1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31 """
32 PE directory classes.
33 """
34
35 __revision__ = "$Id$"
36
37 import datatypes
38 import consts
39 import datadirs
40 import excep
41 import utils
42 import baseclasses
43 import dotnet
44
45
46
47
48
49
50
51 -class ImageBoundForwarderRefEntry(baseclasses.BaseStructClass):
52 """ImageBoundForwarderRefEntry object."""
53 - def __init__(self, shouldPack = True):
54 """
55 This class represents an element of type C{IMAGE_BOUND_FORWARDER_REF}.
56 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
57
58 @type shouldPack: bool
59 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
60 """
61 baseclasses.BaseStructClass.__init__(self, shouldPack)
62
63 self.timeDateStamp = datatypes.DWORD(0)
64 self.offsetModuleName = datatypes.WORD(0)
65 self.reserved = datatypes.WORD(0)
66 self.moduleName = datatypes.String(shouldPack = False)
67
68 self._attrsList = ["timeDateStamp", "offsetModuleName", "reserved", "moduleName"]
69
71 """Returns L{consts.IMAGE_BOUND_FORWARDER_REF_ENTRY}."""
72 return consts.IMAGE_BOUND_FORWARDER_REF_ENTRY
73
74 @staticmethod
75 - def parse(readDataInstance):
76 """
77 Returns a new L{ImageBoundForwarderRefEntry} object.
78
79 @type readDataInstance: L{ReadData}
80 @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRefEntry} object.
81
82 @rtype: L{ImageBoundForwarderRefEntry}
83 @return: A new L{ImageBoundForwarderRefEntry} object.
84 """
85 boundForwarderEntry = ImageBoundForwarderRefEntry()
86 boundForwarderEntry.timeDateStamp.value = readDataInstance.readDword()
87 boundForwarderEntry.offsetModuleName.value = readDataInstance.readWord()
88 boundForwarderEntry.reserved.value = readDataInstance.readWord()
89 return boundForwarderEntry
90
92 """ImageBoundForwarderRef array object."""
94 """
95 This class is a wrapper over an array of C{IMAGE_BOUND_FORWARDER_REF}.
96
97 @type shouldPack: bool
98 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
99 """
100 list.__init__(self)
101 self.shouldPack = shouldPack
102
104 return ''.join([str(x) for x in self if x.shouldPack])
105
106 @staticmethod
107 - def parse(readDataInstance, numberOfEntries):
108 """
109 Returns a L{ImageBoundForwarderRef} array where every element is a L{ImageBoundForwarderRefEntry} object.
110
111 @type readDataInstance: L{ReadData}
112 @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRef} object.
113
114 @type numberOfEntries: int
115 @param numberOfEntries: The number of C{IMAGE_BOUND_FORWARDER_REF} entries in the array.
116
117 @rtype: L{ImageBoundForwarderRef}
118 @return: A new L{ImageBoundForwarderRef} object.
119
120 @raise DataLengthException: If the L{ReadData} instance has less data than C{NumberOfEntries} * sizeof L{ImageBoundForwarderRefEntry}.
121 """
122 imageBoundForwarderRefsList = ImageBoundForwarderRef()
123 dLength = len(readDataInstance)
124 entryLength = ImageBoundForwarderRefEntry().sizeof()
125 toRead = numberOfEntries * entryLength
126
127 if dLength >= toRead:
128 for i in range(numberOfEntries):
129 entryData = readDataInstance.read(entryLength)
130 rd = utils.ReadData(entryData)
131 imageBoundForwarderRefsList.append(ImageBoundForwarderRefEntry.parse(rd))
132 else:
133 raise excep.DataLengthException("Not enough bytes to read.")
134
135 return imageBoundForwarderRefsList
136
138 """ImageBoundImportDescriptor object."""
140 """
141 Array of L{ImageBoundImportDescriptorEntry} objects.
142
143 @type shouldPack: bool
144 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
145 """
146 list.__init__(self)
147 self.shouldPack = shouldPack
148
150 return ''.join([str(x) for x in self if x.shouldPack])
151
152 @staticmethod
153 - def parse(readDataInstance):
154 """
155 Returns a new L{ImageBoundImportDescriptor} object.
156
157 @type readDataInstance: L{ReadData}
158 @param readDataInstance: A L{ReadData} object containing the data to create a new L{ImageBoundImportDescriptor} object.
159
160 @rtype: L{ImageBoundImportDescriptor}
161 @return: A new {ImageBoundImportDescriptor} object.
162 """
163 ibd = ImageBoundImportDescriptor()
164
165 entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32)
166 readDataInstance.offset = 0
167 while not utils.allZero(entryData):
168 prevOffset = readDataInstance.offset
169
170 boundEntry = ImageBoundImportDescriptorEntry.parse(readDataInstance)
171
172
173
174 if boundEntry.numberOfModuleForwarderRefs.value:
175 readDataInstance.offset = prevOffset + (consts.SIZEOF_IMAGE_BOUND_FORWARDER_REF_ENTRY32 * boundEntry.numberOfModuleForwarderRefs.value)
176 else:
177 readDataInstance.offset = prevOffset
178
179 ibd.append(boundEntry)
180 entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32)
181
182 return ibd
183
184
185
186
187
188
189
190 -class ImageBoundImportDescriptorEntry(baseclasses.BaseStructClass):
191 """ImageBoundImportDescriptorEntry object."""
192 - def __init__(self, shouldPack = True):
193 """
194 This class represents a C{IMAGE_BOUND_IMPORT_DESCRIPTOR} structure.
195 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
196
197 @type shouldPack: bool
198 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
199 """
200 baseclasses.BaseStructClass.__init__(self, shouldPack)
201
202 self.timeDateStamp = datatypes.DWORD(0)
203 self.offsetModuleName = datatypes.WORD(0)
204 self.numberOfModuleForwarderRefs = datatypes.WORD(0)
205 self.forwarderRefsList = ImageBoundForwarderRef()
206 self.moduleName = datatypes.String(shouldPack = False)
207
208 self._attrsList = ["timeDateStamp", "offsetModuleName", "numberOfModuleForwarderRefs", "forwarderRefsList", "moduleName"]
209
211 """Returns L{consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY}"""
212 return consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY
213
214 @staticmethod
215 - def parse(readDataInstance):
216 """
217 Returns a new L{ImageBoundImportDescriptorEntry} object.
218
219 @type readDataInstance: L{ReadData}
220 @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageBoundImportDescriptorEntry}.
221
222 @rtype: L{ImageBoundImportDescriptorEntry}
223 @return: A new {ImageBoundImportDescriptorEntry} object.
224 """
225 boundEntry = ImageBoundImportDescriptorEntry()
226 boundEntry.timeDateStamp.value = readDataInstance.readDword()
227 boundEntry.offsetModuleName.value = readDataInstance.readWord()
228 boundEntry.numberOfModuleForwarderRefs.value = readDataInstance.readWord()
229
230 numberOfForwarderRefsEntries = boundEntry.numberOfModuleForwarderRefs .value
231 if numberOfForwarderRefsEntries:
232 bytesToRead = numberOfForwarderRefsEntries * ImageBoundForwarderRefEntry().sizeof()
233 rd = utils.ReadData(readDataInstance.read(bytesToRead))
234 boundEntry.forwarderRefsList = ImageBoundForwarderRef.parse(rd, numberOfForwarderRefsEntries)
235
236 return boundEntry
237
239 """TLS directory object."""
241 """
242 Class representation of a C{IMAGE_TLS_DIRECTORY} structure.
243
244 @see: Figure 11 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx}
245
246 @type shouldPack: bool
247 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
248 """
249 baseclasses.BaseStructClass.__init__(self, shouldPack)
250
251 self.startAddressOfRawData = datatypes.DWORD(0)
252 self.endAddressOfRawData = datatypes.DWORD(0)
253 self.addressOfIndex = datatypes.DWORD(0)
254 self.addressOfCallbacks = datatypes.DWORD(0)
255 self.sizeOfZeroFill = datatypes.DWORD(0)
256 self.characteristics = datatypes.DWORD(0)
257
258 self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\
259 "sizeOfZeroFill", "characteristics"]
260
264
265 @staticmethod
266 - def parse(readDataInstance):
267 """
268 Returns a new L{TLSDirectory} object.
269
270 @type readDataInstance: L{ReadData}
271 @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory} object.
272
273 @rtype: L{TLSDirectory}
274 @return: A new {TLSDirectory} object.
275 """
276 tlsDir = TLSDirectory()
277
278 tlsDir.startAddressOfRawData.value = readDataInstance.readDword()
279 tlsDir.endAddressOfRawData.value = readDataInstance.readDword()
280 tlsDir.addressOfIndex.value = readDataInstance.readDword()
281 tlsDir.addressOfCallbacks.value = readDataInstance.readDword()
282 tlsDir.sizeOfZeroFill.value = readDataInstance.readDword()
283 tlsDir.characteristics.value = readDataInstance.readDword()
284 return tlsDir
285
287 """TLSDirectory64 object."""
289 """
290 Class representation of a C{IMAGE_TLS_DIRECTORY} structure in 64 bits systems.
291
292 @type shouldPack: bool
293 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
294 """
295 baseclasses.BaseStructClass.__init__(self, shouldPack)
296
297 self.startAddressOfRawData = datatypes.QWORD(0)
298 self.endAddressOfRawData = datatypes.QWORD(0)
299 self.addressOfIndex = datatypes.QWORD(0)
300 self.addressOfCallbacks = datatypes.QWORD(0)
301 self.sizeOfZeroFill = datatypes.DWORD(0)
302 self.characteristics = datatypes.DWORD(0)
303
304 self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\
305 "sizeOfZeroFill", "characteristics"]
306
310
311 @staticmethod
312 - def parse(readDataInstance):
313 """
314 Returns a new L{TLSDirectory64} object.
315
316 @type readDataInstance: L{ReadData}
317 @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory64} object.
318
319 @rtype: L{TLSDirectory64}
320 @return: A new L{TLSDirectory64} object.
321 """
322 tlsDir = TLSDirectory64()
323
324 tlsDir.startAddressOfRawData.value = readDataInstance.readQword()
325 tlsDir.endAddressOfRawData.value = readDataInstance.readQword()
326 tlsDir.addressOfIndex.value = readDataInstance.readQword()
327 tlsDir.addressOfCallbacks.value = readDataInstance.readQword()
328 tlsDir.sizeOfZeroFill.value = readDataInstance.readDword()
329 tlsDir.characteristics.value = readDataInstance.readDword()
330 return tlsDir
331
334 "IMAGE_LOAD_CONFIG_DIRECTORY32 object aka CONFIGURATION_DIRECTORY"
336 """
337 Class representation of a C{IMAGE_LOAD_CONFIG_DIRECTORY32} structure.
338
339 @type shouldPack: bool
340 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
341 """
342 baseclasses.BaseStructClass.__init__(self, shouldPack)
343
344 self.size = datatypes.DWORD()
345 self.timeDateStamp = datatypes.DWORD()
346 self.majorVersion = datatypes.WORD()
347 self.minorVersion = datatypes.WORD()
348 self.globalFlagsClear = datatypes.DWORD()
349 self.globalFlagsSet = datatypes.DWORD()
350 self.criticalSectionDefaultTimeout = datatypes.DWORD()
351 self.deCommitFreeBlockThreshold = datatypes.DWORD()
352 self.deCommitTotalFreeThreshold = datatypes.DWORD()
353 self.lockPrefixTable = datatypes.DWORD()
354 self.maximumAllocationSize = datatypes.DWORD()
355 self.virtualMemoryThreshold = datatypes.DWORD()
356 self.processHeapFlags = datatypes.DWORD()
357 self.processAffinityMask = datatypes.DWORD()
358 self.csdVersion = datatypes.WORD()
359 self.reserved1 = datatypes.WORD()
360 self.editList = datatypes.DWORD()
361 self.securityCookie = datatypes.DWORD()
362 self.SEHandlerTable = datatypes.DWORD()
363 self.SEHandlerCount = datatypes.DWORD()
364
365
366 self.GuardCFCheckFunctionPointer = datatypes.DWORD()
367 self.Reserved2 = datatypes.DWORD()
368 self.GuardCFFunctionTable = datatypes.DWORD()
369 self.GuardCFFunctionCount = datatypes.DWORD()
370 self.GuardFlags = datatypes.DWORD()
371
372 self._attrsList = ["size", "timeDateStamp", "majorVersion", "minorVersion", "globalFlagsClear", "globalFlagsSet", "criticalSectionDefaultTimeout", "deCommitFreeBlockThreshold",\
373 "deCommitTotalFreeThreshold", "lockPrefixTable", "maximumAllocationSize", "virtualMemoryThreshold", "processHeapFlags", "processAffinityMask", "csdVersion",\
374 "reserved1", "editList", "securityCookie", "SEHandlerTable","SEHandlerCount", "GuardCFCheckFunctionPointer", "Reserved2", "GuardCFFunctionTable",\
375 "GuardCFFunctionCount", "GuardFlags"]
376
380
381 @staticmethod
382 - def parse(readDataInstance):
383 """
384 Returns a new L{ImageLoadConfigDirectory} object.
385
386 @type readDataInstance: L{ReadData}
387 @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageLoadConfigDirectory} object.
388
389 @rtype: L{ImageLoadConfigDirectory}
390 @return: A new L{ImageLoadConfigDirectory} object.
391 """
392 configDir = ImageLoadConfigDirectory()
393
394 configDir.size.value = readDataInstance.readDword()
395 configDir.timeDateStamp.value = readDataInstance.readDword()
396 configDir.majorVersion.value = readDataInstance.readWord()
397 configDir.minorVersion.value = readDataInstance.readWord()
398 configDir.globalFlagsClear.value = readDataInstance.readDword()
399 configDir.globalFlagsSet.value = readDataInstance.readDword()
400 configDir.criticalSectionDefaultTimeout.value = readDataInstance.readDword()
401 configDir.deCommitFreeBlockThreshold.value = readDataInstance.readDword()
402 configDir.deCommitTotalFreeThreshold.value = readDataInstance.readDword()
403 configDir.lockPrefixTable.value = readDataInstance.readDword()
404 configDir.maximumAllocationSize.value = readDataInstance.readDword()
405 configDir.virtualMemoryThreshold.value = readDataInstance.readDword()
406 configDir.processHeapFlags.value = readDataInstance.readDword()
407 configDir.processAffinityMask.value = readDataInstance.readDword()
408 configDir.csdVersion.value = readDataInstance.readWord()
409 configDir.reserved1.value = readDataInstance.readWord()
410 configDir.editList.value = readDataInstance.readDword()
411 configDir.securityCookie.value = readDataInstance.readDword()
412 configDir.SEHandlerTable.value = readDataInstance.readDword()
413 configDir.SEHandlerCount.value = readDataInstance.readDword()
414
415
416 configDir.GuardCFCheckFunctionPointer.value = readDataInstance.readDword()
417 configDir.Reserved2.value = readDataInstance.readDword()
418 configDir.GuardCFFunctionTable.value = readDataInstance.readDword()
419 configDir.GuardCFFunctionCount.value = readDataInstance.readDword()
420 configDir.GuardFlags.value = readDataInstance.readDword()
421 return configDir
422
424 "IMAGE_LOAD_CONFIG_DIRECTORY64 object"
426 """
427 Class representation of a C{IMAGE_LOAD_CONFIG_DIRECTORY64} structure in 64 bits systems.
428
429 @type shouldPack: bool
430 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
431 """
432 baseclasses.BaseStructClass.__init__(self, shouldPack)
433
434 self.size = datatypes.DWORD()
435 self.timeDateStamp = datatypes.DWORD()
436 self.majorVersion = datatypes.WORD()
437 self.minorVersion = datatypes.WORD()
438 self.globalFlagsClear = datatypes.DWORD()
439 self.globalFlagsSet = datatypes.DWORD()
440 self.criticalSectionDefaultTimeout = datatypes.DWORD()
441 self.deCommitFreeBlockThreshold = datatypes.QWORD()
442 self.deCommitTotalFreeThreshold = datatypes.QWORD()
443 self.lockPrefixTable = datatypes.QWORD()
444 self.maximumAllocationSize = datatypes.QWORD()
445 self.virtualMemoryThreshold = datatypes.QWORD()
446 self.processAffinityMask = datatypes.QWORD()
447 self.processHeapFlags = datatypes.DWORD()
448 self.cdsVersion = datatypes.WORD()
449 self.reserved1 = datatypes.WORD()
450 self.editList = datatypes.QWORD()
451 self.securityCookie = datatypes.QWORD()
452 self.SEHandlerTable = datatypes.QWORD()
453 self.SEHandlerCount = datatypes.QWORD()
454
455
456 self.GuardCFCheckFunctionPointer = datatypes.QWORD()
457 self.Reserved2 = datatypes.QWORD()
458 self.GuardCFFunctionTable = datatypes.QWORD()
459 self.GuardCFFunctionCount = datatypes.QWORD()
460 self.GuardFlags = datatypes.QWORD()
461
462 self._attrsList = ["size", "timeDateStamp", "majorVersion", "minorVersion", "globalFlagsClear", "globalFlagsSet", "criticalSectionDefaultTimeout", "deCommitFreeBlockThreshold",\
463 "deCommitTotalFreeThreshold", "lockPrefixTable", "maximumAllocationSize", "virtualMemoryThreshold", "processAffinityMask", "processHeapFlags", "cdsVersion",\
464 "reserved1", "editList", "securityCookie", "SEHandlerTable", "SEHandlerCount", "GuardCFCheckFunctionPointer", "Reserved2", "GuardCFFunctionTable",\
465 "GuardCFFunctionCount", "GuardFlags"]
466
467
471
472 @staticmethod
473 - def parse(readDataInstance):
474 """
475 Returns a new L{ImageLoadConfigDirectory64} object.
476
477 @type readDataInstance: L{ReadData}
478 @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageLoadConfigDirectory64} object.
479
480 @rtype: L{ImageLoadConfigDirectory64}
481 @return: A new L{ImageLoadConfigDirectory64} object.
482 """
483 configDir = ImageLoadConfigDirectory64()
484
485 configDir.size.value = readDataInstance.readDword()
486 configDir.timeDateStamp.value = readDataInstance.readDword()
487 configDir.majorVersion.value = readDataInstance.readWord()
488 configDir.minorVersion.value = readDataInstance.readWord()
489 configDir.globalFlagsClear.value = readDataInstance.readDword()
490 configDir.globalFlagsSet.value = readDataInstance.readDword()
491 configDir.criticalSectionDefaultTimeout.value = readDataInstance.readDword()
492 configDir.deCommitFreeBlockThreshold.value = readDataInstance.readQword()
493 configDir.deCommitTotalFreeThreshold.value = readDataInstance.readQword()
494 configDir.lockPrefixTable.value = readDataInstance.readQword()
495 configDir.maximumAllocationSize.value = readDataInstance.readQword()
496 configDir.virtualMemoryThreshold.value = readDataInstance.readQword()
497 configDir.processAffinityMask.value = readDataInstance.readQword()
498 configDir.processHeapFlags.value = readDataInstance.readDword()
499 configDir.cdsVersion.value = readDataInstance.readWord()
500 configDir.reserved1.value = readDataInstance.readWord()
501 configDir.editList.value = readDataInstance.readQword()
502 configDir.securityCookie.value = readDataInstance.readQword()
503 configDir.SEHandlerTable.value = readDataInstance.readQword()
504 configDir.SEHandlerCount.value = readDataInstance.readQword()
505
506
507 configDir.GuardCFCheckFunctionPointer.value = readDataInstance.readQword()
508 configDir.Reserved2.value = readDataInstance.readQword()
509 configDir.GuardCFFunctionTable.value = readDataInstance.readQword()
510 configDir.GuardCFFunctionCount.value = readDataInstance.readQword()
511 configDir.GuardFlags.value = readDataInstance.readQword()
512 return configDir
513
514 -class ImageBaseRelocationEntry(baseclasses.BaseStructClass):
515 """ImageBaseRelocationEntry object."""
516 - def __init__(self, shouldPack = True):
517 """
518 A class representation of a C{IMAGE_BASE_RELOCATION} structure.
519 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
520
521 @type shouldPack: bool
522 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
523 """
524 baseclasses.BaseStructClass.__init__(self, shouldPack)
525
526 self.virtualAddress = datatypes.DWORD(0)
527 self.sizeOfBlock = datatypes.DWORD(0)
528 self.items = datatypes.Array(datatypes.TYPE_WORD)
529
530 self._attrsList = ["virtualAddress", "sizeOfBlock", "items"]
531
533 """Returns L{consts.IMAGE_BASE_RELOCATION_ENTRY}."""
534 return consts.IMAGE_BASE_RELOCATION_ENTRY
535
536 @staticmethod
537 - def parse(readDataInstance):
538 """
539 Returns a new L{ImageBaseRelocationEntry} object.
540
541 @type readDataInstance: L{ReadData}
542 @param readDataInstance: A L{ReadData} object with data to parse as a L{ImageBaseRelocationEntry} object.
543
544 @rtype: L{ImageBaseRelocationEntry}
545 @return: A new L{ImageBaseRelocationEntry} object.
546 """
547 reloc = ImageBaseRelocationEntry()
548 reloc.virtualAddress.value = readDataInstance.readDword()
549 reloc.sizeOfBlock.value = readDataInstance.readDword()
550 toRead = (reloc.sizeOfBlock.value - 8) / len(datatypes.WORD(0))
551 reloc.items = datatypes.Array.parse(readDataInstance, datatypes.TYPE_WORD, toRead)
552 return reloc
553
555 """ImageBaseRelocation array."""
556 pass
557
559 """ImageDebugDirectory object."""
561 """
562 Class representation of a C{IMAGE_DEBUG_DIRECTORY} structure.
563 @see: U{http://msdn.microsoft.com/es-es/library/windows/desktop/ms680307%28v=vs.85%29.aspx}
564
565 @type shouldPack: bool
566 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
567 """
568 baseclasses.BaseStructClass.__init__(self, shouldPack)
569
570 self.characteristics = datatypes.DWORD(0)
571 self.timeDateStamp = datatypes.DWORD(0)
572 self.majorVersion = datatypes.WORD(0)
573 self.minorVersion = datatypes.WORD(0)
574 self.type = datatypes.DWORD(0)
575 self.sizeOfData = datatypes.DWORD(0)
576 self.addressOfData = datatypes.DWORD(0)
577 self.pointerToRawData = datatypes.DWORD(0)
578
579 self._attrsList = ["characteristics", "timeDateStamp", "majorVersion", "minorVersion", "type", "sizeOfData",\
580 "addressOfData", "pointerToRawData"]
581
585
586 @staticmethod
587 - def parse(readDataInstance):
588 """
589 Returns a new L{ImageDebugDirectory} object.
590
591 @type readDataInstance: L{ReadData}
592 @param readDataInstance: A new L{ReadData} object with data to be parsed as a L{ImageDebugDirectory} object.
593
594 @rtype: L{ImageDebugDirectory}
595 @return: A new L{ImageDebugDirectory} object.
596 """
597 dbgDir = ImageDebugDirectory()
598
599 dbgDir.characteristics.value = readDataInstance.readDword()
600 dbgDir.timeDateStamp.value = readDataInstance.readDword()
601 dbgDir.majorVersion.value = readDataInstance.readWord()
602 dbgDir.minorVersion.value = readDataInstance.readWord()
603 dbgDir.type.value = readDataInstance.readDword()
604 dbgDir.sizeOfData.value = readDataInstance.readDword()
605 dbgDir.addressOfData.value = readDataInstance.readDword()
606 dbgDir.pointerToRawData.value = readDataInstance.readDword()
607
608 return dbgDir
609
611 """ImageDebugDirectories object."""
613 """
614 Array of L{ImageDebugDirectory} objects.
615
616 @type shouldPack: bool
617 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
618 """
619 self.shouldPack = shouldPack
620
622 return ''.join([str(x) for x in self if self.shouldPack])
623
627
628 @staticmethod
629 - def parse(readDataInstance, nDebugEntries):
630 """
631 Returns a new L{ImageDebugDirectories} object.
632
633 @type readDataInstance: L{ReadData}
634 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageDebugDirectories} object.
635
636 @type nDebugEntries: int
637 @param nDebugEntries: Number of L{ImageDebugDirectory} objects in the C{readDataInstance} object.
638
639 @rtype: L{ImageDebugDirectories}
640 @return: A new L{ImageDebugDirectories} object.
641
642 @raise DataLengthException: If not enough data to read in the C{readDataInstance} object.
643 """
644 dbgEntries = ImageDebugDirectories()
645
646 dataLength = len(readDataInstance)
647 toRead = nDebugEntries * consts.SIZEOF_IMAGE_DEBUG_ENTRY32
648 if dataLength >= toRead:
649 for i in range(nDebugEntries):
650 dbgEntry = ImageDebugDirectory.parse(readDataInstance)
651 dbgEntries.append(dbgEntry)
652 else:
653 raise excep.DataLengthException("Not enough bytes to read.")
654
655 return dbgEntries
656
676
677 -class ImageImportDescriptorEntry(baseclasses.BaseStructClass):
678 """ImageImportDescriptorEntry object."""
679 - def __init__(self, shouldPack = True):
680 """
681 Class representation of a C{IMAGE_IMPORT_DESCRIPTOR} structure.
682 @see: Figure 5 U{http://msdn.microsoft.com/es-ar/magazine/bb985996%28en-us%29.aspx}
683
684 @type shouldPack: bool
685 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
686 """
687 baseclasses.BaseStructClass.__init__(self, shouldPack)
688
689 self.metaData = ImageImportDescriptorMetaData()
690
691 self.originalFirstThunk = datatypes.DWORD(0)
692 self.timeDateStamp = datatypes.DWORD(0)
693 self.forwarderChain = datatypes.DWORD(0)
694 self.name = datatypes.DWORD(0)
695 self.firstThunk = datatypes.DWORD(0)
696
697 self.iat = ImportAddressTable()
698
699 self._attrsList = ["originalFirstThunk", "timeDateStamp", "forwarderChain", "name", "firstThunk"]
700
701 @staticmethod
702 - def parse(readDataInstance):
703 """
704 Returns a new L{ImageImportDescriptorEntry} object.
705
706 @type readDataInstance: L{ReadData}
707 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptorEntry}.
708
709 @rtype: L{ImageImportDescriptorEntry}
710 @return: A new L{ImageImportDescriptorEntry} object.
711 """
712 iid = ImageImportDescriptorEntry()
713 iid.originalFirstThunk.value = readDataInstance.readDword()
714 iid.timeDateStamp.value = readDataInstance.readDword()
715 iid.forwarderChain.value = readDataInstance.readDword()
716 iid.name.value = readDataInstance.readDword()
717 iid.firstThunk.value = readDataInstance.readDword()
718 return iid
719
721 """Returns C{consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY}."""
722 return consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY
723
725 """ImageImportDescriptor object."""
727 """
728 Array of L{ImageImportDescriptorEntry} objects.
729
730 @type shouldPack: bool
731 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
732 """
733 self.shouldPack = shouldPack
734
736 return ''.join([str(x) for x in self if x.shouldPack])
737
741
742 @staticmethod
743 - def parse(readDataInstance, nEntries):
744 """
745 Returns a new L{ImageImportDescriptor} object.
746
747 @type readDataInstance: L{ReadData}
748 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptor} object.
749
750 @type nEntries: int
751 @param nEntries: The number of L{ImageImportDescriptorEntry} objects in the C{readDataInstance} object.
752
753 @rtype: L{ImageImportDescriptor}
754 @return: A new L{ImageImportDescriptor} object.
755
756 @raise DataLengthException: If not enough data to read.
757 """
758 importEntries = ImageImportDescriptor()
759
760 dataLength = len(readDataInstance)
761 toRead = nEntries * consts.SIZEOF_IMAGE_IMPORT_ENTRY32
762 if dataLength >= toRead:
763 for i in range(nEntries):
764 importEntry = ImageImportDescriptorEntry.parse(readDataInstance)
765 importEntries.append(importEntry)
766 else:
767 raise excep.DataLengthException("Not enough bytes to read.")
768
769 return importEntries
770
771 -class ImportAddressTableEntry(baseclasses.BaseStructClass):
772 """ImportAddressTableEntry object."""
773 - def __init__(self, shouldPack = True):
774 """
775 A class representation of a C{} structure.
776
777 @type shouldPack: bool
778 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
779 """
780 baseclasses.BaseStructClass.__init__(self, shouldPack)
781
782 self.firstThunk = datatypes.DWORD(0)
783 self.originalFirstThunk = datatypes.DWORD(0)
784 self.hint = datatypes.WORD(0)
785 self.name = datatypes.String("")
786
787 self._attrsList = ["firstThunk", "originalFirstThunk", "hint", "name"]
788
790 """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY}."""
791 return consts.IMPORT_ADDRESS_TABLE_ENTRY
792
793 -class ImportAddressTableEntry64(baseclasses.BaseStructClass):
794 """ImportAddressTableEntry64 object."""
795 - def __init__(self, shouldPack = True):
796 """
797 A class representation of a C{} structure.
798
799 @type shouldPack: bool
800 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
801 """
802 baseclasses.BaseStructClass.__init__(self, shouldPack)
803
804 self.firstThunk = datatypes.QWORD(0)
805 self.originalFirstThunk = datatypes.QWORD(0)
806 self.hint = datatypes.WORD(0)
807 self.name = datatypes.String("")
808
809 self._attrsList = ["firstThunk", "originalFirstThunk", "hint", "name"]
810
812 """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY64}."""
813 return consts.IMPORT_ADDRESS_TABLE_ENTRY64
814
816 """Array of L{ImportAddressTableEntry} objects."""
817 pass
818
820 """Array of L{ExportTableEntry} objects."""
821 pass
822
823 -class ExportTableEntry(baseclasses.BaseStructClass):
824 """ExportTableEntry object."""
825 - def __init__(self, shouldPack = True):
826 """
827 A class representation of a C{} structure.
828
829 @type shouldPack: bool
830 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
831 """
832 baseclasses.BaseStructClass.__init__(self, shouldPack)
833
834 self.ordinal = datatypes.DWORD(0)
835 self.functionRva = datatypes.DWORD(0)
836 self.nameOrdinal = datatypes.WORD(0)
837 self.nameRva = datatypes.DWORD(0)
838 self.name = datatypes.String("")
839
840 self._attrsList = ["ordinal", "functionRva", "nameOrdinal", "nameRva", "name"]
841
842 - def __repr__(self):
843 return repr((self.ordinal, self.functionRva, self.nameOrdinal, self.nameRva, self.name))
844
846 """Returns L{consts.EXPORT_TABLE_ENTRY}."""
847 return consts.EXPORT_TABLE_ENTRY
848
849 @staticmethod
850 - def parse(readDataInstance):
851 """
852 Returns a new L{ExportTableEntry} object.
853
854 @type readDataInstance: L{ReadData}
855 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ExportTableEntry} object.
856
857 @rtype: L{ExportTableEntry}
858 @return: A new L{ExportTableEntry} object.
859 """
860 exportEntry = ExportTableEntry()
861
862 exportEntry.functionRva.value = readDataInstance.readDword()
863 exportEntry.nameOrdinal.value = readDataInstance.readWord()
864 exportEntry.nameRva.value = readDataInstance.readDword()
865 exportEntry.name.value = readDataInstance.readString()
866 return exportEntry
867
869 """ImageExportTable object."""
871 """
872 Class representation of a C{IMAGE_EXPORT_DIRECTORY} structure.
873 @see: Figure 2 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx}
874
875 @type shouldPack: bool
876 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
877 """
878 baseclasses.BaseStructClass.__init__(self, shouldPack)
879
880 self.exportTable = ExportTable()
881
882 self.characteristics = datatypes.DWORD(0)
883 self.timeDateStamp = datatypes.DWORD(0)
884 self.majorVersion = datatypes.WORD(0)
885 self.minorVersion = datatypes.WORD(0)
886 self.name = datatypes.DWORD(0)
887 self.base = datatypes.DWORD(0)
888 self.numberOfFunctions = datatypes.DWORD(0)
889 self.numberOfNames = datatypes.DWORD(0)
890 self.addressOfFunctions = datatypes.DWORD(0)
891 self.addressOfNames = datatypes.DWORD(0)
892 self.addressOfNameOrdinals = datatypes.DWORD(0)
893
894 self._attrsList = ["characteristics", "timeDateStamp", "majorVersion", "minorVersion", "name", "base", "numberOfFunctions",\
895 "numberOfNames", "addressOfFunctions", "addressOfNames", "addressOfNameOrdinals"]
896
900
901 @staticmethod
902 - def parse(readDataInstance):
903 """
904 Returns a new L{ImageExportTable} object.
905
906 @type readDataInstance: L{ReadData}
907 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageExportTable} object.
908
909 @rtype: L{ImageExportTable}
910 @return: A new L{ImageExportTable} object.
911 """
912 et = ImageExportTable()
913
914 et.characteristics.value = readDataInstance.readDword()
915 et.timeDateStamp.value = readDataInstance.readDword()
916 et.majorVersion.value = readDataInstance.readWord()
917 et.minorVersion.value = readDataInstance.readWord()
918 et.name.value = readDataInstance.readDword()
919 et.base.value = readDataInstance.readDword()
920 et.numberOfFunctions.value = readDataInstance.readDword()
921 et.numberOfNames.value = readDataInstance.readDword()
922 et.addressOfFunctions.value = readDataInstance.readDword()
923 et.addressOfNames.value = readDataInstance.readDword()
924 et.addressOfNameOrdinals.value = readDataInstance.readDword()
925 return et
926
928 """NETDirectory object."""
930 """
931 A class to abstract data from the .NET PE format.
932
933 @type shouldPack: bool
934 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
935 """
936 baseclasses.BaseStructClass.__init__(self, shouldPack)
937
938 self.directory = NetDirectory()
939 self.netMetaDataHeader = NetMetaDataHeader()
940 self.netMetaDataStreams = NetMetaDataStreams()
941
942 self._attrsList = ["directory", "netMetaDataHeader", "netMetaDataStreams"]
943
944 @staticmethod
945 - def parse(readDataInstance):
946 """
947 Returns a new L{NETDirectory} object.
948
949 @type readDataInstance: L{ReadData}
950 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NETDirectory} object.
951
952 @rtype: L{NETDirectory}
953 @return: A new L{NETDirectory} object.
954 """
955 nd = NETDirectory()
956
957 nd.directory = NetDirectory.parse(readDataInstance)
958 nd.netMetaDataHeader = NetMetaDataHeader.parse(readDataInstance)
959 nd.netMetaDataStreams = NetMetaDataStreams.parse(readDataInstance)
960 return nd
961
965
967 """NetDirectory object."""
969 """
970 A class representation of the C{IMAGE_COR20_HEADER} structure.
971 @see: U{http://www.ntcore.com/files/dotnetformat.htm}
972
973 @type shouldPack: bool
974 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
975 """
976 baseclasses.BaseStructClass.__init__(self, shouldPack)
977
978 self.cb = datatypes.DWORD(0)
979 self.majorRuntimeVersion = datatypes.WORD(0)
980 self.minorRuntimeVersion = datatypes.WORD(0)
981 self.metaData = datadirs.Directory()
982 self.flags = datatypes.DWORD(0)
983 self.entryPointToken = datatypes.DWORD(0)
984 self.resources = datadirs.Directory()
985 self.strongNameSignature = datadirs.Directory()
986 self.codeManagerTable = datadirs.Directory()
987 self.vTableFixups = datadirs.Directory()
988 self.exportAddressTableJumps = datadirs.Directory()
989 self.managedNativeHeader = datadirs.Directory()
990
991 self._attrsList = ["cb","majorRuntimeVersion","minorRuntimeVersion","metaData", \
992 "flags","entryPointToken","resources","strongNameSignature",\
993 "codeManagerTable","vTableFixups", "exportAddressTableJumps",\
994 "managedNativeHeader"]
995
999
1000 @staticmethod
1001 - def parse(readDataInstance):
1002 """
1003 Returns a new L{NetDirectory} object.
1004
1005 @type readDataInstance: L{ReadData}
1006 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetDirectory} object.
1007
1008 @rtype: L{NetDirectory}
1009 @return: A new L{NetDirectory} object.
1010 """
1011 nd = NetDirectory()
1012
1013 nd.cb.value = readDataInstance.readDword()
1014 nd.majorRuntimeVersion.value= readDataInstance.readWord()
1015 nd.minorRuntimeVersion.value = readDataInstance.readWord()
1016
1017 nd.metaData.rva.value = readDataInstance.readDword()
1018 nd.metaData.size.value = readDataInstance.readDword()
1019 nd.metaData.name.value = "MetaData"
1020
1021 nd.flags.value = readDataInstance.readDword()
1022 nd.entryPointToken.value = readDataInstance.readDword()
1023
1024 nd.resources.rva.value = readDataInstance.readDword()
1025 nd.resources.size.value = readDataInstance.readDword()
1026 nd.resources.name.value = "Resources"
1027
1028 nd.strongNameSignature.rva.value = readDataInstance.readDword()
1029 nd.strongNameSignature.size.value = readDataInstance.readDword()
1030 nd.strongNameSignature.name.value = "StrongNameSignature"
1031
1032 nd.codeManagerTable.rva.value = readDataInstance.readDword()
1033 nd.codeManagerTable.size.value = readDataInstance.readDword()
1034 nd.codeManagerTable.name.value = "CodeManagerTable"
1035
1036 nd.vTableFixups.rva.value = readDataInstance.readDword()
1037 nd.vTableFixups.size.value = readDataInstance.readDword()
1038 nd.vTableFixups.name.value = "VTableFixups"
1039
1040 nd.exportAddressTableJumps.rva.value = readDataInstance.readDword()
1041 nd.exportAddressTableJumps.size.value = readDataInstance.readDword()
1042 nd.exportAddressTableJumps.name.value = "ExportAddressTableJumps"
1043
1044 nd.managedNativeHeader.rva.value = readDataInstance.readDword()
1045 nd.managedNativeHeader.size.value = readDataInstance.readDword()
1046 nd.managedNativeHeader.name.value = "ManagedNativeHeader"
1047
1048 return nd
1049
1092
1094 """NetMetaDataStreamEntry object."""
1095 - def __init__(self, shouldPack = True):
1107
1111
1112 @staticmethod
1113 - def parse(readDataInstance):
1114 """
1115 Returns a new L{NetMetaDataStreamEntry} object.
1116
1117 @type readDataInstance: L{ReadData}
1118 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataStreamEntry}.
1119
1120 @rtype: L{NetMetaDataStreamEntry}
1121 @return: A new L{NetMetaDataStreamEntry} object.
1122 """
1123 n = NetMetaDataStreamEntry()
1124 n.offset.value = readDataInstance.readDword()
1125 n.size.value = readDataInstance.readDword()
1126 n.name.value = readDataInstance.readAlignedString()
1127 return n
1128
1174
1216
1274
1276 """NetResources object."""
1277 - def __init__(self, shouldPack = True):
1278 """
1279 NetResources object.
1280
1281 @todo: Parse every resource in this struct and store them in the C{self.resources} attribute.
1282 """
1283 baseclasses.BaseStructClass.__init__(self, shouldPack)
1284
1285 self.signature = datatypes.DWORD(0)
1286 self.readerCount = datatypes.DWORD(0)
1287 self.readerTypeLength = datatypes.DWORD(0)
1288 self.version = datatypes.DWORD(0)
1289 self.resourceCount = datatypes.DWORD(0)
1290 self.resourceTypeCount = datatypes.DWORD(0)
1291 self.resourceTypes = None
1292 self.resourceHashes = None
1293 self.resourceNameOffsets = None
1294 self.dataSectionOffset = datatypes.DWORD(0)
1295 self.resourceNames = None
1296 self.resourceOffsets = None
1297 self.info = None
1298
1299 self._attrsList = ["signature", "readerCount", "readerTypeLength", "version", "resourceCount", "resourceTypeCount", "resourceTypes", "resourceHashes", "resourceNameOffsets", "dataSectionOffset", "resourceNames", "resourceOffets", "info"]
1300
1302 return str(self.info)
1303
1305 return repr(self.info)
1306
1310
1311 @staticmethod
1312 - def parse(readDataInstance):
1313 """
1314 Returns a new L{NetResources} object.
1315
1316 @type readDataInstance: L{ReadData}
1317 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetResources} object.
1318
1319 @rtype: L{NetResources}
1320 @return: A new L{NetResources} object.
1321 """
1322 r = NetResources()
1323
1324 r.signature = readDataInstance.readDword()
1325 if r.signature != 0xbeefcace:
1326 return r
1327
1328 r.readerCount = readDataInstance.readDword()
1329 r.readerTypeLength = readDataInstance.readDword()
1330 r.readerType = utils.ReadData(readDataInstance.read(r.readerTypeLength)).readDotNetBlob()
1331 r.version = readDataInstance.readDword()
1332 r.resourceCount = readDataInstance.readDword()
1333 r.resourceTypeCount = readDataInstance.readDword()
1334
1335 r.resourceTypes = []
1336 for i in xrange(r.resourceTypeCount):
1337 r.resourceTypes.append(readDataInstance.readDotNetBlob())
1338
1339
1340 readDataInstance.skipBytes(8 - readDataInstance.tell() & 0x7)
1341
1342 r.resourceHashes = []
1343 for i in xrange(r.resourceCount):
1344 r.resourceHashes.append(readDataInstance.readDword())
1345
1346 r.resourceNameOffsets = []
1347 for i in xrange(r.resourceCount):
1348 r.resourceNameOffsets.append(readDataInstance.readDword())
1349
1350 r.dataSectionOffset = readDataInstance.readDword()
1351
1352 r.resourceNames = []
1353 r.resourceOffsets = []
1354 base = readDataInstance.tell()
1355 for i in xrange(r.resourceCount):
1356 readDataInstance.setOffset(base + r.resourceNameOffsets[i])
1357 r.resourceNames.append(readDataInstance.readDotNetUnicodeString())
1358 r.resourceOffsets.append(readDataInstance.readDword())
1359
1360 r.info = {}
1361 for i in xrange(r.resourceCount):
1362 readDataInstance.setOffset(r.dataSectionOffset + r.resourceOffsets[i])
1363 r.info[i] = readDataInstance.read(len(readDataInstance))
1364 r.info[r.resourceNames[i]] = r.info[i]
1365
1366 return r
1367