Package pype32 :: Module directories
[hide private]
[frames] | no frames]

Source Code for Module pype32.directories

   1  #!/usr/bin/python 
   2  # -*- coding: utf-8 -*-  
   3   
   4  # Copyright (c) 2013, Nahuel Riva  
   5  # All rights reserved.  
   6  #  
   7  # Redistribution and use in source and binary forms, with or without  
   8  # modification, are permitted provided that the following conditions are met:  
   9  #  
  10  #     * Redistributions of source code must retain the above copyright notice,  
  11  #       this list of conditions and the following disclaimer.  
  12  #     * Redistributions in binary form must reproduce the above copyright  
  13  #       notice,this list of conditions and the following disclaimer in the  
  14  #       documentation and/or other materials provided with the distribution.  
  15  #     * Neither the name of the copyright holder nor the names of its  
  16  #       contributors may be used to endorse or promote products derived from  
  17  #       this software without specific prior written permission.  
  18  #  
  19  # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"  
  20  # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE  
  21  # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE  
  22  # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE  
  23  # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR  
  24  # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF  
  25  # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS  
  26  # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN  
  27  # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)  
  28  # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE  
  29  # POSSIBILITY OF SUCH DAMAGE.  
  30   
  31  """ 
  32  PE directory classes. 
  33  """ 
  34   
  35  __revision__ = "$Id$" 
  36              
  37  import datatypes 
  38  import consts 
  39  import datadirs 
  40  import excep 
  41  import utils 
  42  import baseclasses 
  43  import dotnet 
44 45 # typedef struct IMAGE_BOUND_FORWARDER_REF 46 # { 47 # DWORD TimeDateStamp; 48 # WORD OffsetModuleName; 49 # WORD Reserved; 50 # } 51 -class ImageBoundForwarderRefEntry(baseclasses.BaseStructClass):
52 """ImageBoundForwarderRefEntry object."""
53 - def __init__(self, shouldPack = True):
54 """ 55 This class represents an element of type C{IMAGE_BOUND_FORWARDER_REF}. 56 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx} 57 58 @type shouldPack: bool 59 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 60 """ 61 baseclasses.BaseStructClass.__init__(self, shouldPack) 62 63 self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp. 64 self.offsetModuleName = datatypes.WORD(0) #: L{WORD} offsetModuleName. 65 self.reserved = datatypes.WORD(0) #: L{WORD} reserved. 66 self.moduleName = datatypes.String(shouldPack = False) #: moduleName is metadata, not part of the structure. 67 68 self._attrsList = ["timeDateStamp", "offsetModuleName", "reserved", "moduleName"]
69
70 - def getType(self):
71 """Returns L{consts.IMAGE_BOUND_FORWARDER_REF_ENTRY}.""" 72 return consts.IMAGE_BOUND_FORWARDER_REF_ENTRY
73 74 @staticmethod
75 - def parse(readDataInstance):
76 """ 77 Returns a new L{ImageBoundForwarderRefEntry} object. 78 79 @type readDataInstance: L{ReadData} 80 @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRefEntry} object. 81 82 @rtype: L{ImageBoundForwarderRefEntry} 83 @return: A new L{ImageBoundForwarderRefEntry} object. 84 """ 85 boundForwarderEntry = ImageBoundForwarderRefEntry() 86 boundForwarderEntry.timeDateStamp.value = readDataInstance.readDword() 87 boundForwarderEntry.offsetModuleName.value = readDataInstance.readWord() 88 boundForwarderEntry.reserved.value = readDataInstance.readWord() 89 return boundForwarderEntry
90
91 -class ImageBoundForwarderRef(list):
92 """ImageBoundForwarderRef array object."""
93 - def __init__(self, shouldPack = True):
94 """ 95 This class is a wrapper over an array of C{IMAGE_BOUND_FORWARDER_REF}. 96 97 @type shouldPack: bool 98 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 99 """ 100 list.__init__(self) 101 self.shouldPack = shouldPack
102
103 - def __str__(self):
104 return ''.join([str(x) for x in self if x.shouldPack])
105 106 @staticmethod
107 - def parse(readDataInstance, numberOfEntries):
108 """ 109 Returns a L{ImageBoundForwarderRef} array where every element is a L{ImageBoundForwarderRefEntry} object. 110 111 @type readDataInstance: L{ReadData} 112 @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRef} object. 113 114 @type numberOfEntries: int 115 @param numberOfEntries: The number of C{IMAGE_BOUND_FORWARDER_REF} entries in the array. 116 117 @rtype: L{ImageBoundForwarderRef} 118 @return: A new L{ImageBoundForwarderRef} object. 119 120 @raise DataLengthException: If the L{ReadData} instance has less data than C{NumberOfEntries} * sizeof L{ImageBoundForwarderRefEntry}. 121 """ 122 imageBoundForwarderRefsList = ImageBoundForwarderRef() 123 dLength = len(readDataInstance) 124 entryLength = ImageBoundForwarderRefEntry().sizeof() 125 toRead = numberOfEntries * entryLength 126 127 if dLength >= toRead: 128 for i in range(numberOfEntries): 129 entryData = readDataInstance.read(entryLength) 130 rd = utils.ReadData(entryData) 131 imageBoundForwarderRefsList.append(ImageBoundForwarderRefEntry.parse(rd)) 132 else: 133 raise excep.DataLengthException("Not enough bytes to read.") 134 135 return imageBoundForwarderRefsList
136
137 -class ImageBoundImportDescriptor(list):
138 """ImageBoundImportDescriptor object."""
139 - def __init__(self, shouldPack = True):
140 """ 141 Array of L{ImageBoundImportDescriptorEntry} objects. 142 143 @type shouldPack: bool 144 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 145 """ 146 list.__init__(self) 147 self.shouldPack = shouldPack
148
149 - def __str__(self):
150 return ''.join([str(x) for x in self if x.shouldPack])
151 152 @staticmethod
153 - def parse(readDataInstance):
154 """ 155 Returns a new L{ImageBoundImportDescriptor} object. 156 157 @type readDataInstance: L{ReadData} 158 @param readDataInstance: A L{ReadData} object containing the data to create a new L{ImageBoundImportDescriptor} object. 159 160 @rtype: L{ImageBoundImportDescriptor} 161 @return: A new {ImageBoundImportDescriptor} object. 162 """ 163 ibd = ImageBoundImportDescriptor() 164 165 entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32) 166 readDataInstance.offset = 0 167 while not utils.allZero(entryData): 168 prevOffset = readDataInstance.offset 169 170 boundEntry = ImageBoundImportDescriptorEntry.parse(readDataInstance) 171 172 # if the parsed entry has numberOfModuleForwarderRefs we must adjust the value in the readDataInstance.offset field 173 # in order to point after the last ImageBoundForwarderRefEntry. 174 if boundEntry.numberOfModuleForwarderRefs.value: 175 readDataInstance.offset = prevOffset + (consts.SIZEOF_IMAGE_BOUND_FORWARDER_REF_ENTRY32 * boundEntry.numberOfModuleForwarderRefs.value) 176 else: 177 readDataInstance.offset = prevOffset 178 179 ibd.append(boundEntry) 180 entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32) 181 182 return ibd
183
184 # typedef struct IMAGE_BOUND_IMPORT_DESCRIPTOR 185 # { 186 # DWORD TimeDateStamp; 187 # WORD OffsetModuleName; 188 # WORD NumberOfModuleForwarderRefs; 189 # } 190 -class ImageBoundImportDescriptorEntry(baseclasses.BaseStructClass):
191 """ImageBoundImportDescriptorEntry object."""
192 - def __init__(self, shouldPack = True):
193 """ 194 This class represents a C{IMAGE_BOUND_IMPORT_DESCRIPTOR} structure. 195 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx} 196 197 @type shouldPack: bool 198 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 199 """ 200 baseclasses.BaseStructClass.__init__(self, shouldPack) 201 202 self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp. 203 self.offsetModuleName = datatypes.WORD(0) #: L{WORD} offsetModuleName. 204 self.numberOfModuleForwarderRefs = datatypes.WORD(0)#: L{WORD} numberOfModuleForwarderRefs. 205 self.forwarderRefsList = ImageBoundForwarderRef() #: L{ImageBoundForwarderRef} forwarderRefsList. 206 self.moduleName = datatypes.String(shouldPack = False) #: moduleName is metadata, not part of the structure. 207 208 self._attrsList = ["timeDateStamp", "offsetModuleName", "numberOfModuleForwarderRefs", "forwarderRefsList", "moduleName"]
209
210 - def getType(self):
211 """Returns L{consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY}""" 212 return consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY
213 214 @staticmethod
215 - def parse(readDataInstance):
216 """ 217 Returns a new L{ImageBoundImportDescriptorEntry} object. 218 219 @type readDataInstance: L{ReadData} 220 @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageBoundImportDescriptorEntry}. 221 222 @rtype: L{ImageBoundImportDescriptorEntry} 223 @return: A new {ImageBoundImportDescriptorEntry} object. 224 """ 225 boundEntry = ImageBoundImportDescriptorEntry() 226 boundEntry.timeDateStamp.value = readDataInstance.readDword() 227 boundEntry.offsetModuleName.value = readDataInstance.readWord() 228 boundEntry.numberOfModuleForwarderRefs.value = readDataInstance.readWord() 229 230 numberOfForwarderRefsEntries = boundEntry.numberOfModuleForwarderRefs .value 231 if numberOfForwarderRefsEntries: 232 bytesToRead = numberOfForwarderRefsEntries * ImageBoundForwarderRefEntry().sizeof() 233 rd = utils.ReadData(readDataInstance.read(bytesToRead)) 234 boundEntry.forwarderRefsList = ImageBoundForwarderRef.parse(rd, numberOfForwarderRefsEntries) 235 236 return boundEntry
237
238 -class TLSDirectory(baseclasses.BaseStructClass):
239 """TLS directory object."""
240 - def __init__(self, shouldPack = True):
241 """ 242 Class representation of a C{IMAGE_TLS_DIRECTORY} structure. 243 244 @see: Figure 11 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx} 245 246 @type shouldPack: bool 247 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 248 """ 249 baseclasses.BaseStructClass.__init__(self, shouldPack) 250 251 self.startAddressOfRawData = datatypes.DWORD(0) #: L{DWORD} startAddressOfRawData. 252 self.endAddressOfRawData = datatypes.DWORD(0) #: L{DWORD} endAddressOfRawData. 253 self.addressOfIndex = datatypes.DWORD(0) #: L{DWORD} addressOfIndex. 254 self.addressOfCallbacks = datatypes.DWORD(0) #: L{DWORD} addressOfCallbacks. 255 self.sizeOfZeroFill = datatypes.DWORD(0) #: L{DWORD} sizeOfZeroFill. 256 self.characteristics = datatypes.DWORD(0) #:L{DWORD} characteristics. 257 258 self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\ 259 "sizeOfZeroFill", "characteristics"]
260
261 - def getType(self):
262 """Returns L{consts.TLS_DIRECTORY}.""" 263 return consts.TLS_DIRECTORY32
264 265 @staticmethod
266 - def parse(readDataInstance):
267 """ 268 Returns a new L{TLSDirectory} object. 269 270 @type readDataInstance: L{ReadData} 271 @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory} object. 272 273 @rtype: L{TLSDirectory} 274 @return: A new {TLSDirectory} object. 275 """ 276 tlsDir = TLSDirectory() 277 278 tlsDir.startAddressOfRawData.value = readDataInstance.readDword() 279 tlsDir.endAddressOfRawData.value = readDataInstance.readDword() 280 tlsDir.addressOfIndex.value = readDataInstance.readDword() 281 tlsDir.addressOfCallbacks.value = readDataInstance.readDword() 282 tlsDir.sizeOfZeroFill.value = readDataInstance.readDword() 283 tlsDir.characteristics.value = readDataInstance.readDword() 284 return tlsDir
285
286 -class TLSDirectory64(baseclasses.BaseStructClass):
287 """TLSDirectory64 object."""
288 - def __init__(self, shouldPack = True):
289 """ 290 Class representation of a C{IMAGE_TLS_DIRECTORY} structure in 64 bits systems. 291 292 @type shouldPack: bool 293 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 294 """ 295 baseclasses.BaseStructClass.__init__(self, shouldPack) 296 297 self.startAddressOfRawData = datatypes.QWORD(0) #: L{QWORD} startAddressOfRawData. 298 self.endAddressOfRawData = datatypes.QWORD(0) #: L{QWORD} endAddressOfRawData. 299 self.addressOfIndex = datatypes.QWORD(0) #: L{QWORD} addressOfIndex. 300 self.addressOfCallbacks = datatypes.QWORD(0) #: L{QWORD} addressOfCallbacks. 301 self.sizeOfZeroFill = datatypes.DWORD(0) #: L{DWORD} sizeOfZeroFill. 302 self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics. 303 304 self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\ 305 "sizeOfZeroFill", "characteristics"]
306
307 - def getType(self):
308 """Returns L{consts.TLS_DIRECTORY64}.""" 309 return consts.TLS_DIRECTORY64
310 311 @staticmethod
312 - def parse(readDataInstance):
313 """ 314 Returns a new L{TLSDirectory64} object. 315 316 @type readDataInstance: L{ReadData} 317 @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory64} object. 318 319 @rtype: L{TLSDirectory64} 320 @return: A new L{TLSDirectory64} object. 321 """ 322 tlsDir = TLSDirectory64() 323 324 tlsDir.startAddressOfRawData.value = readDataInstance.readQword() 325 tlsDir.endAddressOfRawData.value = readDataInstance.readQword() 326 tlsDir.addressOfIndex.value = readDataInstance.readQword() 327 tlsDir.addressOfCallbacks.value = readDataInstance.readQword() 328 tlsDir.sizeOfZeroFill.value = readDataInstance.readDword() 329 tlsDir.characteristics.value = readDataInstance.readDword() 330 return tlsDir
331
332 # http://msdn.microsoft.com/en-us/library/windows/desktop/ms680328%28v=vs.85%29.aspx 333 -class ImageLoadConfigDirectory(baseclasses.BaseStructClass):
334 "IMAGE_LOAD_CONFIG_DIRECTORY32 object aka CONFIGURATION_DIRECTORY"
335 - def __init__(self, shouldPack = True):
336 """ 337 Class representation of a C{IMAGE_LOAD_CONFIG_DIRECTORY32} structure. 338 339 @type shouldPack: bool 340 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 341 """ 342 baseclasses.BaseStructClass.__init__(self, shouldPack) 343 344 self.size = datatypes.DWORD() 345 self.timeDateStamp = datatypes.DWORD() 346 self.majorVersion = datatypes.WORD() 347 self.minorVersion = datatypes.WORD() 348 self.globalFlagsClear = datatypes.DWORD() 349 self.globalFlagsSet = datatypes.DWORD() 350 self.criticalSectionDefaultTimeout = datatypes.DWORD() 351 self.deCommitFreeBlockThreshold = datatypes.DWORD() 352 self.deCommitTotalFreeThreshold = datatypes.DWORD() 353 self.lockPrefixTable = datatypes.DWORD() # VA 354 self.maximumAllocationSize = datatypes.DWORD() 355 self.virtualMemoryThreshold = datatypes.DWORD() 356 self.processHeapFlags = datatypes.DWORD() 357 self.processAffinityMask = datatypes.DWORD() 358 self.csdVersion = datatypes.WORD() 359 self.reserved1 = datatypes.WORD() 360 self.editList = datatypes.DWORD() # VA 361 self.securityCookie = datatypes.DWORD() # VA 362 self.SEHandlerTable = datatypes.DWORD() # VA 363 self.SEHandlerCount = datatypes.DWORD() 364 365 # Fields for Control Flow Guard 366 self.GuardCFCheckFunctionPointer = datatypes.DWORD() # VA 367 self.Reserved2 = datatypes.DWORD() 368 self.GuardCFFunctionTable = datatypes.DWORD() # VA 369 self.GuardCFFunctionCount = datatypes.DWORD() 370 self.GuardFlags = datatypes.DWORD() 371 372 self._attrsList = ["size", "timeDateStamp", "majorVersion", "minorVersion", "globalFlagsClear", "globalFlagsSet", "criticalSectionDefaultTimeout", "deCommitFreeBlockThreshold",\ 373 "deCommitTotalFreeThreshold", "lockPrefixTable", "maximumAllocationSize", "virtualMemoryThreshold", "processHeapFlags", "processAffinityMask", "csdVersion",\ 374 "reserved1", "editList", "securityCookie", "SEHandlerTable","SEHandlerCount", "GuardCFCheckFunctionPointer", "Reserved2", "GuardCFFunctionTable",\ 375 "GuardCFFunctionCount", "GuardFlags"]
376
377 - def getType(self):
378 """Returns L{consts.IMAGE_LOAD_CONFIG_DIRECTORY32}.""" 379 return consts.IMAGE_LOAD_CONFIG_DIRECTORY32
380 381 @staticmethod
382 - def parse(readDataInstance):
383 """ 384 Returns a new L{ImageLoadConfigDirectory} object. 385 386 @type readDataInstance: L{ReadData} 387 @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageLoadConfigDirectory} object. 388 389 @rtype: L{ImageLoadConfigDirectory} 390 @return: A new L{ImageLoadConfigDirectory} object. 391 """ 392 configDir = ImageLoadConfigDirectory() 393 394 configDir.size.value = readDataInstance.readDword() 395 configDir.timeDateStamp.value = readDataInstance.readDword() 396 configDir.majorVersion.value = readDataInstance.readWord() 397 configDir.minorVersion.value = readDataInstance.readWord() 398 configDir.globalFlagsClear.value = readDataInstance.readDword() 399 configDir.globalFlagsSet.value = readDataInstance.readDword() 400 configDir.criticalSectionDefaultTimeout.value = readDataInstance.readDword() 401 configDir.deCommitFreeBlockThreshold.value = readDataInstance.readDword() 402 configDir.deCommitTotalFreeThreshold.value = readDataInstance.readDword() 403 configDir.lockPrefixTable.value = readDataInstance.readDword() # VA 404 configDir.maximumAllocationSize.value = readDataInstance.readDword() 405 configDir.virtualMemoryThreshold.value = readDataInstance.readDword() 406 configDir.processHeapFlags.value = readDataInstance.readDword() 407 configDir.processAffinityMask.value = readDataInstance.readDword() 408 configDir.csdVersion.value = readDataInstance.readWord() 409 configDir.reserved1.value = readDataInstance.readWord() 410 configDir.editList.value = readDataInstance.readDword() # VA 411 configDir.securityCookie.value = readDataInstance.readDword() # VA 412 configDir.SEHandlerTable.value = readDataInstance.readDword() # VA 413 configDir.SEHandlerCount.value = readDataInstance.readDword() 414 415 # Fields for Control Flow Guard 416 configDir.GuardCFCheckFunctionPointer.value = readDataInstance.readDword() # VA 417 configDir.Reserved2.value = readDataInstance.readDword() 418 configDir.GuardCFFunctionTable.value = readDataInstance.readDword() # VA 419 configDir.GuardCFFunctionCount.value = readDataInstance.readDword() 420 configDir.GuardFlags.value = readDataInstance.readDword() 421 return configDir
422
423 -class ImageLoadConfigDirectory64(baseclasses.BaseStructClass):
424 "IMAGE_LOAD_CONFIG_DIRECTORY64 object"
425 - def __init__(self, shouldPack = True):
426 """ 427 Class representation of a C{IMAGE_LOAD_CONFIG_DIRECTORY64} structure in 64 bits systems. 428 429 @type shouldPack: bool 430 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 431 """ 432 baseclasses.BaseStructClass.__init__(self, shouldPack) 433 434 self.size = datatypes.DWORD() 435 self.timeDateStamp = datatypes.DWORD() 436 self.majorVersion = datatypes.WORD() 437 self.minorVersion = datatypes.WORD() 438 self.globalFlagsClear = datatypes.DWORD() 439 self.globalFlagsSet = datatypes.DWORD() 440 self.criticalSectionDefaultTimeout = datatypes.DWORD() 441 self.deCommitFreeBlockThreshold = datatypes.QWORD() 442 self.deCommitTotalFreeThreshold = datatypes.QWORD() 443 self.lockPrefixTable = datatypes.QWORD() 444 self.maximumAllocationSize = datatypes.QWORD() 445 self.virtualMemoryThreshold = datatypes.QWORD() 446 self.processAffinityMask = datatypes.QWORD() 447 self.processHeapFlags = datatypes.DWORD() 448 self.cdsVersion = datatypes.WORD() 449 self.reserved1 = datatypes.WORD() 450 self.editList = datatypes.QWORD() 451 self.securityCookie = datatypes.QWORD() 452 self.SEHandlerTable = datatypes.QWORD() 453 self.SEHandlerCount = datatypes.QWORD() 454 455 # Fields for Control Flow Guard 456 self.GuardCFCheckFunctionPointer = datatypes.QWORD() # VA 457 self.Reserved2 = datatypes.QWORD() 458 self.GuardCFFunctionTable = datatypes.QWORD() # VA 459 self.GuardCFFunctionCount = datatypes.QWORD() 460 self.GuardFlags = datatypes.QWORD() 461 462 self._attrsList = ["size", "timeDateStamp", "majorVersion", "minorVersion", "globalFlagsClear", "globalFlagsSet", "criticalSectionDefaultTimeout", "deCommitFreeBlockThreshold",\ 463 "deCommitTotalFreeThreshold", "lockPrefixTable", "maximumAllocationSize", "virtualMemoryThreshold", "processAffinityMask", "processHeapFlags", "cdsVersion",\ 464 "reserved1", "editList", "securityCookie", "SEHandlerTable", "SEHandlerCount", "GuardCFCheckFunctionPointer", "Reserved2", "GuardCFFunctionTable",\ 465 "GuardCFFunctionCount", "GuardFlags"]
466 467
468 - def getType(self):
469 """Returns L{consts.IMAGE_LOAD_CONFIG_DIRECTORY64}.""" 470 return consts.IMAGE_LOAD_CONFIG_DIRECTORY64
471 472 @staticmethod
473 - def parse(readDataInstance):
474 """ 475 Returns a new L{ImageLoadConfigDirectory64} object. 476 477 @type readDataInstance: L{ReadData} 478 @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageLoadConfigDirectory64} object. 479 480 @rtype: L{ImageLoadConfigDirectory64} 481 @return: A new L{ImageLoadConfigDirectory64} object. 482 """ 483 configDir = ImageLoadConfigDirectory64() 484 485 configDir.size.value = readDataInstance.readDword() 486 configDir.timeDateStamp.value = readDataInstance.readDword() 487 configDir.majorVersion.value = readDataInstance.readWord() 488 configDir.minorVersion.value = readDataInstance.readWord() 489 configDir.globalFlagsClear.value = readDataInstance.readDword() 490 configDir.globalFlagsSet.value = readDataInstance.readDword() 491 configDir.criticalSectionDefaultTimeout.value = readDataInstance.readDword() 492 configDir.deCommitFreeBlockThreshold.value = readDataInstance.readQword() 493 configDir.deCommitTotalFreeThreshold.value = readDataInstance.readQword() 494 configDir.lockPrefixTable.value = readDataInstance.readQword() 495 configDir.maximumAllocationSize.value = readDataInstance.readQword() 496 configDir.virtualMemoryThreshold.value = readDataInstance.readQword() 497 configDir.processAffinityMask.value = readDataInstance.readQword() 498 configDir.processHeapFlags.value = readDataInstance.readDword() 499 configDir.cdsVersion.value = readDataInstance.readWord() 500 configDir.reserved1.value = readDataInstance.readWord() 501 configDir.editList.value = readDataInstance.readQword() 502 configDir.securityCookie.value = readDataInstance.readQword() 503 configDir.SEHandlerTable.value = readDataInstance.readQword() 504 configDir.SEHandlerCount.value = readDataInstance.readQword() 505 506 # Fields for Control Flow Guard 507 configDir.GuardCFCheckFunctionPointer.value = readDataInstance.readQword() # VA 508 configDir.Reserved2.value = readDataInstance.readQword() 509 configDir.GuardCFFunctionTable.value = readDataInstance.readQword() # VA 510 configDir.GuardCFFunctionCount.value = readDataInstance.readQword() 511 configDir.GuardFlags.value = readDataInstance.readQword() 512 return configDir
513
514 -class ImageBaseRelocationEntry(baseclasses.BaseStructClass):
515 """ImageBaseRelocationEntry object."""
516 - def __init__(self, shouldPack = True):
517 """ 518 A class representation of a C{IMAGE_BASE_RELOCATION} structure. 519 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx} 520 521 @type shouldPack: bool 522 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 523 """ 524 baseclasses.BaseStructClass.__init__(self, shouldPack) 525 526 self.virtualAddress = datatypes.DWORD(0) #: L{DWORD} virtualAddress. 527 self.sizeOfBlock = datatypes.DWORD(0) #: L{DWORD} sizeOfBlock 528 self.items = datatypes.Array(datatypes.TYPE_WORD) #: L{Array} items. 529 530 self._attrsList = ["virtualAddress", "sizeOfBlock", "items"]
531
532 - def getType(self):
533 """Returns L{consts.IMAGE_BASE_RELOCATION_ENTRY}.""" 534 return consts.IMAGE_BASE_RELOCATION_ENTRY
535 536 @staticmethod
537 - def parse(readDataInstance):
538 """ 539 Returns a new L{ImageBaseRelocationEntry} object. 540 541 @type readDataInstance: L{ReadData} 542 @param readDataInstance: A L{ReadData} object with data to parse as a L{ImageBaseRelocationEntry} object. 543 544 @rtype: L{ImageBaseRelocationEntry} 545 @return: A new L{ImageBaseRelocationEntry} object. 546 """ 547 reloc = ImageBaseRelocationEntry() 548 reloc.virtualAddress.value = readDataInstance.readDword() 549 reloc.sizeOfBlock.value = readDataInstance.readDword() 550 toRead = (reloc.sizeOfBlock.value - 8) / len(datatypes.WORD(0)) 551 reloc.items = datatypes.Array.parse(readDataInstance, datatypes.TYPE_WORD, toRead) 552 return reloc
553
554 -class ImageBaseRelocation(list):
555 """ImageBaseRelocation array.""" 556 pass
557
558 -class ImageDebugDirectory(baseclasses.BaseStructClass):
559 """ImageDebugDirectory object."""
560 - def __init__(self, shouldPack = True):
561 """ 562 Class representation of a C{IMAGE_DEBUG_DIRECTORY} structure. 563 @see: U{http://msdn.microsoft.com/es-es/library/windows/desktop/ms680307%28v=vs.85%29.aspx} 564 565 @type shouldPack: bool 566 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 567 """ 568 baseclasses.BaseStructClass.__init__(self, shouldPack) 569 570 self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics. 571 self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp. 572 self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion. 573 self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion. 574 self.type = datatypes.DWORD(0) #: L{DWORD} type. 575 self.sizeOfData = datatypes.DWORD(0) #: L{DWORD} sizeOfData. 576 self.addressOfData = datatypes.DWORD(0) #: L{DWORD} addressOfData. 577 self.pointerToRawData = datatypes.DWORD(0) #: L{DWORD} pointerToRawData. 578 579 self._attrsList = ["characteristics", "timeDateStamp", "majorVersion", "minorVersion", "type", "sizeOfData",\ 580 "addressOfData", "pointerToRawData"]
581
582 - def getType(self):
583 """Returns L{consts.IMAGE_DEBUG_DIRECTORY}.""" 584 return consts.IMAGE_DEBUG_DIRECTORY
585 586 @staticmethod
587 - def parse(readDataInstance):
588 """ 589 Returns a new L{ImageDebugDirectory} object. 590 591 @type readDataInstance: L{ReadData} 592 @param readDataInstance: A new L{ReadData} object with data to be parsed as a L{ImageDebugDirectory} object. 593 594 @rtype: L{ImageDebugDirectory} 595 @return: A new L{ImageDebugDirectory} object. 596 """ 597 dbgDir = ImageDebugDirectory() 598 599 dbgDir.characteristics.value = readDataInstance.readDword() 600 dbgDir.timeDateStamp.value = readDataInstance.readDword() 601 dbgDir.majorVersion.value = readDataInstance.readWord() 602 dbgDir.minorVersion.value = readDataInstance.readWord() 603 dbgDir.type.value = readDataInstance.readDword() 604 dbgDir.sizeOfData.value = readDataInstance.readDword() 605 dbgDir.addressOfData.value = readDataInstance.readDword() 606 dbgDir.pointerToRawData.value = readDataInstance.readDword() 607 608 return dbgDir
609
610 -class ImageDebugDirectories(list):
611 """ImageDebugDirectories object."""
612 - def __init__(self, shouldPack = True):
613 """ 614 Array of L{ImageDebugDirectory} objects. 615 616 @type shouldPack: bool 617 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 618 """ 619 self.shouldPack = shouldPack
620
621 - def __str__(self):
622 return ''.join([str(x) for x in self if self.shouldPack])
623
624 - def getType(self):
625 """"Returns L{consts.IMAGE_DEBUG_DIRECTORIES}.""" 626 return consts.IMAGE_DEBUG_DIRECTORIES
627 628 @staticmethod
629 - def parse(readDataInstance, nDebugEntries):
630 """ 631 Returns a new L{ImageDebugDirectories} object. 632 633 @type readDataInstance: L{ReadData} 634 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageDebugDirectories} object. 635 636 @type nDebugEntries: int 637 @param nDebugEntries: Number of L{ImageDebugDirectory} objects in the C{readDataInstance} object. 638 639 @rtype: L{ImageDebugDirectories} 640 @return: A new L{ImageDebugDirectories} object. 641 642 @raise DataLengthException: If not enough data to read in the C{readDataInstance} object. 643 """ 644 dbgEntries = ImageDebugDirectories() 645 646 dataLength = len(readDataInstance) 647 toRead = nDebugEntries * consts.SIZEOF_IMAGE_DEBUG_ENTRY32 648 if dataLength >= toRead: 649 for i in range(nDebugEntries): 650 dbgEntry = ImageDebugDirectory.parse(readDataInstance) 651 dbgEntries.append(dbgEntry) 652 else: 653 raise excep.DataLengthException("Not enough bytes to read.") 654 655 return dbgEntries
656
657 -class ImageImportDescriptorMetaData(baseclasses.BaseStructClass):
658 """ImageImportDescriptorMetaData object."""
659 - def __init__(self, shouldPack = True):
660 """ 661 Class used to store metadata from the L{ImageImportDescriptor} object. 662 663 @type shouldPack: bool 664 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 665 """ 666 baseclasses.BaseStructClass.__init__(self, shouldPack) 667 668 self.moduleName = datatypes.String("") #: L{String} moduleName. 669 self.numberOfImports = datatypes.DWORD(0) #: L{DWORD} numberOfImports. 670 671 self._attrsList = ["moduleName", "numberOfImports"]
672
673 - def getType(self):
674 """Returns L{consts.IID_METADATA}.""" 675 return consts.IID_METADATA
676
677 -class ImageImportDescriptorEntry(baseclasses.BaseStructClass):
678 """ImageImportDescriptorEntry object."""
679 - def __init__(self, shouldPack = True):
680 """ 681 Class representation of a C{IMAGE_IMPORT_DESCRIPTOR} structure. 682 @see: Figure 5 U{http://msdn.microsoft.com/es-ar/magazine/bb985996%28en-us%29.aspx} 683 684 @type shouldPack: bool 685 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 686 """ 687 baseclasses.BaseStructClass.__init__(self, shouldPack) 688 689 self.metaData = ImageImportDescriptorMetaData() #: L{ImageImportDescriptorMetaData} metaData. 690 691 self.originalFirstThunk = datatypes.DWORD(0) #: L{DWORD} originalFirstThunk. 692 self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp. 693 self.forwarderChain = datatypes.DWORD(0) #: L{DWORD} forwarderChain. 694 self.name = datatypes.DWORD(0) #: L{DWORD} name. 695 self.firstThunk = datatypes.DWORD(0) #: L{DWORD} firstThunk. 696 697 self.iat = ImportAddressTable() #: L{ImportAddressTable} iat. 698 699 self._attrsList = ["originalFirstThunk", "timeDateStamp", "forwarderChain", "name", "firstThunk"]
700 701 @staticmethod
702 - def parse(readDataInstance):
703 """ 704 Returns a new L{ImageImportDescriptorEntry} object. 705 706 @type readDataInstance: L{ReadData} 707 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptorEntry}. 708 709 @rtype: L{ImageImportDescriptorEntry} 710 @return: A new L{ImageImportDescriptorEntry} object. 711 """ 712 iid = ImageImportDescriptorEntry() 713 iid.originalFirstThunk.value = readDataInstance.readDword() 714 iid.timeDateStamp.value = readDataInstance.readDword() 715 iid.forwarderChain.value = readDataInstance.readDword() 716 iid.name.value = readDataInstance.readDword() 717 iid.firstThunk.value = readDataInstance.readDword() 718 return iid
719
720 - def getType(self):
721 """Returns C{consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY}.""" 722 return consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY
723
724 -class ImageImportDescriptor(list):
725 """ImageImportDescriptor object."""
726 - def __init__(self, shouldPack = True):
727 """ 728 Array of L{ImageImportDescriptorEntry} objects. 729 730 @type shouldPack: bool 731 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 732 """ 733 self.shouldPack = shouldPack
734
735 - def __str__(self):
736 return ''.join([str(x) for x in self if x.shouldPack])
737
738 - def getType(self):
739 """Returns L{consts.IMAGE_IMPORT_DESCRIPTOR}.""" 740 return consts.IMAGE_IMPORT_DESCRIPTOR
741 742 @staticmethod
743 - def parse(readDataInstance, nEntries):
744 """ 745 Returns a new L{ImageImportDescriptor} object. 746 747 @type readDataInstance: L{ReadData} 748 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptor} object. 749 750 @type nEntries: int 751 @param nEntries: The number of L{ImageImportDescriptorEntry} objects in the C{readDataInstance} object. 752 753 @rtype: L{ImageImportDescriptor} 754 @return: A new L{ImageImportDescriptor} object. 755 756 @raise DataLengthException: If not enough data to read. 757 """ 758 importEntries = ImageImportDescriptor() 759 760 dataLength = len(readDataInstance) 761 toRead = nEntries * consts.SIZEOF_IMAGE_IMPORT_ENTRY32 762 if dataLength >= toRead: 763 for i in range(nEntries): 764 importEntry = ImageImportDescriptorEntry.parse(readDataInstance) 765 importEntries.append(importEntry) 766 else: 767 raise excep.DataLengthException("Not enough bytes to read.") 768 769 return importEntries
770
771 -class ImportAddressTableEntry(baseclasses.BaseStructClass):
772 """ImportAddressTableEntry object."""
773 - def __init__(self, shouldPack = True):
774 """ 775 A class representation of a C{} structure. 776 777 @type shouldPack: bool 778 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 779 """ 780 baseclasses.BaseStructClass.__init__(self, shouldPack) 781 782 self.firstThunk = datatypes.DWORD(0) #: L{DWORD} firstThunk. 783 self.originalFirstThunk = datatypes.DWORD(0) #: L{DWORD} originalFirstThunk. 784 self.hint = datatypes.WORD(0) #: L{WORD} hint. 785 self.name = datatypes.String("") #: L{String} name. 786 787 self._attrsList = ["firstThunk", "originalFirstThunk", "hint", "name"]
788
789 - def getType(self):
790 """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY}.""" 791 return consts.IMPORT_ADDRESS_TABLE_ENTRY
792
793 -class ImportAddressTableEntry64(baseclasses.BaseStructClass):
794 """ImportAddressTableEntry64 object."""
795 - def __init__(self, shouldPack = True):
796 """ 797 A class representation of a C{} structure. 798 799 @type shouldPack: bool 800 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 801 """ 802 baseclasses.BaseStructClass.__init__(self, shouldPack) 803 804 self.firstThunk = datatypes.QWORD(0) #: L{QWORD} firstThunk. 805 self.originalFirstThunk = datatypes.QWORD(0) #: L{QWORD} originalFirstThunk. 806 self.hint = datatypes.WORD(0) #: L{WORD} hint. 807 self.name = datatypes.String("") #: L{String} name. 808 809 self._attrsList = ["firstThunk", "originalFirstThunk", "hint", "name"]
810
811 - def getType(self):
812 """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY64}.""" 813 return consts.IMPORT_ADDRESS_TABLE_ENTRY64
814
815 -class ImportAddressTable(list):
816 """Array of L{ImportAddressTableEntry} objects.""" 817 pass
818
819 -class ExportTable(list):
820 """Array of L{ExportTableEntry} objects.""" 821 pass
822
823 -class ExportTableEntry(baseclasses.BaseStructClass):
824 """ExportTableEntry object."""
825 - def __init__(self, shouldPack = True):
826 """ 827 A class representation of a C{} structure. 828 829 @type shouldPack: bool 830 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 831 """ 832 baseclasses.BaseStructClass.__init__(self, shouldPack) 833 834 self.ordinal = datatypes.DWORD(0) #: L{DWORD} ordinal. 835 self.functionRva = datatypes.DWORD(0) #: L{DWORD} functionRva. 836 self.nameOrdinal = datatypes.WORD(0) #: L{WORD} nameOrdinal. 837 self.nameRva = datatypes.DWORD(0) #: L{DWORD} nameRva. 838 self.name = datatypes.String("") #: L{String} name. 839 840 self._attrsList = ["ordinal", "functionRva", "nameOrdinal", "nameRva", "name"]
841
842 - def __repr__(self):
843 return repr((self.ordinal, self.functionRva, self.nameOrdinal, self.nameRva, self.name))
844
845 - def getType(self):
846 """Returns L{consts.EXPORT_TABLE_ENTRY}.""" 847 return consts.EXPORT_TABLE_ENTRY
848 849 @staticmethod
850 - def parse(readDataInstance):
851 """ 852 Returns a new L{ExportTableEntry} object. 853 854 @type readDataInstance: L{ReadData} 855 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ExportTableEntry} object. 856 857 @rtype: L{ExportTableEntry} 858 @return: A new L{ExportTableEntry} object. 859 """ 860 exportEntry = ExportTableEntry() 861 862 exportEntry.functionRva.value = readDataInstance.readDword() 863 exportEntry.nameOrdinal.value = readDataInstance.readWord() 864 exportEntry.nameRva.value = readDataInstance.readDword() 865 exportEntry.name.value = readDataInstance.readString() 866 return exportEntry
867
868 -class ImageExportTable(baseclasses.BaseStructClass):
869 """ImageExportTable object."""
870 - def __init__(self, shouldPack = True):
871 """ 872 Class representation of a C{IMAGE_EXPORT_DIRECTORY} structure. 873 @see: Figure 2 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx} 874 875 @type shouldPack: bool 876 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 877 """ 878 baseclasses.BaseStructClass.__init__(self, shouldPack) 879 880 self.exportTable = ExportTable() 881 882 self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics. 883 self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp. 884 self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion. 885 self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion. 886 self.name = datatypes.DWORD(0) #: L{DWORD} name. 887 self.base = datatypes.DWORD(0) #: L{DWORD} base. 888 self.numberOfFunctions = datatypes.DWORD(0) #: L{DWORD} numberOfFunctions. 889 self.numberOfNames = datatypes.DWORD(0) #: L{DWORD} numberOfNames. 890 self.addressOfFunctions = datatypes.DWORD(0) #: L{DWORD} addressOfFunctions. 891 self.addressOfNames = datatypes.DWORD(0) #: L{DWORD} addressOfNames. 892 self.addressOfNameOrdinals = datatypes.DWORD(0) #: L{DWORD} addressOfNamesOrdinals. 893 894 self._attrsList = ["characteristics", "timeDateStamp", "majorVersion", "minorVersion", "name", "base", "numberOfFunctions",\ 895 "numberOfNames", "addressOfFunctions", "addressOfNames", "addressOfNameOrdinals"]
896
897 - def getType(self):
898 """Returns L{consts.EXPORT_DIRECTORY}.""" 899 return consts.EXPORT_DIRECTORY
900 901 @staticmethod
902 - def parse(readDataInstance):
903 """ 904 Returns a new L{ImageExportTable} object. 905 906 @type readDataInstance: L{ReadData} 907 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageExportTable} object. 908 909 @rtype: L{ImageExportTable} 910 @return: A new L{ImageExportTable} object. 911 """ 912 et = ImageExportTable() 913 914 et.characteristics.value = readDataInstance.readDword() 915 et.timeDateStamp.value = readDataInstance.readDword() 916 et.majorVersion.value = readDataInstance.readWord() 917 et.minorVersion.value = readDataInstance.readWord() 918 et.name.value = readDataInstance.readDword() 919 et.base.value = readDataInstance.readDword() 920 et.numberOfFunctions.value = readDataInstance.readDword() 921 et.numberOfNames.value = readDataInstance.readDword() 922 et.addressOfFunctions.value = readDataInstance.readDword() 923 et.addressOfNames.value = readDataInstance.readDword() 924 et.addressOfNameOrdinals.value = readDataInstance.readDword() 925 return et
926
927 -class NETDirectory(baseclasses.BaseStructClass):
928 """NETDirectory object."""
929 - def __init__(self, shouldPack = True):
930 """ 931 A class to abstract data from the .NET PE format. 932 933 @type shouldPack: bool 934 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 935 """ 936 baseclasses.BaseStructClass.__init__(self, shouldPack) 937 938 self.directory = NetDirectory() #: L{NetDirectory} directory. 939 self.netMetaDataHeader = NetMetaDataHeader() #: L{NetMetaDataHeader} netMetaDataHeader. 940 self.netMetaDataStreams = NetMetaDataStreams() #: L{NetMetaDataStreams} netMetaDataStreams. 941 942 self._attrsList = ["directory", "netMetaDataHeader", "netMetaDataStreams"]
943 944 @staticmethod
945 - def parse(readDataInstance):
946 """ 947 Returns a new L{NETDirectory} object. 948 949 @type readDataInstance: L{ReadData} 950 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NETDirectory} object. 951 952 @rtype: L{NETDirectory} 953 @return: A new L{NETDirectory} object. 954 """ 955 nd = NETDirectory() 956 957 nd.directory = NetDirectory.parse(readDataInstance) 958 nd.netMetaDataHeader = NetMetaDataHeader.parse(readDataInstance) 959 nd.netMetaDataStreams = NetMetaDataStreams.parse(readDataInstance) 960 return nd
961
962 - def getType(self):
963 """Returns L{consts.NET_DIRECTORY}.""" 964 return consts.NET_DIRECTORY
965
966 -class NetDirectory(baseclasses.BaseStructClass):
967 """NetDirectory object."""
968 - def __init__(self, shouldPack = True):
969 """ 970 A class representation of the C{IMAGE_COR20_HEADER} structure. 971 @see: U{http://www.ntcore.com/files/dotnetformat.htm} 972 973 @type shouldPack: bool 974 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed. 975 """ 976 baseclasses.BaseStructClass.__init__(self, shouldPack) 977 978 self.cb = datatypes.DWORD(0) #: L{DWORD} cb. 979 self.majorRuntimeVersion = datatypes.WORD(0) #: L{WORD} majorRuntimeVersion. 980 self.minorRuntimeVersion = datatypes.WORD(0) #: L{WORD} minorRuntimeVersion. 981 self.metaData = datadirs.Directory() #: L{Directory} metaData. 982 self.flags = datatypes.DWORD(0) #: L{DWORD} flags. 983 self.entryPointToken = datatypes.DWORD(0) #: L{DWORD} entryPointToken. 984 self.resources = datadirs.Directory() #: L{Directory} resources. 985 self.strongNameSignature = datadirs.Directory() #: L{Directory} strongNameSignature. 986 self.codeManagerTable = datadirs.Directory() #: L{Directory} codeManagerTable. 987 self.vTableFixups = datadirs.Directory() #: L{Directory} vTableFixups. 988 self.exportAddressTableJumps = datadirs.Directory() #: L{Directory} exportAddressTableJumps. 989 self.managedNativeHeader = datadirs.Directory() #: L{Directory} managedNativeHeader. 990 991 self._attrsList = ["cb","majorRuntimeVersion","minorRuntimeVersion","metaData", \ 992 "flags","entryPointToken","resources","strongNameSignature",\ 993 "codeManagerTable","vTableFixups", "exportAddressTableJumps",\ 994 "managedNativeHeader"]
995
996 - def getType(self):
997 """Returns L{consts.IMAGE_COR20_HEADER}.""" 998 return consts.IMAGE_COR20_HEADER
999 1000 @staticmethod
1001 - def parse(readDataInstance):
1002 """ 1003 Returns a new L{NetDirectory} object. 1004 1005 @type readDataInstance: L{ReadData} 1006 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetDirectory} object. 1007 1008 @rtype: L{NetDirectory} 1009 @return: A new L{NetDirectory} object. 1010 """ 1011 nd = NetDirectory() 1012 1013 nd.cb.value = readDataInstance.readDword() 1014 nd.majorRuntimeVersion.value= readDataInstance.readWord() 1015 nd.minorRuntimeVersion.value = readDataInstance.readWord() 1016 1017 nd.metaData.rva.value = readDataInstance.readDword() 1018 nd.metaData.size.value = readDataInstance.readDword() 1019 nd.metaData.name.value = "MetaData" 1020 1021 nd.flags.value = readDataInstance.readDword() 1022 nd.entryPointToken.value = readDataInstance.readDword() 1023 1024 nd.resources.rva.value = readDataInstance.readDword() 1025 nd.resources.size.value = readDataInstance.readDword() 1026 nd.resources.name.value = "Resources" 1027 1028 nd.strongNameSignature.rva.value = readDataInstance.readDword() 1029 nd.strongNameSignature.size.value = readDataInstance.readDword() 1030 nd.strongNameSignature.name.value = "StrongNameSignature" 1031 1032 nd.codeManagerTable.rva.value = readDataInstance.readDword() 1033 nd.codeManagerTable.size.value = readDataInstance.readDword() 1034 nd.codeManagerTable.name.value = "CodeManagerTable" 1035 1036 nd.vTableFixups.rva.value = readDataInstance.readDword() 1037 nd.vTableFixups.size.value = readDataInstance.readDword() 1038 nd.vTableFixups.name.value = "VTableFixups" 1039 1040 nd.exportAddressTableJumps.rva.value = readDataInstance.readDword() 1041 nd.exportAddressTableJumps.size.value = readDataInstance.readDword() 1042 nd.exportAddressTableJumps.name.value = "ExportAddressTableJumps" 1043 1044 nd.managedNativeHeader.rva.value = readDataInstance.readDword() 1045 nd.managedNativeHeader.size.value = readDataInstance.readDword() 1046 nd.managedNativeHeader.name.value = "ManagedNativeHeader" 1047 1048 return nd
1049
1050 -class NetMetaDataHeader(baseclasses.BaseStructClass):
1051 """NetMetaDataHeader object."""
1052 - def __init__(self, shouldPack = True):
1053 baseclasses.BaseStructClass.__init__(self, shouldPack) 1054 1055 self.signature = datatypes.DWORD(0) #: L{DWORD} signature. 1056 self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion. 1057 self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion. 1058 self.reserved = datatypes.DWORD(0) #: L{DWORD} reserved. 1059 self.versionLength = datatypes.DWORD(0) #: L{DWORD} versionLength. 1060 self.versionString = datatypes.AlignedString("") #: L{AlignedString} versionString. 1061 self.flags = datatypes.WORD(0) #: L{WORD} flags. 1062 self.numberOfStreams = datatypes.WORD(0) #: L{WORD} numberOfStreams. 1063 1064 self._attrsList = ["signature","majorVersion","minorVersion","reserved","versionLength","versionString","flags","numberOfStreams"]
1065
1066 - def getType(self):
1067 """Returns L{consts.NET_METADATA_HEADER}.""" 1068 return consts.NET_METADATA_HEADER
1069 1070 @staticmethod
1071 - def parse(readDataInstance):
1072 """ 1073 Returns a new L{NetMetaDataHeader} object. 1074 1075 @type readDataInstance: L{ReadData} 1076 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataHeader} object. 1077 1078 @rtype: L{NetMetaDataHeader} 1079 @return: A new L{NetMetaDataHeader} object. 1080 """ 1081 nmh = NetMetaDataHeader() 1082 1083 nmh.signature.value = readDataInstance.readDword() 1084 nmh.majorVersion.value = readDataInstance.readWord() 1085 nmh.minorVersion.value = readDataInstance.readWord() 1086 nmh.reserved.value = readDataInstance.readDword() 1087 nmh.versionLength.value = readDataInstance.readDword() 1088 nmh.versionString.value = readDataInstance.readAlignedString() 1089 nmh.flags.value = readDataInstance.readWord() 1090 nmh.numberOfStreams.value = readDataInstance.readWord() 1091 return nmh
1092
1093 -class NetMetaDataStreamEntry(baseclasses.BaseStructClass):
1094 """NetMetaDataStreamEntry object."""
1095 - def __init__(self, shouldPack = True):
1096 baseclasses.BaseStructClass.__init__(self, shouldPack) 1097 1098 self.offset = datatypes.DWORD(0) #: L{DWORD} offset. 1099 self.size = datatypes.DWORD(0) #: L{DWORD} size. 1100 # this must be aligned to the next 4-byte boundary 1101 self.name = datatypes.AlignedString("") #: L{AlignedString} name. 1102 # the "info" attribute does not belong to the NETMetaDataStreamEntry struct. It is just a place holder where the 1103 # data for every entry will be stored. 1104 self.info = None 1105 1106 self._attrsList = ["offset", "size", "name", "info"]
1107
1108 - def getType(self):
1109 """Returns L{consts.NET_METADATA_STREAM_ENTRY}.""" 1110 return consts.NET_METADATA_STREAM_ENTRY
1111 1112 @staticmethod
1113 - def parse(readDataInstance):
1114 """ 1115 Returns a new L{NetMetaDataStreamEntry} object. 1116 1117 @type readDataInstance: L{ReadData} 1118 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataStreamEntry}. 1119 1120 @rtype: L{NetMetaDataStreamEntry} 1121 @return: A new L{NetMetaDataStreamEntry} object. 1122 """ 1123 n = NetMetaDataStreamEntry() 1124 n.offset.value = readDataInstance.readDword() 1125 n.size.value = readDataInstance.readDword() 1126 n.name.value = readDataInstance.readAlignedString() 1127 return n
1128
1129 -class NetMetaDataStreams(dict):
1130 """NetMetaDataStreams object."""
1131 - def __init__(self, shouldPack = True):
1132 self.shouldPack = shouldPack
1133
1134 - def __str__(self):
1135 return "".join([str(x) for x in self if hasattr(x, "shouldPack") and x.shouldPack])
1136
1137 - def getByNumber(self, number):
1138 return self.get(name)
1139
1140 - def getByName(self, name):
1141 return self.get(name)
1142
1143 - def getType(self):
1144 """Returns L{consts.NET_METADATA_STREAMS}.""" 1145 return consts.NET_METADATA_STREAMS
1146 1147 @staticmethod
1148 - def parse(readDataInstance, nStreams):
1149 """ 1150 Returns a new L{NetMetaDataStreams} object. 1151 1152 @type readDataInstance: L{ReadData} 1153 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataStreams} object. 1154 1155 @type nStreams: int 1156 @param nStreams: The number of L{NetMetaDataStreamEntry} objects in the C{readDataInstance} object. 1157 1158 @rtype: L{NetMetaDataStreams} 1159 @return: A new L{NetMetaDataStreams} object. 1160 """ 1161 streams = NetMetaDataStreams() 1162 1163 for i in range(nStreams): 1164 streamEntry = NetMetaDataStreamEntry() 1165 1166 streamEntry.offset.value = readDataInstance.readDword() 1167 streamEntry.size.value = readDataInstance.readDword() 1168 streamEntry.name.value = readDataInstance.readAlignedString() 1169 1170 #streams.append(streamEntry) 1171 streams.update({ i: streamEntry, streamEntry.name.value: streamEntry }) 1172 1173 return streams
1174
1175 -class NetMetaDataTableHeader(baseclasses.BaseStructClass):
1176 """NetMetaDataTableHeader object."""
1177 - def __init__(self, shouldPack = True):
1178 baseclasses.BaseStructClass.__init__(self, shouldPack) 1179 1180 self.reserved_1 = datatypes.DWORD(0) #: L{DWORD} reserved_1. 1181 self.majorVersion = datatypes.BYTE(0) #: L{BYTE} majorVersion. 1182 self.minorVersion = datatypes.BYTE(0) #: L{BYTE} minorVersion. 1183 self.heapOffsetSizes = datatypes.BYTE(0) #: L{BYTE} heapOffsetSizes. 1184 self.reserved_2 = datatypes.BYTE(0) #: L{BYTE} reserved_2. 1185 self.maskValid = datatypes.QWORD(0) #: L{QWORD} maskValid. 1186 self.maskSorted = datatypes.QWORD(0) #: L{QWORD} maskSorted. 1187 1188 self._attrsList = ["reserved_1", "majorVersion", "minorVersion", "heapOffsetSizes", "reserved_2", "maskValid", "maskSorted"]
1189
1190 - def getType(self):
1191 """Returns L{consts.NET_METADATA_TABLE_HEADER}.""" 1192 return consts.NET_METADATA_TABLE_HEADER
1193 1194 @staticmethod
1195 - def parse(readDataInstance):
1196 """ 1197 Returns a new L{NetMetaDataTableHeader} object. 1198 1199 @type readDataInstance: L{ReadData} 1200 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataTableHeader} object. 1201 1202 @rtype: L{NetMetaDataTableHeader} 1203 @return: A new L{NetMetaDataTableHeader} object. 1204 """ 1205 th = NetMetaDataTableHeader() 1206 1207 th.reserved_1.value = readDataInstance.readDword() 1208 th.majorVersion.value = readDataInstance.readByte() 1209 th.minorVersion.value = readDataInstance.readByte() 1210 th.heapOffsetSizes.value = readDataInstance.readByte() 1211 th.reserved_2.value = readDataInstance.readByte() 1212 th.maskValid.value = readDataInstance.readQword() 1213 th.maskSorted.value = readDataInstance.readQword() 1214 1215 return th
1216
1217 -class NetMetaDataTables(baseclasses.BaseStructClass):
1218 """NetMetaDataTables object."""
1219 - def __init__(self, shouldPack = True):
1220 """ 1221 NetMetaDataTables object. 1222 1223 @todo: Parse every table in this struct and store them in the C{self.tables} attribute. 1224 """ 1225 baseclasses.BaseStructClass.__init__(self, shouldPack) 1226 1227 self.netMetaDataTableHeader = NetMetaDataTableHeader() #: L{NetMetaDataTableHeader} netMetaDataTableHeader. 1228 self.tables = None #: C{str} tables. 1229 1230 self._attrsList = ["netMetaDataTableHeader", "tables"]
1231
1232 - def getType(self):
1233 """Returns L{consts.NET_METADATA_TABLES}.""" 1234 return consts.NET_METADATA_TABLES
1235 1236 @staticmethod
1237 - def parse(readDataInstance, netMetaDataStreams):
1238 """ 1239 Returns a new L{NetMetaDataTables} object. 1240 1241 @type readDataInstance: L{ReadData} 1242 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataTables} object. 1243 1244 @rtype: L{NetMetaDataTables} 1245 @return: A new L{NetMetaDataTables} object. 1246 """ 1247 dt = NetMetaDataTables() 1248 dt.netMetaDataTableHeader = NetMetaDataTableHeader.parse(readDataInstance) 1249 dt.tables = {} 1250 1251 metadataTableDefinitions = dotnet.MetadataTableDefinitions(dt, netMetaDataStreams) 1252 1253 for i in xrange(64): 1254 dt.tables[i] = { "rows": 0 } 1255 if dt.netMetaDataTableHeader.maskValid.value >> i & 1: 1256 dt.tables[i]["rows"] = readDataInstance.readDword() 1257 if i in dotnet.MetadataTableNames: 1258 dt.tables[dotnet.MetadataTableNames[i]] = dt.tables[i] 1259 1260 for i in xrange(64): 1261 dt.tables[i]["data"] = [] 1262 for j in range(dt.tables[i]["rows"]): 1263 row = None 1264 if i in metadataTableDefinitions: 1265 row = readDataInstance.readFields(metadataTableDefinitions[i]) 1266 dt.tables[i]["data"].append(row) 1267 1268 for i in xrange(64): 1269 if i in dotnet.MetadataTableNames: 1270 dt.tables[dotnet.MetadataTableNames[i]] = dt.tables[i]["data"] 1271 dt.tables[i] = dt.tables[i]["data"] 1272 1273 return dt
1274
1275 -class NetResources(baseclasses.BaseStructClass):
1276 """NetResources object."""
1277 - def __init__(self, shouldPack = True):
1278 """ 1279 NetResources object. 1280 1281 @todo: Parse every resource in this struct and store them in the C{self.resources} attribute. 1282 """ 1283 baseclasses.BaseStructClass.__init__(self, shouldPack) 1284 1285 self.signature = datatypes.DWORD(0) 1286 self.readerCount = datatypes.DWORD(0) 1287 self.readerTypeLength = datatypes.DWORD(0) 1288 self.version = datatypes.DWORD(0) 1289 self.resourceCount = datatypes.DWORD(0) 1290 self.resourceTypeCount = datatypes.DWORD(0) 1291 self.resourceTypes = None 1292 self.resourceHashes = None 1293 self.resourceNameOffsets = None 1294 self.dataSectionOffset = datatypes.DWORD(0) 1295 self.resourceNames = None 1296 self.resourceOffsets = None 1297 self.info = None 1298 1299 self._attrsList = ["signature", "readerCount", "readerTypeLength", "version", "resourceCount", "resourceTypeCount", "resourceTypes", "resourceHashes", "resourceNameOffsets", "dataSectionOffset", "resourceNames", "resourceOffets", "info"]
1300
1301 - def __str__(self):
1302 return str(self.info)
1303
1304 - def __repr__(self):
1305 return repr(self.info)
1306
1307 - def getType(self):
1308 """Returns L{consts.NET_RESOURCES}.""" 1309 return consts.NET_RESOURCES
1310 1311 @staticmethod
1312 - def parse(readDataInstance):
1313 """ 1314 Returns a new L{NetResources} object. 1315 1316 @type readDataInstance: L{ReadData} 1317 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetResources} object. 1318 1319 @rtype: L{NetResources} 1320 @return: A new L{NetResources} object. 1321 """ 1322 r = NetResources() 1323 1324 r.signature = readDataInstance.readDword() 1325 if r.signature != 0xbeefcace: 1326 return r 1327 1328 r.readerCount = readDataInstance.readDword() 1329 r.readerTypeLength = readDataInstance.readDword() 1330 r.readerType = utils.ReadData(readDataInstance.read(r.readerTypeLength)).readDotNetBlob() 1331 r.version = readDataInstance.readDword() 1332 r.resourceCount = readDataInstance.readDword() 1333 r.resourceTypeCount = readDataInstance.readDword() 1334 1335 r.resourceTypes = [] 1336 for i in xrange(r.resourceTypeCount): 1337 r.resourceTypes.append(readDataInstance.readDotNetBlob()) 1338 1339 # aligned to 8 bytes 1340 readDataInstance.skipBytes(8 - readDataInstance.tell() & 0x7) 1341 1342 r.resourceHashes = [] 1343 for i in xrange(r.resourceCount): 1344 r.resourceHashes.append(readDataInstance.readDword()) 1345 1346 r.resourceNameOffsets = [] 1347 for i in xrange(r.resourceCount): 1348 r.resourceNameOffsets.append(readDataInstance.readDword()) 1349 1350 r.dataSectionOffset = readDataInstance.readDword() 1351 1352 r.resourceNames = [] 1353 r.resourceOffsets = [] 1354 base = readDataInstance.tell() 1355 for i in xrange(r.resourceCount): 1356 readDataInstance.setOffset(base + r.resourceNameOffsets[i]) 1357 r.resourceNames.append(readDataInstance.readDotNetUnicodeString()) 1358 r.resourceOffsets.append(readDataInstance.readDword()) 1359 1360 r.info = {} 1361 for i in xrange(r.resourceCount): 1362 readDataInstance.setOffset(r.dataSectionOffset + r.resourceOffsets[i]) 1363 r.info[i] = readDataInstance.read(len(readDataInstance)) 1364 r.info[r.resourceNames[i]] = r.info[i] 1365 1366 return r
1367