupdateÚstringsrí Úparse_resource_data_entryrï ÚIdÚparse_version_informationr
rØ r r rê )%rr r rY rü rq rr r. Ú resource_dirÚ dir_entriesÚnumber_of_entriesÚMAX_ALLOWED_ENTRIESÚstrings_to_postprocessÚlast_name_begin_endr ÚresÚ
|
entry_nameÚentry_idÚname_is_stringÚ ustr_offsetÚentry_directoryr Ú resource_idÚresource_stringsÚ resource_langÚstring_entry_rvaÚstring_entry_sizeÚstring_entry_idÚstring_entry_datarE Ú
|
entry_dataÚ
|
last_entryÚversion_entriesÚ version_entryÚrt_version_structrÍ Ú string_rvasÚresource_directory_datas% r rã z PE.parse_resources_directoryc sq ð. <Ø5Dà Ð ØHà Ô%Ò %Ø OO× "Ñ "ð:Ø=BÔDVÐ<WñXô ð ð ð ==ØYt× GÑ GÓH×OÑOÓQóDð ×+Ñ+Ø × 4Ñ 4Ø Ø ×0Ñ0°Ó5ð ,ó
|
ð
|
Ð ð OO× "Ñ "ð.Ø03ñ4ô ð à ð
|
|×"Ñ"Ó$Ñ$ð × -Ñ -° ×0NÑ0NÑ Nð ð
|
#ÐØ Ð 2Ò 2Ø OO× "Ñ "ð:à$Ð&9Ð:ñ;ô ð
|
à ×+Ò+Ð/@Ñ@Õ+Ø × .Ñ .Ô1EÒ EØ OO× "Ñ "ð>à×6Ñ6Ô8LÐMñNô ð
|
à!#Ð ð
|
#ÐÜÐ*Ó+ó B Cà×6Ò6Ø×/Ñ/°$×2XÑ2XÒXð 6:Ô2Ø×&Ñ&ð'ð ×3Ñ3Ø ×>Ñ>ðñôð ×+Ñ+¨CÓ0CØ{Ø×&Ñ&ð8Ø;>À¸*ñEôò à JØHà !hh¨Ñ 3¸Ñ :NÙ!Ø 88à &¨¯ © Ñ 7 ð Ü!BÀ4ÈÓ!UJØ×/Ò/°:×3RÑ3RÓ3TÑTÕ/ñ +Ø+¨AÑ.°Ò<Ø /°Ñ 2°kÒ Að /×2Ñ2Ô4Ø ×.Ñ.ð 7à:Eñ Gôò
|
ð $Ø# j×&EÑ&EÓ&GÑGð+Ð'ð
|
+×1Ñ1°*Ô=ð ×"Ó"ð c× 3Ñ 3Ñ3°tÑ;Úà"&×"@Ñ"@Ø s× 4Ñ 4Ñ4ØC (NÑ+Ø %Ø !)Ø ¨C×,AÑ,AÑ!AÐ BÑBð #Aó #ñ 'Úð Ø}¨[Ñ 9Ó9Ø GØ'6×'>Ñ'>ó )M Ü" ;° Õ<à/1Ð ,à1<×1FÑ1F×1NÑ1Nò " A ð %2Ð$9Ü+2°=À&Ô+IØ'4×'9Ñ'9×'@Ñ'@×'EÑ'EÐ'MØ'2§~¡~Ð'=à$,ð %2×$6Ñ$6×$=Ñ$=×$JÑ$Jð !1ð 5B×4FÑ4F×4MÑ4M×4RÑ4RÐ 1Ø2=·.±. ð
|
!-Ø8<¿ ¹ Ø(8Ð:Kó9&Ð$5ô !.Ø$5Ü%(¨ Ó%9¸AÑ%=ÀÑ$CØ$4ô!"ð
|
!(§¡Ð/?Õ @ðE" AðH =MK× 1Ñ 1Ö 9ðS)MðV ×"Ñ"Ü(Ø "Ø 'Ø#Ø"1ô õð ×7Ñ7Ø s× 4Ñ 4Ñ4óñ Ø×/Ò/°6·;±;Ñ>Õ/Ü!6Ø %¨C¯H©H°uÑ,<ÀcÇhÁhÐRTÁnô"Jð ×&Ñ&Ü,Ø#&¨Z¸HÈ:ôõñ ð zcff¬ °lÑ(CÒ CÙ Ø!,¨R¡ JðNØ&0×&:Ñ&:×&BÑ&BÀ1Ñ&E×&OÑ&O×&WÑ&WOð *9ò
|
N Ø,0Ð)ð!Ø0=×0BÑ0B×0IÑ0IÐ -ð -Ñ8Ø × :Ñ :Ð;LÕ Mñ
|
Nð 3::<Ñ CðEB ðH -CÖC qqyy{ÐC ÐCØ×ÑÔä Ð 6Ó7ò !FCØ × Ñ Õ ð !ô #2Ø ¨ô#
|
Ð ð 'Ð&øôW ò Ø OO× "Ñ "ð.Ø03ñ4ô ñ ð ûôp %ò ØOO×*Ñ*ðCàFQñS÷ðûô@ (5ò !-Ø$(§O¡O×$:Ñ$:ð+1Ø1AÀ!Ð0Dð E0Ø0AÐ/Bð)Dô%&ò
|
%-ð !-ûð~!ò !ûðò üò DsZ ¹3X ÉA/X4Ê7&X4ÐY"Ô0-Z Õ%ZÖ,Z$Ø'X1Ø0X1Ø4'Y Ù Y Ù"+Z ÚZ ÚZÚ Z!c ó" | j |t | j « j « « }| j | j || j |« ¬« }|S # t $ r! | j
|
j d|z « Y yw xY w)z0Parse a data entry from the resources directory.zGError parsing a resource directory data entry, the RVA is invalid: 0x%xNr ) r rè Ú$__IMAGE_RESOURCE_DATA_ENTRY_format__r r r; r rV rT )rr r r. Ú
|
data_entrys r r z PE.parse_resource_data_entry s ð ð ==ØYt× HÑ HÓI×PÑPÓRóDð ×)Ñ)Ø × 5Ñ 5Ø Ø ×0Ñ0°Ó5ð *ó
|
|
ð Ðøô ò Ø OO× "Ñ "ð+Ø.1ñ3ô ñ ð ús 3A$ Á$'B Bc óº | j |t | j « j « « }| j | j || j |« ¬« }|y|j dz |_ |j dz |_ |j dz |_
|
|j dz dz |_ |j dz |_ |S # t $ r Y yw xY w)z5Parse a directory entry from the resources directory.Nr r` ì þ rÊ r5 r¨ )r rè Ú)__IMAGE_RESOURCE_DIRECTORY_ENTRY_format__r r rV rT rÖ r} Ú_PE__padr
r r~ r )rr r r. Úresources r r| zPE.parse_resource_entry² sá ð Ø==ØYt× MÑ MÓN×UÑUÓWóDð ×'Ñ'Ø × :Ñ :Ø Ø ×0Ñ0°Ó5ð (ó
|
ð Ð Øð 'mm¨jÑ 8Ôà! ¨Ñ3Ø mm jÑ0 à$,×$9Ñ$9¸JÑ$FÈ2Ñ#MÔ Ø%-×%:Ñ%:¸ZÑ%GÔ"àøô- ò áð ús 3C à CÃCc óú | j |j « }| j |||j z }| j | j ||¬« }|y|j |j « z }| j |« }d}|r-|j t |j |j « z }d} || j! |d¬« }n| j! |||z
|
dz d¬« }|+| j j dj |« « y|©|d k7 r¤t# |« d
|
kD rL|dd
|
j% d« } | d| j' d « } t) d j | t# |« « « }| j j dj |j% d« j+ d d« « « yt- | d« sg | _ |}
|
||
|
_ | j. j |
|
« |d}| j3 |j « dt# |« dz z z |j « } | j | j4 || d || z ¬« } | syt- | d« sg | _ | j6 j | « | j3 | | j « z |j « } t- | d« sg | _ g } | j | j: || d || z ¬« }| | j j d« y|j | z |j « z } | j! |« }||_ |j |« |r'|j= d« r|j> dv r |j@ dk( rý| j3 | |j « z dt# |« dz z z |j « }g |_! | j | jD ||d ||z ¬« }|sn|j |z |j « z } | j! |« }||_# i |_$ i |_% i |_& |jB j |« | j3 ||j « z dt# |« dz z z |j « }|||jN z k r| j | jP ||d ||z ¬« }|sn_|j |z |j « z } | j! |« }| j |« }| j3 dt# |« dz z |z |j « z |j « }|j |z } | j! ||j@ ¬« }| j |« }|jN dk( r||jN z }n)| j3 |jN |z |j « }||jH |< ||f|jJ |< t# |« t# |« f|jL |< |||jN z k r| j3 |jN |z |j « }||k( rn |}||jN k\ rn ¯|r|j= d « rò|}d |_) |j> dv rÚ|j@ dk( rÊ| j3 | |j « z dt# |« dz z z |j « } g |_* | j | jV || d || z ¬« } | sn[|j | z | j « z } | j! |« } | n%|jT j | « | j3 dt# | « dz z | z | j « z |j « } | } | | | j@ z k ry| jY || | dz d« }!| jY || dz | d!z d« }"| d!z } t[ |!t\ « r t[ |"t\ « r| d"|!|"fz i| _/ | | | j@ z k ry| j3 | | jN z |j « } | | | jN z k rn| j3 |jN | z |j « } |jN dk( s| |jN k\ rn| j8 j |« y# t $ r7 | j j dj |j « « Y yw xY w# t $ r" | j j d|z « Y ww xY w# t $ r- | j j dj |« « Y Âw xY w# t $ r. | j j dj |« « Y Fw xY w# t $ r. | j j dj |« « Y Ìw xY w# t $ r# | j j d |d « Y ûw xY w# t $ r. | j j d j |« « Y éw xY w)#a Parse version information structure.
|
|
The date will be made available in three attributes of the PE object.
|
|
VS_VERSIONINFO will contain the first three fields of the main structure:
|
'Length', 'ValueLength', and 'Type'
|
|
VS_FIXEDFILEINFO will hold the rest of the fields, accessible as sub-attributes:
|
'Signature', 'StrucVersion', 'FileVersionMS', 'FileVersionLS',
|
'ProductVersionMS', 'ProductVersionLS', 'FileFlagsMask', 'FileFlags',
|
'FileOS', 'FileType', 'FileSubtype', 'FileDateMS', 'FileDateLS'
|
|
FileInfo is a list of all StringFileInfo and VarFileInfo structures.
|
|
StringFileInfo structures will have a list as an attribute named 'StringTable'
|
containing all the StringTable structures. Each of those structures contains a
|
dictionary 'entries' with all the key / value version information string pairs.
|
|
VarFileInfo structures will have a list as an attribute named 'Var' containing
|
all Var structures. Each Var structure will have a dictionary as an attribute
|
named 'entry' which will contain the name and value of the Var.
|
zWError parsing the version information, attempting to read OffsetToData with RVA: 0x{:x}Nr Úascii©Úencodingr7 zzError parsing the version information, attempting to read VS_VERSION_INFO string. Can't read unicode string at offset 0x%xz"Invalid VS_VERSION_INFO block: {0}s VS_VERSION_INFOrc z\uz({0} ... ({1} bytes, too long to display)ú z\00r r r? r r z/Error parsing StringFileInfo/VarFileInfo structz|Error parsing the version information, attempting to read StringFileInfo string. Can't read unicode string at offset 0x{0:x}s StringFileInforQ r zyError parsing the version information, attempting to read StringTable string. Can't read unicode string at offset 0x{0:x}z}Error parsing the version information, attempting to read StringTable Key string. Can't read unicode string at offset 0x{0:x}r zzError parsing the version information, attempting to read StringTable Value string. Can't read unicode string at offset 0xrj s VarFileInfoÚ VarFileInfoz}Error parsing the version information, attempting to read VarFileInfo Var string. Can't read unicode string at offset 0x{0:x}rC z 0x%04x 0x%04x)0rT r r r; r r rE r± rV Ú__VS_VERSIONINFO_format__r r r2 rq r3 r4 r rD rH ÚrfindrG r^ rM r ÚKeyÚ dword_alignÚ__VS_FIXEDFILEINFO_format__r r Ú__StringFileInfo_format__rV rS Ú ValueLengthr Ú__StringTable_format__ÚLangIDrà rÄ rÅ ÚLengthÚ__String_format__rí r Ú__Var_format__Úget_word_from_datarS r# r> )#rr Úversion_structÚ start_offsetr¤ Úversioninfo_structr rÛ Ú section_endÚversioninfo_stringÚexcerptÚvinfoÚfixedfileinfo_offsetÚfixedfileinfo_structÚstringfileinfo_offsetrÊ Ústringfileinfo_structÚstringfileinfo_stringÚstringtable_offsetÚstringtable_structÚstringtable_stringÚ entry_offsetÚ string_structr Ú
|
key_offsetÚ value_offsetr` Únew_stringtable_offsetÚvarfileinfo_structÚ
|
var_offsetÚ
|
var_structÚ
|
var_stringÚvarword_offsetÚorig_varword_offsetÚword1Úword2s# r r z PE.parse_version_informationÑ s, ð4 Ø ×3Ñ3°N×4OÑ4OÓPLð == ° ¸~×?RÑ?RÑ0RÐSð "× 1Ñ 1Ø × *Ñ *¨HÀ,ð 2ó
|
Ðð Ð %Ø à$×1Ñ1Ð4F×4MÑ4MÓ4OÑO Ø×)Ñ)¨+Ó6Ø Ù Ø!×0Ñ0´3Ø×%Ñ% w×'?Ñ'?ó4ñ Kð "Ðð
|
ØÐ"Ø%)×%=Ñ%=Ø ¨'ð &>ó &Ñ"ð &*×%=Ñ%=Ø +° Ñ";ÀÑ!AÈGð &>ó &Ð"ð Ð %Ø OO× "Ñ "Ø4×;Ñ;Ð<NÓOô ð ð Ð )Ð.@ÐDVÒ.VÜÐ%Ó&¨Ò,Ø,¨T¨cÐ2×9Ñ9¸'ÓBà!Ð"8 G§M¡M°%Ó$8Ð9Ü%&Ø>×EÑEØ ¤Ð%7Ó!8óó&Ð"ð
|
OO× "Ñ "Ø4×;Ñ;Ø&×-Ñ-¨gÓ6×>Ñ>¸uÀfÓMóô ð
|
ätÐ -Ô.Ø"$DÔ ð #ð ' à ×Ñ×"Ñ" 5Ô)à Ð %Ø!#Ð à #× /Ñ /Ø × %Ñ %Ó '¨!¬sÐ3EÓ/FÈÑ/JÑ*KÑ KØ × 'Ñ 'ó
|
Ð ð $× 3Ñ 3Ø × ,Ñ ,Ø Ð)Ð*Ð +Ø$Ð';Ñ;ð 4ó
|
Ð ñ $Ø ätÐ /Ô0Ø$&DÔ !ð × Ñ ×$Ñ$Ð%9Ô:ð
|
!%× 0Ñ 0Ø Ð#7×#>Ñ#>Ó#@Ñ @Ø × 'Ñ 'ó!
|
Ð ô tZÔ(Ø DMàØð %)×$8Ñ$8Ø×.Ñ.ØÐ.Ð/Ð0Ø (Ð+@Ñ @ð %9ó %Ð !ð %Ð,Ø×&Ñ&ØEôð ð ×+Ñ+Ø'ñ(à$×+Ñ+Ó-ñ.ð ð
|
Ø(,×(@Ñ(@ÀÓ(MÐ%ð )>Ð !Ô %ð LLÐ.Ô /ò %Ð)>×)IÑ)IØ!õ*ð
|
*×.Ñ.°&Ò8Ø-×9Ñ9¸QÓ>ð *.×)9Ñ)9Ø-Ø/×6Ñ6Ó8ñ9àsÐ#8Ó 9¸AÑ =Ñ>ñ?ð '×3Ñ3ó *Ð&ð 9;Ð)Ô5ð à-1×-AÑ-AØ × 7Ñ 7Ø $Ð%7Ð%8Ð 9Ø(4Ð7IÑ(Ið .Bó .Ð*ñ 2Ù !ð +× 7Ñ 7Ø 0ñ 1à 0× 7Ñ 7Ó 9ñ :ð $ð
|
|
"Ø15×1IÑ1IÈ+Ó1VÐ .ð 5GÐ*Ô1Ø57Ð*Ô2Ø=?Ð*Ô:Ø=?Ð*Ô:Ø-×9Ñ9×@Ñ@ÐASÔTà'+×'7Ñ'7Ø .Ø 0× 7Ñ 7Ó 9ñ :à ¤3Ð'9Ó#:¸QÑ#>Ñ ?ñ @ð +× 7Ñ 7ó ( ð )Ø 0Ð3E×3LÑ3LÑ Ló Mð -1×,@Ñ,@Ø $× 6Ñ 6Ø (¨ ¨ Ð 7Ø,8¸<Ñ,Gð -Aó - Mñ $1Ù %ð !/× ;Ñ ;Ø".ñ!/à"/×"6Ñ"6Ó"8ñ!9ð (ð
|
&Ø&*×&>Ñ&>¸{Ó&K Ø-1×-EÑ-EÀkÓ-R
|
ð ,0×+;Ñ+;Ø !¤S¨£X°¡\Ñ 2Ø".ñ!/à"/×"6Ñ"6Ó"8ñ!9ð !/× ;Ñ ;ó , Lð +9×*EÑ*EÈ Ñ*TKð &Ø(,×(@Ñ(@Ø$/¸M×<UÑ<Uð )Aó )" ð 04×/GÑ/GÈ Ó/T ð -× 3Ñ 3°qÒ 8à$6Ð9K×9RÑ9RÑ$Rñ !-ð 04×/?Ñ/?Ø$1×$8Ñ$8¸<Ñ$GØ$2×$?Ñ$?ó0" ð
|
?DÐ .× 6Ñ 6°sÑ ;à *Ø ,ðG Ð .× >Ñ >¸sÑ Cô
|
!$ C£Ü # E£
|
ðG Ð .× >Ñ >¸sÑ CðG )Ø 0Ð3E×3LÑ3LÑ Lô MðP 26×1AÑ1AØ .× 5Ñ 5Ð8JÑ JØ *× 7Ñ 7ó2Ð.ð 2Ð5GÒGÙ !Ø-CÐ*à-Ð1F×1MÑ1MÒMÙ !ñA òF 'Ð+@×+KÑ+KØ õ,ð &;Ð"Ø*7Ð"Ô'ð '×+Ñ+¨vÒ5Ø*×6Ñ6¸!Ó;ð "&×!1Ñ!1Ø-Ø,×3Ñ3Ó5ñ6àsÐ#8Ó 9¸AÑ =Ñ>ñ?ð '×3Ñ3ó "Jð .0Ð&Ô*ð Ø%)×%9Ñ%9Ø × /Ñ /Ø $ Z [Ð 1Ø(4°zÑ(Að &:ó &
|
ñ *Ù !ð +× 7Ñ 7Ø (ñ )à (× /Ñ /Ó 1ñ 2ð $ð
|
|
"Ø)-×)AÑ)AÀ+Ó)NJð &Ð-Ù !à*×.Ñ.×5Ñ5°jÔAà)-×)9Ñ)9Ø ¤ Z£ °1Ñ!4Ñ 5Ø (ñ )à (× /Ñ /Ó 1ñ 2ð +× 7Ñ 7ó *ð /=Ð+ð +Ø 1°J×4JÑ4JÑ Jò Kð %)×$;Ñ$;Ø (¨ ¸.È1Ñ:LÐ MÈqó% Eð %)×$;Ñ$;Ø (¨ ¸!Ñ);¸nÈqÑ>PÐ QÐSTó% Eð +¨aÑ /Nä )¨%´Ô 5¼*ÀUÌCÔ:Pà$.°À5È%À.Ñ0Pð4"
|
Ô 0ð +Ø 1°J×4JÑ4JÑ Jó Kð &*×%5Ñ%5Ø &¨×):Ñ):Ñ :¸N×<WÑ<Wó&
|
ð &¨°j×6GÑ6GÑ)GÒGØ !ñ} ðB %)×$4Ñ$4Ø%×,Ñ,Ð/DÑDØ ×+Ñ+ó%Ð !ð &×,Ñ,°Ò1Ø(Ð,>×,EÑ,EÒEàñ} ð@ × Ñ UÕ#øôo ò Ø OO× "Ñ "ðCßCIÁ6Ø"×/Ñ/óDô ñ ð ûôR ò Ø OO× "Ñ "ð5à8CñE÷ ð ûôJ !ò Ø×&Ñ&ð<ç<B¹FÀ;Ó<Oôñ
|
ð ûôh -ò "Ø OO× 2Ñ 2ð!HçHNÉØ$/óI"ô ò "ð"ûô^ $1ò &Ø $§¡× 6Ñ 6ð%LçLRÉFØ(3óM&ô!"ò !&ð &ûô. $1ò &Ø $§¡× 6Ñ 6ð%BàBMÈaÀ ð%Rô!"ò
|
!&ð &ûôf -ò "Ø OO× 2Ñ 2ð!NçNTÉfØ$/óO"ô ò "ð"ús} c6 Â<0d9 Ì6e' Ð#f Ô"g Õ7.h Ýi ã6=d6ä5d6ä9'e$å#e$å'3f æ f æ 3gçgç3hèhè(i è?i é3i:é9i:c ó j j j |t j « j « « j |« ¬« }|sy fd} j |j t ||j « |j dz « « } j |j t ||j « |j dz « « } j |j t ||j « |j dz « « }g } d}
|
j |j « } t! j" « } | r3| j$ t! | j « « z |j z
|
} t' j( t* « } d}t- t |j t+ | dz « « « D ]Ô } j/ ||« }|$|dz t! |« k r j1 ||« }n y||dk( rF||k\ r,|||z k r$ j3 |« } j |« }n|rzd}d} j1 ||« }||
|
d z }
|
|
|
dk rd
|
} n7 j3 |t4 « }t7 |d¬ « sd
|
} n j |« }| ||fxx d z cc< | ||f dkD r% j j d | d |dd« n¿t! | « j8 kD r6 j j dj; j8 « « nq| j t= |j> |z j |j d|z z « | j |j d|z z « ||||¬« « × |s) j j d|j d« | D ch c] }|j@ }}d}
|
j |j « } t! j" « } | r3| j$ t! | j « « z |j z
|
} t' j( t* « } d}t- t |j t+ | dz « « « D ]% }||j> z |vs j1 ||« }||
|
d z }
|
|
|
dk rd
|
} nð|dk( r?| ||k\ r|||z k r j3 |« }nd}| |xx d z cc< | | jB kD r7 j j dj; jB |« « nqt! | « j8 kD r+ j j d j8 d« n.| j t= |j> |z |d|¬« « ( |s* j j d|j d« y| s|jE « rytG || j3 |jH « ¬« S # t $ r! j j d|z « Y yw xY w# t $ r! j j d|z « Y yw xY w# t $ r Y ¾w xY w# t $ rI |
|
d z }
|
|
|
dk rd
|
}Y j |« }n"# t $ r |
|
d z }
|
|
|
dk rd
|
}Y Y 0Y Y w xY wY 8w xY wc c}w # t $ r d}Y 8w xY w)a Parse the export directory.
|
|
Given the RVA of the export directory, it will process all
|
its entries.
|
|
The exports will be made available as a list of ExportData
|
instances in the 'IMAGE_DIRECTORY_ENTRY_EXPORT' PE attribute.
|
r z+Error parsing export directory at RVA: 0x%xNc óR t j « j | « z
|
S r )rD rE rT )r rr s r Úlength_until_eofz3PE.parse_export_directory.<locals>.length_until_eof¤ s" ø Üt}}Ó%¨×(@Ñ(@ÀÓ(EÑEÐ Er rC rO Tr r7 F)rË z9Export directory contains more than 10 repeated entries (r/ z#02xz). Assuming corrupt.zHExport directory contains more than {} symbol entries. Assuming corrupt.r? ) r rÈ rÚ rË ræ rí rØ rä rç zIRVA AddressOfNames in the export directory points to an invalid address: rj z[Export directory contains more than {} repeated ordinal entries (0x{:x}). Assuming corrupt.z$Export directory contains more than z# ordinal entries. Assuming corrupt.)rÈ rË rí rä zMRVA AddressOfFunctions in the export directory points to an invalid address: )rE Úsymbolsrí )%rV Ú!__IMAGE_EXPORT_DIRECTORY_format__r rè r rT r r; r ÚAddressOfNamesrp Ú NumberOfNamesÚAddressOfNameOrdinalsÚAddressOfFunctionsÚNumberOfFunctionsr rD rE r2 Ú collectionsÚ defaultdictr# r¤ r» Úget_dword_from_dataÚget_string_at_rvaÚMAX_SYMBOL_NAME_LENGTHrÐ r7 r râ ÚBaserÈ r8 r rà rÖ )rr r rY rß Ú
|
export_dirrÚ Úaddress_of_namesÚaddress_of_name_ordinalsÚaddress_of_functionsÚexportsÚ#max_failed_entries_before_giving_uprÛ r Ú symbol_countsÚ&export_parsing_loop_completed_normallyrL Úsymbol_ordinalÚsymbol_addressÚ forwarder_strrç Úsymbol_name_addressÚ symbol_nameÚsymbol_name_offsetÚexpÚordinalsr s ` r râ zPE.parse_export_directory s² ø ð Ø ×-Ñ-Ø×6Ñ6Ø Ø 4×#IÑ#IÓJ×QÑQÓSóð !× 4Ñ 4°SÓ 9ð .ó Jñ Ø ô
|
Fð Ø #}}Ø×)Ñ)ÜÙ$ Z×%>Ñ%>Ó?Ø ×,Ñ,¨qÑ0óó Ð ð (,§}¡}Ø×0Ñ0ÜÙ$ Z×%EÑ%EÓFØ ×,Ñ,¨qÑ0óó(Ð $ð $(§=¡=Ø×-Ñ-ÜÙ$ Z×%BÑ%BÓCØ ×0Ñ0°1Ñ4óó$Ð ð à.0Ð+à×)Ñ)¨*×*CÑ*CÓDä dmmÓ,Ù à×&Ñ&Üg×&Ñ&Ó(Ó)ñ*à ×+Ñ+ñ,ð ô $×/Ñ/´Ó4 Ø15Ð.Üs:×3Ñ3´S¸ È1Ñ9LÓ5MÓNÓOó ] AØ !× 4Ñ 4Ð5MÈqÓ QNà Ð)¨n¸qÑ.@Ä3Ø$óDò /ð "&×!9Ñ!9Ø(¨.ó"ñ Ø Ð%¨ ¸1Ò)<Øð
|
Ò$¨ ¸#À¹*Ò)DØ $× 6Ñ 6°~Ó F ð Ø'+×'?Ñ'?ÀÓ'OÑ$ñ "Ø Ø $ Ø#'Ð à"&×":Ñ":Ð;KÈQÓ"OÐ Ø"Ð*Ø3°qÑ8Ð3Ø6¸!Ò;Ø=BÐ:Úà ×0Ñ0Ø#Ô%;óKô *¨+ÐPTÕUØ9>Ð6Úð Ø%)×%=Ñ%=Ð>QÓ%RÐ"ð$ ;¨Ð7Ó 8¸AÑ =Ó 8Ø k¨>Ð :Ñ;¸bÒ@Ø×&Ñ&ðØ#} B ~°dÐ&;Ð;OðQôñ Ü]Ó# d×&=Ñ&=Ò=Ø×&Ñ&ð(ß(.©¨t×/FÑ/FÓ(Gôñ à NNÜØØ &OO¨nÑ <Ø#'×#;Ñ#;Ø"×8Ñ8¸1¸q¹5Ñ@ó$ð +Ø#'×#;Ñ#;Ø"×5Ñ5¸¸NÑ8JÑJó$ð %Ø 2Ø +Ø%5ôö ð[] ñ~ 6Ø OO× "Ñ "ð Ø &× 5Ñ 5°aÐ8ð:ô ð
|
,3Ö3 CCKKÐ3Ð3à.0Ð+à×)Ñ)¨*×*GÑ*GÓHä dmmÓ,Ù à×&Ñ&Üg×&Ñ&Ó(Ó)ñ*à ×/Ñ/ñ0ð ô $×/Ñ/´Ó4 Ø15Ð.ÜZ× 9Ñ 9¼3¸ÐQRÑ?RÓ;SÓTÓUó 6 Cà Ñ(¨HÒ4ð*Ø%)×%=Ñ%=Ð>RÐTWÓ%XNð "Ð)Ø7¸1Ñ<Ð7Ø:¸aÒ?ØAFÐ>Ù à! QÒ&Ø ð #Ð.Ø&¨#Ò-Ø&¨¨t©Ò3à$(×$:Ñ$:¸>Ó$JMà$(Mð
|
nÓ-°Ñ2Ó-Ø Ñ0°4×3KÑ3KÒKàOO×*Ñ*ðFßFLÁfØ × 4Ñ 4°nóGôñ Ü Ó'¨$×*AÑ*AÒAØOO×*Ñ*Ø>Ø ×2Ñ2Ð3Ð3VðXôñ àÜ Ø *§¡°#Ñ 5Ø .Ø !Ø"/ô öð_6 ñp 6Ø OO× "Ñ "ð Ø &× 9Ñ 9¸!Ð<ð>ô ð á:×0Ñ0Ô2ØÜ Ø ØØ×'Ñ'¨
|
¯©Ó8ô
|
ð
|
øôc ò Ø OO× "Ñ "Ø=ÀÑEô ñ ð ûôJ ò Ø OO× "Ñ "Ø=ÀÑEô ñ ð ûôZ %ò Ú ð ûô. !ò Ø3°qÑ8Ð3Ø6¸!Ò;Ø=BÐ:Ûð Ø)-×)AÑ)AÐBUÓ)VÑ&øÜ$ò Ø7¸1Ñ<Ð7Ø:¸aÒ?ØAFÐ>Ü Û ð úò 'ð üòn 4øô* %ò *Ø%)Nð*ús A X: Á*C Y' ÉZÊ,Z$Ï)[9Ó[>Ø:'Y$Ù#Y$Ù''ZÚZÚ Z!Ú Z!Ú$[6Ú>[Û[6Û[/Û%[6Û*[6Û.[/Û/[6Û5[6Û> \ Ü \ c ó$ ||z dz dz |dz z
|
S )NrA l üÿ rc )rr rÞ Úbases r r² zPE.dword_align s Ø$ Ñ" jÑ0°T¸JÑ5FÑGÐGr c óª | j j }| j j | j j z }||k r
|
||k r||z }|S r )r= Ú ImageBaser7 )rr ÚvaÚbegin_of_imageÚ end_of_images r Únormalize_import_vazPE.normalize_import_va sW ð ×-Ñ-×7Ñ7Ø×+Ñ+×5Ñ5¸×8LÑ8L×8XÑ8XÑX ð RÒ B¨ Ò$5Ø .Ñ BØ r c óP g }d} | j |t | j « j « « }| j |« }| j | j ||¬« }|r|j « r |S d}|j dk( râ| j j t d k( rÂ| j |j « |_ | j |j « |_ | j |j" « |_ | j |j$ « |_ | j |j$ « |_ | j |j( « |_ d}||j « z }t+ | j, « |z
|
} ||j" kD s||j kD r&t/ ||j" z
|
||j z
|
« } g }
|
| j1 |j" |j d| |« }
|
|d kD r-| j
|
j d
|
j3 |« « |S |
|
s|d z }B| j6 t8 kD r1| j
|
j d | j6 t8 fz « |S | j; |j( t< « } t? | « s tA d « } | ri|
|
D ]G } | jB tE jF | jI « | jJ « }|sA|| _! I |j tM ||
|
| ¬« « (# t $ r" | j
|
j d|z « Y |S w xY w# t $ r@} | j
|
j dj3 || j4 « « Y d} ~ d} ~ ww xY w)z*Walk and parse the delay import directory.r Tz5Error parsing the Delay import directory at RVA: 0x%xr Frà NzSError parsing the Delay import directory. Invalid import data at RVA: 0x{0:x} ({1})rE zWToo many errors parsing the Delay import directory. Invalid import data at RVA: 0x{0:x}r7 z)Error, too many imported symbols %d (>%s)ú *invalid*©rE ÚimportsÚdll)'r rè Ú(__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__r r r; r rT rV r ÚgrAttrsry rô rõ rÿ Ú pBoundIATÚpIATÚpINTÚ
|
pUnloadIATÚphmodÚszNamerD rE rq Ú parse_importsr r` rB ÚMAX_IMPORT_SYMBOLSrå ÚMAX_DLL_LENGTHrÊ rG rí Ú ordlookupÚ ordLookupÚlowerrÈ r )rr r rY Ú import_descsrM r. rî Ú import_descÚcontains_addressesÚmax_lenÚ import_datar r r% Úfuncnames r rè z PE.parse_delay_import_directory s ð Ø Øð ð }}ØÜ d× KÑ KÓL×SÑSÓUóð ×2Ñ2°3Ó7KØ ×.Ñ.Ø×=Ñ=ØØ 'ð /ó Kñ +×"8Ñ"8Ô":Øð^ Ðð] "'Ð ð ×#Ñ# qÒ(Ø×$Ñ$×,Ñ,´ Ð=VÑ0WÒWà(,×(@Ñ(@À×AVÑAVÓ(W Ô%Ø#'×#;Ñ#;¸K×<LÑ<LÓ#M Ô Ø#'×#;Ñ#;¸K×<LÑ<LÓ#M Ô Ø)-×)AÑ)AØ ×*Ñ*ó* Ô&ð %)×$<Ñ$<¸[×=SÑ=SÓ$T Ô!Ø%)×%=Ñ%=¸k×>PÑ>PÓ%Q Ô"Ø%)Ð"à ;×%Ñ%Ó'Ñ 'Cô
|
$--Ó(¨;Ñ6GØ[×%Ñ%Ò%¨¨{×/?Ñ/?Ò)?Ü c K×$4Ñ$4Ñ 4°c¸K×<LÑ<LÑ6LÓMà Kð Ø "× 0Ñ 0Ø ×$Ñ$Ø ×$Ñ$ØØØ&ó ð QØ×&Ñ&ð:ß:@¹&À»+ôð ð6 Ðñ3 ØqÑ Ùà×*Ñ*Ô-?Ò?Ø×&Ñ&Ø?Ø×2Ñ2Ô4FÐGñHôð ð Ðð ×(Ñ(¨×);Ñ);¼^ÓLCÜ(¨Ô-Ü náØ )ò 3FØ {{Ñ*Ü#,×#6Ñ#6°s·y±y³{ÀFÇNÁNÓ#SÚ#Ø*2FKð 3ð
|
×#Ñ#Ü"¨+¸{ÐPSÔTôñE øô !ò Ø×&Ñ&ØKÈsÑSôð ðt Ðð} ûôp !ò Ø×&Ñ&ð@ß@FÁÀsÈDÏJÉJÓ@W÷ò ûð ús) 3L. Ç#)M Ì.'MÍMÍ N%Í%5N Î N%c óÚ t | d« r | j y|dk( r-t | j j « j « S |dk( r-t | j j « j « S |dk( r-t | j j « j « S |dk( r-t | j j « j « S t d« )Nr¿ r r r r r z#Invalid hashing algorithm specified) rM r¿ r r§ ra r r r rh )rr Ú algorithms r Úget_rich_header_hashzPE.get_rich_header_hash sÆ Üt]Ô+¨t×/?Ñ/?Ð/GØà Ò Üt×'Ñ'×2Ñ2Ó3×=Ñ=Ó?Ð ?Ø &Ò Ü×(Ñ(×3Ñ3Ó4×>Ñ>Ó@Ð @Ø (Ò "Ü$×*Ñ*×5Ñ5Ó6×@Ñ@ÓBÐ BØ (Ò "Ü$×*Ñ*×5Ñ5Ó6×@Ñ@ÓBÐ BäÐ=Ó>Ð>r c ó g }g d¢}t | d« sy| j D ]p }t |j t « r)|j j « j « }n|j j « }|j dd« }t |« dkD r |d |v r|d }|j j « }|j D ]» }d}|j sJt j ||j d¬ « }|s2t d
|
|j d |j d « |j }|sjt |t « r|j « }|j |j « d|j « « ½ s t! d j# |« j% « « j' « S )a? Return the imphash of the PE file.
|
|
Creates a hash based on imported symbol names and their specific order within
|
the executable:
|
https://www.mandiant.com/resources/blog/tracking-malware-import-hashing
|
|
Returns:
|
the hexdigest of the MD5 hash of the exported symbols.
|
)ÚocxÚsysr ÚDIRECTORY_ENTRY_IMPORTr ú.r7 r NT)Ú make_namezUnable to look up ordinal r Ú04xrÖ )rM r rS r rU rH r ÚrsplitrD r rí r r rÈ r r r rÁ ri ra ) rr ÚimpstrsÚextsr> ÚlibnameÚpartsÚentry_dll_lowerÚimpr s r Ú get_imphashzPE.get_imphash s ð Ú$ÜtÐ 5Ô6ØØ×0Ñ0ó NEÜ%))¤UÔ+Ø ))×*Ñ*Ó,×2Ñ2Ó4à ))//Ó+ØNN 3¨Ó*Eä5zA~ %¨¡(¨dÑ"2Ø (à #iiooÓ /OØ }}ò NØ ØxxÜ (× 2Ñ 2Ø'¨¯©Àô Hñ $Ü +Ø 8¸¿¹¸ À1ÀSÇ[Á[ÐQTÐDUÐ Vó ð ð #xxHá Ø ä h¬Ô.Ø 'Ó 0Hب'¯-©-/¸8¿>¹>Ô;KÐ LÕMò% Nð Nô> 388GÓ$×+Ñ+Ó-Ó.×8Ñ8Ó:Ð:r c ó t | d« syt | j d« sy| j j D cg c]8 }|r4|j (|j j « j « : }}t |« dk( ryt dj |« j « « j « S c c}w )zÝReturn the exphash of the PE file.
|
|
Similar to imphash, but based on exported symbol names and their specific order.
|
|
Returns:
|
the hexdigest of the SHA256 hash of the exported symbols.
|
ÚDIRECTORY_ENTRY_EXPORTr rÛ r rÖ ) rM r, rÛ rí rH r rD r rÁ ri ra )rr r: Ú export_lists r Ú get_exphashzPE.get_exphashJ s¬ ô tÐ 5Ô6Øät×2Ñ2°IÔ>Øð ×0Ñ0×8Ñ8ö
|
àÙQVVÐ'ð FFMMO× !Ñ !Õ #ð
|
ð
|
ô
|
{Ó qÒ Øächh{Ó+×2Ñ2Ó4Ó5×?Ñ?ÓAÐAùò
|
s ½=Cc ót g }d}t | j « j « } | j ||« }| j |« }| j | j ||¬« } | r| j « rnx|| j « z }t | j « |z
|
}
|
|| j kD s|| j kD r&t || j z
|
|| j z
|
« }
|
g } |sb | j | j | j | j |
|
¬« } |d
|
kD r | j
|
j d |d« n¬| s|d z },| j% | j& t( « } t+ | « s t- d « } | ri| D ]G }|j. t1 j2 | j5 « |j6 « }|sA||_ I |j t9 | | | ¬« « Î|sÍt; ddg« }d}d}|D ] }|j< D ]x }|D ]l }|r |j. s|j. }t? |j. « t@ k( r|j. jC d« }|jE |« sg|d z } n |d z }z |t |« k( r |dk r| j
|
j d« |S # t $ r" | j
|
j d|d« Y ûw xY w# t $ r8} | j
|
j d|dd| j" d« Y d } ~ d } ~ ww xY w)z$Walk and parse the import directory.r z-Error parsing the import directory at RVA: 0xrj r r zBError parsing the import directory. Invalid Import data at RVA: 0xz (ú)NrE zLToo many errors parsing the import directory. Invalid import data at RVA: 0xr7 r r Ú LoadLibraryÚGetProcAddressr r³ z?Imported symbols contain entries typical of packed executables.)#rè Ú"__IMAGE_IMPORT_DESCRIPTOR_format__r r r r; r rT rV r rD rE ÚOriginalFirstThunkÚ
|
FirstThunkrq r ÚForwarderChainr` rå rÖ r rÊ rG rí r r r rÈ r rÉ r rù rU rH rV )rr r rY rà r rM Ú image_import_descriptor_sizer. rî r r r r: r r% r Úsuspicious_importsÚsuspicious_imports_countÚ total_symbolsÚimp_dllÚsuspicious_symbolrí s r rá zPE.parse_import_directoryc so ð Ø Ü'0Ø × 3Ñ 3ó(
|
ç
|
&(ð %ð ð ð }} SÐ*FÓGð ×2Ñ2°3Ó7KØ ×.Ñ.Ø×7Ñ7¸È;ð /ó Kñ
|
+×"8Ñ"8Ô":Ùà ;×%Ñ%Ó'Ñ 'Cô
|
$--Ó(¨;Ñ6GØ[×3Ñ3Ò3°s¸[×=SÑ=SÒ7SÜ Ø+×8Ñ8Ñ8¸#À ×@VÑ@VÑ:Vóð KÙ ð Ø"&×"4Ñ"4Ø#×6Ñ6Ø#×.Ñ.Ø#×2Ñ2Ø#*ð #5ó #Kð ?ØOO×*Ñ*ð9Ø9<¸Q¸ðAôð á"Ø 1Ñ$Ká à×(Ñ(¨×)9Ñ)9¼>ÓJCÜ(¨Ô-Ü náØ )ò 3FØ {{Ñ*Ü#,×#6Ñ#6°s·y±y³{ÀFÇNÁNÓ#SÚ#Ø*2FKð 3ð
|
×#Ñ#Ü"¨+¸{ÐPSÔTôñI ñP Ü!$ mÐ5EÐ%FÓ!GÐ Ø'(Ð $Ø MØ'ò 'Ø %ooò
|
'FØ-?ò "Ð)Ù %¨V¯[ª[Ø $Ø %{{Ü § ¡ Ó,´Ò5Ø#)§;¡;×#5Ñ#5°gÓ#>DØ ??Ð+<Õ=Ø 4¸Ñ 9Ð 4Ù !ð"ð " QÑ&Mñ
|
'ð 'ð )¬CÐ0BÓ,CÒCØ! BÒ&à×&Ñ&ØUôð Ðøôw !ò Ø×&Ñ&ØCÀCÈÀ7ÐKôñ ð ûôF %ò ØOO×*Ñ*ð9Ø9<¸Q¸¸rÀ!Ç'Á'ÀÈ!ðM÷ò ûðús) ªK Ã33K6 Ë(K3Ë2K3Ë6 L7Ë?-L2Ì2L7c óf g }| j |||« }| j |||« }|rt |« dk( r5|rt |« dk( r%| j j d|dd|d« g S d} |r|} n|r|} nyd}
|
d} | j t
|
k( rt } n$| j t k( r t } d}
|
d } nt } d} t | « D ]Â \ }}d}d}d}d}d}d
|
}|j rÓ|j | z rd }|j d z }d}d}nd
|
} |j | z }| j |d « }| j |d« }| j |j d z t « }t |« s t! d« }| j# |j d z « }|j' « }| j) |« }|| j* j, z ||
|
z z }d} |r6|r4|| j || j k7 r|| j }|| }nd}| | t% d« |t! d« k( r | dkD r| |k( r t% d« | dz } |s|s|j t1 | |||||j' « ||||||¬« « Å |S # t$ $ r Y w xY w# t. $ r d}Y w xY w)zíParse the imported symbols.
|
|
It will fill a list, which will be available as the dictionary
|
attribute "imports". Its keys will be the DLL names and the values
|
of all the symbols imported from that object.
|
r z\Damaged Import Table information. ILT and/or IAT appear to be broken. OriginalFirstThunk: 0xrj z FirstThunk: 0xNrC r` rK l ÿÿÿÿ FTrÊ r? r z"Invalid entries, aborting parsing.iè z)Too many invalid names, aborting parsing.r7 )r rÒ r× Úimport_by_ordinalrÈ rÚ Úhintrí rØ rÉ rË Úhint_name_table_rvaÚ thunk_offsetÚ thunk_rva)Úget_import_tablerD r; r rÍ rÎ rÏ rÐ rÑ r rÔ r r» rå ÚMAX_IMPORT_NAME_LENGTHrÐ rG rT r rû rQ r= rû rë rÆ ) rr Úoriginal_first_thunkÚ first_thunkÚforwarder_chainr r Úimported_symbolsÚiltÚiatÚtableÚ
|
imp_offsetÚ address_maskrÜ Ú num_invalidr Ú tbl_entryÚimp_ordÚimp_hintÚimp_namerØ r@ r> r. rA rB Ú imp_addressr× Ú imp_bounds r r zPE.parse_importsÍ sL ð Ðð ×#Ñ#Ø *Ð.@ó
|
ð ×#Ñ# K°Ð=OÓPñ s3x 1}©s´c¸#³hÀ!²mØ OO× "Ñ "ð)à)=¸aÐ(@ð A!Ø!,¨Q ð1ô ð IàÙ ØEÙ ØEàà
|
Ø! Ø <<Ô3Ò 3Ü-LØ \\Ô :Ò :Ü/LØJØ-Lô
|
.Là Ü '¨Ó .ó ^ NCØGØHØHØ KØ"&Ð Ø %Ð à×&Ò&ð ×*Ñ*¨\Ò9Ø(,Ð%Ø '× 5Ñ 5¸Ñ >GØ #HØ"&Kà(-Ð%ð Ø.7×.EÑ.EÈ Ñ.TÐ+Ø #}}Ð-@À!Ó Dà#'×#:Ñ#:¸4ÀÓ#CØ#'×#9Ñ#9Ø %× 3Ñ 3°aÑ 7Ô9Oó$ô 6°hÔ ?Ü'(¨£~Hà&*×&>Ñ&>Ø %× 3Ñ 3°aÑ 7ó' ð )× 8Ñ 8Ó : Ø × 4Ñ 4°\Ó B ð d× 2Ñ 2× <Ñ <Ñ<¸sÀZÑ?OÑOð ð Jð !Ù3 3 s¡8×#9Ñ#9¸SÀ¹X×=SÑ=SÒ#SØ # C¡× 6Ñ 6IØ!$ S¡Jà $Ið 8Ð#3Ü#Ð$HÓIÐIð
|
1[>Ò)Ø Ò%¨+¸Ò*<Ü'Ð(SÓTÐTØqÑ Ùá(Ø ×'Ñ'Ü Ø Ø%.Ø#-Ø*;Ø 'Ø'0×'@Ñ'@Ó'BØ %Ø %Ø$/Ø 'Ø +Ø,?Ø%1Ø"+ô öð[^ ð@ Ð øôA )ò Ú ð ûô$ ò !Ø ð !ús% ÄB
|
JÇ :J"Ê J Ê J Ê" J0Ê/J0c ó* g }| j t k( rt }| j }n8| j t k( rt
|
}| j }nt }| j }t |« j « }d}d} d}
|
d} t « } t « } |}|rf|&|||z k\ r | j j d« |S | j t kD r1| j j d| j t fz « |S | xj dz c_ | |
|
k\ rg S | j « |kD rg S | j « |kD rg S d} | j ||« }|st# « |k7 r | j j d
|
|z « y | j% ||| j' |« ¬ « }|r| j) |j* « |_ | j) |j, « |_ | j) |j. « |_ | j) |j0 « |_ |r?|j* |k\ r0|j* |k r!| j j d |z « |S |rK|j* r?|j* }||z r
|
|d z dkD r&g S || k\ r| }n| }||v r| dz } |j3 |« |r|j5 « r |S ||j « z }|j |« |rf|S # t $ r d }Y ¯w xY w)Nr ì rY r z9Error parsing the import table. Entries go beyond bounds.z$Excessive number of imports %d (>%s)r7 FTz9Error parsing the import table. Invalid data at RVA: 0x%xr z\Error parsing the import table. AddressOfData overlaps with THUNK_DATA for THUNK at RVA 0x%xr` rÊ )rÍ rÎ rÏ Ú__IMAGE_THUNK_DATA_format__rÐ rÑ Ú __IMAGE_THUNK_DATA64_format__rè r rl r; r rB r rx r r rD rV rT rÿ rÔ rÖ rÕ rÓ ru r )rr r r r rK rÜ r Ú expected_sizeÚMAX_ADDRESS_SPREADÚADDR_4GBÚMAX_REPEATED_ADDRESSESÚrepeated_addressÚaddresses_of_data_set_64Úaddresses_of_data_set_32Ú start_rvaÚfailedr. Ú
|
thunk_dataÚ addr_of_dataÚthe_sets r rC zPE.get_import_tablel s] àð
|
<<Ô3Ò 3Ü-LØ×5Ñ5FØ \\Ô :Ò :Ü/LØ×7Ñ7Fô
|
.LØ×5Ñ5Fä! &Ó)×0Ñ0Ó2 Ø (ÐØØ!#Ð Ø ÐÜ#-£<Ð Ü#-£<Ð Ø ÚØÐ%¨#°¸ZÑ1GÒ*GØ×&Ñ&ØOôð ðB ð ×*Ñ*Ô-?Ò?Ø×&Ñ&Ø:Ø×2Ñ2Ô4FÐGñHôð ðt ðq × 'Ò '¨1Ñ ,Õ 'ð Ð#9Ò9Ø ð
|
(×,Ñ,Ó.Ð1CÒCØ Ø'×,Ñ,Ó.Ð1CÒCØ àFð Ø}} S¨-Ó8ñ T mÒ3Ø×&Ñ&ØRÐUXÑXôð à ×-Ñ-ب$×*BÑ*BÀ3Ó*Gð .ó Jñ
|
"Ø+/×+CÑ+CØ ×,Ñ,ó,
|
Ô(ð .2×-EÑ-EØ ×.Ñ.ó.
|
Ô*ð '+×&>Ñ&>¸z×?RÑ?RÓ&S
|
Ô#Ø%)×%=Ñ%=¸j×>PÑ>PÓ%Q
|
Ô"ñ Ø ×,Ñ,° Ò9Ø ×,Ñ,°Ò3à×&Ñ&ð(à+.ñ0ôð
|
ð> ñ; j× 6Ò 6Ø )× 7Ñ 7 à ,Ò.ð $ jÑ0°6Ò9Ø ! ð $ xÒ/Ø":à":à# wÑ.Ø(¨AÑ-Ð(ØKK Ô-á ×!6Ñ!6Ô!8Øð ð :×$Ñ$Ó&Ñ &Cà LLÔ $óI ðL øôM !ò Ø ð ús ÅL Ì LÌLc óî | | j }| j |« | j dd }| j D ]- }|j dk( r|j dk( r#|j }| j |j | j j « }| j |j | j j | j j « }|t | j « kD s8|t | j « kD s ||z t | j « kD s||k\ rõ|t |« z
|
} | dkD r |d| z z }n
|
| dk r|d| }||j « z }0 || _ |S )a´ Returns the data corresponding to the memory layout of the PE file.
|
|
The data includes the PE header and the sections loaded at offsets
|
corresponding to their relative virtual addresses. (the VirtualAddress
|
section header member).
|
Any offset in this data corresponds to the absolute memory address
|
ImageBase+offset.
|
|
The optional argument 'max_virtual_address' provides with means of limiting
|
which sections are processed.
|
Any section with their VirtualAddress beyond this value will be skipped.
|
Normally, sections with values beyond this range are just there to confuse
|
tools. It's a common trick to see in packed executables.
|
|
If the 'ImageBase' optional argument is supplied, the file's relocations
|
will be applied to the image by calling the 'relocate_image()' method. Beware
|
that the relocation information is applied permanently.
|
Nr r )rE Úrelocate_imager: r4 r3 r< r1 r= r> rA r2 rB rD r )
|
rr Úmax_virtual_addressrû Ú original_dataÚ mapped_datarÛ ÚsrdÚprdr6 r s
|
r Úget_memory_mapped_imagezPE.get_memory_mapped_imageð s{ ð, Ð ð !MMMà × Ñ Ô *ð mm¡AÐ& Ø}}ó .Gð ×'Ñ'¨1Ò,°×1FÑ1FÈ!Ò1KØà×'Ñ'CØ×+Ñ+Ø×(Ñ(¨$×*>Ñ*>×*LÑ*LóCð "&×!=Ñ!=Ø×&Ñ&Ø×$Ñ$×5Ñ5Ø×$Ñ$×2Ñ2ó"Ð ð c$--Ó(Ò(ØT]]Ó+Ò+Ø9s 4§=¡=Ó 1Ò1Ø%Ð)<Ò<àà /´#°kÓ2BÑ BNà Ò!Øu ~Ñ 5Ñ5 Ø !Ò#Ø )¨/¨>Ð : à 7×+Ñ+Ó-Ñ -KðA .ðH Ð Ø )DMàÐr c ó¤ g }t | d« rÁ| j j D ]¨ }t |d« s|j j D ] }t |d« st |j d« s'|j j s>t |j j j « « D ] }|j |« ª |S )a Returns a list of all the strings found withing the resources (if any).
|
|
This method will scan all entries in the resources directory of the PE, if
|
there is one, and will return a [] with the strings.
|
|
An empty list will be returned otherwise.
|
ÚDIRECTORY_ENTRY_RESOURCErs r )rM rn rà rs r rª rk r )rr Úresources_stringsÚres_typer Ú
|
res_strings r Úget_resources_stringszPE.get_resources_strings9 sÈ ð Ðä 4Ð3Ô 4à × 9Ñ 9× AÑ Aò IÜ8 [Õ1Ø'/×'9Ñ'9×'AÑ'Aò I Ü" ;° Õ<ä '¨ ×(=Ñ(=¸yÕ IØ$/×$9Ñ$9×$AÓ$Aä26Ø$/×$9Ñ$9×$AÑ$A×$HÑ$HÓ$Jó3"ò !I Jð %6×$<Ñ$<¸ZÕ$Hñ!Iñ Ið Ið !Ð r c ó | j |« }|r||z }nd}|sY|t | j « k r| j || S |t | j « k r| j || S t d« |j ||« S )zÌGet data regardless of the section where it lies on.
|
|
Given a RVA and the size of the chunk to retrieve, this method
|
will find the section where the data lies and return the data.
|
Nz-data at RVA can't be fetched. Corrupt header?)r rD r rE r r )rr r r rÍ rH s r r z PE.get_dataU s ð × #Ñ # CÓ (á Ø,CàCáØSÓ%Ò%Ø{{ 3 sÐ+Ð+ð S Ó'Ò'Ø}} S¨Ð-Ð-ä Ð OÓPÐ Pàzz#vÓ&Ð&r c
|
óL | j |« }|s|| j rnt | j D cg c]G }| j |j | j
|
j | j
|
j « I c}« }||k r|S y|S |j |« S c c}w )z.Get the RVA corresponding to this file offset.N) r r: rp rA r2 r= rB r> rQ )rr rÞ rÍ Ú
|
lowest_rvas r rQ zPE.get_rva_from_offsetw s§ ð × &Ñ & vÓ .ÙØ}}Ü ð "&§ ¡ ö ð ð ×4Ñ4Ø × ,Ñ ,Ø × 0Ñ 0× AÑ AØ × 0Ñ 0× >Ñ >õòó
|
ð JÒ&ð "MØà Ø×$Ñ$ VÓ,Ð,ùò-s ³A B!c ó | j |« }|s*|t | j « k r|S t d|dd« |j |« S )z³Get the file offset corresponding to this RVA.
|
|
Given a RVA , this method will find the section where the
|
data lies and return the offset within the file.
|
zdata at RVA 0xrj z can't be fetched)r rD rE r rT )rr r rÍ s r rT zPE.get_offset_from_rva sW ð × #Ñ # CÓ (Ùð S Ó'Ò'Ø
|
ä .°°Q°Ð7HÐ IÓJÐ Jà×$Ñ$ SÓ)Ð)r c ó¸ |y| j |« }|s"| j d| j |||z « S | j d|j ||¬« « S )z1Get an ASCII string located at the given address.Nr )r )r r rE r )rr r r rÍ s r rå zPE.get_string_at_rva« sb ð ;Øà × #Ñ # CÓ (ÙØ×,Ñ,¨Q°· ± ¸cÀCÈ*ÑDTÐ0UÓVÐ VØ×(Ñ(¨¨A¯J©J°sÀ:¨JÓ,NÓOÐOr c ód |t |« kD ry||d }t |t « r t |« S |S )r r N)rD rS rg rU )rr rÞ r. rÌ s r Úget_bytes_from_datazPE.get_bytes_from_data¶ s4 à CIÒ ØØ MÜ aÔ #Ü8OØr c ó` | j ||« }|j d« }|dk\ r|d| }|S )z Get an ASCII string from data.r r N)ry r© )rr rÞ r. rÍ rH s r r zPE.get_string_from_data¿ s8 à × $Ñ $ V¨TÓ 2ØffUmØ !8Ø$3AØr c ób |dk( ry| j |d« }|dz }t |d« }| j ||« }d} |j d|dz « }|dk( rGt |« }||k s||k( rt |« dz }n2|| j ||z ||z
|
« z }|dz
|
}|}n|dz dk( r|dz }npt j
|
dj |« |d |dz « }d
|
j t t |« « } |rt | j |d « « S t | j d d « « S ) z3Get an Unicode string located at the given address.r r r? r7 re r¢ rK z<{:d}HNr r
|
r ) r rp r© rD rE rF r rÁ Úmapr# rG ri )
|
rr r r r¬ r. Ú requestedÚ
|
null_indexÚ data_lengthÚuchrsrÍ s
|
r r zPE.get_string_u_at_rvaÇ sM ð ?Øð }}S !Ó$ð qÑ
|
ä
|
CÓ( Ø}}S )Ó,à
|
ØØ ;°
|
¸Q±Ó?JØRÒ Ü ! $i Ø Ò*¨k¸ZÒ.GÜ!$ T£¨a¡ JØð c¨KÑ&7¸ÀkÑ9QÓRÑRØ &¨]
|
Ø & àa 1Ò$ØqÑ
|
Øð ô$ hoo¨jÓ 9¸4Ð@PÀ*ÈqÁ.Ð;QÓRØ GGCUOÓ $á ÜQXXhÐ(;Ó<Ó=Ð =ä'Ð#6Ó7Ó8Ð8r c óP | j D ] }|j |« s|c S y)z1Get the section containing the given file offset.N)r: rV )rr rÞ rÛ s r r zPE.get_section_by_offsetò s/ ð }}ò GØ×&Ñ& vÕ.Ø ð ð r c óÄ | j '| j j |« r | j S | j D ] }|j |« s|| _ |c S y)z-Get the section containing the given address.N)r9 rZ r: )rr r rÛ s r r zPE.get_section_by_rvaû sc ð
|
× -Ñ -Ð 9Ø×1Ñ1×>Ñ>¸sÔCØ×9Ñ9Ð9à}}ò GØ×#Ñ# CÕ(Ø5<Ô2Ø ð ð
|
r c ó" | j « S r )Ú dump_inforw s r r z
|
PE.__str__ s Ø~~Ó Ð r c ó t | d« S )z.Checks if the PE file has relocation directoryÚDIRECTORY_ENTRY_BASERELOC)rM rw s r Ú
|
has_relocsz PE.has_relocs s ätÐ 8Ó9Ð9r c óJ t | d« r| j j ryy)NÚDIRECTORY_ENTRY_LOAD_CONFIGTF)rM r r rw s r Úhas_dynamic_relocszPE.has_dynamic_relocs s" Ü 4Ð6Ô 7Ø×/Ñ/×CÒCØàr c ó: t | j |¬« « y)z=Print all the PE header information in a human readable from.r« N)r· r )rr r¬ s r Ú
|
print_infoz PE.print_info s ä dnn hnÓ/Õ0r c ó- |
|
t « }| j « }|r9|j d« |D ]# }|j |« |j « % |j d« |j | j j « « |j « |j d« |j | j j « « |j « |j d« |j | j j « « t t d« }|j d« g }t |« D ]0 }t | j |d « s |j |d « 2 |j d j! |« « |j « t# | d
|
« rF| j$ :|j d
|
« |j | j$ j « « t t& d « }|j d « g }t |« D ]0 }t | j$ |d « s |j |d « 2 |j d j! |« « |j « |j d « t t( d« } | j* D ]s }
|
|j |
|
j « « |j d« g }t | « D ]& }t |
|
|d « s|j |d « ( |j d j! |« « |j dj- |
|
j/ « « « t0 .|j dj- |
|
j3 « « « t4 "|j d|
|
j7 « z « t8 "|j d|
|
j; « z « t< "|j d|
|
j? « z « |j « v t# | d
|
« rtt# | j$ d« r^|j d« | j$ j@ D ]$ } | |j | j « « & |j « t# | d« rKtC | jD « D ]2 \ } } tG | jD « dkD r|j d| dz « n|j d« | |j | j « « |j « t# | d« r<|j | jH | j « « |j « t# | d« sÎtG | jJ « | kD sç| jJ | D ]9 }|j |j « « |j « t# |d « r|jL D ]ô }|j « D cg c] }|j d |z « c} |j d j- |jN jQ |d « « « |j « t tS |jT jW « « « D ]I }|j d j- |d jQ |d « |d jQ |d « « « K ö |j « Ut# |d!« sc|jX D ]¸ }t# |d"« s|j « D cg c] }|j d |z « c} |j d j- tS |jZ j] « « d jQ d#d « tS |jZ j_ « « d « « º |j « < 5 t# | d$« rT|j d%« |j | j` jb j « « |j « |j d&d'z « | j` jd D ]Ã }|jf ti d(« }|jj r |jj }|j d)|jl |jf |jQ |« fz « |jn r;|j d*j- |jn jQ |d « « « ´|j « Å |j « t# | d+« rU|j d,« | jp D ]4 }|j |jb j « « |jr sc|j d-j- | ju |jb jv « jQ |d « « « |j « |j « |jr D ]i }|jx d.u r°|jj _|j d/j- |jz jQ d#« |jj jQ d#« |jl « « n¥|j d0j- |jz jQ d#« |jl « « n`|j d1j- |jz jQ |d « |jj jQ |d « |j| « « |j~ r,|j d2j- |j~ « « Z|j « l |j « 7 t# | d3« r|j d4« | j D ]û }|j |jb j « « |j d5j- |jj jQ |d « « « |j « |jT D ]w }|j |jb j « d6« |j d5j- |jj jQ |d « « d6« |j « y ý t# | d7« ry|j d8« | j D ]X }|j |jb j « « |j « |jr D ]ý }|jx d.u rF|j d9j- |jz jQ |d « |jl « « n`|j d:j- |jz jQ |d « |jj jQ |d « |j| « « |j~ r+|j d2j- |j~ « « î|j « ÿ |j « [ t# | d;« rY|j d<« |j | j jb j « « | j jT D ]ë }|jj 3|jj jQ |d « }|j d=| d>d?« nXt j |jb j d@« }|j dA|jb j dBdC| dDd?« |j |jb j « d?« t# |dE« r
|
|j |j jb j « d6« |j jT D ]¼ }|jj 3|jj jQ d#d « }|j d=| d>dF« n+|j dA|jb j dBd>dF« |j |jb j « dF« t# |dE« s¥|j |j jb j « dG« |j jT D ] } t# | dH« s|j dI| j j | j j t j | j j dJ« t | j j | j j « fz dG« |j | jb j « dK« |j | j jb j « dL« t# |j dM« s|j j s,|j dNdK« tS t |j j jW « « « D ]F \ } } |j dOj- | | j dPdQ« jQ dR« « dL« H ¿ |j « î |j « t# | dS« rv| j rj| j jb rT|j dT« |j | j jb j « « |j « t# | dU« rv| j rj| j jb rT|j dV« |j | j jb j « « |j « t# | dW« rÒ|j dX« | j D ]² } |j | jb j « « |j dYt¢ | jb j¤ z « |j « | jZ sy|j | jZ j « d6« |j « ´ | j© « r¢|j d[« | jª D ] } |j | jb j « « | jT D ]8 } |j d\| j¬ t® | j° d]d fz d6« : |j « t# | d_« r§tG | j² « dkD r|j d`« | j² D ]o }!|j |!jb j « « t# |!da« s9|!j´ F|j |!j´ j « d6« q |j· « S c c}w c c}w # t¦ $ r8 |j dZj- | jb j¤ « « Y w xY w# t¦ $ r/ |j d^| j¬ | j° fz d6« Y w xY w)bz>Dump all the PE header information into human readable string.NúParsing Warningsrl rr ry r^ r. r r/ r= r_ zDllCharacteristics: ú PE SectionsrK z!Entropy: {0:f} (Min=0.0, Max=8.0)zMD5 hash: {0}zSHA-1 hash: %szSHA-256 hash: %szSHA-512 hash: %sr Ú Directoriesr r7 zVersion Information úVersion Informationr r r z z LangID: {0}r
|
z {0}: {1}r r> r r, úExported symbolsz%-10s %-10s %s©rÓ ÚRVArÖ ÚNonez%-10d 0x%08X %sz forwarder: {0}r úImported symbolsz Name -> {0}Tz*{0}.{1} Ordinal[{2}] (Imported by Ordinal)z&{0} Ordinal[{1}] (Imported by Ordinal)z{0}.{1} Hint[{2:d}]z Bound: 0x{0:08X}Ú DIRECTORY_ENTRY_BOUND_IMPORTú Bound importszDLL: {0}rC Ú DIRECTORY_ENTRY_DELAY_IMPORTúDelay Imported symbolsz({0} Ordinal[{1:d}] (Imported by Ordinal)z{0}.{1} Hint[{2}]rn úResource directoryzName: [ú]r? rM zId: [0xrN z] (r0 rs rG rK r. z\--- LANG [%d,%d][%s,%s]r9 rO rS r z [STRINGS]z {0:6d}: {1}úunicode-escaper rª ÚDIRECTORY_ENTRY_TLSÚTLSr Ú LOAD_CONFIGÚDIRECTORY_ENTRY_DEBUGúDebug informationzType: zType: 0x{0:x}(Unknown)úBase relocationsz%08Xh %sr4 z0x%08X 0x%x(Unknown)ÚDIRECTORY_ENTRY_EXCEPTIONz"Unwind data for exception handlingró )\rª r r¹ r® r» r² rl r rr ry rZ rz ru Úsortedr
|
r rÁ rM r= r rL r: r r_ r ri r rb r rd r rg r r r rD r r r r· rH rª rà r¿ r r> rR rk r, rE rÛ rË rG rí rÈ rä r r rå rÖ r> r r? rÉ r r rn r r; r
rs r. ru rv r: rA r ri r r r¡ Ú
|
DEBUG_TYPErS r r r r ÚRELOCATION_TYPErù r¤ ró r )"rr r r¬ Úwarningsr¸ r r_ rY r rN rÛ rs r Ú vinfo_entryr> rË r± Ú str_entryÚ var_entryÚexportrí Úmoduler% Úbound_imp_descÚ bound_imp_refrp Ú res_type_idr r rq re Ú
|
base_relocÚrelocrù s" r r z PE.dump_info s ð <Ü6Dà×$Ñ$Ó&Ù Ø OOÐ .Ô /Ø#ò #Ø gÔ&Ø× Ñ Õ"ð #ð Ô%Ø t×+Ñ+Ó-Ô.Ø ×ÑÔà Ô%Ø t×+Ñ+Ó-Ô.Ø ×ÑÔà Ô&Ø t×'Ñ'×,Ñ,Ó.Ô/ä$Ô%:¸MÓJ à ÔØÜ;Ó'ò &DÜt×'Ñ'¨¨a©Õ1Ø T !WÕ%ð &ð dii Ó&Ô'Ø ×ÑÔä 4Ð*Ô +°×0DÑ0DÐ0PØ OOÐ -Ô .Ø NN4×/Ñ/×4Ñ4Ó6Ô 7ä$2Ü Ð!<ó%
|
Ð!ð Ð'Ô(ØÜÐ4Ó5ò &DÜt×+Ñ+¨T°!©WÕ5Ø T !WÕ%ð &ð dii Ó&Ô'Ø ×ÑÔà Ô&ä&Ô'>À ÓM à}}ó GØ NN7<<>Ô *Ø HHYÔ ØEÜ }Ó-ò *Ü7 D¨¡GÕ,ØLL a¡Õ)ð *ð MM$)) EÓ*Ô +Ø MMØ3×:Ñ:¸7×;NÑ;NÓ;PÓQô ô Ø Ð 1× 8Ñ 8¸×9MÑ9MÓ9OÓ PÔQÜÐ Ø Ð 0°7×3HÑ3HÓ3JÑ JÔKÜÐ!Ø Ð 0°7×3JÑ3JÓ3LÑ LÔMÜÐ!Ø Ð 0°7×3JÑ3JÓ3LÑ LÔMØ × Ñ Ö ð' ô* 4Ð*Ô +´Ø × Ñ Ð"2ô1
|
ð OOMÔ *Ø !× 1Ñ 1× @Ñ @ò 5 Ø Ñ(ØNN 9§>¡>Ó#3Õ4ð 5ð × Ñ Ô ä 4Ð)Õ *Ü$-¨d×.AÑ.AÓ$Bó < /Ñ [Üt×*Ñ*Ó+¨aÒ/ØOOÐ&:¸3À¹7¸)Ð$DÕEàOOÐ$9Ô:Ø Ð*ØNN ;×#3Ñ#3Ó#5Ô6Ø× Ñ Ô"ä4Ð!3Ô4ØNN 4×#8Ñ#8¸Ñ#=×#BÑ#BÓ#DÔEØ×$Ñ$Ô&ä4 Õ,´°T·]±]Ó1CÀcÓ1IØ!%§ ¡ ¨sÑ!3ó ./Ø u§z¡z£|Ô4Ø ×(Ñ(Ô*ä" 5¨-Õ8Ø,1×,=Ñ,=ò & ØHPÏ É ËÖ XÀ § ¡ ¨t°d©{Õ!;Ó XØ $§ ¡ Ø$3×$:Ñ$:Ø(0¯©×(>Ñ(>Ø,4Ð6Ió)*ó%&ô!"ð !%× 0Ñ 0Ô 2Ü17¼¸X×=MÑ=M×=SÑ=SÓ=UÓ8VÓ1Wò !& Ià$(§M¡MØ(6×(=Ñ(=Ø,5°a©L×,?Ñ,?Ø08Ð:Mó-.ð -6°a©L×,?Ñ,?Ø08Ð:Mó-.ó )*õ %&ñ !&ð &ð. !× ,Ñ ,Ö .ä $ U¨EÖ 2Ø-2¯Y©Yò & Ü#*¨9°gÕ#>ð 5>·N±NÓ4Dö%&à,0ð )-¯ © °d¸T±kÕ(Bó%&ð %)§M¡MØ(6×(=Ñ(=Ü,0°· ± ×1EÑ1EÓ1GÓ,HÈÑ,K×,RÑ,RØ07Ð9Ló-.ô -1°· ± ×1GÑ1GÓ1IÓ,JÈ1Ñ,Mó )*õ%&ð &ð !× ,Ñ ,Ö .ò]./ð < /ô| 4Ð1Õ 2Ø OOÐ .Ô /Ø NN4×6Ñ6×=Ñ=×BÑBÓDÔ EØ × Ñ Ô Ø MMÐ-Ð0JÑJÔ KØ ×5Ñ5×=Ñ=ò +Ø>>Ñ-Ü V9DØ {{Ø %{{ØHHØ,Ø!>>¨6¯>©>¸4¿;¹;ÀxÓ;PÐQñRôð ×'Ò'Ø Ø -× 4Ñ 4Ø &× 0Ñ 0× 7Ñ 7¸ÐBUÓ Vó õð ×(Ñ(Õ*ð! +ð$ × Ñ Ô ä 4Ð1Õ 2Ø OOÐ .Ô /Ø ×5Ñ5ó * #Øv}}× 1Ñ 1Ó 3Ô4à ~~ØHHØ'×.Ñ.Ø × 2Ñ 2°6·=±=×3EÑ3EÓ F× MÑ MØ (Ð*=ó óôð ×$Ñ$Ô&Ø× Ñ Ô"Ø $nnó +FØ ×/Ñ/°4Ñ7Ø!;;Ð2Ø HHØ L× SÑ SØ$*§J¡J×$5Ñ$5°gÓ$>Ø$*§K¡K×$6Ñ$6°wÓ$?Ø$*§N¡Nó!"õ ð !HHØ H× OÑ OØ$*§J¡J×$5Ñ$5°gÓ$>ÀÇÁó!"õ ð Ø 1× 8Ñ 8Ø &§
|
¡
|
× 1Ñ 1°(Ð<OÓ PØ &§ ¡ × 2Ñ 2°8Ð=PÓ QØ &§ ¡ ó ôð ||Ø Ð&9×&@Ñ&@ÀÇ Á Ó&NÖOà ×(Ñ(Ö*ð9 +ð: × Ñ Ö"ðU* #ôX 4Ð7Õ 8Ø OOOÔ ,Ø"&×"CÑ"Cò 'à~× 4Ñ 4× 9Ñ 9Ó ;Ô<Ø Ø ×%Ñ%Ø&×+Ñ+×2Ñ2°8Ð=PÓQóôð
|
× Ñ Ô"à%3×%;Ñ%;ò 'MØNN =×#7Ñ#7×#<Ñ#<Ó#>ÀÔBØMMØ"×)Ñ)Ø )× .Ñ .× 5Ñ 5°hÐ@SÓ Tóð ô ð ×$Ñ$Õ&ñ'ð 'ô( 4Ð7Õ 8Ø OOÐ 4Ô 5Ø ×;Ñ;ó #àv}}× 1Ñ 1Ó 3Ô4Ø× Ñ Ô"à $nnò +FØ ×/Ñ/°4Ñ7Ø Ø F× MÑ MØ &§
|
¡
|
× 1Ñ 1°(Ð<OÓ PØ &§¡ó õð Ø /× 6Ñ 6Ø &§
|
¡
|
× 1Ñ 1°(Ð<OÓ PØ &§ ¡ × 2Ñ 2°8Ð=PÓ QØ &§ ¡ ó ôð ||Ø Ð&9×&@Ñ&@ÀÇ Á Ó&NÕOà ×(Ñ(Õ*ð)+ð* × Ñ Ö"ð5 #ô8 4Ð3Õ 4Ø OOÐ 0Ô 1à NN4×8Ñ8×?Ñ?×DÑDÓFÔ Gà × 9Ñ 9× AÑ Aó J #à==Ð,Ø#==×/Ñ/°Ð:MÓNDØMMØ! $ qÐ)Øõô
|
#0×"3Ñ"3°H·O±O×4FÑ4FÈÓ"LKØMMØ! (§/¡/×"4Ñ"4°QÐ!7°s¸;¸-ÀqÐIØôð
|
x× 3Ñ 3Ó 5°qÔ9ä8 [Õ1àNN 8×#5Ñ#5×#<Ñ#<×#AÑ#AÓ#CÀQÔGà'/×'9Ñ'9×'AÑ'Aó 3& à&×+Ñ+Ð7Ø#.×#3Ñ#3×#:Ñ#:¸7ÐDWÓ#XDØ MMØ")¨$¨¨qÐ 1Ø !õ ð
|
!MM¨G°K×4FÑ4F×4IÑ4IÈ!Ð3LÈAÐ*NÐPQÔ Rà {×'9Ñ'9×'>Ñ'>Ó'@À!ÔDä" ;° Õ<Ø NN¨;×+@Ñ+@×+GÑ+G×+LÑ+LÓ+NÐPQÔ Rà1<×1FÑ1F×1NÑ1Nó Y Ü#*¨=¸&Õ#AØ$(§M¡MØ(Cà,9×,>Ñ,>×,CÑ,CØ,9×,>Ñ,>×,FÑ,FÜ,0¯H©HØ0=×0BÑ0B×0GÑ0GÈó-.ô -FØ0=×0BÑ0B×0GÑ0GØ0=×0BÑ0B×0JÑ0Jó-.ð
|
+*ñ )*ð )*ô%&ð %)§N¡N°=×3GÑ3G×3LÑ3LÓ3NÐPRÔ$SØ$(§N¡N°=×3EÑ3E×3LÑ3L×3QÑ3QÓ3SÐUWÖ$Xð% Yô( !(¨ ×(=Ñ(=¸yÖ IØ$/×$9Ñ$9×$AÔ$Aà $§ ¡ ¨k¸2Ô >Ü7;Ü$*¨;×+@Ñ+@×+HÑ+H×+NÑ+NÓ+PÓ$Qó8"ò !&¡O C¨ð %)§M¡MØ(5×(<Ñ(<Ø,/Ø,6×,=Ñ,=Ø0@ÐBTó-.ç.4©f°W«oó )*ð )+õ%&ò !&ðQ3&ðj × Ñ Ö"ðUJ #ðX × Ñ Ô ô DÐ/Ô 0Ø×(Ò(Ø×(Ñ(×/Ò/ð OOEÔ "Ø NN4×3Ñ3×:Ñ:×?Ñ?ÓAÔ BØ × Ñ Ô ô DÐ7Ô 8Ø×0Ò0Ø×0Ñ0×7Ò7ð OOMÔ *Ø NN4×;Ñ;×BÑB×GÑGÓIÔ JØ × Ñ Ô ä 4Ð0Ô 1Ø OOÐ /Ô 0Ø×1Ñ1ò 'ØszzÓ 0Ô1ðTØMM (¬Z¸¿
|
¹
|
¿¹Ñ-HÑ"HÔIð × Ñ Ô"Ø99ØNN 3§9¡9§>¡>Ó#3°QÔ7Ø×$Ñ$Õ&ð 'ð ??Ô Ø OOÐ .Ô /Ø "× <Ñ <ò #
|
Øz× 0Ñ 0× 5Ñ 5Ó 7Ô8Ø '× /Ñ /ò EðØ Ø &¨%¯)©)´_ÀUÇZÁZÑ5PÐQSÐQTÐ5UÐ)VÑ VØ õð ð × Ñ Õ"ð #ô DÐ5Ô 6ÜD×2Ñ2Ó3°aÒ7à OOÐ @Ô AØ×4Ñ4ò <Øryy~~Ó /Ô0Ü2|Õ,°· ± Ñ1JØNN 2§=¡=×#5Ñ#5Ó#7¸Õ;ð <ð
|
}}Ð ùòg !Yùò6%&øôn ò TØMMÐ":×"AÑ"AÀ#Ç*Á*Ç/Á/Ó"R×SðTûô" $ò Ø Ø 2°e·i±iÀÇÁÐ5LÑ LÈa÷ðús> Ø7AY
|
Ý'AY
|
ÁQ/AYÁT85AZÁY=AZÁZAZÁZ4A[
|
Á[ A[
|
c ó i }| j « }|r||d< | j j « |d< | j j « |d< | j j « |d< t t d« }g |d< |D ]3 }t | j |d « s |d j |d « 5 t | d« r)| j | j j « |d< t t d
|
« }g |d < |D ]3 }t | j |d « s |d j |d « 5 g |d < t t d « }| j D ]Ñ }|j « }|d j |« g |d< |D ]) }t ||d « s|d j |d « + |j « |d< t |j! « |d< t" |j% « |d< t& |j) « |d< t* ¿|j- « |d< Ó t | d« rgt | j d« rQg |d< t/ | j j0 « D ]* \ } }
|
|
|
|d j |
|
j « « , t | d« r;g |d< t/ | j2 « D ] \ } } g } | j | j « « t | d« r,| j | j4 | j « « t | d« rt7 | j8 « | kD rg } | j | « | j8 | D ]^ }| j |j « « t |d« ri }|j: D ]c }| j= |j « « |j> |d< tA |jB jE « « D ] }|d ||d < e | j |« µt |d « sÂ|jF D ] }i }t |d « s| j= |j « « tA |jH jK « « d |tA |jH jM « « d < | j |« a |d j | « t | d « rÆg |d < |d j | jN jP j « « | jN jR D ]r }i }|jT N|jW |jX |jT |jZ d « |j\ r|j\ |d!< |d j |« t t | d"« rîg |d#< | j^ D ]Ú }g }|d# j |« |j |jP j « « |j` D ] }i }|jb d$u r |jd |d%< |jX |d&< n-|jd |d%< |jZ |d'< |jf |d(< |jh r|jh |d)< |j |« Ü t | d*« r¯g |d+< | jj D ] }i }|d+ j |« |jW |jP j « « |jZ |d%< |jB D ]< } i } | jW | jP j « « | jZ | d%< > t | d,« rîg |d-< | jl D ]Ú }g } |d- j | « | j |jP j « « |j` D ] }i }|jb d$u r |jd |d%< |jX |d&< n-|jd |d%< |jZ |d'< |jf |d(< |jh r|jh |d)< | j |« Ü t | d.« rñg |d/< |d/ j | jn jP j « « | jn jB D ] } i } | jZ | jZ | d'< nC| jP jp tr ju | jP jp d0« f| d1< | jW | jP j « « |d/ j | « t | d2« s¯g }!|!j | jv jP j « « |d/ j |!« | jv jB D ] }"i }#|"jZ |"jZ |#d'< n|"jP jp |#d1< |#jW |"jP j « « |!j |#« t |"d2« sg }$|$j |"jv jP j « « |!j |$« |"jv jB D ] }%t |%d3« si }&|%jx jz |&d4< |%jx j| |&d5< t~ ju |%jx jz d6« |&d7< t |%jx jz |%jx j| « |&d8< |&jW |%jP j « « |&jW |%jx jP j « « |$j |&« t |"jv d9« s|"jv j s'tA |"jv j jE « « D ]5 \ } }'|$j |'j
d:d;« j d<« « 7 t | d=« rI| j r=| j jP r'| j jP j « |d>< t | d?« rI| j r=| j jP r'| j jP j « |d@< t | dA« rg |dB< | j D ] }(i })|dB j |)« |)jW |(jP j « « t ju |(jP j |(jP j « |)dC< | j « r¢g |dD< | j D ] }*g }+|dD j |+« |+j |*jP j « « |*jB D ]> },i }-|+j |-« |,j |-dE< t |,j dFd |-dC< @ |S # t $ r |,j |-dC< Y _w xY w)Gz5Dump all the PE header information into a dictionary.r rl rr ry r^ r r r= Nr_ r r rK ÚEntropyÚMD5ÚSHA1ÚSHA256ÚSHA512r r r r r r r r· r7 r r> r, r r rä r r TÚDLLrÓ rÖ ÚHintÚBoundr r r r rn r rM r
rs r. r: r< r9 Ú LANG_NAMEÚ SUBLANG_NAMEr r r rª r r r r r¡ r¢ rS r£ r r4 )Or rl r, rr ry rZ rz r
|
r rM r= r rL r: r_ r ri r rb r rd r rg r r r r rD r r r r· rª rà r¿ r r> rk rR r, rE rÛ rË r rÈ rí rä r r r> r r? rÉ r r rn r
r r; rs r. ru rv r: rA r ri rH r r r¡ r¦ rS r r r r§ rù r ).rr r, r¨ r rY r rN rÛ Ú section_dictr rs Úvs_vinfoÚversion_info_listÚ fileinfo_listr> Ústringtable_dictrË rª r« Úvar_dictr¬ Ú export_dictr Ú import_listr% Ú symbol_dictr® Úbound_imp_desc_dictr¯ Úbound_imp_ref_dictÚ module_listrp Úresource_type_dictÚdirectory_listr Úresource_id_dictÚresource_id_listr Úresource_lang_dictrq re Údbg_dictr± Úbase_reloc_listr² Ú
|
reloc_dicts. r r, z PE.dump_dict¼ sØ ð à×$Ñ$Ó&Ù Ø,4IÐ(Ñ )à"&§/¡/×";Ñ";Ó"= ,Ñ Ø"&§/¡/×";Ñ";Ó"= ,Ñ Ø#'×#3Ñ#3×#=Ñ#=Ó#? -Ñ ä$Ô%:¸MÓJ à 'ÑØ ò 3DÜt×'Ñ'¨¨a©Õ1Ø'Ñ"×)Ñ)¨$¨q©'Õ2ð 3ô 4Ð*Ô +°×0DÑ0DÐ0PØ+/×+?Ñ+?×+IÑ+IÓ+KIÐ'Ñ (ä$2Ü Ð!<ó%
|
Ð!ð +- Ð&Ñ'Ø-ò @DÜt×+Ñ+¨T°!©WÕ5ØÐ.Ñ/×6Ñ6°t¸A±wÕ?ð @ð $& -Ñ ä&Ô'>À ÓM Ø}}ò CGØ"×,Ñ,Ó.LØ mÑ $× +Ñ +¨LÔ 9Ø$&LÑ !Ø%ò :Ü7 D¨¡GÕ,Ø Ñ)×0Ñ0°°a±Õ9ð :ð '.×&9Ñ&9Ó&;LÑ #ÜØ&-×&:Ñ&:Ó&< UÑ#ÜÐ Ø'.×'<Ñ'<Ó'> VÑ$ÜÐ!Ø)0×)@Ñ)@Ó)B XÑ&ÜÑ!Ø)0×)@Ñ)@Ó)B XÒ&ð! Cô$ 4Ð*Ô +´Ø × Ñ Ð"2ô1
|
ð (*ImÑ $ä"+¨D×,@Ñ,@×,OÑ,OÓ"Pò KYØ Ñ(Ø mÑ,×3Ñ3°I×4GÑ4GÓ4IÕJð Kô 4Ð)Õ *Ø/1IÐ+Ñ ,Ü!*¨4×+>Ñ+>Ó!?ó K XØ$&Ð!Ø!×(Ñ(¨×);Ñ);Ó)=Ô>ä4Ð!3Ô4Ø%×,Ñ,¨T×-BÑ-BÀ3Ñ-G×-QÑ-QÓ-SÔTä4 Õ,´°T·]±]Ó1CÀcÓ1IØ$&MØ%×,Ñ,¨]Ô;Ø!%§ ¡ ¨sÑ!3ó CØ%×,Ñ,¨U¯_©_Ó->Ô?ä" 5¨-Ô8Ø/1Ð ,Ø,1×,=Ñ,=ò R Ø -× 4Ñ 4°X×5GÑ5GÓ5IÔ JØ=E¿_¹_Ð 0°Ñ :Ü15°h×6FÑ6F×6LÑ6LÓ6NÓ1Oò !R IØENÈqÁ\Ð$4°Y¸q±\Ò$Bñ!Rð Rð
|
*× 0Ñ 0Ð1AÕ Bä $ U¨EÕ 2Ø-2¯Y©Yò C Ø+- Ü#*¨9°gÕ#>Ø$1×$8Ñ$8¸×9LÑ9LÓ9NÔ$OÜPTØ(1¯©×(>Ñ(>Ó(@óQ&à&'ñQ) H¬T°)·/±/×2FÑ2FÓ2HÓ-IÈ!Ñ-LÑ$Mð %2×$8Ñ$8¸Õ$Bò CðCð, Ð/Ñ0×7Ñ7Ð8IÖJðA KôD 4Ð1Ô 2Ø,.IÐ(Ñ )Ø Ð(Ñ )× 0Ñ 0Ø×+Ñ+×2Ñ2×<Ñ<Ó>ô ð ×5Ñ5×=Ñ=ò BØ Ø>>Ð-Ø ×&Ñ&à'-§~¡~Ø#)§>¡>Ø$*§K¡Kñôð ×'Ò'Ø39×3CÑ3C KÑ0ØÐ,Ñ-×4Ñ4°[ÕAð Bô 4Ð1Ô 2Ø,.IÐ(Ñ )Ø ×5Ñ5ò 4Ø ØÐ,Ñ-×4Ñ4°[ÔAØ×"Ñ" 6§=¡=×#:Ñ#:Ó#<Ô=Ø $nnò 4FØ"$KØ ×/Ñ/°4Ñ7Ø-3¯Z©Z EÑ*Ø17· ± IÒ.à-3¯Z©Z EÑ*Ø.4¯k©k FÑ+Ø.4¯k©k FÑ+à ||Ø/5¯|©| GÑ,Ø ×&Ñ& {Õ3ñ 4ð 4ô$ 4Ð7Ô 8Ø)+IoÑ &Ø"&×"CÑ"Cò
|
CØ&(Ð#Ø/Ñ*×1Ñ1Ð2EÔFà#×*Ñ*¨>×+@Ñ+@×+JÑ+JÓ+LÔMØ-;×-@Ñ-@Ð# EÑ*à%3×%;Ñ%;ò CMØ)+Ð&Ø&×-Ñ-¨m×.BÑ.B×.LÑ.LÓ.NÔOØ0=×0BÑ0BÐ& uÒ-ñCð
|
Cô 4Ð7Ô 8Ø24IÐ.Ñ /Ø ×;Ñ;ò 4Ø ØÐ2Ñ3×:Ñ:¸;ÔGØ×"Ñ" 6§=¡=×#:Ñ#:Ó#<Ô=à $nnò 4FØ"$KØ ×/Ñ/°4Ñ7Ø-3¯Z©Z EÑ*Ø17· ± IÒ.à-3¯Z©Z EÑ*Ø.4¯k©k FÑ+Ø.4¯k©k FÑ+à ||Ø/5¯|©| GÑ,Ø ×&Ñ& {Õ3ñ 4ð 4ô& 4Ð3Õ 4Ø.0IÐ*Ñ +Ø Ð*Ñ +× 2Ñ 2Ø×-Ñ-×4Ñ4×>Ñ>Ó@ô ð !× 9Ñ 9× AÑ Aó G &Ø%'Ð"à==Ð,Ø19· ± Ð& vÒ.ð !×*Ñ*Ü%×)Ñ)¨(¯/©/×*<Ñ*<¸cÓBð0Ð& tÑ,ð
|
#×)Ñ)¨(¯/©/×*CÑ*CÓ*EÔFØÐ.Ñ/×6Ñ6Ð7IÔJä8 [Õ1Ø%'NØ"×)Ñ)¨(×*<Ñ*<×*CÑ*C×*MÑ*MÓ*OÔPØ Ð 2Ñ3×:Ñ:¸>ÔJà'/×'9Ñ'9×'AÑ'Aó 4& Ø+-Ð(à&×+Ñ+Ð7Ø7B×7GÑ7GÐ ,¨VÒ 4à5@×5GÑ5G×5JÑ5JÐ ,¨TÑ 2à(×/Ñ/° ×0BÑ0B×0LÑ0LÓ0NÔOØ&×-Ñ-Ð.>Ô?ä" ;° Õ<Ø/1Ð ,Ø ,× 3Ñ 3Ø +× 5Ñ 5× <Ñ <× FÑ FÓ Hô ð +× 1Ñ 1Ð2BÔ Cà1<×1FÑ1F×1NÑ1Nó P Ü#*¨=¸&Õ#AØ9;Ð$6ØAN×ASÑAS×AXÑAXÐ$6°vÑ$>ð )6×(:Ñ(:×(BÑ(Bð %7Ø(1ñ%&ô GKÇhÁhØ(5×(:Ñ(:×(?Ñ(?ÀóG&Ð$6°{Ñ$Cô
|
)BØ(5×(:Ñ(:×(?Ñ(?Ø(5×(:Ñ(:×(BÑ(Bó)&ð %7Ø(6ñ%&ð %7×$=Ñ$=Ø(5×(<Ñ(<×(FÑ(FÓ(Hô%&ð %7×$=Ñ$=Ø(5×(:Ñ(:×(AÑ(A×(KÑ(KÓ(Mô%&ð %5×$;Ñ$;Ð<NÖ$Oð- Pô0 !(¨ ×(=Ñ(=¸yÖ IØ$/×$9Ñ$9×$AÔ$Aä7;Ø$/×$9Ñ$9×$AÑ$A×$GÑ$GÓ$Ió8"ò !&¡O C¨ð %5×$;Ñ$;Ø(2×(9Ñ(9Ø,<Ð>Pó)*ç*0©&°«/õ%&ò!&ò[4&ð'G &ôT DÐ/Ô 0Ø×(Ò(Ø×(Ñ(×/Ò/à #× 7Ñ 7× >Ñ >× HÑ HÓ JIeÑ ô DÐ7Ô 8Ø×0Ò0Ø×0Ñ0×7Ò7ð ×0Ñ0×7Ñ7×AÑAÓCð Ø ñ ô 4Ð0Ô 1Ø-/IÐ)Ñ *Ø×1Ñ1ò TØ ØÐ-Ñ.×5Ñ5°hÔ?Ø §
|
¡
|
× 4Ñ 4Ó 6Ô7Ü#-§>¡>°#·*±*·/±/À3Ç:Á:Ç?Á?Ó#SÒ ð Tð ??Ô Ø,.IÐ(Ñ )Ø "× <Ñ <ò 8
|
Ø"$ØÐ,Ñ-×4Ñ4°_ÔEØ ×&Ñ& z×'8Ñ'8×'BÑ'BÓ'DÔEØ '× /Ñ /ò 8EØ!#JØ#×*Ñ*¨:Ô6Ø(-¯ © JuÑ%ð8Ü-<¸U¿Z¹ZÑ-HÈÈÐ-M
|
6Ò*ñ 8ð 8ð Ðøô $ò 8Ø-2¯Z©Z
|
6Ó*ð8ús ùy/ù/z
|
ú z
|
c óD | j |« S # t $ r Y yw xY w)z;Gets the physical address in the PE file from an RVA value.N)rT rh rS s r Úget_physical_by_rvazPE.get_physical_by_rvaâ s* ð Ø×+Ñ+¨CÓ0Ð 0øÜò Ùð ús c ó4 t j d|dz « S )zMReturn a four byte string representing the double word value (little endian).r£ ì ÿÿ ©rE r )rr Údwords r Úget_data_from_dwordzPE.get_data_from_dwordí s ä{{4 ¨Ñ!3Ó4Ð4r c óv |dz dz t |« kD ryt j d||dz |dz dz « d S )a Convert four bytes of data to a double word (little endian)
|
|
'offset' is assumed to index into a dword array. So setting it to
|
N will return a dword out of the data starting at offset N*4.
|
|
Returns None if the data can't be turned into a double word.
|
r7 rC Nr r ©rD rE rF ©rr r. rÞ s r rä zPE.get_dword_from_datañ óF ð QJ!Ñ c $iÒ 'Øä}}T 4¨°©
|
°f¸q±jÀAÑ5EÐ#FÓGÈÑJÐJr c óf | j | j |d« d« S # t $ r Y yw xY w)z Return the double word value at the given RVA.
|
|
Returns None if the value can't be read, i.e. the RVA can't be mapped
|
to a file offset.
|
rC r N)rä r r rS s r r zPE.get_dword_at_rvaÿ s7 ð Ø×+Ñ+¨D¯M©M¸#¸qÓ,AÀ1ÓEÐ EøÜ ò Ùð ús !$ ¤ 0¯0c ó~ |dz t | j « kD ry| j | j ||dz d« S )zFReturn the double word value at the given file offset. (little endian)rC Nr )rD rE rä rý s r Úget_dword_from_offsetzPE.get_dword_from_offset ó> ð A:DMMÓ*Ò *Øà×'Ñ'¨¯ © °f¸vȹzÐ(JÈAÓNÐNr c óD | j || j |« « S )zLSet the double word value at the file offset corresponding to the given RVA.)Úset_bytes_at_rvarØ )rr r r× s r Úset_dword_at_rvazPE.set_dword_at_rva ó à×$Ñ$ S¨$×*BÑ*BÀ5Ó*IÓJÐJr c óD | j || j |« « S )z3Set the double word value at the given file offset.)rÛ rØ )rr rÞ r× s r rÙ zPE.set_dword_at_offset ó à×'Ñ'¨°×0HÑ0HÈÓ0OÓPÐPr c ó. t j d|« S )zFReturn a two byte string representing the word value. (little endian).r rÖ ©rr rý s r Úget_data_from_wordzPE.get_data_from_word ó ä{{4 Ó&Ð&r c óv |dz dz t |« kD ryt j d||dz |dz dz « d S )a Convert two bytes of data to a word (little endian)
|
|
'offset' is assumed to index into a word array. So setting it to
|
N will return a dword out of the data starting at offset N*2.
|
|
Returns None if the data can't be turned into a word.
|
r7 r? Nr r rÚ rÛ s r r» zPE.get_word_from_data# rÜ r c ój | j | j |« dd d« S # t $ r Y yw xY w)zReturn the word value at the given RVA.
|
|
Returns None if the value can't be read, i.e. the RVA can't be mapped
|
to a file offset.
|
Nr? r )r» r r rS s r Úget_word_at_rvazPE.get_word_at_rva1 s< ð Ø×*Ñ*¨4¯=©=¸Ó+=¸b¸qÐ+AÀ1ÓEÐ EøÜ ò Ùð úó #& ¦ 2±2c ó~ |dz t | j « kD ry| j | j ||dz d« S )z?Return the word value at the given file offset. (little endian)r? Nr )rD rE r» rý s r Úget_word_from_offsetzPE.get_word_from_offset= s> ð A:DMMÓ*Ò *Øà×&Ñ& t§}¡}°V¸fÀq¹jÐ'IÈ1ÓMÐMr c óD | j || j |« « S )zESet the word value at the file offset corresponding to the given RVA.)râ ré )rr r rý s r Úset_word_at_rvazPE.set_word_at_rvaE s à×$Ñ$ S¨$×*AÑ*AÀ$Ó*GÓHÐHr c óD | j || j |« « S )z,Set the word value at the given file offset.)rÛ ré )rr rÞ rý s r rå zPE.set_word_at_offsetI s à×'Ñ'¨°×0GÑ0GÈÓ0MÓNÐNr c ó. t j d|« S )zMReturn an eight byte string representing the quad-word value (little endian).ú<QrÖ rè s r Úget_data_from_qwordzPE.get_data_from_qwordQ rê r c óv |dz dz t |« kD ryt j d||dz |dz dz « d S )a Convert eight bytes of data to a word (little endian)
|
|
'offset' is assumed to index into a word array. So setting it to
|
N will return a dword out of the data starting at offset N*8.
|
|
Returns None if the data can't be turned into a quad word.
|
r7 rK Nrõ r rÚ rÛ s r Úget_qword_from_datazPE.get_qword_from_dataU rÜ r c ój | j | j |« dd d« S # t $ r Y yw xY w)zReturn the quad-word value at the given RVA.
|
|
Returns None if the value can't be read, i.e. the RVA can't be mapped
|
to a file offset.
|
NrK r )rø r r rS s r Úget_qword_at_rvazPE.get_qword_at_rvac s< ð Ø×+Ñ+¨D¯M©M¸#Ó,>¸rÀÐ,BÀAÓFÐ FøÜ ò Ùð úrî c ó~ |dz t | j « kD ry| j | j ||dz d« S )zDReturn the quad-word value at the given file offset. (little endian)rK Nr )rD rE rø rý s r Úget_qword_from_offsetzPE.get_qword_from_offseto rà r c óD | j || j |« « S )zJSet the quad-word value at the file offset corresponding to the given RVA.)râ rö )rr r Úqwords r Úset_qword_at_rvazPE.set_qword_at_rvaw rä r c óD | j || j |« « S )z1Set the quad-word value at the given file offset.)rÛ rö )rr rÞ rþ s r Úset_qword_at_offsetzPE.set_qword_at_offset{ ræ r c ó t |t « s t d« | j |« }|sy| j ||« S )zèOverwrite, with the given string, the bytes at the file offset corresponding
|
to the given RVA.
|
|
Return True if successful, False otherwise. It can fail if the
|
offset is outside the file's boundaries.
|
ú data should be of type: bytesF)rS rU Ú TypeErrorrÓ rÛ )rr r r. rÞ s r râ zPE.set_bytes_at_rva sC ô $¤Ô&ÜÐ ;Ó<Ð <à×)Ñ)¨#Ó.ÙØà×'Ñ'¨°Ó5Ð5r c ó¢ t |t « s t d« d|cxk rt | j « k rn y| j ||« yy)zÅOverwrite the bytes at the given file offset with the given string.
|
|
Return True if successful, False otherwise. It can fail if the
|
offset is outside the file's boundaries.
|
r r FT)rS rU r rD rE Úset_data_bytes©rr rÞ r. s r rÛ zPE.set_bytes_at_offset sQ ô $¤Ô&ÜÐ ;Ó<Ð <à Ô +T]]Ó+Ô +ð ð × Ñ ¨Ô -ð ð r rÞ r. c ó¢ t | j t « st | j « | _ || j ||t |« z y r )rS rE rg rD r s r r zPE.set_data_bytes¥ s9 Ü$--¬Ô3Ü % d§m¡mÓ 4DMà59 fv¬¨D« Ñ 1Ñ2r c óH | j D ] }| j |j | j j « }||j
|
z }|t | j « k s[|t | j « k st| j ||j « « y)zeUpdate the PE image content with any individual section data that has been
|
modified.
|
N)
|
r: r< r1 r= r> r3 rD rE r r )rr rÛ Úsection_data_startÚsection_data_ends r Úmerge_modified_section_dataz PE.merge_modified_section_data« s ð
|
}}ò LGØ!%×!:Ñ!:Ø×(Ñ(¨$×*>Ñ*>×*LÑ*Ló"Ð ð 2°G×4IÑ4IÑ IÐ Ø!¤C¨¯ © Ó$6Ó6Ð;KÌcØ óOó <ð ×#Ñ#Ð$6¸×8HÑ8HÓ8JÕKñ Lr c óÀ || j j z
|
}t | j j « dk\ r¢| j j d j r}t | d« s| j t d g¬« t | d« s | j j d« nM| j D ]= }d}|t |j « k s |j | }|dz }|j t d k( rnÙ|j t d
|
k( r@| j |j | j! |j « |z d z d z « n|j t d k( r=| j |j | j! |j « |z d z « n0|j t d k( r9| j# |j | j% |j « |z « ná|j t d k( r}|t |j « k( rs|j | }|dz }| j |j | j! |j « d z |j z |z dz d z « nN|j t d k( r8| j' |j | j) |j « |z « |t |j « k r @ || j _ t | d« r7| j* D ]( }|j, D ] }|xj. |z c_ * t | d« r¤| j0 j2 xj4 |z c_ | j0 j2 xj6 |z c_ | j0 j2 xj8 |z c_ | j0 j2 xj: |z c_ t | d« rÏ| j< j2 } t | d« r!| j> r| xj> |z c_ t | d« r!| j@ r| xj@ |z c_ t | d« r!| jB r| xjB |z c_! t | d« r!| jD r| xjD |z c_" t | d« r!| jF r| xjF |z c_# t | d« r!| jH r| xjH |z c_$ t | d« r!| jJ r| xjJ |z c_% t | d « r!| jL r| xjL |z c_& t | d « r!| jN r| xjN |z c_' t | d « r!| jP r| xjP |z c_( | jR tT k( r-t | d « r!| jV r| xjV |z c_+ t | d « r!| jX r| xjX |z c_, t | d!« r!| jZ r| xj\ |z c_. t | d"« r!| j\ r| xj\ |z c_. t | d#« r#| j^ r| xj^ |z c_/ y$y$y$y$y$y$)%a2 Apply the relocation information to the image using the provided image base.
|
|
This method will apply the relocation information to the image. Given the new
|
base, all the relocations will be processed and both the raw data and the
|
section's data will be fixed accordingly.
|
The resulting image can be retrieved as well through the method:
|
|
get_memory_mapped_image()
|
|
In order to get something that would more closely match what could be found in
|
memory once the Windows loader finished its work.
|
rG rE r rD ©rí zZRelocating image but PE does not have (or pefile cannot parse) a DIRECTORY_ENTRY_BASERELOCr r7 rç rè r4 rÊ ré rê rë r¥ rñ r r r ÚLockPrefixTableÚEditListÚSecurityCookieÚSEHandlerTableÚGuardCFCheckFunctionPointerÚ GuardCFDispatchFunctionPointerÚGuardCFFunctionTableÚ GuardAddressTakenIatEntryTableÚGuardLongJumpTargetTableÚDynamicValueRelocTableÚCHPEMetadataPointerÚGuardRFFailureRoutineÚ$GuardRFFailureRoutineFunctionPointerÚ(GuardRFVerifyStackPointerFunctionPointerÚEnclaveConfigurationPointerN)0r= rû rD r r± rM r¾ r r; r r rà rù r§ rò r rí rã r rÿ rú r r rË r rE ÚStartAddressOfRawDataÚEndAddressOfRawDataÚAddressOfIndexÚAddressOfCallBacksr r r r r r r r r r r rÍ rÐ r r r r r )
|
rr Ú new_ImageBaseÚrelocation_differencer² Ú entry_idxr> Ú
|
next_entryr ÚfuncÚ load_configs
|
r rf zPE.relocate_imageº s> ð !.°×0DÑ0D×0NÑ0NÑ NÐ ô ×$Ñ$×3Ñ3Ó 4¸Ó 9Ø×$Ñ$×3Ñ3°AÑ6×;Ó;ä4Ð!<Ô=Ø×+Ñ+Ü!0Ð1RÑ!SÐ Tð ,ô ô 4Ð!<Ô=Ø×&Ñ&ð9öð
|
"× ;Ñ ;ó \ Eð !"IØ#¤c¨%¯-©-Ó&8Ó8à %§ ¡ ¨iÑ 8Ø! Q à ::¬ Ð9SÑ)TÒTá à "ZZ¬?Ð;QÑ+RÒ Rð !× 0Ñ 0Ø %§ ¡ à$(×$8Ñ$8¸¿¹Ó$CØ&;ñ%<à')ñ%*ð #)ñ !)ö ð #ZZ¬?Ð;PÑ+QÒ Qð !× 0Ñ 0Ø %§ ¡ à$(×$8Ñ$8¸¿¹Ó$CØ&;ñ%<ð #)ñ !)ö ð #ZZ¬?Ð;TÑ+UÒ Uð
|
!× 1Ñ 1Ø %§ ¡ Ø $× 5Ñ 5°e·i±iÓ @Ø"7ñ!8õ ð #ZZ¬?Ð;TÑ+UÒ Uð )¬C°· ± Ó,>Ò >Ù %à).¯ © °yÑ)AJØ %¨NIØ × 0Ñ 0Ø %§ ¡ à%)×%9Ñ%9¸%¿)¹)Ó%DÈÑ%JØ&0§n¡nñ%5à&;ñ%<ð '1ñ%1ð
|
$&ñ !&õ ð #ZZ¬?Ð;RÑ+SÒ Sð !× 1Ñ 1Ø %§ ¡ Ø $× 5Ñ 5°e·i±iÓ @Ø"7ñ!8ô ðc $¤c¨%¯-©-Ó&8Ö8ð\ ð| .;D× Ñ Ô *ô tÐ 5Ô6Ø ×6Ñ6ò >CØ #§ ¡ ò >Ø Ð(=Ñ= ñ>ð>ô tÐ 2Ô3Ø×(Ñ(×/Ñ/×EÒEØ)ñÕEð ×(Ñ(×/Ñ/×CÒCØ)ñÕCð ×(Ñ(×/Ñ/×>Ò>ÐBWÑWÕ>Ø×(Ñ(×/Ñ/×BÒBØ)ñÕBô tÐ :Õ;Ø "× >Ñ >× EÑ E äKÐ):Ô;Ø#×3Ò3à ×/Ò/Ð3HÑHÕ/Ü;¨
|
Ô3¸ ×8LÒ8LØ ×(Ò(Ð,AÑAÕ(äKÐ)9Ô:Ø#×2Ò2à ×.Ò.Ð2GÑGÕ.äKÐ)9Ô:Ø#×2Ò2à ×.Ò.Ð2GÑGÕ.äKÐ)FÔGØ#×?Ò?à ×;Ò;Ð?TÑTÕ;äKÐ)IÔJØ#×BÒBà ×>Ò>ÐBWÑWÕ>äKÐ)?Ô@Ø#×8Ò8à ×4Ò4Ð8MÑMÕ4äKÐ)IÔJØ#×BÒBà ×>Ò>ÐBWÑWÕ>äKÐ)CÔDØ#×<Ò<à ×8Ò8Ð<QÑQÕ8äKÐ)AÔBØ#×:Ò:à ×6Ò6Ð:OÑOÕ6àLLÔ$AÒAÜ Ð-BÔCØ#×7Ò7à ×3Ò3Ð7LÑLÕ3äKÐ)@ÔAØ#×9Ò9à ×5Ò5Ð9NÑNÕ5äKÐ)OÔPØ#×HÒHà ×HÒHØ-ñÕHô KÐ)SÔTØ#×LÒLà ×HÒHØ-ñÕHô KÐ)FÔGØ#×?Ò?à ×;Ò;Ð?TÑTÖ;ð @ð HðW <ðy <ð :r c óP | j j | j « k( S r )r= ÚCheckSumÚgenerate_checksumrw s r Úverify_checksumzPE.verify_checksum s" à×#Ñ#×,Ñ,°×0FÑ0FÓ0HÑHÐHr c ó´ | j « | _ | j j « dz }d}t | j « dz }t | j « d|z
|
|dk7 z z }t t |dz « « D ]¢ }|t |dz « k( r|dz t |dz « k( r5|r3t j d| j |dz d dd|z
|
z z « d }n/t j d| j |dz |dz dz « d }||z }|dk\ s|dz |d z z }¤ |d
|
z |d z z }||d z z }|d
|
z }|t | j « z S ) Nra r rC r7 rÈ r rV rÕ r3 rÊ r4 ) rÆ rE r= rû rD r¤ r# rE rF )rr Úchecksum_offsetr¨ Ú remainderÚdata_lenrL r× s r r* zPE.generate_checksum s ð
|
|
ð ×.Ñ.×>Ñ>Ó@À4ÑGàô Ó&¨Ñ* Üt}}Ó%¨!¨i©-¸IȹNÑ)KÑLäs8 a<Ó(Ó)ò FAàC¨!Ñ+Ó,Ò,ØØ1uX¨\Ó*Ò+± Ü Ø q¨1¡u wÐ/°5¸AÀ ¹MÑ3JÑKóàñô c¨4¯=©=¸¸Q¹ÀÀQÁÈÁÐ+KÓLÈQÑOà Ñ HØ5Ó Ø $ zÑ 1°hÀ"±nÑEð Fð vÑ%¨(°b©.Ñ9Ø ¨R¡ Ñ0ØfÑ$ð #dmmÓ,Ñ,Ð,r c ó t d }| j « s-| j « s || j j z |k( ryy)zùCheck whether the file is a standard executable.
|
|
This will return true only if the file has the IMAGE_FILE_EXECUTABLE_IMAGE flag
|
set and the IMAGE_FILE_DLL not set and the file does not appear to be a driver
|
either.
|
r[ TF)rz Úis_dllr× ry rJ )rr ÚEXE_flags r Úis_exez PE.is_exeÌ sC ô )Ð)FÑGð Ø^^Ô%ØD× ,Ñ ,× <Ñ <Ñ<ÀÒIààr c óP t d }|| j j z |k( ryy)zCheck whether the file is a standard DLL.
|
|
This will return true only if the image has the IMAGE_FILE_DLL flag set.
|
rk TF)rz ry rJ )rr ÚDLL_flags r r1 z PE.is_dllß s. ô )Ð)9Ñ:à t×'Ñ'×7Ñ7Ñ 7¸HÒ DØàr c ó t | d« s| j t d g¬« t | d« syt d« }|j | j
|
D cg c] }|j j « c}« ryt d« }|j | j D cg c]+ }|j j « j d« - c}« r)| j j t d t d
|
fv ryyc c}w c c}w ) zCheck whether the file is a Windows driver.
|
|
This will return true only if there are reliable indicators of the image
|
being a driver.
|
r r= r F)s ntoskrnl.exes hal.dlls ndis.syss bootvid.dlls kdcom.dllT)s pages pagedr rµ rº )rM r¾ r rÉ Ú intersectionr r r r: rÖ r" r= Ú SubsystemÚSUBSYSTEM_TYPE)rr Ú system_DLLsr) Údriver_like_section_namesrÛ s r r× z PE.is_driverì s ô, tÐ 5Ô6Ø × 'Ñ 'Ü ,Ð-KÑ LÐ Mð (ô ô tÐ 5Ô6Øô Ø Tó
|
ð × #Ñ #Ø(,×(CÑ(CÖ D SWW]]_Ò Dô
|
ð ä$'Ð(;Ó$<Ð!Ø $× 1Ñ 1ØAEÇ Á Ö O°gW\\× Ñ Ó !× (Ñ (¨Õ 1Ò Oô
|
ð × Ñ × *Ñ *ä Ð 7Ñ8Ü Ð ?Ñ@ðñ ð àùò! Eùò Ps Á!DÂ%0D c ó^ dt | j « ffd }t | d« r6 || j j « | j
|
j f« | j D ] } ||j |j f« " t d g}t | j j « D ]8 \ }}||v r || j |j « |j f« : t | j « t# « kD r t# « S y# t $ r Y sw xY w)zoGet the offset of data appended to the file and not contained within
|
the area described in the headers.r¸ c óV t | « |k rt | « t « kD r| S S r )Úsum)Úoffset_and_sizeÚ file_sizeÚlargest_offset_and_sizes r Ú'update_if_sum_is_larger_and_within_filezQPE.get_overlay_data_start_offset.<locals>.update_if_sum_is_larger_and_within_file, s7 ø ô ?Ó# yÒ0´S¸ Ó5IÌCØ'óMò 6ð 'Ð&Ø*Ð *r r= rB N)rD rE rM r= rû ry r{ r: r1 r3 r r r rT r2 r± r r> )rr rB rÛ Úskip_directoriesr rs rA s @r Ú get_overlay_data_start_offsetz PE.get_overlay_data_start_offset& s: ø ð #)Ð ô (+¨4¯=©=Ó'9õ +ô 4Ð*Ô +Ù&Mà×(Ñ(×8Ñ8Ó:Ø×$Ñ$×9Ñ9ðó'Ð #ð }}ò GÙ&MØ×)Ñ)¨7×+@Ñ+@ÐAó'Ñ #ð ô
|
,Ð,LÑ MÐNÐä '¨×(<Ñ(<×(KÑ(KÓ Lò NCØÐ&Ñ&Øð Ù*QØ×-Ñ-¨i×.FÑ.FÓGÈÏ É ÐXó+Ñ'ð ô t}}Ó ¤Ð$;Ó <Ò <ÜÐ.Ó/Ð /àøô !ò Ùð ús Ã-D Ä D,Ä+D,c óF | j « }|| j |d S y)zeGet the data appended to the file and not contained within the area described
|
in the headers.N©rD rE ©rr Úoverlay_data_offsets r Ú get_overlayzPE.get_overlayT s/ ð #× @Ñ @Ó BÐà Ð *Ø==Ð!4Ð!5Ð6Ð 6àr c ób | j « }|| j d| S | j dd S )zKReturn the just data defined by the PE headers, removing any overlaid data.NrF rG s r ÚtrimzPE.trim_ s; ð #× @Ñ @Ó BÐà Ð *Ø==Ð!5Ð"5Ð6Ð 6à}}QÐ Ð r c ó¨ |t kD r>| j du r0t |« s%| j j d|z « d| _ t ||« S )NFz=If FileAlignment > 0x200 it should be a power of 2. Value: %xT)r" r> rd r; r r& )rr r$ r% s r r< zPE.adjust_FileAlignmentv sT Ø Ô :Ò :à×)Ñ)¨UÑ2¼<ÈÔ;WØ×&Ñ&ØSØ%ñ'ôð .2Ô*ä)¨#¨~Ó>Ð>r c ó¢ |t k r:||k7 r5| j du r'| j j d||fz « d| _ t |||« S )NFzAIf FileAlignment(%x) < 0x200 it should equal SectionAlignment(%x)T)r" r? r; r r* )rr r$ r) r% s r rA zPE.adjust_SectionAlignment s_ Ø Ô :Ò :à Ð"3Ò3Ø×1Ñ1°UÑ:à×&Ñ&ØWØ%Ð'8Ð9ñ:ôð 15Ô-ä,¨SÐ2CÀ^ÓTÐTr r )NFF)r Nr N©Fr )NF)r N)r N)r N)r )Nrª )ry rz r{ r¤ rk rx r
r| r~ rq rÕ r r3 rÜ rx r¦ r¢ r¯ r³ r´ r¶ r¹ rº rW rX rR r6 r@ rC rD rE r r r r r' r( r) Ú&__IMAGE_DYNAMIC_RELOCATION_V2_format__Ú(__IMAGE_DYNAMIC_RELOCATION64_V2_format__r r rö ÚMAX_SYMBOL_EXPORT_COUNTro rK rN rI rV rY rH r³ r r¹ r rÆ r r¾ rê ré ræ rç r rå r, r9 r: rä rã r r| r râ r² rÿ rè r r* r. rá r rC rl rr r rQ rT r rå ry r r r r r r r r r r, rÓ rØ rä r rß rã rÙ ré r» rí rð rò rå rö rø rú rü rÿ r râ rÛ r# rU r r rf r+ r* r3 r1 r× rD rI rK r< rA rc r r rÒ rÒ s{ ñBðP#Ð ð2 $Ð ð'Ð#ð
|
"(Ð$ðH!*Ð&ðF #IÐ ð'Ð#ð 0Ð,ð *Ð&ð)Ð%ð"
|
+Ð'ð1Ð-ð
|
,Ð(ð
|
!Ð ð
|
#Ð ð&!Ð ð
|
VÐàKÐàENð#Ð ð
|
%Ð!ð
|
(Ð$ð (Ð$ð
|
.Ð*ð
|
CÐ?ð
|
BÐ>ð>Ð:ð
|
|
&Ð"ð
|
(Ð$ð/.Ð*ðb00Ð,ðd1Ð-ð
|
+Ð'ð
|
-Ð)ð
|
.Ð*ð
|
0Ð,ð
|
0Ð,ð
|
,Ð(ð
|
#Ð ð Ø ØØ2Ø ó 4òlòò
|
òò,ò,n ò` Oòb ò ò$ó.5ònLð^ TYó`4òDXòtu òn*ò83
|
òjX#òt@ó
|
;òz*òX&òPióVu'òn ò0 ò>s$ój G
|
òRHò
|
òk óZ ?ò .;ò`Bó2h ð^ Ø ó ] ó~BóHGòR!ó8 'òD -ò>*ð* 1Bó Pòòó)9òVòò ò:òó1ó] ò~ còL ò5ò Kò
|
òOòKòQò'ò Kò
|
òNòIòOò'ò Kò
|
òOòKòQò6ò"ð": Sð :°ó :ò Lò \Uò|Iò.-ò`ò& ò8òt,ò\ ò ò.
|
?ó$ Ur rÒ c ó dd l } d}| j dd s t |« y | j d dk( r| j dd s| j d« t | j d « }|j
|
j D ]M }t t |j j |j z « |j |j « O y t t | j d « j « « y )Nr z1pefile.py <filename>
|
pefile.py exports <filename>r7 rì r? zerror: <filename> required)r Úargvr· ÚexitrÒ r, rÛ r r= rû rË rí rÈ r )r Úusager rö s r ÚmainrV sÈ Ûð Eð 88AB<Ü e Ø ! Ò !Øxx|Ø HHÐ1Ô 2Ü _Ø×,Ñ,×4Ñ4ò CÜ ÜB×&Ñ&×0Ñ0°3·;±;Ñ>Ó?ÀÇÁÈ3Ï;É;õ ñ ô
|
b!o×'Ñ'Ó)Õ*r Ú__main__)rc FFrN ) r¤ Ú
|
__author__Ú __version__Ú __contact__râ ra rE rh r rm r rP rW r Útypingr Úhashlibr r r r r r r r Úregister_errorÚ lookup_errorr# r r r& r* r/ r6 r r rD r ræ rÔ r{ rw rQ ro rn rs rt ru rv rw Ú IMAGE_NUMBEROF_DIRECTORY_ENTRIESrÏ rÑ rÎ rÐ r; Údirectory_entry_typesr Úimage_characteristicsrz Úsection_characteristicsrL Ú debug_typesr¦ Úsubsystem_typesr9 Ú machine_typesrõ Úrelocation_typesr§ Údll_characteristicsr r" r1 r6 Ú registersrR rM rV rf ro rz r r¬ r r r¨ Ú resource_typer ru r: rv r< r8 r@ r> r rA rP rZ ra rd rG rÉ rl r rh r rª rÐ rÓ ræ rè r/ r r r½ r rÆ rà râ rê rí rï rñ ró rõ r÷ rÿ r r r r r rA rL rU re rn ry r r r r§ r« r! Úascii_lowercaseÚascii_uppercaserÏ rÇ rÊ rÎ rT rU rg ÚboolrÐ rÒ rV ry rc r r ú<module>rm s3 ðñð
|
Ø Ø% ã Û Û Û Û Û Û Û Û å Ý Ý Ý Ý Ý ã Û ã à × Ñ Ð)Ð+>¨6×+>Ñ+>Ð?QÓ+RÔ Sà
|
ó
|
ñ" 4Ôñ&ó ð&ñ 4Ôñ ó ð ò ð ð
|
Ð ð Ð ð Ð ØØ Ð ð ð Ð ð Ð ð !Ð à Ð Ø Ð ØÐ ØÐ ØÐ ØÐ à Ð Ø#%Ð Ø Ð Ø)Ð Ø Ð Ø %Ð ò7òÐ ñ( Ð 4Ó5òÐ ñ& %Ð%:Ó;Ð ò/Ð ñb 'Ð'>Ó?Ð ò ñ* +Ó &
|
òñ" oÓ.ò% ñN MÓ* ò Ð ñ Ð /Ó0òÐ ñ$ #Ð#6Ó7Ð à!&Ð ò
|
Ð ñ !Ð!2Ó3Ð ò ñ& Ó # ð Ð ØÐ ØÐ ØØÐ ØÐ Ø ØÐ ØÐ ØÐ ò ñ0 ]Ó+ ò_ñB DÓòh ñT wÓ
|
ñ w-à#*ò 0Ñ L-ØÑ Ø Ñ ×%Ñ% lÕ3à". Ò ð 0ò8òò. ò 'ò /ò*ô Rô R÷ Hñ HôV Iô ÷&;ñ &;ðT
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
Ø
|
ñ Ð ñ& 4Ôñ+ó ð+ñ 4dÔ#ñ(ó $ð(÷VFñ FôREyô EñP 4eÔ$ñNXó %ðNXôbi,Yô i,÷X%ñ %ô]ô ô?" ô ?"ôDCMô Cô." ô ."ôbmô ô=ô ô*Mô ô ô ôMô ô ô ô "]ô "ôBmô ô-ô ô&]ô ô ô ô]ô ôi$Ð'ô i$÷XOñ Oô28Nô 8ô;~ô ;ô8 ;~ô ;ô
|
.ô
|
ô&XNô Xô&Y~ô Yô&XNô Xô&Y~ô Yô&Hnô Hô=
|
ô =
|
÷@
|
ñ
|
ñD Ø
|
×ÒØ × Ò ñ à mmñð ñ óÐ ò-ñ Ø
|
×ÒV× 3Ò 3Ñ3°f·m²mÑCóÐ ñ
|
4ÔàFKñ
|
Ø S%Ð "Ñ#ð
|
Ø?Cð
|
à ò
|
ó ð
|
÷@VUñ @VUòFl+ð* zÒÙ
Fð r
|
