1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31 """
32 PE directory classes.
33 """
34
35 __revision__ = "$Id$"
36
37 import datatypes
38 import consts
39 import datadirs
40 import excep
41 import utils
42 import baseclasses
43
44
45
46
47
48
49
50 -class ImageBoundForwarderRefEntry(baseclasses.BaseStructClass):
51 """ImageBoundForwarderRefEntry object."""
52 - def __init__(self, shouldPack = True):
53 """
54 This class represents an element of type C{IMAGE_BOUND_FORWARDER_REF}.
55 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
56
57 @type shouldPack: bool
58 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
59 """
60 baseclasses.BaseStructClass.__init__(self, shouldPack)
61
62 self.timeDateStamp = datatypes.DWORD(0)
63 self.offsetModuleName = datatypes.WORD(0)
64 self.reserved = datatypes.WORD(0)
65 self.moduleName = datatypes.String(shouldPack = False)
66
67 self._attrsList = ["timeDateStamp", "offsetModuleName", "reserved", "moduleName"]
68
70 """Returns L{consts.IMAGE_BOUND_FORWARDER_REF_ENTRY}."""
71 return consts.IMAGE_BOUND_FORWARDER_REF_ENTRY
72
73 @staticmethod
74 - def parse(readDataInstance):
75 """
76 Returns a new L{ImageBoundForwarderRefEntry} object.
77
78 @type readDataInstance: L{ReadData}
79 @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRefEntry} object.
80
81 @rtype: L{ImageBoundForwarderRefEntry}
82 @return: A new L{ImageBoundForwarderRefEntry} object.
83 """
84 boundForwarderEntry = ImageBoundForwarderRefEntry()
85 boundForwarderEntry.timeDateStamp.value = readDataInstance.readDword()
86 boundForwarderEntry.offsetModuleName.value = readDataInstance.readWord()
87 boundForwarderEntry.reserved.value = readDataInstance.readWord()
88 return boundForwarderEntry
89
91 """ImageBoundForwarderRef array object."""
93 """
94 This class is a wrapper over an array of C{IMAGE_BOUND_FORWARDER_REF}.
95
96 @type shouldPack: bool
97 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
98 """
99 list.__init__(self)
100 self.shouldPack = shouldPack
101
103 return ''.join([str(x) for x in self if x.shouldPack])
104
105 @staticmethod
106 - def parse(readDataInstance, numberOfEntries):
107 """
108 Returns a L{ImageBoundForwarderRef} array where every element is a L{ImageBoundForwarderRefEntry} object.
109
110 @type readDataInstance: L{ReadData}
111 @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRef} object.
112
113 @type numberOfEntries: int
114 @param numberOfEntries: The number of C{IMAGE_BOUND_FORWARDER_REF} entries in the array.
115
116 @rtype: L{ImageBoundForwarderRef}
117 @return: A new L{ImageBoundForwarderRef} object.
118
119 @raise DataLengthException: If the L{ReadData} instance has less data than C{NumberOfEntries} * sizeof L{ImageBoundForwarderRefEntry}.
120 """
121 imageBoundForwarderRefsList = ImageBoundForwarderRef()
122 dLength = len(readDataInstance)
123 entryLength = ImageBoundForwarderRefEntry().sizeof()
124 toRead = numberOfEntries * entryLength
125
126 if dLength >= toRead:
127 for i in range(numberOfEntries):
128 entryData = readDataInstance.read(entryLength)
129 rd = utils.ReadData(entryData)
130 imageBoundForwarderRefsList.append(ImageBoundForwarderRefEntry.parse(rd))
131 else:
132 raise excep.DataLengthException("Not enough bytes to read.")
133
134 return imageBoundForwarderRefsList
135
137 """ImageBoundImportDescriptor object."""
139 """
140 Array of L{ImageBoundImportDescriptorEntry} objects.
141
142 @type shouldPack: bool
143 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
144 """
145 list.__init__(self)
146 self.shouldPack = shouldPack
147
149 return ''.join([str(x) for x in self if x.shouldPack])
150
151 @staticmethod
152 - def parse(readDataInstance):
153 """
154 Returns a new L{ImageBoundImportDescriptor} object.
155
156 @type readDataInstance: L{ReadData}
157 @param readDataInstance: A L{ReadData} object containing the data to create a new L{ImageBoundImportDescriptor} object.
158
159 @rtype: L{ImageBoundImportDescriptor}
160 @return: A new {ImageBoundImportDescriptor} object.
161 """
162 ibd = ImageBoundImportDescriptor()
163
164 entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32)
165 readDataInstance.offset = 0
166 while not utils.allZero(entryData):
167 prevOffset = readDataInstance.offset
168
169 boundEntry = ImageBoundImportDescriptorEntry.parse(readDataInstance)
170
171
172
173 if boundEntry.numberOfModuleForwarderRefs.value:
174 readDataInstance.offset = prevOffset + (consts.SIZEOF_IMAGE_BOUND_FORWARDER_REF_ENTRY32 * boundEntry.numberOfModuleForwarderRefs.value)
175 else:
176 readDataInstance.offset = prevOffset
177
178 ibd.append(boundEntry)
179 entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32)
180
181 return ibd
182
183
184
185
186
187
188
189 -class ImageBoundImportDescriptorEntry(baseclasses.BaseStructClass):
190 """ImageBoundImportDescriptorEntry object."""
191 - def __init__(self, shouldPack = True):
192 """
193 This class represents a C{IMAGE_BOUND_IMPORT_DESCRIPTOR} structure.
194 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
195
196 @type shouldPack: bool
197 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
198 """
199 baseclasses.BaseStructClass.__init__(self, shouldPack)
200
201 self.timeDateStamp = datatypes.DWORD(0)
202 self.offsetModuleName = datatypes.WORD(0)
203 self.numberOfModuleForwarderRefs = datatypes.WORD(0)
204 self.forwarderRefsList = ImageBoundForwarderRef()
205 self.moduleName = datatypes.String(shouldPack = False)
206
207 self._attrsList = ["timeDateStamp", "offsetModuleName", "numberOfModuleForwarderRefs", "forwarderRefsList", "moduleName"]
208
210 """Returns L{consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY}"""
211 return consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY
212
213 @staticmethod
214 - def parse(readDataInstance):
215 """
216 Returns a new L{ImageBoundImportDescriptorEntry} object.
217
218 @type readDataInstance: L{ReadData}
219 @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageBoundImportDescriptorEntry}.
220
221 @rtype: L{ImageBoundImportDescriptorEntry}
222 @return: A new {ImageBoundImportDescriptorEntry} object.
223 """
224 boundEntry = ImageBoundImportDescriptorEntry()
225 boundEntry.timeDateStamp.value = readDataInstance.readDword()
226 boundEntry.offsetModuleName.value = readDataInstance.readWord()
227 boundEntry.numberOfModuleForwarderRefs .value = readDataInstance.readWord()
228
229 numberOfForwarderRefsEntries = boundEntry.numberOfModuleForwarderRefs .value
230 if numberOfForwarderRefsEntries:
231 bytesToRead = numberOfForwarderRefsEntries * ImageBoundForwarderRefEntry().sizeof()
232 rd = utils.ReadData(readDataInstance.read(bytesToRead))
233 boundEntry.forwarderRefsList = ImageBoundForwarderRef.parse(rd, numberOfForwarderRefsEntries)
234
235 return boundEntry
236
238 """TLS directory object."""
240 """
241 Class representation of a C{IMAGE_TLS_DIRECTORY} structure.
242
243 @see: Figure 11 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx}
244
245 @type shouldPack: bool
246 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
247 """
248 baseclasses.BaseStructClass.__init__(self, shouldPack)
249
250 self.startAddressOfRawData = datatypes.DWORD(0)
251 self.endAddressOfRawData = datatypes.DWORD(0)
252 self.addressOfIndex = datatypes.DWORD(0)
253 self.addressOfCallbacks = datatypes.DWORD(0)
254 self.sizeOfZeroFill = datatypes.DWORD(0)
255 self.characteristics = datatypes.DWORD(0)
256
257 self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\
258 "sizeOfZeroFill", "characteristics"]
259
261 """Returns L{consts.TLS_DIRECTORY}."""
262 return consts.TLS_DIRECTORY32
263
264 @staticmethod
265 - def parse(readDataInstance):
266 """
267 Returns a new L{TLSDirectory} object.
268
269 @type readDataInstance: L{ReadData}
270 @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory} object.
271
272 @rtype: L{TLSDirectory}
273 @return: A new {TLSDirectory} object.
274 """
275 tlsDir = TLSDirectory()
276
277 tlsDir.startAddressOfRawData.value = readDataInstance.readDword()
278 tlsDir.endAddressOfRawData.value = readDataInstance.readDword()
279 tlsDir.addressOfIndex.value = readDataInstance.readDword()
280 tlsDir.addressOfCallbacks.value = readDataInstance.readDword()
281 tlsDir.sizeOfZeroFill.value = readDataInstance.readDword()
282 tlsDir.characteristics.value = readDataInstance.readDword()
283 return tlsDir
284
286 """TLSDirectory64 object."""
288 """
289 Class representation of a C{IMAGE_TLS_DIRECTORY} structure in 64 bits systems.
290
291 @type shouldPack: bool
292 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
293 """
294 baseclasses.BaseStructClass.__init__(self, shouldPack)
295
296 self.startAddressOfRawData = datatypes.QWORD(0)
297 self.endAddressOfRawData = datatypes.QWORD(0)
298 self.addressOfIndex = datatypes.QWORD(0)
299 self.addressOfCallbacks = datatypes.QWORD(0)
300 self.sizeOfZeroFill = datatypes.DWORD(0)
301 self.characteristics = datatypes.DWORD(0)
302
303 self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\
304 "sizeOfZeroFill", "characteristics"]
305
309
310 @staticmethod
311 - def parse(readDataInstance):
312 """
313 Returns a new L{TLSDirectory64} object.
314
315 @type readDataInstance: L{ReadData}
316 @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory64} object.
317
318 @rtype: L{TLSDirectory64}
319 @return: A new L{TLSDirectory64} object.
320 """
321 tlsDir = TLSDirectory64()
322
323 tlsDir.startAddressOfRawData.value = readDataInstance.readQword()
324 tlsDir.endAddressOfRawData.value = readDataInstance.readQword()
325 tlsDir.addressOfIndex.value = readDataInstance.readQword()
326 tlsDir.addressOfCallbacks.value = readDataInstance.readQword()
327 tlsDir.sizeOfZeroFill.value = readDataInstance.readDword()
328 tlsDir.characteristics.value = readDataInstance.readDword()
329 return tlsDir
330
331 -class ImageBaseRelocationEntry(baseclasses.BaseStructClass):
332 """ImageBaseRelocationEntry object."""
333 - def __init__(self, shouldPack = True):
334 """
335 A class representation of a C{IMAGE_BASE_RELOCATION} structure.
336 @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
337
338 @type shouldPack: bool
339 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
340 """
341 baseclasses.BaseStructClass.__init__(self, shouldPack)
342
343 self.virtualAddress = datatypes.DWORD(0)
344 self.sizeOfBlock = datatypes.DWORD(0)
345 self.items = datatypes.Array(datatypes.TYPE_WORD)
346
347 self._attrsList = ["virtualAddress", "sizeOfBlock", "items"]
348
350 """Returns L{consts.IMAGE_BASE_RELOCATION_ENTRY}."""
351 return consts.IMAGE_BASE_RELOCATION_ENTRY
352
353 @staticmethod
354 - def parse(readDataInstance):
355 """
356 Returns a new L{ImageBaseRelocationEntry} object.
357
358 @type readDataInstance: L{ReadData}
359 @param readDataInstance: A L{ReadData} object with data to parse as a L{ImageBaseRelocationEntry} object.
360
361 @rtype: L{ImageBaseRelocationEntry}
362 @return: A new L{ImageBaseRelocationEntry} object.
363 """
364 reloc = ImageBaseRelocationEntry()
365 reloc.virtualAddress.value = readDataInstance.readDword()
366 reloc.sizeOfBlock.value = readDataInstance.readDword()
367 toRead = (reloc.sizeOfBlock.value - 8) / len(datatypes.WORD(0))
368 reloc.items = datatypes.Array.parse(readDataInstance, datatypes.TYPE_WORD, toRead)
369 return reloc
370
372 """ImageBaseRelocation array."""
373 pass
374
376 """ImageDebugDirectory object."""
378 """
379 Class representation of a C{IMAGE_DEBUG_DIRECTORY} structure.
380 @see: U{http://msdn.microsoft.com/es-es/library/windows/desktop/ms680307%28v=vs.85%29.aspx}
381
382 @type shouldPack: bool
383 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
384 """
385 baseclasses.BaseStructClass.__init__(self, shouldPack)
386
387 self.characteristics = datatypes.DWORD(0)
388 self.timeDateStamp = datatypes.DWORD(0)
389 self.majorVersion = datatypes.WORD(0)
390 self.minorVersion = datatypes.WORD(0)
391 self.type = datatypes.DWORD(0)
392 self.sizeOfData = datatypes.DWORD(0)
393 self.addressOfData = datatypes.DWORD(0)
394 self.pointerToRawData = datatypes.DWORD(0)
395
396 self._attrsList = ["characteristics", "timeDateStamp", "majorVersion", "minorVersion", "type", "sizeOfData",\
397 "addressOfData", "pointerToRawData"]
398
402
403 @staticmethod
404 - def parse(readDataInstance):
405 """
406 Returns a new L{ImageDebugDirectory} object.
407
408 @type readDataInstance: L{ReadData}
409 @param readDataInstance: A new L{ReadData} object with data to be parsed as a L{ImageDebugDirectory} object.
410
411 @rtype: L{ImageDebugDirectory}
412 @return: A new L{ImageDebugDirectory} object.
413 """
414 dbgDir = ImageDebugDirectory()
415
416 dbgDir.characteristics.value = readDataInstance.readDword()
417 dbgDir.timeDateStamp.value = readDataInstance.readDword()
418 dbgDir.majorVersion.value = readDataInstance.readWord()
419 dbgDir.minorVersion.value = readDataInstance.readWord()
420 dbgDir.type.value = readDataInstance.readDword()
421 dbgDir.sizeOfData.value = readDataInstance.readDword()
422 dbgDir.addressOfData.value = readDataInstance.readDword()
423 dbgDir.pointerToRawData.value = readDataInstance.readDword()
424
425 return dbgDir
426
428 """ImageDebugDirectories object."""
430 """
431 Array of L{ImageDebugDirectory} objects.
432
433 @type shouldPack: bool
434 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
435 """
436 self.shouldPack = shouldPack
437
439 return ''.join([str(x) for x in self if self.shouldPack])
440
444
445 @staticmethod
446 - def parse(readDataInstance, nDebugEntries):
447 """
448 Returns a new L{ImageDebugDirectories} object.
449
450 @type readDataInstance: L{ReadData}
451 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageDebugDirectories} object.
452
453 @type nDebugEntries: int
454 @param nDebugEntries: Number of L{ImageDebugDirectory} objects in the C{readDataInstance} object.
455
456 @rtype: L{ImageDebugDirectories}
457 @return: A new L{ImageDebugDirectories} object.
458
459 @raise DataLengthException: If not enough data to read in the C{readDataInstance} object.
460 """
461 dbgEntries = ImageDebugDirectories()
462
463 dataLength = len(readDataInstance)
464 toRead = nDebugEntries * consts.SIZEOF_IMAGE_DEBUG_ENTRY32
465 if dataLength >= toRead:
466 for i in range(nDebugEntries):
467 dbgEntry = ImageDebugDirectory.parse(readDataInstance)
468 dbgEntries.append(dbgEntry)
469 else:
470 raise excep.DataLengthException("Not enough bytes to read.")
471
472 return dbgEntries
473
493
494 -class ImageImportDescriptorEntry(baseclasses.BaseStructClass):
495 """ImageImportDescriptorEntry object."""
496 - def __init__(self, shouldPack = True):
497 """
498 Class representation of a C{IMAGE_IMPORT_DESCRIPTOR} structure.
499 @see: Figure 5 U{http://msdn.microsoft.com/es-ar/magazine/bb985996%28en-us%29.aspx}
500
501 @type shouldPack: bool
502 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
503 """
504 baseclasses.BaseStructClass.__init__(self, shouldPack)
505
506 self.metaData = ImageImportDescriptorMetaData()
507
508 self.originalFirstThunk = datatypes.DWORD(0)
509 self.timeDateStamp = datatypes.DWORD(0)
510 self.forwarderChain = datatypes.DWORD(0)
511 self.name = datatypes.DWORD(0)
512 self.firstThunk = datatypes.DWORD(0)
513
514 self.iat = ImportAddressTable()
515
516 self._attrsList = ["originalFirstThunk", "timeDateStamp", "forwarderChain", "name", "firstThunk"]
517
518 @staticmethod
519 - def parse(readDataInstance):
520 """
521 Returns a new L{ImageImportDescriptorEntry} object.
522
523 @type readDataInstance: L{ReadData}
524 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptorEntry}.
525
526 @rtype: L{ImageImportDescriptorEntry}
527 @return: A new L{ImageImportDescriptorEntry} object.
528 """
529 iid = ImageImportDescriptorEntry()
530 iid.originalFirstThunk.value = readDataInstance.readDword()
531 iid.timeDateStamp.value = readDataInstance.readDword()
532 iid.forwarderChain.value = readDataInstance.readDword()
533 iid.name.value = readDataInstance.readDword()
534 iid.firstThunk.value = readDataInstance.readDword()
535 return iid
536
538 """Returns C{consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY}."""
539 return consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY
540
542 """ImageImportDescriptor object."""
544 """
545 Array of L{ImageImportDescriptorEntry} objects.
546
547 @type shouldPack: bool
548 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
549 """
550 self.shouldPack = shouldPack
551
553 return ''.join([str(x) for x in self if x.shouldPack])
554
558
559 @staticmethod
560 - def parse(readDataInstance, nEntries):
561 """
562 Returns a new L{ImageImportDescriptor} object.
563
564 @type readDataInstance: L{ReadData}
565 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptor} object.
566
567 @type nEntries: int
568 @param nEntries: The number of L{ImageImportDescriptorEntry} objects in the C{readDataInstance} object.
569
570 @rtype: L{ImageImportDescriptor}
571 @return: A new L{ImageImportDescriptor} object.
572
573 @raise DataLengthException: If not enough data to read.
574 """
575 importEntries = ImageImportDescriptor()
576
577 dataLength = len(readDataInstance)
578 toRead = nEntries * consts.SIZEOF_IMAGE_IMPORT_ENTRY32
579 if dataLength >= toRead:
580 for i in range(nEntries):
581 importEntry = ImageImportDescriptorEntry.parse(readDataInstance)
582 importEntries.append(importEntry)
583 else:
584 raise excep.DataLengthException("Not enough bytes to read.")
585
586 return importEntries
587
588 -class ImportAddressTableEntry(baseclasses.BaseStructClass):
589 """ImportAddressTableEntry object."""
590 - def __init__(self, shouldPack = True):
591 """
592 A class representation of a C{} structure.
593
594 @type shouldPack: bool
595 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
596 """
597 baseclasses.BaseStructClass.__init__(self, shouldPack)
598
599 self.firstThunk = datatypes.DWORD(0)
600 self.originalFirstThunk = datatypes.DWORD(0)
601 self.hint = datatypes.WORD(0)
602 self.name = datatypes.String("")
603
604 self._attrsList = ["firstThunk", "originalFirstThunk", "hint", "name"]
605
607 """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY}."""
608 return consts.IMPORT_ADDRESS_TABLE_ENTRY
609
610 -class ImportAddressTableEntry64(baseclasses.BaseStructClass):
611 """ImportAddressTableEntry64 object."""
612 - def __init__(self, shouldPack = True):
613 """
614 A class representation of a C{} structure.
615
616 @type shouldPack: bool
617 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
618 """
619 baseclasses.BaseStructClass.__init__(self, shouldPack)
620
621 self.firstThunk = datatypes.QWORD(0)
622 self.originalFirstThunk = datatypes.QWORD(0)
623 self.hint = datatypes.WORD(0)
624 self.name = datatypes.String("")
625
626 self._attrsList = ["firstThunk", "originalFirstThunk", "hint", "name"]
627
629 """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY64}."""
630 return consts.IMPORT_ADDRESS_TABLE_ENTRY64
631
633 """Array of L{ImportAddressTableEntry} objects."""
634 pass
635
637 """Array of L{ExportTableEntry} objects."""
638 pass
639
640 -class ExportTableEntry(baseclasses.BaseStructClass):
641 """ExportTableEntry object."""
642 - def __init__(self, shouldPack = True):
643 """
644 A class representation of a C{} structure.
645
646 @type shouldPack: bool
647 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
648 """
649 baseclasses.BaseStructClass.__init__(self, shouldPack)
650
651 self.ordinal = datatypes.DWORD(0)
652 self.functionRva = datatypes.DWORD(0)
653 self.nameOrdinal = datatypes.WORD(0)
654 self.nameRva = datatypes.DWORD(0)
655 self.name = datatypes.String("")
656
657 self._attrsList = ["ordinal", "functionRva", "nameOrdinal", "nameRva", "name"]
658
659 - def __repr__(self):
660 return repr((self.ordinal, self.functionRva, self.nameOrdinal, self.nameRva, self.name))
661
663 """Returns L{consts.EXPORT_TABLE_ENTRY}."""
664 return consts.EXPORT_TABLE_ENTRY
665
666 @staticmethod
667 - def parse(readDataInstance):
668 """
669 Returns a new L{ExportTableEntry} object.
670
671 @type readDataInstance: L{ReadData}
672 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ExportTableEntry} object.
673
674 @rtype: L{ExportTableEntry}
675 @return: A new L{ExportTableEntry} object.
676 """
677 exportEntry = ExportTableEntry()
678
679 exportEntry.functionRva.value = readDataInstance.readDword()
680 exportEntry.nameOrdinal.value = readDataInstance.readWord()
681 exportEntry.nameRva.value = readDataInstance.readDword()
682 exportEntry.name.value = readDataInstance.readString()
683 return exportEntry
684
686 """ImageExportTable object."""
688 """
689 Class representation of a C{IMAGE_EXPORT_DIRECTORY} structure.
690 @see: Figure 2 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx}
691
692 @type shouldPack: bool
693 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
694 """
695 baseclasses.BaseStructClass.__init__(self, shouldPack)
696
697 self.exportTable = ExportTable()
698
699 self.characteristics = datatypes.DWORD(0)
700 self.timeDateStamp = datatypes.DWORD(0)
701 self.majorVersion = datatypes.WORD(0)
702 self.minorVersion = datatypes.WORD(0)
703 self.name = datatypes.DWORD(0)
704 self.base = datatypes.DWORD(0)
705 self.numberOfFunctions = datatypes.DWORD(0)
706 self.numberOfNames = datatypes.DWORD(0)
707 self.addressOfFunctions = datatypes.DWORD(0)
708 self.addressOfNames = datatypes.DWORD(0)
709 self.addressOfNameOrdinals = datatypes.DWORD(0)
710
711 self._attrsList = ["characteristics", "timeDateStamp", "majorVersion", "minorVersion", "name", "base", "numberOfFunctions",\
712 "numberOfNames", "addressOfFunctions", "addressOfNames", "addressOfNameOrdinals"]
713
717
718 @staticmethod
719 - def parse(readDataInstance):
720 """
721 Returns a new L{ImageExportTable} object.
722
723 @type readDataInstance: L{ReadData}
724 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageExportTable} object.
725
726 @rtype: L{ImageExportTable}
727 @return: A new L{ImageExportTable} object.
728 """
729 et = ImageExportTable()
730
731 et.characteristics.value = readDataInstance.readDword()
732 et.timeDateStamp.value = readDataInstance.readDword()
733 et.majorVersion.value = readDataInstance.readWord()
734 et.minorVersion.value = readDataInstance.readWord()
735 et.name.value = readDataInstance.readDword()
736 et.base.value = readDataInstance.readDword()
737 et.numberOfFunctions.value = readDataInstance.readDword()
738 et.numberOfNames.value = readDataInstance.readDword()
739 et.addressOfFunctions.value = readDataInstance.readDword()
740 et.addressOfNames.value = readDataInstance.readDword()
741 et.addressOfNameOrdinals.value = readDataInstance.readDword()
742 return et
743
745 """NETDirectory object."""
747 """
748 A class to abstract data from the .NET PE format.
749
750 @type shouldPack: bool
751 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
752 """
753 baseclasses.BaseStructClass.__init__(self, shouldPack)
754
755 self.directory = NetDirectory()
756 self.netMetaDataHeader = NetMetaDataHeader()
757 self.netMetaDataStreams = NetMetaDataStreams()
758
759 self._attrsList = ["directory", "netMetaDataHeader", "netMetaDataStreams"]
760
761 @staticmethod
762 - def parse(readDataInstance):
763 """
764 Returns a new L{NETDirectory} object.
765
766 @type readDataInstance: L{ReadData}
767 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NETDirectory} object.
768
769 @rtype: L{NETDirectory}
770 @return: A new L{NETDirectory} object.
771 """
772 nd = NETDirectory()
773
774 nd.directory = NetDirectory.parse(readDataInstance)
775 nd.netMetaDataHeader = NetMetaDataHeader.parse(readDataInstance)
776 nd.netMetaDataStreams = NetMetaDataStreams.parse(readDataInstance)
777 return nd
778
782
784 """NetDirectory object."""
786 """
787 A class representation of the C{IMAGE_COR20_HEADER} structure.
788 @see: U{http://www.ntcore.com/files/dotnetformat.htm}
789
790 @type shouldPack: bool
791 @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
792 """
793 baseclasses.BaseStructClass.__init__(self, shouldPack)
794
795 self.cb = datatypes.DWORD(0)
796 self.majorRuntimeVersion = datatypes.WORD(0)
797 self.minorRuntimeVersion = datatypes.WORD(0)
798 self.metaData = datadirs.Directory()
799 self.flags = datatypes.DWORD(0)
800 self.entryPointToken = datatypes.DWORD(0)
801 self.resources = datadirs.Directory()
802 self.strongNameSignature = datadirs.Directory()
803 self.codeManagerTable = datadirs.Directory()
804 self.vTableFixups = datadirs.Directory()
805 self.exportAddressTableJumps = datadirs.Directory()
806 self.managedNativeHeader = datadirs.Directory()
807
808 self._attrsList = ["cb","majorRuntimeVersion","minorRuntimeVersion","metaData", \
809 "flags","entryPointToken","resources","strongNameSignature",\
810 "codeManagerTable","vTableFixups", "exportAddressTableJumps",\
811 "managedNativeHeader"]
812
816
817 @staticmethod
818 - def parse(readDataInstance):
819 """
820 Returns a new L{NetDirectory} object.
821
822 @type readDataInstance: L{ReadData}
823 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetDirectory} object.
824
825 @rtype: L{NetDirectory}
826 @return: A new L{NetDirectory} object.
827 """
828 nd = NetDirectory()
829
830 nd.cb.value = readDataInstance.readDword()
831 nd.majorRuntimeVersion.value= readDataInstance.readWord()
832 nd.minorRuntimeVersion.value = readDataInstance.readWord()
833
834 nd.metaData.rva.value = readDataInstance.readDword()
835 nd.metaData.size.value = readDataInstance.readDword()
836 nd.metaData.name.value = datatypes.String("MetaData")
837
838 nd.flags.value = readDataInstance.readDword()
839 nd.entryPointToken.value = readDataInstance.readDword()
840
841 nd.resources.rva.value = readDataInstance.readDword()
842 nd.resources.size.value = readDataInstance.readDword()
843 nd.resources.name.value = datatypes.String("Resources")
844
845 nd.strongNameSignature.rva.value = readDataInstance.readDword()
846 nd.strongNameSignature.size.value = readDataInstance.readDword()
847 nd.strongNameSignature.name.value = datatypes.String("StrongNameSignature")
848
849 nd.codeManagerTable.rva.value = readDataInstance.readDword()
850 nd.codeManagerTable.size.value = readDataInstance.readDword()
851 nd.codeManagerTable.name.value = datatypes.String("CodeManagerTable")
852
853 nd.vTableFixups.rva.value = readDataInstance.readDword()
854 nd.vTableFixups.size.value = readDataInstance.readDword()
855 nd.vTableFixups.name.value = datatypes.String("VTableFixups")
856
857 nd.exportAddressTableJumps.rva.value = readDataInstance.readDword()
858 nd.exportAddressTableJumps.size.value = readDataInstance.readDword()
859 nd.exportAddressTableJumps.name.value = datatypes.String("ExportAddressTableJumps")
860
861 nd.managedNativeHeader.rva.value = readDataInstance.readDword()
862 nd.managedNativeHeader.size.value = readDataInstance.readDword()
863 nd.managedNativeHeader.name.value = datatypes.String("ManagedNativeHeader")
864
865 return nd
866
909
911 """NetMetaDataStreamEntry object."""
924
928
929 @staticmethod
930 - def parse(readDataInstance):
931 """
932 Returns a new L{NetMetaDataStreamEntry} object.
933
934 @type readDataInstance: L{ReadData}
935 @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataStreamEntry}.
936
937 @rtype: L{NetMetaDataStreamEntry}
938 @return: A new L{NetMetaDataStreamEntry} object.
939 """
940 n = NetMetaDataStreamEntry()
941 n.offset.value = readDataInstance.readDword()
942 n.size.value = readDataInstance.readDword()
943 n.name.value = readDataInstance.readAlignedString()
944 return n
945
984
1026
1062