;it dZdZdZdZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddlm Z ddlmZddlmZdd lmZdd lmZdd lmZddlZddlZddlZejd ejd eZddZeddZeddZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.dZ/d Z0d!Z1d"Z2d#Z3d$Z4d%Z5d&Z6d'Z7gd(Z8e7e8Z9gd)Z:e7e:Z;gd*Z<e7e<Z=gd+Z>e7e>Z?gd,Z@e7e@ZAgd-ZBe7eBZCgd.ZDe7eDZEgd/ZFe7eFZGdZHgd0ZIe7eIZJgd1ZKe7eKZLdZMd2ZNd3ZOd4ZPd5ZQd6ZRd7ZSd8ZTd9ZUd:ZVgd;ZWe7eWZXgd<ZYe7eYZZgd=Z[e7e[Z\e]e[Z\e[D]+\Z^Z_e_e\vre\e_`e^%e^ge\e_<,d>Zad?Zbd@ZcdAZddBZedCZfGdDdEegZhGdFdGZiGdHdIejZkGdJdKZld2d2d2d2d3d3d5d5d5d5d5d8d8d8d2dLZmeddMZneddNOdPZoGdQdRZpGdSdTepZqeddOdUZrGdVdWepZsGdXdYZtGdZd[etZuGd\d]etZvGd^d_etZwGd`daetZxGdbdcetZyGdddeetZzGdfdgetZ{GdhdietZ|GdjdketZ}GdldmetZ~GdndoetZGdpdqetZGdrdsetZGdtduetZGdvdwetZGdxdyetZGdzd{esZGd|d}ZGd~deZGddeZGddeZGddeZGddeZGddeZGddeZGddeZGddeZGddeZGddZefe je jze jzdzZdZefe je jze jzZed ddeeeefdedefdZGddZdZedkr edSdS)abpefile, Portable Executable reader module All the PE file basic structures are available with their default names as attributes of the instance returned. Processed elements such as the import table are made available with lowercase names, to differentiate them from the upper case basic structure names. pefile has been tested against many edge cases such as corrupted and malformed PEs as well as malware, which often attempts to abuse the format way beyond its standard use. To the best of my knowledge most of the abuse is handled gracefully. Copyright (c) 2005-2023 Ero Carrera z Ero Carreraz2023.2.7zero.carrera@gmail.comN)Counter)Union)sha1)sha256)sha512md5backslashreplace_backslashreplaceFcD|stjSfd}|S)Nctj|tj|fd}|S)Nc8tj|i|SN)copymodcopy)argskwargs cached_funcs :C:\PYTHON\MyICR_Workspace\venv\Lib\site-packages\pefile.pywrapperz-lru_cache..decorator..wrapper;s$< T .decorator8sU9i)'599!<<    > > > >   >r)rr)rrrrs`` rrr4sE 3"7E222 r)rcF|tkr|St|dz dzS)N)FILE_ALIGNMENT_HARDCODED_VALUEint)valfile_alignments rcache_adjust_FileAlignmentr'Es*666 e   %%rcN|dkr|}|r||zr|t||z zS|S)N)r$)r%section_alignmentr&s rcache_adjust_SectionAlignmentr+LsJ6!!*BS#44B C.?(?$@$@AA Jrc,|dSNr)count)datas r count_zeroesr0\s ::a==r r" iMZiZMiNEiLEiLXiVZiPEli i c:td|D|zS)Nc.g|]}|d|dfS)r.0es r z two_way_dict..s$---!!A$!---r)dict)pairss r two_way_dictrAs$ --u---5 6 66r))IMAGE_DIRECTORY_ENTRY_EXPORTr)IMAGE_DIRECTORY_ENTRY_IMPORTr9)IMAGE_DIRECTORY_ENTRY_RESOURCE)IMAGE_DIRECTORY_ENTRY_EXCEPTION)IMAGE_DIRECTORY_ENTRY_SECURITY)IMAGE_DIRECTORY_ENTRY_BASERELOC)IMAGE_DIRECTORY_ENTRY_DEBUG)IMAGE_DIRECTORY_ENTRY_COPYRIGHT)IMAGE_DIRECTORY_ENTRY_GLOBALPTR)IMAGE_DIRECTORY_ENTRY_TLS )!IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG )"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT )IMAGE_DIRECTORY_ENTRY_IAT )"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT )$IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR)IMAGE_DIRECTORY_ENTRY_RESERVED))IMAGE_FILE_RELOCS_STRIPPEDr9)IMAGE_FILE_EXECUTABLE_IMAGErE)IMAGE_FILE_LINE_NUMS_STRIPPEDrI)IMAGE_FILE_LOCAL_SYMS_STRIPPEDrQ)IMAGE_FILE_AGGRESIVE_WS_TRIMr5)IMAGE_FILE_LARGE_ADDRESS_AWAREr4)IMAGE_FILE_16BIT_MACHINE@)IMAGE_FILE_BYTES_REVERSED_LOr )IMAGE_FILE_32BIT_MACHINE)IMAGE_FILE_DEBUG_STRIPPEDr")"IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP)IMAGE_FILE_NET_RUN_FROM_SWAPr )IMAGE_FILE_SYSTEMr))IMAGE_FILE_DLLr2)IMAGE_FILE_UP_SYSTEM_ONLY@)IMAGE_FILE_BYTES_REVERSED_HIr3).)IMAGE_SCN_TYPE_REGr)IMAGE_SCN_TYPE_DSECTr9)IMAGE_SCN_TYPE_NOLOADrE)IMAGE_SCN_TYPE_GROUPrI)IMAGE_SCN_TYPE_NO_PADrQ)IMAGE_SCN_TYPE_COPYr5)IMAGE_SCN_CNT_CODEr4)IMAGE_SCN_CNT_INITIALIZED_DATArg) IMAGE_SCN_CNT_UNINITIALIZED_DATAr )IMAGE_SCN_LNK_OTHERrj)IMAGE_SCN_LNK_INFOr")IMAGE_SCN_LNK_OVERrm)IMAGE_SCN_LNK_REMOVEr )IMAGE_SCN_LNK_COMDATr))IMAGE_SCN_MEM_PROTECTEDrr)IMAGE_SCN_NO_DEFER_SPEC_EXCrr)IMAGE_SCN_GPRELr3)IMAGE_SCN_MEM_FARDATAr3)IMAGE_SCN_MEM_SYSHEAP)IMAGE_SCN_MEM_PURGEABLE)IMAGE_SCN_MEM_16BITr)IMAGE_SCN_MEM_LOCKEDi)IMAGE_SCN_MEM_PRELOADi)IMAGE_SCN_ALIGN_1BYTESr1)IMAGE_SCN_ALIGN_2BYTESi )IMAGE_SCN_ALIGN_4BYTESi0)IMAGE_SCN_ALIGN_8BYTESi@)IMAGE_SCN_ALIGN_16BYTESiP)IMAGE_SCN_ALIGN_32BYTESi`)IMAGE_SCN_ALIGN_64BYTESip)IMAGE_SCN_ALIGN_128BYTESi)IMAGE_SCN_ALIGN_256BYTESi)IMAGE_SCN_ALIGN_512BYTESi)IMAGE_SCN_ALIGN_1024BYTESi)IMAGE_SCN_ALIGN_2048BYTESi)IMAGE_SCN_ALIGN_4096BYTESi)IMAGE_SCN_ALIGN_8192BYTESi)IMAGE_SCN_ALIGN_MASKi)IMAGE_SCN_LNK_NRELOC_OVFLi)IMAGE_SCN_MEM_DISCARDABLEi)IMAGE_SCN_MEM_NOT_CACHEDi)IMAGE_SCN_MEM_NOT_PAGED)IMAGE_SCN_MEM_SHARED)IMAGE_SCN_MEM_EXECUTEi )IMAGE_SCN_MEM_READi@)IMAGE_SCN_MEM_WRITEr6))IMAGE_DEBUG_TYPE_UNKNOWNr)IMAGE_DEBUG_TYPE_COFFr9)IMAGE_DEBUG_TYPE_CODEVIEWrE)IMAGE_DEBUG_TYPE_FPOrG)IMAGE_DEBUG_TYPE_MISCrI)IMAGE_DEBUG_TYPE_EXCEPTIONrK)IMAGE_DEBUG_TYPE_FIXUPrM)IMAGE_DEBUG_TYPE_OMAP_TO_SRCrO)IMAGE_DEBUG_TYPE_OMAP_FROM_SRCrQ)IMAGE_DEBUG_TYPE_BORLANDrS)IMAGE_DEBUG_TYPE_RESERVED10rU)IMAGE_DEBUG_TYPE_CLSIDrW)IMAGE_DEBUG_TYPE_VC_FEATURErY)IMAGE_DEBUG_TYPE_POGOr[)IMAGE_DEBUG_TYPE_ILTCGr])IMAGE_DEBUG_TYPE_MPXr_)IMAGE_DEBUG_TYPE_REPROr5)&IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS))IMAGE_SUBSYSTEM_UNKNOWNr)IMAGE_SUBSYSTEM_NATIVEr9)IMAGE_SUBSYSTEM_WINDOWS_GUIrE)IMAGE_SUBSYSTEM_WINDOWS_CUIrG)IMAGE_SUBSYSTEM_OS2_CUIrK)IMAGE_SUBSYSTEM_POSIX_CUIrO)IMAGE_SUBSYSTEM_NATIVE_WINDOWSrQ)IMAGE_SUBSYSTEM_WINDOWS_CE_GUIrS)IMAGE_SUBSYSTEM_EFI_APPLICATIONrU)'IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVERrW)"IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVERrY)IMAGE_SUBSYSTEM_EFI_ROMr[)IMAGE_SUBSYSTEM_XBOXr])(IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATIONr5)$)IMAGE_FILE_MACHINE_UNKNOWNr)IMAGE_FILE_MACHINE_I386iL)IMAGE_FILE_MACHINE_R3000ib)IMAGE_FILE_MACHINE_R4000if)IMAGE_FILE_MACHINE_R10000ih)IMAGE_FILE_MACHINE_WCEMIPSV2ii)IMAGE_FILE_MACHINE_ALPHAi)IMAGE_FILE_MACHINE_SH3i)IMAGE_FILE_MACHINE_SH3DSPi)IMAGE_FILE_MACHINE_SH3Ei)IMAGE_FILE_MACHINE_SH4i)IMAGE_FILE_MACHINE_SH5i)IMAGE_FILE_MACHINE_ARMi)IMAGE_FILE_MACHINE_THUMBi)IMAGE_FILE_MACHINE_ARMNTi)IMAGE_FILE_MACHINE_AM33i)IMAGE_FILE_MACHINE_POWERPCi)IMAGE_FILE_MACHINE_POWERPCFPi)IMAGE_FILE_MACHINE_IA64r")IMAGE_FILE_MACHINE_MIPS16if)IMAGE_FILE_MACHINE_ALPHA64)IMAGE_FILE_MACHINE_AXP64r)IMAGE_FILE_MACHINE_MIPSFPUif)IMAGE_FILE_MACHINE_MIPSFPU16if)IMAGE_FILE_MACHINE_TRICOREi )IMAGE_FILE_MACHINE_CEFi )IMAGE_FILE_MACHINE_EBCi)IMAGE_FILE_MACHINE_RISCV32i2P)IMAGE_FILE_MACHINE_RISCV64idP)IMAGE_FILE_MACHINE_RISCV128i(Q)IMAGE_FILE_MACHINE_LOONGARCH32i2b)IMAGE_FILE_MACHINE_LOONGARCH64idb)IMAGE_FILE_MACHINE_AMD64id)IMAGE_FILE_MACHINE_M32RiA)IMAGE_FILE_MACHINE_ARM64id)IMAGE_FILE_MACHINE_CEEi) )IMAGE_REL_BASED_ABSOLUTEr)IMAGE_REL_BASED_HIGHr9)IMAGE_REL_BASED_LOWrE)IMAGE_REL_BASED_HIGHLOWrG)IMAGE_REL_BASED_HIGHADJrI)IMAGE_REL_BASED_MIPS_JMPADDRrK)IMAGE_REL_BASED_SECTIONrM)IMAGE_REL_BASED_RELrO)IMAGE_REL_BASED_MIPS_JMPADDR16rS)IMAGE_REL_BASED_IA64_IMM64rS)IMAGE_REL_BASED_DIR64rU)IMAGE_REL_BASED_HIGH3ADJrW))IMAGE_LIBRARY_PROCESS_INITr9)IMAGE_LIBRARY_PROCESS_TERMrE)IMAGE_LIBRARY_THREAD_INITrI)IMAGE_LIBRARY_THREAD_TERMrQ)(IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VAr4)%IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASErg)(IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITYr )"IMAGE_DLLCHARACTERISTICS_NX_COMPATrj)%IMAGE_DLLCHARACTERISTICS_NO_ISOLATIONr")IMAGE_DLLCHARACTERISTICS_NO_SEHrm) IMAGE_DLLCHARACTERISTICS_NO_BINDr )%IMAGE_DLLCHARACTERISTICS_APPCONTAINERr))#IMAGE_DLLCHARACTERISTICS_WDM_DRIVERr2)!IMAGE_DLLCHARACTERISTICS_GUARD_CFrr).IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWAREr3))UNW_FLAG_EHANDLERr9)UNW_FLAG_UHANDLERrE)UNW_FLAG_CHAININFOrI))RAXr)RCXr9)RDXrE)RBXrG)RSPrI)RBPrK)RSIrM)RDIrO)R8rQ)R9rS)R10rU)R11rW)R12rY)R13r[)R14r])R15r_r9rErGrIrKrMrQrSrU)) RT_CURSORr9) RT_BITMAPrE)RT_ICONrG)RT_MENUrI) RT_DIALOGrK) RT_STRINGrM) RT_FONTDIRrO)RT_FONTrQ)RT_ACCELERATORrS) RT_RCDATArU)RT_MESSAGETABLErW)RT_GROUP_CURSORrY) RT_GROUP_ICONr]) RT_VERSIONr5) RT_DLGINCLUDE) RT_PLUGPLAY)RT_VXDr) RT_ANICURSOR) RT_ANIICON)RT_HTML) RT_MANIFEST)^) LANG_NEUTRALr)LANG_INVARIANT)LANG_AFRIKAANS6) LANG_ALBANIAN) LANG_ARABICr9) LANG_ARMENIAN+) LANG_ASSAMESEM) LANG_AZERI,) LANG_BASQUE-)LANG_BELARUSIAN#) LANG_BENGALIE)LANG_BULGARIANrE) LANG_CATALANrG) LANG_CHINESErI) LANG_CROATIAN) LANG_CZECHrK) LANG_DANISHrM) LANG_DIVEHIe) LANG_DUTCHr+) LANG_ENGLISHrS) LANG_ESTONIAN%) LANG_FAEROESE8) LANG_FARSI)) LANG_FINNISHrW) LANG_FRENCHrY) LANG_GALICIANV) LANG_GEORGIAN7) LANG_GERMANrO) LANG_GREEKrQ) LANG_GUJARATIG) LANG_HEBREWr[) LANG_HINDI9)LANG_HUNGARIANr])LANG_ICELANDICr_)LANG_INDONESIAN!) LANG_ITALIANr5) LANG_JAPANESEr)) LANG_KANNADAK) LANG_KASHMIRI`) LANG_KAZAK?) LANG_KONKANIW) LANG_KOREAN) LANG_KYRGYZrg) LANG_LATVIAN&)LANG_LITHUANIAN')LANG_MACEDONIAN/) LANG_MALAY>)LANG_MALAYALAML) LANG_MANIPURIX) LANG_MARATHIN)LANG_MONGOLIANP) LANG_NEPALIa)LANG_NORWEGIANr) LANG_ORIYAH) LANG_POLISHr.)LANG_PORTUGUESEr0) LANG_PUNJABIF) LANG_ROMANIANr4) LANG_RUSSIAN) LANG_SANSKRITO) LANG_SERBIANrM) LANG_SINDHIY) LANG_SLOVAK)LANG_SLOVENIAN$) LANG_SPANISHrU) LANG_SWAHILIA) LANG_SWEDISH) LANG_SYRIACZ) LANG_TAMILI) LANG_TATARD) LANG_TELUGUJ) LANG_THAI) LANG_TURKISH)LANG_UKRAINIAN") LANG_URDUr4) LANG_UZBEKC)LANG_VIETNAMESE*) LANG_GAELIC<) LANG_MALTESE:) LANG_MAORI()LANG_RHAETO_ROMANCEr2) LANG_SAAMI;) LANG_SORBIAN.) LANG_SUTU0) LANG_TSONGA1) LANG_TSWANA2) LANG_VENDA3) LANG_XHOSA4) LANG_ZULU5)LANG_ESPERANTO) LANG_WALON) LANG_CORNISH) LANG_WELSH) LANG_BRETON)g)SUBLANG_NEUTRALr)SUBLANG_DEFAULTr9)SUBLANG_SYS_DEFAULTrE)SUBLANG_ARABIC_SAUDI_ARABIAr9)SUBLANG_ARABIC_IRAQrE)SUBLANG_ARABIC_EGYPTrG)SUBLANG_ARABIC_LIBYArI)SUBLANG_ARABIC_ALGERIArK)SUBLANG_ARABIC_MOROCCOrM)SUBLANG_ARABIC_TUNISIArO)SUBLANG_ARABIC_OMANrQ)SUBLANG_ARABIC_YEMENrS)SUBLANG_ARABIC_SYRIArU)SUBLANG_ARABIC_JORDANrW)SUBLANG_ARABIC_LEBANONrY)SUBLANG_ARABIC_KUWAITr[)SUBLANG_ARABIC_UAEr])SUBLANG_ARABIC_BAHRAINr_)SUBLANG_ARABIC_QATARr5)SUBLANG_AZERI_LATINr9)SUBLANG_AZERI_CYRILLICrE)SUBLANG_CHINESE_TRADITIONALr9)SUBLANG_CHINESE_SIMPLIFIEDrE)SUBLANG_CHINESE_HONGKONGrG)SUBLANG_CHINESE_SINGAPORErI)SUBLANG_CHINESE_MACAUrK) SUBLANG_DUTCHr9)SUBLANG_DUTCH_BELGIANrE)SUBLANG_ENGLISH_USr9)SUBLANG_ENGLISH_UKrE)SUBLANG_ENGLISH_AUSrG)SUBLANG_ENGLISH_CANrI)SUBLANG_ENGLISH_NZrK)SUBLANG_ENGLISH_EIRErM)SUBLANG_ENGLISH_SOUTH_AFRICArO)SUBLANG_ENGLISH_JAMAICArQ)SUBLANG_ENGLISH_CARIBBEANrS)SUBLANG_ENGLISH_BELIZErU)SUBLANG_ENGLISH_TRINIDADrW)SUBLANG_ENGLISH_ZIMBABWErY)SUBLANG_ENGLISH_PHILIPPINESr[)SUBLANG_FRENCHr9)SUBLANG_FRENCH_BELGIANrE)SUBLANG_FRENCH_CANADIANrG)SUBLANG_FRENCH_SWISSrI)SUBLANG_FRENCH_LUXEMBOURGrK)SUBLANG_FRENCH_MONACOrM)SUBLANG_GERMANr9)SUBLANG_GERMAN_SWISSrE)SUBLANG_GERMAN_AUSTRIANrG)SUBLANG_GERMAN_LUXEMBOURGrI)SUBLANG_GERMAN_LIECHTENSTEINrK)SUBLANG_ITALIANr9)SUBLANG_ITALIAN_SWISSrE)SUBLANG_KASHMIRI_SASIArE)SUBLANG_KASHMIRI_INDIArE)SUBLANG_KOREANr9)SUBLANG_LITHUANIANr9)SUBLANG_MALAY_MALAYSIAr9)SUBLANG_MALAY_BRUNEI_DARUSSALAMrE)SUBLANG_NEPALI_INDIArE)SUBLANG_NORWEGIAN_BOKMALr9)SUBLANG_NORWEGIAN_NYNORSKrE)SUBLANG_PORTUGUESErE)SUBLANG_PORTUGUESE_BRAZILIANr9)SUBLANG_SERBIAN_LATINrE)SUBLANG_SERBIAN_CYRILLICrG)SUBLANG_SPANISHr9)SUBLANG_SPANISH_MEXICANrE)SUBLANG_SPANISH_MODERNrG)SUBLANG_SPANISH_GUATEMALArI)SUBLANG_SPANISH_COSTA_RICArK)SUBLANG_SPANISH_PANAMArM)"SUBLANG_SPANISH_DOMINICAN_REPUBLICrO)SUBLANG_SPANISH_VENEZUELArQ)SUBLANG_SPANISH_COLOMBIArS)SUBLANG_SPANISH_PERUrU)SUBLANG_SPANISH_ARGENTINArW)SUBLANG_SPANISH_ECUADORrY)SUBLANG_SPANISH_CHILEr[)SUBLANG_SPANISH_URUGUAYr])SUBLANG_SPANISH_PARAGUAYr_)SUBLANG_SPANISH_BOLIVIAr5)SUBLANG_SPANISH_EL_SALVADORr))SUBLANG_SPANISH_HONDURASrv)SUBLANG_SPANISH_NICARAGUAr+)SUBLANG_SPANISH_PUERTO_RICOr)SUBLANG_SWEDISHr9)SUBLANG_SWEDISH_FINLANDrE)SUBLANG_URDU_PAKISTANr9)SUBLANG_URDU_INDIArE)SUBLANG_UZBEK_LATINr9)SUBLANG_UZBEK_CYRILLICrE)SUBLANG_DUTCH_SURINAMrG)SUBLANG_ROMANIANr9)SUBLANG_ROMANIAN_MOLDAVIArE)SUBLANG_RUSSIANr9)SUBLANG_RUSSIAN_MOLDAVIArE)SUBLANG_CROATIANr9)SUBLANG_LITHUANIAN_CLASSICrE)SUBLANG_GAELICr9)SUBLANG_GAELIC_SCOTTISHrE)SUBLANG_GAELIC_MANXrGct|d}t|gD] }||vr|cS t|dgdS)N *unknown*r)LANGgetSUBLANG) lang_value sublang_value lang_name sublang_names rget_sublang_name_for_langrFsm[11I M266    $ $    % ;;}{m 4 4Q 77rcd}d}|t|kr|||dz}t|dkrdStjd|d}|dz }|dkrzd|dzcxkrt|kr]nnZ t||||dzzd||<n#t $r|dz }YnwxYw|dkrdS||dzz }|dz }|t|kdSdS)NrrEzSr:) isinstancestrbytes startswith)r<flag flag_dict flag_filters rr>z"retrieve_flags..s\     dS%L ) ) /3ook.J.J  y   r)keys)r]r^s``rretrieve_flagsr`s>     NN$$   rcJ|D]\}}||zr d|j|<d|j|< dS)a Will process the flags and set attributes in the object accordingly. The object "obj" will gain attributes named after the flags provided in "flags" and valued True/False, matching the results of applying each flag value from "flags" to flag_field. TFN)__dict__)obj flag_fieldflagsr\values r set_flagsrgsL'' e :  '!%CL  !&CL   ''rc&|dko ||dz zdkS)Nrr9r:)r%s r power_of_tworis !8 .aQ..rct|tr|St|trt|Stj|dS)Ncp1252)rXrZ bytearraycodecsencode)xs rrLrLsH!U* Ay ! !*Qxx}Q)))rc.eZdZfdZfdZdZxZS) AddressSetcdtd|_d|_dSr)super__init__minmax)self __class__s rrtzAddressSet.__init__s+ rct||j|nt|j||_|j|nt|j||_dSr)rsaddrurv)rwrfrxs rrzzAddressSet.addsY  E H,55#dh2F2F H,55#dh2F2Frc@|j|jdn|j|jz Sr-)rurvrws rdiffzAddressSet.diffs#H$(8qqdh>QQr)__name__ __module__ __qualname__rtrzr} __classcell__rxs@rrqrqsl GGGGG RRRRRRRrrqcNeZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d S) !UnicodeStringWrapperPostProcessorzThis class attempts to help the process of identifying strings that might be plain Unicode or Pascal. A list of strings will be wrapped on it with the hope the overlappings will help make the decision about their type.c0||_||_d|_dSr)perva_ptrstring)rwrrs rrtz*UnicodeStringWrapperPostProcessor.__init__s  rc|jS)zGet the RVA of the string.)rr|s rget_rvaz)UnicodeStringWrapperPostProcessor.get_rvas |rc.|ddS)z6Return the escaped UTF-8 representation of the string.utf-8r )rMr|s r__str__z)UnicodeStringWrapperPostProcessor.__str__s{{7$7888rc2|jsdS|jj|S)N)rrM)rwrs rrMz(UnicodeStringWrapperPostProcessor.decodes#{ 2!t{!4((rc d}dS)z>Make this instance None, to express it's no known string type.Nr:r|s r invalidatez,UnicodeStringWrapperPostProcessor.invalidates rc. |j|jdz||_dS#t $rK|jd|jdzYdSwxYw)NrE max_lengthzCFailed rendering pascal string, attempting to read from RVA 0x{0:x}) rget_string_u_at_rvarget_pascal_16_lengthr PEFormatError get_warningsappendformatr|s rrender_pascal_16z2UnicodeStringWrapperPostProcessor.render_pascal_16 s '55 q T-F-F-H-H6DKKK    G " " ) )66 >&5DK4urc |j|j|_dS#t$rH|jd|jYdSwxYw)NzDFailed rendering unicode string, attempting to read from RVA 0x{0:x})rrrrrrrrr|s rrender_unicode_16z3UnicodeStringWrapperPostProcessor.render_unicode_160s '55dlCCDKKK    G " " ) )66z Dump.get_text..js,::1u||A::::::r)joinrr|s rget_textz Dump.get_texths%ww:: ::::::rNr) r~rrrrtrrrzrrrr:rrrrDs;;((((%%%%====;;;;;;;;rr)rocrLBhHrQIrPLrqQdscd}|}|dtjvrKtdd|D}dd|D}t||zS)Nr9rrc.g|]}|tjv|Sr:rdigitsr<rs rr>zsizeof_type..s$@@@1Q&--?-?Q-?-?-?rc.g|]}|tjv|Sr:rrs rr>zsizeof_type..s$===Aav}&<& > r "U **rT)rrc d}g}i}g}d}d}|D]}d|vr|dd\} ||z }|d d} g} | D]Y |vr9 fd|D} |  } d |  |  || <Z|t |z }|| t j|}|||||fS)Ng|]}|dtSr)rI)r<roelm_names rr>zset_format..s("H"H"H!1_s8}}_#5"H"H"Hrz {0}_{1:d})splitrr.rrrJcalcsize)r__format_str____unpacked_data_elms____field_offsets____keys____format_length__offsetelmelm_type elm_namesnames search_list occ_countrs @r set_formatrsWNH F## #::!$3!2!2 Hh h &N " ) )$ / / / s++IE% 5 5x''"H"H"H"Hx"H"H"HK + 1 1( ; ;I*11(IFFH X&&&.4!(++ k(++ +F OOE " " "77   rcpeZdZdZddZdefdZdZdZdZ d Z d Z d Z d Z d ZdZdZddZdZdS) StructurezPrepare structure object to extract members from data. Format is a list containing definitions for the elements of the structure. NcLd|_g|_d|_i|_g|_|d}t |t st |}t|\|_|_|_|_|_d|_||_ |r ||_ dS|d|_ dS)Nrrr9F) rrrrrrXtupler__all_zeroes____file_offset__name)rwrr file_offsetrs rrtzStructure.__init__s! !"!#&(# 1I!U## aA qMM     '  " M  "$*  "DIIIq DIIIrreturnc|jSr)rr|s r__get_format__zStructure.__get_format__ ""rc,|j|j|zS)zLReturn the offset within the field for the requested field in the structure.)rrrw field_names rget_field_absolute_offsetz#Structure.get_field_absolute_offsets#d&> ( (HC}S) ( (c3'''' ( ( (rcg}t|jD]D\}}d}|j|D]}t||}||krn||Et j|jg|RSr)rrrgetattrrrJpackr)rw new_valuesrr%new_valrs r__pack__zStructure.__pack__ s !$"=>> ' 'HCG}S)  !$,,c>>E"   g & & & &{4.<<<<rc\g|])}d|*S)r)rrr<rs rr>z&Structure.__repr__..!s,???achhqwwyy))???rrr|s r__repr__zStructure.__repr__s5 HH??499;;??? @ @  rrc g}|d|jdtjD|jD]}|D]}t ||}t|ttfr| drd|}nd|}|dks|dkrC |dtj tj |zz }n#t$r|d z }YnwxYwnt|}| d r3d d |d D}n4d fd|d D}|d|j||jz|j||dz|fz|S)z1Returns a string representation of the structure.z[{0}]cHg|]}|tjvt| Sr:)r whitespaceordr<rQs rr>z"Structure.dump..+s2   9J0J0JCFF0J0J0Jr Signature_z{:<8X}z0x{:<8X} TimeDateStamp dwTimeStampz [%s UTC]z [INVALID TIME] Signaturerc8g|]}d|S)z{:02X}rr%s rr>z"Structure.dump..Cs$QQQAX__Q//QQQrc`g|]*}|vrt|nd|+S)z \x{0:02x})chrr)r<rQprintable_bytess rr>z"Structure.dump..GsQ%&%&$8$8!$A%1%8%8%;%;rz0x%-8X 0x%-3X %-30s %s:)rrrr printablerrrXr$longr[timeasctimegmtime ValueErrorrlrrstriprr)rw indentationrr_rr%val_strr.s @rrzStructure.dump$s6 GNN49--...  ",    M& & D% % dC((cC;//~~l339"*//#"6"6","3"3C"8"8o-- 1E1E9#{T\$+cBRBR5S5S'SSGG)999#'88GGG92F (nnG~~k22 "$''QQ9P9PQQQ###%''*1)@)@ ## ,.s3d6JJ.s3c  ;% N s,C<<D Dc i}|j|d<|jD]}|D]}t||}t|tt frO|dks|dkrB d|t jt j|fz}n?#t$rd|z}Yn.wxYwn)d dd|DD}|j ||j z|j ||d ||<Ό|S) z5Returns a dictionary representation of the structure.rr'r(z0x%-8X [%s UTC]z0x%-8X [INVALID TIME]rc3tK|]3}t|tjvrt|nd|zV4dS)z\x%02xNr-rr0rs rrz&Structure.dump_dict..rsW""#&a&&F,<"<"<A)a-""""""rcZg|](}t|tst|n|)Sr:rXr$r$r<rs rr>z'Structure.dump_dict..ts1!W!W!Wa 1c0B0B"I#a&&&!W!W!Wr) FileOffsetOffsetValue) rrrrXr$r1r2r3r4r5rrr)rw dump_dictr_rr%s rrBzStructure.dump_dict[sY !% +M  D  dC((cC;// o-- 1E1E@"3 # $ T[-=-= > >7#CC *@@@"9C"?CCC@ 2F''""!W!WSV!W!W!W"""C #'"8"=@T"T"4S9 "" #% 0s+A??BBNNr)r~rrrrtrYrrrrr r r rrrr rrBr:rrrrs  """"8#####III222$$$&&&### &&& (((.=== &&&   5555n"""""rrcteZdZdZdZdZdZddZdZd Z d Z d Z d Z d Z dZdZdZdZdZdZdS)SectionStructurez#Convenience section handling class.cd|vr|d|_|d=d|_d|_d|_d|_t j|g|Ri|d|_d|_d|_ d|_ dS)Nr) rPointerToRawDataVirtualAddress SizeOfRawDataMisc_VirtualSizerrtPointerToRawData_adjVirtualAddress_adjsection_min_addrsection_max_addr)rwarglargds rrtzSectionStructure.__init__s 4<<4jDGT $"! $4/$///$///$(!"& $ $rc|j;|j4|j|j|jjj|_|jSr)rKrGradjust_FileAlignmentOPTIONAL_HEADER FileAlignmentr|s rget_PointerToRawData_adjz)SectionStructure.get_PointerToRawData_adjsI  $ ,$0,0G,H,H)47+B+P--)((rc|jK|jD|j|j|jjj|jjj|_|jSr)rLrHradjust_SectionAlignmentrSSectionAlignmentrTr|s rget_VirtualAddress_adjz'SectionStructure.get_VirtualAddress_adjsU  " *".*.'*I*I'G+<G+9++' &&rNFc||}n,||z |z}|||z}n|j ||jz}n|}|r||t|||jz}|j)|j"||j|jzkr|j|jz}|jj||S)aGet data chunk from a section. Allows to query data from the section by passing the addresses where the PE file would be loaded by default. It is then possible to retrieve code and data by their real addresses as they would be if loaded. Note that sections on disk can include padding that would not be loaded to memory. That is the case if `section.SizeOfRawData` is greater than `section.Misc_VirtualSize`, and that means that data past `section.Misc_VirtualSize` is padding. In case you are not interested in this padding, passing `ignore_padding=True` will truncate the result in order not to return the padding (if any). Returns bytes() under Python 3.x and set() under Python 2.7 )rUrYrIrurJrGr__data__)rwstartrignore_paddingrends rrzSectionStructure.get_datas& =2244FF33555--//0F  6/CC   +4--CCC  ;co&2Dc6D$99::C  ,1C1OT*T-????+d.@@ws ++rc"|dkr'ttd}t|||nWd|vrSt||rC|r!|jdxxt|zcc<n |jdxxt|zcc<||j|<dS)NCharacteristics IMAGE_SCN_)r`SECTION_CHARACTERISTICSrghasattrrb)rwrr% section_flagss r __setattr__zSectionStructure.__setattr__s $ $ $*+BLQQM dC / / / / T ! !gdD&9&9 ! R /0004KD4QQ0000 /0004KD4QQ000! drcZ||z |zSr)rUrYrs rget_rva_from_offsetz$SectionStructure.get_rva_from_offsets*55777$:U:U:W:WWWrcZ||z |zSr)rYrUrwrs rget_offset_from_rvaz$SectionStructure.get_offset_from_rvas*T00222T5R5R5T5TTTrcl|jdS|}||cxko ||jzkncS)z> F V V V V-ADDV-V V V V V rc|j!|j|j|cxko |jkncS|}t|jj|z |jkr|j}nt|j|j}|j (|j |j kr||z|j kr |j |z }||_||z|_||cxko||zkncS)z8Check whether the section contains the address provided.) rMrNrYrIrr[rUrIrJrvnext_section_virtual_addressrH)rwrrLsizes r contains_rvazSectionStructure.contains_rvas  ,1F1R(CGGGG$2GGGGG G!88:: tw 4#@#@#B#B BTEW W W(DDt)4+@AAD  - 91D4GGG"T)D,MMM47IID 2 2T 9!SDDDD+=+DDDDDDrc,||Sr)rpris rcontainszSectionStructure.containss  %%%rcP||S)z1Calculate and return the entropy for the section.) entropy_Hrr|s r get_entropyzSectionStructure.get_entropys~~dmmoo...rczt3t|SdS)z/Get the SHA-1 hex-digest of the section's data.N)rr hexdigestr|s r get_hash_sha1zSectionStructure.get_hash_sha1 s4   ((2244 4  rczt3t|SdS)z1Get the SHA-256 hex-digest of the section's data.N)rrrwr|s rget_hash_sha256z SectionStructure.get_hash_sha256&4  $--//**4466 6  rczt3t|SdS)z1Get the SHA-512 hex-digest of the section's data.N)rrrwr|s rget_hash_sha512z SectionStructure.get_hash_sha512,r{rczt3t|SdS)z-Get the MD5 hex-digest of the section's data.N)r rrwr|s r get_hash_md5zSectionStructure.get_hash_md52s2 ?t}}''1133 3 ?rc|sdStt|}d}|D]<}t|t |z }||t j|dzz}=|S)z)Calculate the entropy of a chunk of data.grrE)rrlvaluesfloatrImathlog)rwr/ occurencesentropyrop_xs rrtzSectionStructure.entropy_H8s| 3Yt__-- ""$$ . .A((SYY&C sTXc1--- -GGr)NNF)r~rrrrtrUrYrrergrjrlrprrrurxrzr}rrtr:rrrErEs-- % % %)))'''*,*,*,*,X""" XXXUUU    $E$E$EL&&&/// 555 777 777 444     rrEcGdd}g}i}|||}|dD]}d|vr*|||0|dd\}}d|vrtd|dd\}}t |}||ks||kr)|||||||tt|\} } } } } g}t| D]g\}}||vr||||\} }d|D}| ||D]}| |d| |d<h| | | | ||fS) Nc8eZdZdZdZdZdZdZdZdZ dS) )set_bitfields_format..AccumulatorcZg|_d|_d|_d|_||_||_dS)N~r) _subfields_name_type _bits_left _comp_fields_format)rwfmt comp_fieldss rrtz2set_bitfields_format..Accumulator.__init__Ks3 DODJDJDO +D DLLLrc|jdS|j|jdz|jz|j|jf|jt |jdz <d|_d|_g|_dS)Nrr9r)rrrrrrrIr|s rwrap_upz1set_bitfields_format..Accumulator.wrap_upUsqz! L   S 04: = > > >8< DO7TD c$,//!3 4DJDJ DOOOrc>t|dz|_||_dSNrQ)rrr)rwtps rnew_typez2set_bitfields_format..Accumulator.new_type^s1"59DODJJJrc~|xj|z c_|xj|zc_|j||fdSr)rrrr)rwrbitcnts r add_subfieldz6set_bitfields_format..Accumulator.add_subfieldbsB JJ$ JJ OOv %OO O " "D&> 2 2 2 2 2rc|jSr)rr|s rget_typez2set_bitfields_format..Accumulator.get_typeg : rc|jSr)rr|s rget_namez2set_bitfields_format..Accumulator.get_namejrrc|jSr)rr|s r get_bits_leftz7set_bitfields_format..Accumulator.get_bits_leftms ? "rN) r~rrrtrrrrrrr:rr AccumulatorrJs}    ! ! !    3 3 3        # # # # #rrr9r/rz3Structures with bitfields do not support unions yetc4g|]}|tjgSr:)StructureWithBitfields BTF_NAME_IDX)r<rs rr>z(set_bitfields_format..s$JJJQ-:;<JJJrr) rrrNotImplementedErrorr$rrrrrrrextend)rrold_fmtracrrrelm_bits format_str_ field_offsetsr_ format_length extended_keysrr%sbfbf_namesns rset_bitfields_formatrHs#$#$#$#$#$#$#$#$#LGK Wk * *Bay,,czz JJLLL NN3     YYsA..( (??%E &^^C33(x== r{{}} $ $23C3C3E3E(E(E JJLLL KK ! ! ! (++++JJLLL8B5>>8R8R5J=$ MdOO88Sk!!   % % % S!3JJcJJJX&&& 8 8A"/A"7M!A$   8  }dM; WWrcfeZdZdZdZdZdZdZd dZfdZ fdZ d fd Z fd Z d Z d ZxZS)raV Extends Structure's functionality with support for bitfields such as: ('B:4,LowerHalf', 'B:4,UpperHalf') To this end, two lists are maintained: * self.__keys__ that contains compound fields, for example ('B,~LowerHalfUpperHalf'), and is used during packing/unpaking * self.__keys_ext__ containing a separate key for each field (ex., LowerHalf, UpperHalf) to simplify implementation of dump() This way the implementation of unpacking/packing and dump() from Structure can be reused. In addition, we create a dictionary: --> (data type, [ (subfield name, length in bits)+ ] ) that facilitates bitfield paking and unpacking. With lru_cache() creating only once instance per format string, the memory overhead is negligible. rr9Nct|\|_|_|_|_|_|_dt|jD|_d|_ ||_ |dkr|n|d|_ dS)Ncg|]}dSrr:r%s rr>z3StructureWithBitfields.__init__..s&S&S&St&S&S&SrFr) rrrrr __keys_ext____compound_fields__rangerrrr)rwrrrs rrtzStructureWithBitfields.__init__s ! ( (    "  " M    $'T&SU4;Q5R5R&S&S&S##* DLLDDfQi rctt|||dSr)rsrr_unpack_bitfield_attributesrwr/rxs rrz!StructureWithBitfields.__unpack__s< $d++66t<<< ((*****rc| tt|}|n#|wxYw|Sr)_pack_bitfield_attributesrsrrrrs rrzStructureWithBitfields.__pack__sh &&((( //66??AAD  , , . . . .D , , . . . . s 'AA)c|j}|j|_ tt||}||_n #||_wxYw|Sr)rrrsrr)rwr7tkretrxs rrzStructureWithBitfields.dumpsX ])  .55::;GGCDMMBDM     s (A Ac|j}|j|_ tt|}||_n #||_wxYw|Sr)rrrsrrB)rwrrrxs rrBz StructureWithBitfields.dump_dictsV ])  .55??AACDMMBDM     s 'A Ac|jD]}|j|d}t||}t ||d}|j|t jD][}d|t jzdz }||z}t||t j ||z|z ||t jz }\dS)zaReplace compound attributes corresponding to bitfields with separate sub-fields. rr9N) rr_rrdelattrr CF_SUBFLD_IDXBTF_BITCNT_IDXrr)rwrQcf_namecvaloffstsfmasks rrz2StructureWithBitfields._unpack_bitfield_attributess)..00 C CAmA&q)G4))D D' " " "E.q12H2VW C CR 6 EFF!K-:;D[U* 2ABB C C Crc|jD]}|j|d}d\}}|j|tjD]Z}d|tjzdz }t ||tj|z}|||zz}||tjz }[t|||dS)z(Pack attributes into a compound bitfieldrrrr9N) rr_rrrrrrr)rwrQrracc_valrr field_vals rrz0StructureWithBitfields._pack_bitfield_attributess)..00 , ,AmA&q)G!NE7.q12H2VW C CR 6 EFF!KD"%;%H"IJJTQ9--2ABB D'7 + + + + , ,rrCr)r~rrrrr CF_TYPE_IDXrrtrrrrBrrrrs@rrrs(LNKM8888 +++++ CCC& , , , , , , ,rrc"eZdZdZfdZxZS) DataContainerzGeneric data container.c tt|j}|D]\}}|||dSr)rsrreitems)rwr bare_setattrrrfrxs rrtzDataContainer.__init__ sO]D11= **,, % %JC Le $ $ $ $ % %r)r~rrrrtrrs@rrrs>!!%%%%%%%%%rrceZdZdZdS)ImportDescDatazHolds import descriptor information. dll: name of the imported DLL imports: list of imported symbols (ImportData instances) struct: IMAGE_IMPORT_DESCRIPTOR structure Nr~rrrr:rrrrrrceZdZdZdZdS) ImportDatazHolds imported symbol's information. ordinal: Ordinal of the symbol name: Name of the symbol bound: If the symbol is bound, this contains the address. cRt|dr t|drt|dr|dkr|jjtkrt}n|jjt krt }||dzz|j_|jj|j_ |jj|j_ |jj|j_ nT|dkrV|j N||j _ |j j |j _ |j j |j _ |j j |j _ n|dkrO||j_ |jj |j_|jj |j_ |jj |j_ n|dkr|j r|j|j }|j|jd|zt#|t#|jkrt'd|j|j |||j|<dS)Nordinalboundraddressr9The export name provided is longer than the existing one.)rcrPE_TYPEOPTIONAL_HEADER_MAGIC_PEIMAGE_ORDINAL_FLAGOPTIONAL_HEADER_MAGIC_PE_PLUSIMAGE_ORDINAL_FLAG64 struct_tableOrdinal AddressOfDataFunctionForwarderString struct_iat name_offsetrgset_dword_at_offsetordinal_offsetrIrrset_bytes_at_offsetrb)rwrr% ordinal_flagname_rvas rrezImportData.__setattr__!s D) $ $. Gg&&. Gf%%. G y  7?&>>>#5LLW_(EEE#7L-9C&L,I!)262C2K!/-1->-F!*484E4M!11?.47DO148O4QDO1/3/LDO,6:o6SDO3""25!/,0,=,K!)-1->-L!*484E4S!11#G#w::4;KLLHG//+g-A 3xx#di..00+WG//0@#FFF! drNr~rrrrer:rrrrs-6"6"6"6"6"rrceZdZdZdS) ExportDirDatazHolds export directory information. struct: IMAGE_EXPORT_DIRECTORY structure symbols: list of exported symbols (ExportData instances)Nrr:rrrrZs"CCCCrrceZdZdZdZdS) ExportDataadHolds exported symbols' information. ordinal: ordinal of the symbol address: address of the symbol name: name of the symbol (None if the symbol is exported by ordinal only) forwarder: if the symbol is forwarded it will contain the name of the target symbol, None otherwise. ct|dr6t|dr%t|drt|dr|dkr!|j|j|n|dkr!|j|j|n|dkrUt |t |jkrtd|j |j |nZ|dkrTt |t |j krtd|j |j |||j |<dS)Nrr forwarderrrzDDDD""++D,?EEEEs88c$)nn,,'S++D,  t99t & &4 <1  !2!2;c$BV>W>WW W :t $ $ + + - -& 1nn O & &tBdo6L6L6N6N1N,N'O P P P*11$/BBE}03t7Kb7P3Q3QQQ ::4?DQQL--//,>H   R"x-'($r)     (NB , &J   # #E * * *!1nn$  ! 6T%; 6#5D  " 3#2D  4 ' ' $ ${[;Ns;S-SST   $( trcjdkrBjtdz jj<jjg t t|}jdkrj n*#jdkrj wwxYw|dd fdtDz|dd dj Dz|S)NrFlags: , cLg|] }t|d|d!Sr)rr<rrws rr>z#UnwindInfo.dump..s0PPP!GD!A$s rr>z#UnwindInfo.dump..s+JJJAQZZ\\JQJJJr) r+r*rrrrrsr!rpoprunwind_info_flagsr8)rwr7rrxs` rrzUnwindInfo.dumpsY  4 ' '"5c"::  "4#7 8   $ $d&:%; < < < (T**// < ")**,, ,JJ  4 ' ' D'$0D"E"EFF "5c"::T_L  rc|jSr)r-r|s rget_chained_function_entryz%UnwindInfo.get_chained_function_entryrrcH|jdkrtd||_dS)Nz(Chained function entry cannot be changed)r-r)rwentrys rset_chained_function_entryz%UnwindInfo.set_chained_function_entrys-  $ & & JKK K#rr)r~rrrrtrDrrBrer rrWrZrrs@rr!r!(s ))))))0<<<<<|6     """$###$$$$$$$rr!c*eZdZdZdZdZdZdZdS)PrologEpilogOpzMeant as an abstract class representing a generic unwind code. There is a subclass of PrologEpilogOp for each member of UNWIND_OP_CODES enum. ct||||_|j|dS)Nr$)r _get_formatrJr)rwunw_coder/unw_infors rr<zPrologEpilogOp.initializesI,   X & &K     t$$$$$rcdS)zComputes how many UNWIND_CODE structures UNWIND_CODE occupies. May be called before initialize() and, for that reason, should not rely on the values of intance attributes. r9r:rwr_r`s rr;z(PrologEpilogOp.length_in_code_structuress qrcdS)NTr:r|s rrKzPrologEpilogOp.is_validstrcdS)Nr%r:rwr_s rr^zPrologEpilogOp._get_formatsNNrN)r~rrrr<r;rKr^r:rrr\r\s_%%% OOOOOrr\ceZdZdZdZdZdS)PrologEpilogOpPushRegUWOP_PUSH_NONVOLcdS)N)UNWIND_CODE_PUSH_NONVOL)r'r(B:4,Regr:res rr^z!PrologEpilogOpPushReg._get_formatsWWrc6dt|jjzS)Nz .PUSHREG ) REGISTERSrJRegr|s rrzPrologEpilogOpPushReg.__str__sYt{777rN)r~rrrr^rr:rrrgrgs;XXX88888rrgc*eZdZdZdZdZdZdZdS)PrologEpilogOpAllocLargeUWOP_ALLOC_LARGEc,dddd|jdkrdndffS)NUNWIND_CODE_ALLOC_LARGEr'r(r)rzH,AllocSizeInQwordsz I,AllocSizeOpInfores rr^z$PrologEpilogOpAllocLarge._get_formats2 %)1A)=)=%%=    rc |jdkrdndS)NrrErGrtrbs rr;z2PrologEpilogOpAllocLarge.length_in_code_structuressOq((qqa/rcX|jjdkr|jjdzn |jjS)NrrQ)rJruAllocSizeInQwords AllocSizer|s rget_alloc_sizez'PrologEpilogOpAllocLarge.get_alloc_sizes3{!Q&& K )A - -& rcJdt|zSNz .ALLOCSTACK r7rzr|s rrz PrologEpilogOpAllocLarge.__str__!D$7$7$9$9 : :::rN)r~rrrr^r;rzrr:rrrprpsV    000   ;;;;;rrpc$eZdZdZdZdZdZdS)PrologEpilogOpAllocSmallUWOP_ALLOC_SMALLcdS)N)UNWIND_CODE_ALLOC_SMALL)r'r(zB:4,AllocSizeInQwordsMinus8r:res rr^z$PrologEpilogOpAllocSmall._get_format   rc&|jjdzdzSr)rJAllocSizeInQwordsMinus8r|s rrzz'PrologEpilogOpAllocSmall.get_alloc_sizes{2Q6::rcJdt|zSr|r}r|s rrz PrologEpilogOpAllocSmall.__str__r~rN)r~rrrr^rzrr:rrrrsG   ;;;;;;;;rrc(eZdZdZfdZdZxZS)PrologEpilogOpSetFPUWOP_SET_FPREGctt||||||j|_|jdz|_dSNr5)rsrr< FrameRegister_frame_register FrameOffset _frame_offsetrwr_r/r`rrxs rr<zPrologEpilogOpSetFP.initialize&sR !4((33 dHk    (5%1B6rc\dt|jzdzt|jzS)Nz .SETFRAME rG)rmrr7rr|s rrzPrologEpilogOpSetFP.__str__-s7 ,- . $$%% & r)r~rrrr<rrrs@rrr#sM77777       rrc*eZdZdZdZdZdZdZdS)PrologEpilogOpSaveRegUWOP_SAVE_NONVOLcdSNrEr:)rwunwcoder`s rr;z/PrologEpilogOpSaveReg.length_in_code_structures9qrc |jjdzSr)rJOffsetInQwordsr|s r get_offsetz PrologEpilogOpSaveReg.get_offset<s{)A--rcdS)N)UNWIND_CODE_SAVE_NONVOL)r'r(rkzH,OffsetInQwordsr:res rr^z!PrologEpilogOpSaveReg._get_format?rrcdt|jjzdzt|zSNz .SAVEREG rG)rmrJrnr7rr|s rrzPrologEpilogOpSaveReg.__str__Es2Yt{77$>T__EVEVAWAWWWrNr~rrrr;rr^rr:rrrr6s[...   XXXXXrrc*eZdZdZdZdZdZdZdS)PrologEpilogOpSaveRegFarUWOP_SAVE_NONVOL_FARcdSNrGr:rbs rr;z2PrologEpilogOpSaveRegFar.length_in_code_structuresLrrc|jjSrrJr@r|s rrz#PrologEpilogOpSaveRegFar.get_offsetO {!!rcdS)N)UNWIND_CODE_SAVE_NONVOL_FARr'r(rkzI,Offsetr:res rr^z$PrologEpilogOpSaveRegFar._get_formatRrrcpdt|jjzdzt|jjzSr)rmrJrnr7r@r|s rrz PrologEpilogOpSaveRegFar.__str__Xs-Yt{77$>T[EWAXAXXXrNrr:rrrrIs["""   YYYYYrrc*eZdZdZdZdZdZdZdS)PrologEpilogOpSaveXMMUWOP_SAVE_XMM128cdS)N)UNWIND_CODE_SAVE_XMM128)r'r(rkzH,OffsetIn2Qwordsr:res rr^z!PrologEpilogOpSaveXMM._get_format_rrcdSrr:rbs rr;z/PrologEpilogOpSaveXMM.length_in_code_structureserrc |jjdzSr)rJOffsetIn2Qwordsr|s rrz PrologEpilogOpSaveXMM.get_offseths{*R//rcdt|jjzdzt|zSNz.SAVEXMM128 XMMrG)rYrJrnr7rr|s rrzPrologEpilogOpSaveXMM.__str__ks5 3t{#7#77$>T__EVEVAWAWWWrNr~rrrr^r;rrr:rrrr\s[   000XXXXXrrc*eZdZdZdZdZdZdZdS)PrologEpilogOpSaveXMMFarUWOP_SAVE_XMM128_FARcdS)N)UNWIND_CODE_SAVE_XMM128_FARrr:res rr^z$PrologEpilogOpSaveXMMFar._get_formatrrrcdSrr:rbs rr;z2PrologEpilogOpSaveXMMFar.length_in_code_structuresxrrc|jjSrrr|s rrz#PrologEpilogOpSaveXMMFar.get_offset{rrctdt|jjzdzt|jjzSr)rYrJrnr7r@r|s rrz PrologEpilogOpSaveXMMFar.__str__~s0 3t{#7#77$>T[EWAXAXXXrNrr:rrrros[   """YYYYYrrceZdZdZdZdS)PrologEpilogOpPushFrameUWOP_PUSH_MACHFRAMEc(d|jjrdndzS)Nz .PUSHFRAMEz r)rJrur|s rrzPrologEpilogOpPushFrame.__str__sDK,>FyyBGGrN)r~rrrrr:rrrrs.HHHHHrrc@eZdZdZfdZdZdZdZdZdZ xZ S)PrologEpilogOpEpilogMarker UWOP_EPILOGcd|_t|d |_tt||||||jr.t |d|jj|j dzdk|_|j |_ dS)NT SizeOfEpilogr9r) _long_offstrc_firstrsrr<rrJSizerur _epilog_sizers rr<z%PrologEpilogOpEpilogMarker.initializes!(N;;;  ($//:: dHk    ; 8 Hndk.> ? ? ?'2a7D $1rc<|jrd|jdzdkrdndfSdS)NUNWIND_CODE_EPILOGr9)zB,OffsetLow,Sizer( B:4,Flags)zB,Sizer(r B,OffsetLowz B:4,UnusedB:4,OffsetHigh)r)rr(r)rrures rr^z&PrologEpilogOpEpilogMarker._get_formatsE ; $?Q&!++BA  rcFt|ds|jdzdkrdndS)Nrr9rrE)rcrurbs rr;z4PrologEpilogOpEpilogMarker.length_in_code_structuress88^44 :B/A:MRS9S9S A rcL|jj|jr|jjdzndzS)NrQr)rJ OffsetLowr OffsetHighr|s rrz%PrologEpilogOpEpilogMarker.get_offsets.{$+/+; BDK "a ' '  rc2|dkSr-)rr|s rrKz#PrologEpilogOpEpilogMarker.is_valids  1$$rc|dkr.s',,qG|,,,,,,r)rXrYrZrlallowed_filenameallset)rrs @ris_valid_dos_filenamersUy 1sE9&=>>yu'G ,,,,SVV,,, , ,,rrrelax_allowed_charactersrcd|rd|duoIt|tttfo't fdt |DS)Ns ._?@$()<>s!"#$%&'()*+,-./:<>?[\]^_`{|}~@c32K|]}|tvp|vVdSr)allowed_function_name)r<r allowed_extras rrz)is_valid_function_name.. s3SSq++AqM/ASSSSSSr)rXrYrZrlrr)rrrs @ris_valid_function_namer sj!M<;    T q3y1 2 2 T SSSSCPQFFSSS S SrceZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Z*d)d)d)e+d*fd+Z,d,Z-d-Z.d.Z/d/Z0d0Z1d1Z2d2Z3d3Z4d4Z5d5Z6dd6Z7d7Z8 dd9Z9d:Z:d;Z;d<ZZ>d?Z?dd@Z@dAZAdBZBdCZCddEZDdFZEdGZFdHZGddIZHdJZIdKZJdLZKddNZLdOZMdPZNddQZO ddRZPddSZQddUZRdVZSddWZTdXZUdYZVeWfdZZXd[ZYd\ZZdd^Z[d_Z\d`Z]daZ^dbZ_dcZ`ddeZaddgZbdhZcdiZddjZedkZfdlZgdmZhdnZidoZjdpZkdqZldrZmdsZndtZoduZpdvZqdwZrdxZsdyZtdzZud{Zvd|Zwd}Zxd~eydezfdZ{dZ|dZ}dZ~dZdZdZdZdZdZdZdZdZd)S)PEa A Portable Executable representation. This class provides access to most of the information in a PE file. It expects to be supplied the name of the file to load or PE data to process and an optional argument 'fast_load' (False by default) which controls whether to load all the directories information, which can be quite time consuming. pe = pefile.PE('module.dll') pe = pefile.PE(name='module.dll') would load 'module.dll' and process it. If the data is already available in a buffer the same can be achieved with: pe = pefile.PE(data=module_dll_data) The "fast_load" can be set to a default by setting its value in the module itself by means, for instance, of a "pefile.fast_load = True". That will make all the subsequent instances not to load the whole PE structure. The "full_load" method can be used to parse the missing data at a later stage. Basic headers information will be available in the attributes: DOS_HEADER NT_HEADERS FILE_HEADER OPTIONAL_HEADER All of them will contain among their attributes the members of the corresponding structures as defined in WINNT.H The raw data corresponding to the header (from the beginning of the file up to the start of the first section) will be available in the instance's attribute 'header' as a string. The sections will be available as a list in the 'sections' attribute. Each entry will contain as attributes all the structure's members. Directory entries will be available as attributes (if they exist): (no other entries are processed at this point) DIRECTORY_ENTRY_IMPORT (list of ImportDescData instances) DIRECTORY_ENTRY_EXPORT (ExportDirData instance) DIRECTORY_ENTRY_RESOURCE (ResourceDirData instance) DIRECTORY_ENTRY_DEBUG (list of DebugData instances) DIRECTORY_ENTRY_BASERELOC (list of BaseRelocationData instances) DIRECTORY_ENTRY_TLS DIRECTORY_ENTRY_BOUND_IMPORT (list of BoundImportData instances) The following dictionary attributes provide ways of mapping different constants. They will accept the numeric value and return the string representation and the opposite, feed in the string and get the numeric constant: DIRECTORY_ENTRY IMAGE_CHARACTERISTICS SECTION_CHARACTERISTICS DEBUG_TYPE SUBSYSTEM_TYPE MACHINE_TYPE RELOCATION_TYPE RESOURCE_TYPE LANG SUBLANG )IMAGE_DOS_HEADER)z H,e_magiczH,e_cblpzH,e_cpzH,e_crlcz H,e_cparhdrz H,e_minallocz H,e_maxalloczH,e_sszH,e_spzH,e_csumzH,e_ipzH,e_csz H,e_lfarlczH,e_ovnoz8s,e_resz H,e_oemidz H,e_oeminfoz 20s,e_res2z I,e_lfanew)IMAGE_FILE_HEADER)z H,MachinezH,NumberOfSectionsI,TimeDateStampzI,PointerToSymbolTablezI,NumberOfSymbolszH,SizeOfOptionalHeaderzH,Characteristics)IMAGE_DATA_DIRECTORY)I,VirtualAddressI,Size)IMAGE_OPTIONAL_HEADER)H,MagicB,MajorLinkerVersionB,MinorLinkerVersion I,SizeOfCodeI,SizeOfInitializedDataI,SizeOfUninitializedDataI,AddressOfEntryPoint I,BaseOfCodez I,BaseOfDataz I,ImageBaseI,SectionAlignmentI,FileAlignmentH,MajorOperatingSystemVersionH,MinorOperatingSystemVersionH,MajorImageVersionH,MinorImageVersionH,MajorSubsystemVersionH,MinorSubsystemVersion I,Reserved1 I,SizeOfImageI,SizeOfHeaders I,CheckSum H,SubsystemH,DllCharacteristicszI,SizeOfStackReservezI,SizeOfStackCommitzI,SizeOfHeapReservezI,SizeOfHeapCommit I,LoaderFlagsI,NumberOfRvaAndSizes)IMAGE_OPTIONAL_HEADER64)rrrrrrrrz Q,ImageBaserrrrrrrrrrrrr r zQ,SizeOfStackReservezQ,SizeOfStackCommitzQ,SizeOfHeapReservezQ,SizeOfHeapCommitr r )IMAGE_NT_HEADERS) I,Signature)IMAGE_SECTION_HEADER) z8s,Namez,I,Misc,Misc_PhysicalAddress,Misc_VirtualSizerzI,SizeOfRawDataI,PointerToRawDatazI,PointerToRelocationszI,PointerToLinenumberszH,NumberOfRelocationszH,NumberOfLinenumbersI,Characteristics)IMAGE_DELAY_IMPORT_DESCRIPTOR)z I,grAttrszI,szNamezI,phmodzI,pIATzI,pINTz I,pBoundIATz I,pUnloadIATz I,dwTimeStamp)IMAGE_IMPORT_DESCRIPTOR)z$I,OriginalFirstThunk,CharacteristicsrzI,ForwarderChainI,Namez I,FirstThunk)IMAGE_EXPORT_DIRECTORY) rrH,MajorVersionH,MinorVersionrzI,BasezI,NumberOfFunctionszI,NumberOfNameszI,AddressOfFunctionszI,AddressOfNameszI,AddressOfNameOrdinals)IMAGE_RESOURCE_DIRECTORY)rrrrzH,NumberOfNamedEntrieszH,NumberOfIdEntries)IMAGE_RESOURCE_DIRECTORY_ENTRY)rI,OffsetToData)IMAGE_RESOURCE_DATA_ENTRY)rrz I,CodePagez I,Reserved)VS_VERSIONINFOzH,Lengthz H,ValueLengthzH,Type)VS_FIXEDFILEINFO) rzI,StrucVersionzI,FileVersionMSzI,FileVersionLSzI,ProductVersionMSzI,ProductVersionLSzI,FileFlagsMaskz I,FileFlagszI,FileOSz I,FileTypez I,FileSubtypez I,FileDateMSz I,FileDateLS)StringFileInfor) StringTabler)Stringr)Varr)IMAGE_THUNK_DATA)z0I,ForwarderString,Function,Ordinal,AddressOfData)r$)z0Q,ForwarderString,Function,Ordinal,AddressOfData)IMAGE_DEBUG_DIRECTORY)rrrrzI,Typez I,SizeOfDatazI,AddressOfRawDatar)IMAGE_BASE_RELOCATION)rz I,SizeOfBlock)IMAGE_BASE_RELOCATION_ENTRY)zH,Data)0IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION)I:12,PageRelativeOffsetI:1,IndirectCallz I:19,IATIndex)/IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION)r)r*zI:1,RexWPrefixz I:1,CfgCheckz I:1,Reserved)+IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION)r)zI:4,RegisterNumber)IMAGE_TLS_DIRECTORY)zI,StartAddressOfRawDatazI,EndAddressOfRawDatazI,AddressOfIndexzI,AddressOfCallBacksI,SizeOfZeroFillr)r-)zQ,StartAddressOfRawDatazQ,EndAddressOfRawDatazQ,AddressOfIndexzQ,AddressOfCallBacksr.r)IMAGE_LOAD_CONFIG_DIRECTORY)+rrrrI,GlobalFlagsClearI,GlobalFlagsSetI,CriticalSectionDefaultTimeoutzI,DeCommitFreeBlockThresholdzI,DeCommitTotalFreeThresholdzI,LockPrefixTablezI,MaximumAllocationSizezI,VirtualMemoryThresholdI,ProcessHeapFlagszI,ProcessAffinityMask H,CSDVersion H,Reserved1z I,EditListzI,SecurityCookiezI,SEHandlerTablezI,SEHandlerCountzI,GuardCFCheckFunctionPointerz I,GuardCFDispatchFunctionPointerzI,GuardCFFunctionTablezI,GuardCFFunctionCount I,GuardFlagsH,CodeIntegrityFlagsH,CodeIntegrityCatalogI,CodeIntegrityCatalogOffsetI,CodeIntegrityReservedz I,GuardAddressTakenIatEntryTablez I,GuardAddressTakenIatEntryCountzI,GuardLongJumpTargetTablezI,GuardLongJumpTargetCountzI,DynamicValueRelocTablezI,CHPEMetadataPointerzI,GuardRFFailureRoutinez&I,GuardRFFailureRoutineFunctionPointerI,DynamicValueRelocTableOffsetH,DynamicValueRelocTableSection H,Reserved2z?I,GuardRFVerifyStackPointerFunctionPointerI,HotPatchTableOffset I,Reserved3zI,EnclaveConfigurationPointer)r/),rrrrr0r1r2zQ,DeCommitFreeBlockThresholdzQ,DeCommitTotalFreeThresholdzQ,LockPrefixTablezQ,MaximumAllocationSizezQ,VirtualMemoryThresholdzQ,ProcessAffinityMaskr3r4r5z Q,EditListzQ,SecurityCookiezQ,SEHandlerTablezQ,SEHandlerCountzQ,GuardCFCheckFunctionPointerz Q,GuardCFDispatchFunctionPointerzQ,GuardCFFunctionTablezQ,GuardCFFunctionCountr6r7r8r9r:z Q,GuardAddressTakenIatEntryTablez Q,GuardAddressTakenIatEntryCountzQ,GuardLongJumpTargetTablezQ,GuardLongJumpTargetCountzQ,DynamicValueRelocTablezQ,CHPEMetadataPointerzQ,GuardRFFailureRoutinez&Q,GuardRFFailureRoutineFunctionPointerr;r<r=z*Q,GuardRFVerifyStackPointerFunctionPointerzI,HotPatchTableOffsetr>zQ,EnclaveConfigurationPointer)IMAGE_DYNAMIC_RELOCATION_TABLE)z I,Versionr)IMAGE_DYNAMIC_RELOCATION)I,SymbolI,BaseRelocSize)IMAGE_DYNAMIC_RELOCATION64)Q,SymbolrB)IMAGE_DYNAMIC_RELOCATION_V2) I,HeaderSizeI,FixupInfoSizerA I,SymbolGroupI,Flags)IMAGE_DYNAMIC_RELOCATION64_V2)rFrGrDrHrI)IMAGE_BOUND_IMPORT_DESCRIPTOR)rH,OffsetModuleNamezH,NumberOfModuleForwarderRefs)IMAGE_BOUND_FORWARDER_REF)rrLz H,Reserved)RUNTIME_FUNCTION)zI,BeginAddressz I,EndAddressz I,UnwindDataNxc||_||_d|_g|_g|_d|_||t dg|_d|_d|_ d|_ d|_ d|_ d|_ tjtjtjd|_||nt'd} ||||dS#|xYw)NzMust supply either name or dataFr)rGrIrK fast_load)max_symbol_exportsmax_repeated_symbol_get_section_by_rva_last_usedsections _PE__warningsrr5__structures___PE__from_fileFileAlignment_WarningSectionAlignment_Warning!_PE__total_resource_entries_count_PE__total_resource_bytes_PE__total_import_symbolsr;__IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION_format__:__IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION_format__6__IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION_format__#dynamic_relocation_format_by_symbolglobals __parse__close)rwrr/rQrRrSs rrtz PE.__init__ s#5#6 -1*  ?? ? !&+"(-%/0+'(#&'#MLH4 4 0 "+!6IIGIIk>>     & & & &    O " "IPP1I{C    44444   ""9---) A35A..A3c$t||} ||nM#t$r@}|jd|d||Yd}~dSd}~wwxYw|j||Srm)rrrrVrrrWrns r__unpack_data_with_bitfields__z!PE.__unpack_data_with_bitfields__| s +6{KKK     & & & &    O " "IPP1I{C    44444   ""9---rrc l|Rtj|}|jdkrtdd} t |d}|_t tdr+tjjdtj_ n+tjjdtj _ d_ nQ#t$rD}d |}|od |z}td ||d}~wwxYw ||n,#||wwxYw||_ d _ t!j _d _|st't)j D]\}} |dkr| t!j z d ks!|dkra| t!j z d krFjd |d| zt!j z j dd} t!| dkrtdj| d_jjt8krtdjrjjt:krtdjjt!j krtdjj} jj | | dz| _ j r j j!stddj j!ztDkrtddj j!ztFkrtddj j!ztHkrtddj j!ztJkrtdj j!tLkrtdj'j | dz| dzdz| dz_(tStTd } j(std!tWj(j(j,| | dzj(-z} | j(j.z}j/j | | d"z| _0d#}j0_t!j | | d$z|kr||}|n t~||_@n#ttf$rYnawxYw||-z }j0j8||| j0-zd%zkrn C|}fd0jDD}t!|dkrt|}nd}|r||krj d|_Fnj d|_FGj0j9 _Hj0j9}|t!j kr'jd1j0j9zn'jd2j0j9z|sIdSdS)3zParse a Portable Executable file. Loads a PE file, parsing all its structures and making them available through the instance's attributes. NrzThe file is emptyrb MAP_PRIVATE)accessTrz: %szUnable to access file '{0}'{1}Fg?g333333?zeByte 0x{0:02x} makes up {1:.4f}% of the file's contents. This may indicate truncation / malformation.gY@rgz9Unable to read the DOS Header, possibly a truncated file.r$z)Probably a ZM Executable (not a PE file).zDOS Header magic not found.z.Invalid e_lfanew value, probably not a PE filerQzNT Headers not found.rz0Invalid NT Headers signature. Probably a NE filez0Invalid NT Headers signature. Probably a LE filez0Invalid NT Headers signature. Probably a LX filez0Invalid NT Headers signature. Probably a TE filezInvalid NT Headers signature.rIr4 IMAGE_FILE_zFile Header missingrjrHr"r r+rz5No Optional Header found, invalid PE32 or PE32+ file.z*Invalid type 0x{0:04x} in Optional Header.IMAGE_DLLCHARACTERISTICS_zXSizeOfHeaders is smaller than AddressOfEntryPoint: this file cannot run under Windows 8.r5zsSuspicious NumberOfRvaAndSizes in the Optional Header. Normal values are never larger than 0x10, the value is: 0x%xscpg|]2}|jdk |jjj3Sr)rGrRrSrTrIs rr>z PE.__parse__.. sS   !A%%  % %"D$8$F  &%%rz[Possibly corrupt file. AddressOfEntryPoint lies outside the file. AddressOfEntryPoint: 0x%xzTAddressOfEntryPoint lies outside the sections' boundaries. AddressOfEntryPoint: 0x%x)Josstatst_sizeropenfilenorcrkrwr[ ACCESS_READrXIOErrorr ExceptionrdrI$_PE__resource_size_limit_upperbounds _PE__resource_size_limit_reachedrrlrrVrrq__IMAGE_DOS_HEADER_format__ DOS_HEADERe_magicIMAGE_DOSZM_SIGNATUREIMAGE_DOS_SIGNATUREe_lfanew__IMAGE_NT_HEADERS_format__ NT_HEADERSr)IMAGE_NE_SIGNATUREIMAGE_LE_SIGNATUREIMAGE_LX_SIGNATUREIMAGE_TE_SIGNATUREIMAGE_NT_SIGNATURE__IMAGE_FILE_HEADER_format__ FILE_HEADERr`IMAGE_CHARACTERISTICSrgr`r SizeOfOptionalHeader __IMAGE_OPTIONAL_HEADER_format__rSMagicrrr"__IMAGE_OPTIONAL_HEADER64_format__DLL_CHARACTERISTICSDllCharacteristicsDATA_DIRECTORYAddressOfEntryPoint SizeOfHeadersNumberOfRvaAndSizesrr$__IMAGE_DATA_DIRECTORY_format__DIRECTORY_ENTRYrKeyErrorAttributeErrorparse_sectionsrUruheaderget_section_by_rvarj full_load)rwfnamer/rQr~fdexcp exception_msgbyte byte_countdos_header_datant_headers_offset image_flagsoptional_header_offsetsections_offset&MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZEpadding_length padded_datadll_characteristics_flagsr)MAX_ASSUMED_VALID_NUMBER_OF_RVA_AND_SIZESrQ dir_entryrawDataPointerslowest_section_offset ep_offsets` rrcz PE.__parse__ sq   75>>D|q  #$7888B %&& iikk 4//W$(Idk1d>N$O$ODMM%)Idk1TEU$V$V$VDM#'      % T 2 2 - J6M3I 4;;E=QQ !>HHJJJ>HHJJJJ"   DM$D 25T]1C1C.-2* $+Idm,D,D$E$E$K$K$M$M   j AII*s4=/A/A"AC"G"GAII*s4=/A/A"AD"H"HO**L &uz'9C > > ? #c$-&8&8 8 8 PQQ Q O4..  , M+.?!.CC D)/   9do&? 9 788 8 T_. .3E E E RSS S T_. .3E E E RSS S T_. .3E E E RSS S T_. .3E E E RSS S ? $(: : : ?@@ @//  - M+a/2Ca2G"2LL M)A-0   %%:MJJ  7 566 6 $"D$4$DkRRR!2Q!69I9P9P9R9R!R143C3XX#33  1 M03IC3OO P. 4   24.  ( 47MPU7UUV666!N-&)?%)GG')K$(#7#752$8$$D    +#)-EEE7 %+/LLL< '+';';;M.1G%1OO!7 (<(($:@6(0 25Ke5SS > >>&)N"&-.1G%1OO#/#1K,0+?+??#$:,@,,D(  7 566 6   ' WXX X <  O " "<CC(.    %3 !<% % !    3 %   /1+'$*>*E*E*G*GG&*&6#*.*>'  4"0 1 1 O " ".      3d : : O " "O&:;    5:1s:(<(PPQQRR+ + A4=!!F*a//4=!!F*Q..}VWW- 9}V&OOO,,4d-I  !0!3 n-     i&&(( (F  / 6 6y A A A&)=)D)D)F)FFO  $$_55    ]       ! # #$'$8$8 ! !$( !$ @(=(F(F-0DKK-(>)>(>?DK  # #D$8$L M M  00$8I3t}----&&7*>? O " ",.2.B.VW      NN       s<BCD; D ?DD  D;;E0bbbc d}d}|jdd|j}|dkrdS |jd|dz}|ddt t |dz z}t tjd t t |dz |}||vrdSn#t$rYdSwxYwtj d || |d z}d |i}|d|d}||d <d} t} t|D]E\} } | | | | || t |zz Ft!| |d<|d } |d| z |ks|d| ks |d| krdS| |d<g}||d<|dd}t#t t |dz D]a}|d|z|kr.|d|zd z| kr|jdn#||d|z| z |d|zd z| z gz }b|S)a"Parses the rich header see http://www.ntcore.com/files/richsign.htm for more information Structure: 00 DanS ^ checksum, checksum, checksum, checksum 10 Symbol RVA ^ checksum, Symbol size ^ checksum... ... XX Rich, checksum, 0, 0,... iDanSiRichsRichr NrQrIz<{0}Iz&PE.parse_rich_header..0 sz!S'9'9@Qqr clear_datarrErGchecksumrzRich Header is malformed)r[findrSrr$rIlistrJrKrrrindexrlrrrZrrV)rwDANSRICH rich_index rich_datar/rresultrord_rrr%r headervaluesrQs rparse_rich_headerzPE.parse_rich_header s]'' T4/??AA     4  dZ!^&;(?(?$?"?@I gnnSY!1C-D-DEEyQQD4t    44 k$TZZ%5%5%9 :;;6y~~g6667%z@@[[ !(++ G GHC   ttCyy44C#c((N0C+D+DD F F F F$Z00|7 7X  % %aH)<)<Q8@S@S4%z 'xABBxs3t99q=))** Q QAAE{d""A ?h..O**+EFFF T!a%[83T!a%!)_x5OP PLL sBC C$#C$c|jS)zReturn the list of warnings. Non-critical problems found when parsing the PE file are appended to a list of warnings. This method returns the full list. )rVr|s rrzPE.get_warningsS s rc:|jD]}td|dS)zPrint the list of warnings. Non-critical problems found when parsing the PE file are appended to a list of warnings. This method prints the full list to standard output. >N)rVprint)rwwarnings r show_warningszPE.show_warnings] s2  G #w      rc|Gdd}|}|r||_|dd|j_|dd|j_|dd|j_|dd|j_|dd|j_dSd|_dS) zProcess the data directories. This method will load the data directories which might not have been loaded if the "fast_load" option was used. ceZdZdS) PE.full_load..RichHeaderN)r~rrr:rr RichHeaderrq s DrrrNrrrr) parse_data_directoriesr RICH_HEADERr@rrrrr)rwr rich_headers rrz PE.full_loadh s ##%%%        ,,..  $)z||D (3 D(I(ID  %&1ooh&E&ED  ##.??5$#?#?D  (3 D(I(ID  %*5//,*M*MD  ' ' '#D   rc t|j}|jD]N}t|}|}||||t |z<Ot |drDt |dr3|jD]*}|D]#}t |dr|jD]}t|j D]\} }|j | } |j | } t || dkrY|dd} | d| ddz|| d| d| ddzz<|dd} | || d| dt | z<ݐ%,|}|s|St!|d }|||dS) aWrite the PE file. This function will process all headers and components of the PE file and include all changes made (by just assigning to attributes in the PE objects) and write the changes back to a file whose name is provided as an argument. The filename is optional, if not provided the data will be returned as a 'str' object. rFileInfor!r9rrHNrEzwb+)rlr[rWrrrIrcrr!rentriesrentries_offsetsentries_lengthsrMrnrwriterd)rwfilename file_dataro struct_datarfinforYst_entryroffsetslengthsrP encoded_data new_file_datars rrzPE.write sBdm,, , H HI#I$6$6$8$899K..00F'>,1LL,A,A,H,H,T,T-..> Q.>,?)2,3AJgajSTn9T,T)*)*8=||G7L7L7S7S,68*8* -9)2,3AJc,FWFW9W,W)*)*%!992"  ! 5 ! !    rc4 g|_d}t|jjD]}|tkr@|jd|jjtnnd}t|j |}|snQ|| |zz}| ||j ||| z}t|| kr!|jd|dn|s!|jd|dn|||j||j|jzt%|j kr#|dz }|jd |d ||j|jjt%|j kr#|dz }|jd |d |jd kr#|dz }|jd |d||j|jj|jjd kr#|dz }|jd |d|jjdkr;|j|jjzdkr#|dz }|jd |d||kr|jdnt5t6d}t9||j||jddrl|jddrQ|j !ddkr|"rn|jd|d|j||j#dtI|jD]B\} }| t%|jdz krd|_%(|j| dzj|_%C|jjdkr6|jr/||jd |jjzzS|S)aFetch the PE file sections. The sections will be readily available in the "sections" attribute. Its attributes will contain all the section information plus "data" a buffer containing the section's data. The "Characteristics" member will be processed and attributes representing the section characteristics (with the 'IMAGE_SCN_' string trimmed from the constant's names) will be added to the section instance. Refer to the SectionStructure class for additional info. rGzToo many sections {0} (>={1})r)rzInvalid section z. Contents are null-bytes.z8. No data in the file (is this corkami's virtsectblXP?).r9zError parsing section z$. SizeOfRawData is larger than file.z5. PointerToRawData points beyond the end of the file.rz'Suspicious value found parsing section z*. VirtualSize is extremely large > 256MiB.z&. VirtualAddress is beyond 0x10000000.z. PointerToRawData should normally be a multiple of FileAlignment, this might imply the file is trying to confuse tools which parse this incorrectly.z,Too many warnings parsing section. Aborting.rarFrr+sPAGEz!Suspicious flags set for section zf. Both IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE are set. This might indicate a packed executable.c|jSr)rH)as rrz#PE.parse_sections..4s )9r)rN)&rUrrNumberOfSections MAX_SECTIONSrVrrrE__IMAGE_SECTION_HEADER_format__r r r[r0rrWrIrGrIrRrSrTrJrWrHrXr`rbrgr`rbr@Namer6 is_driversortrrn) rwrMAX_SIMULTANEOUS_ERRORSrQsimultaneous_errorssectionsection_offset section_datardrs rrzPE.parse_sections sv "#t'899h *h *AL  &&3::(9< "# &t'KPTUUUG #gnn&6&6&::N  # #N 3 3 3='..2B2B!BBLL))W^^-=-===&&'W!'W'W'WXXX &&&q&&&   | , , ,   & &w / / /$w'??#dmBTBTTT#q(#&&TQTTT((($*>*LDM""##$q(#&&+Q+++ '*44#q(#&&0a000 ,,*(9(6  $q(#&&)a))) $2a77-0D0RRWXXX#q(#&&SSSS#&===&&'UVVV*+BLQQM gw6 F F F##%u "&&'>FF <&&w//7::t~~?O?O:O**CACCC M  ) ) ) ) 99:::%dm44 ! !LCc$-((1,,,7;447;}!G8 44   ,q 0 0T] 0q)0022T5E5VVV MrFc d|jfd|jfd|jfd|jfd|jfd|jfd|jfd|jfd |jfd |j ff }|t|ttfs|g}|D]W} t|d }|jj|}n#t $rYd SwxYw|||vrd }|jr|r+|d dkr|d |j|jd}n|r+|d dkr|d |j|jd}n[ |d |j|j}n=#t&$r0} |jd|d d| Yd } ~ nd } ~ wwxYw|rt-||d dd ||4t|tr|d |vr||Yd S)aSParse and process the PE file's data directories. If the optional argument 'directories' is given, only the directories at the specified indexes will be parsed. Such functionality allows parsing of areas of interest without the burden of having to parse all others. The directories can then be specified as: For export / import only: directories = [ 0, 1 ] or (more verbosely): directories = [ DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'], DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'] ] If 'directories' is a list, the ones that are processed will be removed, leaving only the ones that are not present in the image. If `forwarded_exports_only` is True, the IMAGE_DIRECTORY_ENTRY_EXPORT attribute will only contain exports that are forwarded to another DLL. If `import_dllnames_only` is True, symbols will not be parsed from the import table and the entries in the IMAGE_DIRECTORY_ENTRY_IMPORT attribute will not have a `symbols` attribute. rCrBrDrLrJrRrTrZrVrFNrr9T)forwarded_only) dllnames_onlyzFailed to process directoty "z": rM)parse_import_directoryparse_export_directoryparse_resources_directoryparse_debug_directoryparse_relocations_directoryparse_directory_tlsparse_directory_load_configparse_delay_import_directoryparse_directory_bound_importsparse_exceptions_directoryrXrrrrSr IndexErrorrHrrrVrrremove) rw directoriesforwarded_exports_onlyimport_dllnames_onlydirectory_parsingrYdirectory_indexrrfrs rrzPE.parse_data_directoriesDs@,T-H I +T-H I -t/M N *D,F G .0P Q ($*B C 0$2R S 143T U 143U V .0O P    "kE4=99 ,*m &0 40 4E "1%("; 0?P      "o&D&D+;.!!H(FFF (a%4%N+/!!! -!!H(FFF (a%4inTX!!! $,E!HY-Ey~$V$VEE, O22 Sa S ST S S;eAhqrrlE:::({D11)1X,,""?333a0 40 4s*:%B  B/.B/D99 E3&E..E3c0|jjtdkr|jjtdkrdSt|j}|}i}g}i}t ||zD]}||j|||| |}|nod} |j dzdkr'|j |vr||j } n2t| |j } | ||j <| ||j | } | dkr|j | n| ||j | } | dkr|j | nQ|j| t!|| } || | ||j<||z }|D]}|j t'|jds |jj|vr7|j d |jd d e |j||jj#t0$rB} |j d |jd d | Yd} ~ d} ~ wwxYw|S)zParses exception directory All the code related to handling exception directories is documented in https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details rrNr$r9r)rJ unwindinfor2z FunctionEntry of UNWIND_INFO at roz' points to an entry that does not existz/Failed parsing FunctionEntry of UNWIND_INFO at z: )rMachine MACHINE_TYPEr__RUNTIME_FUNCTION_format__r rrqrrj UnwindDatar!rDrVrrWr BeginAddressrrcr2rJrrZr) rwrrorfrf_sizerva2rtrt_funcs rva2infosruiwsrYrs rrzPE.parse_exceptions_directorysW   $ 5O(P P P (L9R,SSS4 t7 8 8))++ tw''( ( A%%0 c7++ 44S99&B zB #)) MY.."2=1BB#0H0H0W0WXXXB/1Ibm,((r}biikk)R)RSS::O**2...E((r}biikk)R)RSS::O**2...E#**2...*"DDDE OOE " " "&+F2? # 7NCC  B}$ 2=/:: =.&88&&>ry7P7P7R7RV>>>  882=67!   &&?y0022>??8<??  s*K L8LLc lt|j}|}|}g} ||j|j|||z|}||jddS|rn||z }||}| ||]t|jz }fd|j D} | r0t| } || }| |j z }n,|j t|zz }|s/|jd|dSg} t!t|jt%|dz D]} ||j|j|||z|} | st)d|| z }|| jz}|d |j||t.z}|r0d t1|D}t|d ks|rn%| t3| | ||jz}|d |j||t.z}|r/d t1|D}t|d ks|rn*|sn'|t5||| |S)rTr$Nz7The Bound Imports directory exists but can't be parsed.c4g|]}|jk |jSr:)rG)r<rrs rr>z4PE.parse_directory_bound_imports.."s4))))K77&777rzHRVA of IMAGE_BOUND_IMPORT_DESCRIPTOR points to an invalid address: {0:x}rQz(IMAGE_BOUND_FORWARDER_REF cannot be readrcHg|]}t|tjv| Sr:r;r>s rr>z4PE.parse_directory_bound_imports..Ws2%%%#a&&HX:X:X:X:X:Xrrj)rJrcHg|]}t|tjv| Sr:r;r>s rr>z4PE.parse_directory_bound_imports..gs2!!!c!ffFDT6T6TA6T6T6Tr)rJrr)r(__IMAGE_BOUND_IMPORT_DESCRIPTOR_format__r rqr[rVrr get_section_by_offsetrjrIrUrurGrrrNumberOfModuleForwarderRefsr$$__IMAGE_BOUND_FORWARDER_REF_format__rOffsetModuleNameget_string_from_dataMAX_STRING_LENGTHrlrr)rwrro bnd_descrbnd_descr_sizer\ bound_importsrsafety_boundarysections_after_offsetfirst_section_after_offsetforwarder_refsr bnd_frwd_refrname_str invalid_charsrs @rrz PE.parse_directory_bound_importssdKLL "))++ k ,,= cC.$889-I  &&M##%%  9##%% %C0055G22377K"%dm"4"4{"B))))!])))% )Q255J1K1K."889STTG**1*B[*P,s73C3C3E3E/F/FFT  &&7fSkk  NI93QR?R;S;STT" "  $33=M#n(<"<= # 4   $T'(RSSS|**,,,!>>44t}Vf7H.H%HI%%#,X#6#6%%%M8}}s**m*%%&lJJJY77F004=&3D*D!DEH !!(22!!! x==3&&-&   #$8^   Ok Zrc |j}|jtkr|j} ||||t |||}n/#t$r"|j d|zd}YnwxYw|sdSt|S)rr$z5Invalid TLS information. Can't read data at RVA: 0x%xN)rJ) __IMAGE_TLS_DIRECTORY_format__rr __IMAGE_TLS_DIRECTORY64_format__rqrrr rjrrVrr)rwrror tls_structs rrzPE.parse_directory_tlsws 4 <8 8 8:F -- c9V#4#4#;#;#=#=>> 44S99.JJ     O " "JSP   JJJ    4j))))sAA??)B+*B+c @|jtkr||}|j}nI|jtkr||}|j}n|jddSd}d}|dD]8}|dz }|t| ddz }||krn9|d|dd|f}d} | || |t| ||}n-#t$r |jd|zYnwxYw|sdSd} |dkr ||j|j} t'|| S) rzGDon't know how to parse LOAD_CONFIG information for non-PE32/PE32+ fileNrr9rr$z=Invalid LOAD_CONFIG information. Can't read data at RVA: 0x%xrF)rJdynamic_relocations)rrget_dword_at_rva&__IMAGE_LOAD_CONFIG_DIRECTORY_format__r(__IMAGE_LOAD_CONFIG_DIRECTORY64_format__rVrrrrqrrr rjrparse_dynamic_relocationsDynamicValueRelocTableOffsetDynamicValueRelocTableSectionr) rwrroload_config_dir_szrfields_counter cumulative_szfieldload_config_structr6s rrzPE.parse_directory_load_configs  <3 3 3!%!6!6s!;!; @FF \: : :!%!6!6s!;!; BFF O " "   4 AY  E a N 0S1A1A!1DE EM 2223)VAY78! !%!5!5 c9V#4#4#;#;#=#=>> 44S99"6""       O " "RUXX       " 4" B  "&"@"@"?"@##  %;N    sAD66'E E c|sdS|sdS|t|jkrdS|j|dz }|j|z}d}t|j} ||j|||||}n-#t$r |j d|zYnwxYw|j dkr"|j d|j dS||z }||j z}g}||kri|j} |jt kr|j} t| } || ||| ||} n/#t$r"|j d|zd} YnwxYw| sn|| z }| j} | j} d| cxkrdkrJnnG||| |j| }| t-| | || dkr;||| }| t-| | ||| z }||ki|S) Nr9r$zPInvalid IMAGE_DYNAMIC_RELOCATION_TABLE information. Can't read data at RVA: 0x%xzDNo pasring available for IMAGE_DYNAMIC_RELOCATION_TABLE.Version = %d c#344 44S990D00 , ,     O " "$&)*       , 3q 8 8 O " "V08   4 499 Cii=F|<<<C ((//11H #"22MM#x00 $ 8 8 = =3 ! # # #&&(*-.#  #  8OC 'F,DFa"CCtGO $**)*6{ zz"CCCNN #**)*6{ 4KC]Cii`#"s%&AB++'CC?F)G G c.|||S)r)rK)rwrros rrzPE.parse_relocations_directory"s44S$???rc\t|j}||z}g}||krw ||j|||||}n/#t $r"|jd|zd}YnwxYw|sn|j |j j kr#|jd|j zn|j |j j kr#|jd|j zn|(| ||z|j |j |z }n(|||z|j |j |z |}|t|||j sn||j z }||kw|S)Nr$rCzEInvalid relocation information. VirtualAddress outside of Image: 0x%xz9Invalid relocation information. SizeOfBlock too large: %drJr)r __IMAGE_BASE_RELOCATION_format__r rqrrjrrVrrHrS SizeOfImage SizeOfBlockparse_relocationsparse_relocations_with_formatr ) rwrrorrPr^rErlc reloc_entriess rrKz#PE.parse_image_base_relocation_list'sTBCCJJLLDj Cii **9MM#x00 $ 8 8 = =+ !   &&(*-.   !D$8$DDD&&&(+(:;!5!AAA&& _-{ $ 6 6(NC$6(8R!! !% B B(NC$6(8RTW!!    1mTTT U U U?  3? "CiCiilsAA;;)B'&B'c  |||}||}n0#t$r#|jd|dgcYSwxYwg}t }t tt|dz D]}| |j ||dz|dzdz|} | sn| j } | dz } | dz} | | f|vr"|jd| |zznX| | | f|t| | || |z || z }|S) rBad RVA in relocation data: 0xrorEr9r$rYr3Overlapping offsets in relocation data at RVA: 0x%x)rJrrr)rrjrrVrrrr$rIrq&__IMAGE_BASE_RELOCATION_ENTRY_format__rrzrr ) rwdata_rvarror/rroffsets_and_typerrYr reloc_type reloc_offsets rrXzPE.parse_relocationsds ==400D228<> )KK+.*AAc  |||}||}n0#t$r#|jd|dgcYSwxYwt |}g}t} ttt||z D]} | ||| |z| dz|z|} | snp| j } | | vr"|jd| |zznC| | |t| || |z||z }|S)rr]ror9r$r^)rJrr)rrjrrVrrr rrr$rIrtPageRelativeOffsetrzr) rwr`rrorr/r entry_sizerrrrYrcs rrYz PE.parse_relocations_with_formats ==400D228<>?'8E   3Lw&&&&#&2S&8: KK % % % NNec|c?QRRR    : %KKrdc Nt|j}g}tt ||z D][} ||||zz|}n/#t $r"|jd|zYdSwxYw| |j|| |||zz}|sdSd}|j dkrn|j dkr|j } |j } |j| | | z} | dddkrdgd g} | t| z } | d kr.| dd | | | | | }|t!jd d |jzd |_t)t+j|j|j|j|j|j|jfdd|jdz|_nF| dddkrudgdg}| t|z } | d kr.|dd | | || | }n|j dkr|j } |j } |j| | | z} dgdg}| || | }|rx|j dvro| t|z }|d kr.|dd|| || | }|tC||]|S)rz7Invalid debug information. Can't read data at RVA: 0x%xNr$r9rErIsRSDS CV_INFO_PDB70)z4s,CvSignaturezI,Signature_Data1zH,Signature_Data2zH,Signature_Data3zB,Signature_Data4zB,Signature_Data5z6s,Signature_Data6I,Agerz{0}s,PdbFileNamez>Q)fields-XsNB10 CV_INFO_PDB20)zI,CvHeaderSignaturezI,CvHeaderOffsetrrjIMAGE_DEBUG_MISC)z I,DataTypezI,Lengthz B,Unicodez B,Reserved1r=rr9z {0}s,Data)rJrY)"r __IMAGE_DEBUG_DIRECTORY_format__r rr$rrrVrrqrjTyperG SizeOfDatar[rrJrKSignature_Data6Signature_Data6_valuerYuuidUUIDSignature_Data1Signature_Data2Signature_Data3Signature_Data4Signature_Data5replaceupperAgeSignature_StringUnicoder )rwrrodbg_sizedebugrr/dbgdbg_typedbg_type_offset dbg_type_size dbg_type_data__CV_INFO_PDB70_format__pdbFileName_size__CV_INFO_PDB20_format_____IMAGE_DEBUG_MISC_format__dbg_type_partial data_sizes rrzPE.parse_debug_directorysTBCCJJLLTH_--..a @a @C }}S8c>%98DD    &&PSVVttt   &&5 44S8c>5IJJ'C  tt Hx1}}Q"%"6 # $ #o &EE! !!$//(    0,& 2J(K(K(R(R(T(TT%(!++03::.556FGG $330-  H +9? 'H,D"D:::6 $ (0(@(0(@(0(@(0(@(0(@(0(F ,& !" !" !"  %WS"--"UWW!)112!1$#2A2&'11(0,& 2J(K(K(R(R(T(TT% (!++03::.556FGG $330-  HQ"%"6 # $ #o &EE! ' 0,$(#7#70-$$ $'/699)'(DEELLNNO"%q==8;BB + 2 29 = =$(#7#78-$$ LL#X>>> ? ? ? ? s A))'BBrc v ||g}||}|tkr&|jd|tfzdS ||t |j}n.#t$r!|jd|zYdSwxYw||j|| |}||jd|zdSg}||z }|j |j z} d} | | kr!|jd| | fzdS|xj | z c_ |j tkr+|jd|j tfzdSg} d} t| D]8} |js@|j|jkr0d |_|jd |j|jfz||}|"|jd | |fznd}d}|jd zd z }|s|j}n||jz} t+||}|xj|z c_| rL| d|kr@| d|kr4| |jd|zn|||zf} | |n-#t$r |jd|zYnwxYw|jr||jz|vrn|||jz|||z z ||dz|||jzgz}|snbd}|t6dkri}|jD]}t;|dri}|jjD]}|(t;|dr|jj j!|j"-|jj j#}|jj j!}|j"} |||}n1#t$r$|jd|dd|YwxYwtI|tK|dz dz||&|||j_'|tQ||||n|)||jz}|r^|xj|j!z c_tU||jdz|jdz }|tQ||||nn|dkrx|j+t6dkrb|r|d } |jjdjj}|D]0} d}! | jj }!n#YnxYw|!|,|!1n#YnxYw||z }:d!| D}"|"-t]| D]\} }#|#/ta||"}$|$S)#aParse the resources directory. Given the RVA of the resources directory, it will process all its entries. The root will have the corresponding member of its structure, IMAGE_RESOURCE_DIRECTORY plus 'entries', a list of all the entries in the directory. Those entries will have, correspondingly, all the structure's members (IMAGE_RESOURCE_DIRECTORY_ENTRY) and an additional one, "directory", pointing to the IMAGE_RESOURCE_DIRECTORY structure representing upper layers of the tree. This one will also have an 'entries' attribute, pointing to the 3rd, and last, level. Another directory with more entries. Those last entries will have a new attribute (both 'leaf' or 'data_entry' can be used to access it). This structure finally points to the resource data. All the members of this structure, IMAGE_RESOURCE_DATA_ENTRY, are available as its attributes. NzNError parsing the resources directory. Excessively nested table depth %d (>%s)zCInvalid resources directory. Can't read directory data at RVA: 0x%xr$zDInvalid resources directory. Can't parse directory data at RVA: 0x%xr)zNError parsing the resources directory. The directory contains %d entries (>%s)zRError parsing the resources directory. The file contains at least %d entries (>%d)TzGResource size 0x%x exceeds file size 0x%x, overlapping resources found.zHError parsing the resources directory, Entry %d is invalid, RVA = 0x%x. r6rrr9z^Error parsing the resources directory, attempting to read entry name. Entry names overlap 0x%xznError parsing the resources directory, attempting to read entry name. Can't read unicode string at offset 0x%x)rleveldirsr directoryr/z2Error parsing resource of type RT_STRING at RVA 0xroz with size r5)rJridrirU)rJlangsublang)rJrrr/r'rc6g|]}|Sr:)rrs rr>z0PE.parse_resources_directory..s CCCqqyy{{CCCrrT)1MAX_RESOURCE_DEPTHrVrrr#__IMAGE_RESOURCE_DIRECTORY_format__r rrqrjNumberOfNamedEntriesNumberOfIdEntriesr[MAX_RESOURCE_ENTRIESrrr\rparse_resource_entryr NameOffsetrrrLDataIsDirectoryOffsetToDirectoryr RESOURCE_TYPErrcrr/rJrr OffsetToDatarUr$updatestringsrparse_resource_data_entryrIdparse_version_informationrrrr)%rwrrorrrr/ resource_dir dir_entriesnumber_of_entriesMAX_ALLOWED_ENTRIESstrings_to_postprocesslast_name_begin_endrres entry_nameentry_idname_is_string ustr_offsetentry_directoryr resource_idresource_strings resource_langstring_entry_rvastring_entry_sizestring_entry_idstring_entry_datarJ entry_data last_entryversion_entries version_entryrt_version_struct string_rvasrresource_directory_datas% rrzPE.parse_resources_directorycs. <5D  H % % % O " ":=BDV68LMN    4!# #*++B B C6 /$2XXX6:2&&'3>++C00C{&&8;>*EJH!h3:N!$ 8&7  !B4!U!UJ//:3R3R3T3TT//+ +A.<</2kAA/22444..7:EG $#j&E&E&G&GG+' +11*====$O**CFQS"e c33t;;E"&"@"@s44C(N+%!)C,A!A BB #A##'E}[999 G'6'>)M)M "; <<(M/1,1<1F1N"A"A %2$9+2=&+I+I%:'4'9'@'E'M'2~'=$,%2$6$=$J!15B4F4M4R 12=. !-8< (8:K9&9&$5$5(5!-!-!-$(O$:$:)D1A(K)D)D0A)D)D%&%&%& %-H !-!.$5%(%9%9A%=$C$4!"!"!" !(/? @ @ @ @//!6%CHu,#t$r1|jd|YnwxYw||_|||r|dr|jdvr|j dkr|| | zdt#|dzzz|j}g|_! ||j"||d||z}|sn#|j|z| z} ||}n>#t$r1|jd|YnwxYw||_#i|_$i|_%i|_&|j!|||| zdt#|dzzz|j}|||j'zkr||j(||d||z}|sn|j|z| z} ||}||}n>#t$r1|jd|Yn9wxYw|dt#|dzz|z| z|j}|j|z} |||j }||}n.#t$r!|jd|dYnwxYw|j'dkr ||j'z}n#||j'|z|j}||j$|<||f|j%|<t#|t#|f|j&|<|||j'zk||j'|z|j}||krn|}||j'krnOn^|r[|drE|}d |_)|jdvr2|j dkr&|| | zdt#|dzzz|j}g|_* ||j+||d||z}|sn|j|z| z} ||}n>#t$r1|jd!|Yn|j|dS)$aParse version information structure. The date will be made available in three attributes of the PE object. VS_VERSIONINFO will contain the first three fields of the main structure: 'Length', 'ValueLength', and 'Type' VS_FIXEDFILEINFO will hold the rest of the fields, accessible as sub-attributes: 'Signature', 'StrucVersion', 'FileVersionMS', 'FileVersionLS', 'ProductVersionMS', 'ProductVersionLS', 'FileFlagsMask', 'FileFlags', 'FileOS', 'FileType', 'FileSubtype', 'FileDateMS', 'FileDateLS' FileInfo is a list of all StringFileInfo and VarFileInfo structures. StringFileInfo structures will have a list as an attribute named 'StringTable' containing all the StringTable structures. Each of those structures contains a dictionary 'entries' with all the key / value version information string pairs. VarFileInfo structures will have a list as an attribute named 'Var' containing all Var structures. Each Var structure will have a dictionary as an attribute named 'entry' which will contain the name and value of the Var. zWError parsing the version information, attempting to read OffsetToData with RVA: 0x{:x}Nr$asciiencodingr9zzError parsing the version information, attempting to read VS_VERSION_INFO string. Can't read unicode string at offset 0x%xz"Invalid VS_VERSION_INFO block: {0}sVS_VERSION_INFOr z\uz({0} ... ({1} bytes, too long to display)z\00rrrErrTz/Error parsing StringFileInfo/VarFileInfo structz|Error parsing the version information, attempting to read StringFileInfo string. Can't read unicode string at offset 0x{0:x}sStringFileInforqrzyError parsing the version information, attempting to read StringTable string. Can't read unicode string at offset 0x{0:x}z}Error parsing the version information, attempting to read StringTable Key string. Can't read unicode string at offset 0x{0:x}rzzError parsing the version information, attempting to read StringTable Value string. Can't read unicode string at offset 0xros VarFileInfo VarFileInfoz}Error parsing the version information, attempting to read VarFileInfo Var string. Can't read unicode string at offset 0x{0:x}rIz 0x%04x 0x%04x)0rjrrrVrrr[rrq__VS_VERSIONINFO_format__r rrHrvrIrJrrIrMrfindrLr~rcrKey dword_align__VS_FIXEDFILEINFO_format__rr__StringFileInfo_format__r[rs ValueLengthr!__StringTable_format__LangIDrrrLength__String_format__rr#__Var_format__get_word_from_datarXr$rY)#rwversion_struct start_offsetrversioninfo_structrr section_endversioninfo_stringexcerptvinfofixedfileinfo_offsetfixedfileinfo_structstringfileinfo_offsetrstringfileinfo_structstringfileinfo_stringstringtable_offsetstringtable_structstringtable_string entry_offset string_structr key_offset value_offsetrfnew_stringtable_offsetvarfileinfo_struct var_offset var_struct var_stringvarword_offsetorig_varword_offsetword1word2s# rrzPE.parse_version_informationsC4 33N4OPPLL    O " "CCI6"/DD    FF = ~?R0R!RS"11  *H,2    % F$14F4M4M4O4OO ))+66  !03%w'?44K"  "%)%=%='&>&&""&*%=%=+ ";!AG&>&&"    O " "58CE        % O " "4;;EE%7!8!8&&" O " "4;;&--g66>>ufMM    Ft-.. %"$D #'  ""5)))  %!# #//  % % ' '!s3E/F/F/J*K K  '   $33  , )** +$';; 4   $  Ft/00 '$&D ! $$%9::: !% 0 0 #7#>#>#@#@ @  '! !  tZ(( DM^ %)$8$8..//0(+@@%9%% ! %,&&Et+'($++--.   (,(@(@(M(M%%    &&< ! % LL. / / /%k ")>)I)I!**k " *.&88-9Q>>*.)9)9-/66889s#899A=>?'3 **&9;)5@"-1-A-A 7$%7%8%89(47I(I.B..* 2"!+70107799:$ "151I1I+1V1V..,""" O22!HHN$/I"I""E"5G*157*2=?*:=?*:-9@@ASTTT'+'7'7.07799:3'9#:#:Q#>?@+7 (( )03E3LLMM-1,@,@ $ 6 ( 7,8<,G-A--M $1& %!/ ;".!/"/"6"6"8"8!9( &&*&>&>{&K&K-1-E-Ek-R-R #0&&& $ 6 6%LLRF(3M&M&!"!"!"!&&,0+;+; !SXX\ 2".!/"/"6"6"8"8!9!/ ; ,,L+9*E *TK &(,(@(@$/MsC !$C #E G.>sCG)03E3LLMMP261A1A.58JJ*722.25GGG!-C*-1F1MMM!A@"F'U "+@+K+K,,U "&;"*7"''+v55*6!;;"&!1!1-,33556s#899A=>?'3 ""J.0&*>"%)%9%9 /$Z[[1(4z(A&:&& *"!+7()(//112$ ")-)A)A+)N)NJJ,""" O22!NNTf$/O"O""E"&-!*.55jAAA)-)9)9Z1!45()(//112+7 ** /=++1J4JJKK%)$;$; (.1:L)L Mq%%E%)$;$; (!);nq>P)P QST%%E+a/N)%55"*UC:P:P"$.5%.0P4" 0+1J4JJKK &*%5%5&)::N"B%)$4$4%,/DD+%% !&,11(,>,EEE}^ @ U#####s{|s%jd|j ddS| s|!rdStE|| |j#S)aParse the export directory. Given the RVA of the export directory, it will process all its entries. The exports will be made available as a list of ExportData instances in the 'IMAGE_DIRECTORY_ENTRY_EXPORT' PE attribute. r$z+Error parsing export directory at RVA: 0x%xNcXtj|z Sr)rIr[rj)rrws rlength_until_eofz3PE.parse_export_directory..length_until_eofs&t}%%(@(@(E(EE ErrIrUTrr9F)rz9Export directory contains more than 10 repeated entries (rGz#02xz). Assuming corrupt.zHExport directory contains more than {} symbol entries. Assuming corrupt.rE) rrrrrrrrrzIRVA AddressOfNames in the export directory points to an invalid address: roch|] }|j Sr:)r)r<exps r z,PE.parse_export_directory..8s333CCK333rz[Export directory contains more than {} repeated ordinal entries (0x{:x}). Assuming corrupt.z$Export directory contains more than z# ordinal entries. Assuming corrupt.)rrrrzMRVA AddressOfFunctions in the export directory points to an invalid address: )rJsymbolsr)$rq!__IMAGE_EXPORT_DIRECTORY_format__rrr rjrrVrAddressOfNamesru NumberOfNamesAddressOfNameOrdinalsAddressOfFunctionsNumberOfFunctionsrrIr[rH collections defaultdictr$rrget_dword_from_dataget_string_at_rvaMAX_SYMBOL_NAME_LENGTHrrRrrBaserSr rr)rwrror export_dirraddress_of_namesaddress_of_name_ordinalsaddress_of_functionsexports#max_failed_entries_before_giving_uprr* symbol_counts&export_parsing_loop_completed_normallyrQsymbol_ordinalsymbol_address forwarder_strrsymbol_name_address symbol_namesymbol_name_offsetordinalsrs` rrzPE.parse_export_directorys  --6 4#IJJQQSS!44S99 .JJ    O " "=E    FF     F  F F F F F #}})$$Z%>??,q0   (,}}0$$Z%EFF,q0(( $$(==-$$Z%BCC014$$     O " "=E    FF   .0+))**CDDdm,,  &g&&(())*+,  $/44 15.s:3S19L5M5MNNOO] ] A!445MqQQN)nq.@3$DD//"&!9!9(."" tt%1)<)< $$#*)D)D $ 6 6~ F F '+'?'?'O'O$$$H" $ #' "&":":;KQ"O"O "*3q836!;;=B:E00#%;K*+PTUUU 9>6 %)%=%=>Q%R%R""   3q836!;;=B:EE)-)A)ABU)V)V&&$71<7:a??AF>HH '& " ;7 8 8 8A = 8 8 8k>:;b@@&&Q#QQ'5PQQQ]##d&===&&((.t/F(G(G NN&On<#'#;#;"81q5@$$+#'#;#;"5N8JJ$$% 2+%5    $6  O " ":&59::    437333.0+))**GHHdm,,  &g&&(())*/0  $/44 15.Z93QR?R;S;STTUU6 6 C(H44*%)%=%=>RTW%X%XNN$***%)NNN*")71<7:a??AF>!Q&&#.&#--&t33$($:$:>$J$JMM$(M n---2--- 043KKKO**FFLf 4nGG E''$*AAAO**X2XXXE *# 5 .!"/ 6  O " ">&9=>>    F :0022 4'' 88    sA(A,,'BB$B=E""'F  F ;K KKMN14N  N1 N+!N1&N1*N++N10N1'V>> W  W c$||zdzdz|dzz S)NrGlr:)rwrbases rrzPE.dword_aligns $"j0TJ5FGGrcr|jj}|jj|jjz}||kr ||kr||z}|Sr)rS ImageBaserV)rwvabegin_of_image end_of_images rnormalize_import_vazPE.normalize_import_vasK-7+58L8XX  R  B$5$5 . B rc(g}d} ||t|j}n.#t$r!|jd|zYn&wxYw||}||j||}|r| rnd}|j dkr|j j tdkr||j|_||j|_||j|_||j|_||j|_||j|_d}||z }t+|j|z } ||jks ||jkr t/||jz ||jz } g} ||j|jd| |} nJ#t$r=} |jd|| jYd} ~ nd} ~ wwxYw|d kr.|jd |n| s|d z }|jt8kr*|jd |jt8fzn||jt<} t?| stAd } | rf| D]>} | j!5tEj#| $| j%}|r|| _!?|tM|| | |S)z*Walk and parse the delay import directory.rTz5Error parsing the Delay import directory at RVA: 0x%xr$FrNzSError parsing the Delay import directory. Invalid import data at RVA: 0x{0:x} ({1})rKzWToo many errors parsing the Delay import directory. Invalid import data at RVA: 0x{0:x}r9z)Error, too many imported symbols %d (>%s) *invalid*rJimportsdll)'rr(__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__r rrVrrjrqr grAttrsrrrr" pBoundIATpIATpINT pUnloadIATphmodszNamerIr[rv parse_importsrrfr]MAX_IMPORT_SYMBOLSr MAX_DLL_LENGTHrrLr ordlookup ordLookuplowerrr)rwrro import_descsrRr/r import_desccontains_addressesmax_len import_datarr'rDfuncnames rrzPE.parse_delay_import_directorys  d  }}dKLLSSUU!   &&KsS   22377K..='/K +"8"8":": !& #q(($, =V0WWW(,(@(@AV(W(W %#'#;#;KP%Q%Q "%)" ;%%'' 'C $-((;6G[%%%{/?)?)?cK$44cK>@@ @ ( " "$*566@@BB B ( " "$*566@@BB B=>>>rc g}gd}t|dsdS|jD]y}t|jtr,|j}n|j}|dd}t|dkr|d|vr|d}|j}|j D]}d}|j s?tj ||j d }|s td |jd |j d n|j }|sTt|tr|}||d|{t!d |S)a?Return the imphash of the PE file. Creates a hash based on imported symbol names and their specific order within the executable: https://www.mandiant.com/resources/blog/tracking-malware-import-hashing Returns: the hexdigest of the MD5 hash of the exported symbols. )ocxsysr'DIRECTORY_ENTRY_IMPORTr.r9rNT) make_namezUnable to look up ordinal r/04xr)rcrBrXr'rZrMr5rsplitrIr&rr3r4rrrr rrnrw) rwimpstrsextsrYlibnamepartsentry_dll_lowerimpr;s r get_imphashzPE.get_imphashs$$$t566 20 N NE%)U++ ,)**,,2244)//++NN3**E5zzA~~%(d"2"2(#ioo//O} N Nx ((2'   H$+VVVS[VVV #xHh..1'00H'--////8>>;K;K;KLMMMM% N(388G$$++--..88:::rc6t|dsdSt|jdsdSd|jjD}t|dkrdSt d|S)zReturn the exphash of the PE file. Similar to imphash, but based on exported symbol names and their specific order. Returns: the hexdigest of the SHA256 hash of the exported symbols. DIRECTORY_ENTRY_EXPORTrrcvg|]6}|r2|j |j7Sr)rrMr5r;s rr>z"PE.get_exphash..YsJ    V' FMMOO ! ! # #'''rrr)rcrOrrIrrrnrw)rw export_lists r get_exphashzPE.get_exphashJst566 2t2I>> 2  08   {  q 2chh{++224455??AAArcXg}d}t|j} |||}n/#t$r"|jd|dYnwxYw||}||j||} | r| rn|| z }t|j |z } || j ks || j kr t|| j z || j z } g} |s || j | j | j| } n>#t$r1} |jd|dd| jd Yd } ~ nd } ~ wwxYw|d kr|jd |dn| s|d z }|| jt(} t+| st-d} | rf| D]>}|j5t1j| |j}|r||_?|t9| | | 7|st;ddg}d}d}|D]z}|jD]p}|D]f}|r|js |j}t?|jt@kr|j!d}|"|r|d z }ng|d z }q{|t|kr |dkr|jd|S)z$Walk and parse the import directory.rTz-Error parsing the import directory at RVA: 0xror$rzBError parsing the import directory. Invalid Import data at RVA: 0xz ()NrKzLToo many errors parsing the import directory. Invalid import data at RVA: 0xr9r$r% LoadLibraryGetProcAddressrrz?Imported symbols contain entries typical of packed executables.)#r"__IMAGE_IMPORT_DESCRIPTOR_format__r rrrVrrjrqr rIr[OriginalFirstThunk FirstThunkrvr0ForwarderChainrfr rr2rrLrr3r4r5rrrr&rrZrMr[)rwrrorr6rRimage_import_descriptor_sizer/rr7r9r:r=r'rDr;suspicious_importssuspicious_imports_count total_symbolsimp_dllsuspicious_symbolrs rrzPE.parse_import_directorycsQ  '0  3( ( &(( %F  }}S*FGG    &&KCKKK   22377K..7;/K  +"8"8":":  ;%%'' 'C $-((;6G[333s[=S7S7S+88# @V:VK   "&"4"4#6#.#2#* #5##KK %O**M9<LMMBC'MMM ??O**A9<@AA"1$K(()9>JJC(-- % nn )33F{*#,#6syy{{FN#S#S#3*2FK##"+{PSTTTIF P !$m5E%F!G!G '( $M' ' '%o ' 'F-?"")%%V[%$%{ ,,55#);#5#5g#>#>D??+<=="494!E""Q&MM ')C0B,C,CCC!B&&&&Us)A(A0/A0&(E F 'FF cg}||||}||||}|rt|dkr9|rt|dkr$|jd|dd|dgSd} |r|} n|r|} ndSd} d} |jt krt } n#|jtkr t} d} d } nt } d} t| D]\}}d}d}d}d}d}d }|j r|j | zrd }|j d z}d}d}nd } |j | z}| |d }| |d}| |j d zt}t|st!d}||j d z}n#t$$rYnwxYw|}||}||jjz|| zz}d} |r4|r2||j ||j kr||j }||}nd}n#t.$rd}YnwxYw||t%d|t!dkr"| dkr| |krt%d| dz } |s|rB|t1|||||||||||||||S)zParse the imported symbols. It will fill a list, which will be available as the dictionary attribute "imports". Its keys will be the DLL names and the values of all the symbols imported from that object. rz\Damaged Import Table information. ILT and/or IAT appear to be broken. OriginalFirstThunk: 0xroz FirstThunk: 0xNrIr{rQlFTrrEr$z"Invalid entries, aborting parsing.iz)Too many invalid names, aborting parsing.r9)rrrimport_by_ordinalrrhintrrrrhint_name_table_rva thunk_offset thunk_rva)get_import_tablerIrVrrrrrrrrrrr MAX_IMPORT_NAME_LENGTHrrLrjrrrgrSrrr)rworiginal_first_thunk first_thunkforwarder_chainrr8imported_symbolsiltiattable imp_offset address_maskr num_invalidr tbl_entryimp_ordimp_hintimp_namerrdrbr/rerf imp_addressr imp_bounds rr0zPE.parse_importss## *.@  ##K=OPP s3xx1}}s}c#hh!mm O " "1)=B11"-011    I  EE  EE4 ! <3 3 3-LL \: : :/LJ-LL .L '..^ ^ NCGHHK"&  % & C*\9(,%'5>G#H"&KK(-%.7.E .T+#}}-@!DD#'#:#:4#C#C#'#9#9%3a79O$$ 6h??6'(~~H&*&>&>%3a7'' ) )88::  44\BB d2<>))%%+*<*<'(STTTq  (  ''%.#-*; ''0'@'@'B'B%%$/' +,?%1"+& s%BF)) F65F6:8H33 IIc0g}|jtkrt}|j}n-|jtkrt }|j}nt}|j}t|}d}d} d} d} t} t} |}|r}|%|||zkr|j dnV|j tkr+|j d|j tfzn|xj dz c_ | | krgS| |krgS| |krgSd} |||}n#t $rd }YnwxYw|st#||kr|j d |zdS||||| }|r|||j|_||j|_||j|_||j|_|r4|j|kr)|j|kr|j d |zn|rH|jrA|j}||zr |d zdkrgSn)|| kr| }n| }||vr| dz } |||r|rn/||z }| ||}|S)Nrr_rz9Error parsing the import table. Entries go beyond bounds.z$Excessive number of imports %d (>%s)r9FTz9Error parsing the import table. Invalid data at RVA: 0x%xr$z\Error parsing the import table. AddressOfData overlaps with THUNK_DATA for THUNK at RVA 0x%xr{r)rrr__IMAGE_THUNK_DATA_format__rr__IMAGE_THUNK_DATA64_format__rr rqrVrr]r1r}rrrIrqrjr"rrrrrzr )rwrrr8rorr expected_sizeMAX_ADDRESS_SPREADADDR_4GBMAX_REPEATED_ADDRESSESrepeated_addressaddresses_of_data_set_64addresses_of_data_set_32 start_rvafailedr/ thunk_data addr_of_datathe_sets rrgzPE.get_import_tablels <3 3 3-L5FF \: : :/L7FF .L5F!&))0022 (!##-<< #-<<  d %%#Z1G*G*G&&O*-???&&:24FGH  ' '1 , ' ' #999 (,,..1CCC ',,..1CCC F }}S-88      Tm33&&RUXXt--$*B*B3*G*G.J " R+/+C+C,,, (.2-E-E... *'+&>&>z?R&S&S #%)%=%=j>P%Q%Q " , 99,33&&(+.0  .j6 .)7 ,..$j0699! :$x//":":#w..(A-(KK --- !6!6!8!8  :$$&& &C LL $ $ $Id %L s E!! E0/E0rc||j}|||jdd}|jD]}|jdkr |jdkr|j}||j|jj}| |j |jj |jj}|t|jks9|t|jks!||zt|jks||kr|t|z } | dkr |d| zz }n| dkr |d| }|| z }|||_|S)aReturns the data corresponding to the memory layout of the PE file. The data includes the PE header and the sections loaded at offsets corresponding to their relative virtual addresses. (the VirtualAddress section header member). Any offset in this data corresponds to the absolute memory address ImageBase+offset. The optional argument 'max_virtual_address' provides with means of limiting which sections are processed. Any section with their VirtualAddress beyond this value will be skipped. Normally, sections with values beyond this range are just there to confuse tools. It's a common trick to see in packed executables. If the 'ImageBase' optional argument is supplied, the file's relocations will be applied to the image by calling the 'relocate_image()' method. Beware that the relocation information is applied permanently. Nrr+)r[relocate_imagerUrJrIrRrGrSrTrWrHrXrIr) rwmax_virtual_addressr original_data mapped_datarsrdprdrLrs rget_memory_mapped_imagezPE.get_memory_mapped_images,  !MM    * * *mAAA& } . .G'1,,1F!1K1K'C++($*>*LC"&!=!=&$5$2"" c$-((((T]++++9s4=1111%)<<</#k2B2BBN!!u~55 !##)/>/: 7++-- -KK  )DMrcng}t|dr|jjD]}t|dr|jjD]v}t|drdt|jdrO|jjrCt |jjD]}||w|S)aReturns a list of all the strings found withing the resources (if any). This method will scan all entries in the resources directory of the PE, if there is one, and will return a [] with the strings. An empty list will be returned otherwise. DIRECTORY_ENTRY_RESOURCErr)rcrrrrrrr)rwresources_stringsres_typer res_strings rget_resources_stringszPE.get_resources_strings9s 43 4 4 I 9A I I8[11 I'/'9'A I I "; <<I ' (=y I II$/$9$AI37$/$9$A$H$H$J$J3"3"!I!IJ%6$<$z*PE.get_rva_from_offset..~sS  44, 0A 0>rN)r!rUrurg)rwrr lowest_rvas` rrgzPE.get_rva_from_offsetws  & &v . . }   "&    J&&"Mt $$V,,,rc||}|s.|t|jkr|Std|dd||S)zGet the file offset corresponding to this RVA. Given a RVA , this method will find the section where the data lies and return the offset within the file. zdata at RVA 0xroz can't be fetched)rrIr[rrj)rwrrs rrjzPE.get_offset_from_rvasm  # #C ( ( K S''''  I I I I IJJ J$$S)))rc|dS||}|s&|d|j|||zS|d|||S)z1Get an ASCII string located at the given address.Nr)r)rr%r[r)rwrrrs rr zPE.get_string_at_rvasw ;4  # #C ( ( W,,Q cC*DT>T0UVV V((AJJs:J,N,NOOOrc|t|krdS||d}t|trt|S|S)rCrN)rIrXrlrZ)rwrr/rs rget_bytes_from_datazPE.get_bytes_from_datasG CII  3 M a # # 88Orc||||}|d}|dkr |d|}|S)zGet an ASCII string from data.r+rN)rr)rwrr/rr^s rr%zPE.get_string_from_datasA  $ $VT 2 2ffUmm !88$3$Arrc|dkrdS||d}|dz}t|d}|||}d} |d|dz}|dkrUt|}||ks||krt|dz }n7||||z||z z }|dz }|}n|dzdkr|dz}nt jd ||d |dz}d tt|} |r#t| |d St| d d S)z3Get an Unicode string located at the given address.rrrEr9rjrTrkz<{:d}HNrr r) rrurrIrJrKrrmapr-rLrn) rwrrrr/ requested null_index data_lengthuchrsrs rrzPE.get_string_u_at_rvas ??3}}S!$$ q  C(( }}S),,  ; Q??JR!$ii **kZ.G.G!$TaJ cK&7k9QRRR&] & a1$$q  $ hooj994@P*q.@P;QRR GGCUOO $ $  >QXXh(;<<== ='#677888rcL|jD]}||r|cSdS)z1Get the section containing the given file offset.N)rUrl)rwrrs rr!zPE.get_section_by_offsets@}  G&&v..  trc|j!|j|r|jS|jD]"}||r ||_|cS#dS)z-Get the section containing the given address.N)rTrprU)rwrrs rrzPE.get_section_by_rvass  - 91>>sCC :99}  G##C(( 5<2 trc*|Sr) dump_infor|s rrz PE.__str__ s~~rc"t|dS)z.Checks if the PE file has relocation directoryDIRECTORY_ENTRY_BASERELOC)rcr|s r has_relocsz PE.has_relocsst8999rcBt|dr|jjrdSdS)NDIRECTORY_ENTRY_LOAD_CONFIGTF)rcrr6r|s rhas_dynamic_relocszPE.has_dynamic_relocss- 46 7 7 /C turrcLt||dS)z=Print all the PE header information in a human readable from.rN)rr)rwrs r print_infoz PE.print_infos$ dnnhn//00000rrc /t|}|rCd|D]+}|,d|jd|jd|j ttd} dg}t|D]8}t|j |dr||d9d |t#|d rH|jAd |jtt&d } d g}t|D]8}t|j|dr||d9d |d tt(d} |jD]} |  dg}t| D]3}t| |dr||d4d |d| t0:d| t4*d| zt8*d| zt<*d| zt#|d rvt#|jdrad|jj D]+} | '| ,t#|drtC|j"D]\} } tG|j"dkrd| dznd| '| t#|drF|j$| t#|drtG|j%| krw|j%| D]h}|t#|dr*|j&D] }fd|Dd|j'(|dttS|j*+D]_}d |d(|d|d(|d` yt#|d!r|j,D]}t#|d"rfd#|Dd tS|j-.d(d$dtS|j-/dĉjt#|d%rNd&|j0j1d'd(z|j0j2D]}|j3tid)}|j5r|j5} d*|j6|j3|(|fz|j7rBd+|j7(|dt#|d,rWd-|j8D]9}|j1|j9sm d.|:|j1j;(|d|j9D]e}|j<d/ur|j5` d0|j=(d$|j5(d$|j6n d1|j=(d$|j6na d2|j=(|d|j5(|d|j>|j?r/d3|j?Qg;t#|d4r/d5|j@D]}|j1d6|j5(|d|j*D]}|j1d7d6|j5(|dd7t#|d8rzd9|jAD]\}|j1|j9D]}|j<d/urH d:|j=(|d|j6na d;|j=(|d|j5(|d|j>|j?r.d3|j?^t#|d<rd=|jBj1|jBj*D]}|j56|j5(|d}d>|d?d@nMtD|j1jEdA}dB|j1jEdCdD|dEd@|j1d@t#|dFrω|jFj1d7|jFj*D]}|j56|j5(d$d}d>|d?dGn%dB|j1jEdCd?dG|j1dGt#|dFr|jFj1dH|jFj*D]}t#|dIrՉdJ|jGjH|jGjItD|jGjHdKt|jGjH|jGjIfzdH|j1dL|jGj1dMt#|jFdNr|jFjLrdOdLtSt|jFjL+D]V\} }dP| |MdQdR(dSdMWt#|dTrm|jNrf|jNj1rZdU|jNj1t#|dVrm|jOrf|jOj1rZdW|jOj1t#|dXrdY|jPD]}|j1 dZt|j1jRznB#t$r5d[|j1jRYnwxYw|j-rA|j-d7|Tr׉d\|jUD]}|j1|j*D]p} d]|jVt|jXd^dfzd7<#t$r(d_|jV|jXfzd7YmwxYwt#|d`rtG|jYdkrda|jYD]r} | j1t#| dbr4| jZ-| jZd7s[S)cz>Dump all the PE header information into human readable string.NParsing WarningsrrrryrFrrGrSrzzDllCharacteristics: PE Sectionsraz!Entropy: {0:f} (Min=0.0, Max=8.0)zMD5 hash: {0}zSHA-1 hash: %szSHA-256 hash: %szSHA-512 hash: %sr Directoriesrr9zVersion Information Version Informationrrr!c@g|]}d|zSz rr<rrs rr>z PE.dump_info..s) X X Xtd{!;!; X X Xrz LangID: {0}r z {0}: {1}r#rYc@g|]}d|zSrrrs rr>z PE.dump_info..s9%&%&%&,0)- dTk(B(B%&%&%&rrrOExported symbolsz%-10s %-10s %srRVArNonez%-10d 0x%08X %sz forwarder: {0}rBImported symbolsz Name -> {0}Tz*{0}.{1} Ordinal[{2}] (Imported by Ordinal)z&{0} Ordinal[{1}] (Imported by Ordinal)z{0}.{1} Hint[{2:d}]z Bound: 0x{0:08X}DIRECTORY_ENTRY_BOUND_IMPORT Bound importszDLL: {0}rIDIRECTORY_ENTRY_DELAY_IMPORTDelay Imported symbolsz({0} Ordinal[{1:d}] (Imported by Ordinal)z{0}.{1} Hint[{2}]rResource directoryzName: []rErmzId: [0xrnz] (rTrrMrQr/z\--- LANG [%d,%d][%s,%s]r>rUrYrz [STRINGS]z {0:6d}: {1}unicode-escaper rDIRECTORY_ENTRY_TLSTLSr LOAD_CONFIGDIRECTORY_ENTRY_DEBUGDebug informationzType: zType: 0x{0:x}(Unknown)Base relocationsz%08Xh %sr5z0x%08X 0x%x(Unknown)DIRECTORY_ENTRY_EXCEPTIONz"Unwind data for exception handlingr)\rrrrrrrrrrr`rrzsortedrrrrcrSrrbrUrrur rrrxrrzrr}rrrrIrrr!rrMrrrr#rYr_rrOrJrrrLrrrrBr&r rrbr'rcrrrrrr@rrr/rrr?rFrrnrrr DEBUG_TYPErsrrrrRELOCATION_TYPErrrr)!rwrrwarningsrrrer\rrdrrr vinfo_entryrYr str_entry var_entryexportrmodulerDbound_imp_desc bound_imp_refr res_type_idrrrr base_relocrelocrs! ` rrz PE.dump_infos] <66D$$&&  # OO. / / /# # # g&&&  """"  %%% t++--...   %%% t++--...   &&& t',,..///$%:MJJ  ;'' & &Dt'a11 & T!W%%% dii&&'''  4* + + 80D0P OO- . . . NN4/4466 7 7 7$2 !<% % ! '(((455 & &Dt+T!W55 & T!W%%% dii&&'''   &&&&'> MM }  G NN7<<>> * * * HHY   E}-- * *7DG,,*LLa))) MM$))E** + + + MM3::7;N;N;P;PQQ    1889M9M9O9OPPQQQ 073H3H3J3JJKKK! 073J3J3L3LLMMM! 073J3J3L3LLMMM        4* + +   "21 1   OOM * * *!1@ 5 5 (NN9>>#3#3444       4) * *= /$-d.A$B$B< /< / [t*++a//OO$D37$D$DEEEEOO$9:::*NN;#3#3#5#5666  """4!344'NN4#8#=#B#B#D#DEEE$$&&&4,,//T]1C1Cc1I1I!%s!3././uzz||444((***"5-88*/,1,=&& X X X X  X X X X $ $3$:$:(0(>(>,46I)*)*%&%&!"!"!"!% 0 0 2 2 217X=M=S=S=U=U8V8V1W1W !& !&I$(MM(6(=(=,5aL,?,?08:M-.-.-6aL,?,?08:M-.-. )*)* %& %& %& %& !&!,,....$UE22/-2Y & & #*9g#>#> !&%&%&%&%&4=NN4D4D%&%&%&%&%)MM(6(=(=,01E1E1G1G,H,H,K,R,R079L-.-.-11G1G1I1I,J,J1,M )*)*%&%&%&!,,... 41 2 2  OO. / / / NN46=BBDD E E E       MM-0JJ K K K5= + +>-V99D{+%{HH,!>6>4;;x;P;PQR'+ -44 & 0 7 7BU V V ((***       41 2 2, # OO. / / /5* #* #v}1133444~'HH'.. 226=3EFFMM (*=$$&&&  """$n++F/477!;2 HH L S S$*J$5$5g$>$>$*K$6$6w$?$?$*N!"!"!HH H O O$*J$5$5g$>$>!"!" 188 & 1 1(#>BBBMM"))).55h@STT  $$&&&&' 47 8 8 # OO4 5 5 5; # #v}1133444  """$n++F/477FMM & 1 1('>'@'@!DDD"; <<&& NN;+@+G+L+L+N+NPQRRR1<1F1NYY #*=&#A#A!Y$(MM(C,9,>,C,9,>,F,0HH0=0B0G-.-.-F0=0B0G0=0B0J-.-. +* )*)*%&%&%&%)NN=3G3L3L3N3NPR$S$S$S$(NN=3E3L3Q3Q3S3SUW$X$X$X ' (=y I I&$/$9$A&!% k2 > > >7;$*;+@+H+N+N+P+P$Q$Q8"8" !& !&OC%)MM(5(<(<,/,6,=,=0@BT-.-..4fWoo )*)* )+%&%&%&%&  """"       D/ 0 0 ( (/  OOE " " " NN43:??AA B B B       D7 8 8 0 07  OOM * * * NN4;BGGII J J J       40 1 1 ' OO/ 0 0 01 ' 'sz00111TMM(Z -H"HIIIITTTMM":"A"A#*/"R"RSSSSST  """9'NN39>>#3#3Q777$$&&& ??   # OO. / / /"< # # z05577888'/  E &%)_UZ5PQSQTQT5U)VV$ 2ei5LLa  """" D5 6 6 <D233a77 OO@ A A A4 < <ry~~//0002|,,<1JNN2=#5#5#7#7;;;}}s0U-AU<U<}t|j|dr!|d|d?t|dr#|j |j |d<t td }g|d <|D]>}t|j |dr!|d |d?g|d <t td }|j D]}|}|d |g|d<|D]9}t||dr!|d|d:||d<t||d<t"||d<t&||d<t*||d<t|drht|j drSg|d<t/|j jD]4\} } | -|d| 5t|drg|d<t/|jD]d\} } g} | | t|dr2| |j| t|drt7|j| krg} | | |j| D]}| |t|dri}|jD]m}| ||j|d<tA|j!"D]}|d||d<n| |t|dr|j#D]}i}t|dr| |tA|j$%d|tA|j$&d<| ||d| ft|drg|d<|d|j'j(|j'j)D]_}i}|j*9|+|j,|j*|j-d |j.r |j.|d!<|d|`t|d"rg|d#<|j/D]}g}|d#|||j(|j0D]f}i}|j1d$ur|j2|d%<|j,|d&<n|j2|d%<|j-|d'<|j3|d(<|j4r |j4|d)<||gt|d*rg|d+<|j5D]}i}|d+||+|j(|j-|d%<|j!D]:}i}|+|j(|j-|d%<;t|d,rg|d-<|j6D]}g}|d-|||j(|j0D]f}i}|j1d$ur|j2|d%<|j,|d&<n|j2|d%<|j-|d'<|j3|d(<|j4r |j4|d)<||gt|d.rg|d/<|d/|j7j(|j7j!D]M}i} |j- |j-| d'<n4|j(j8tr:|j(j8d0f| d1<| +|j(|d/| t|d2rg}!|!|j;j(|d/|!|j;j!D]N}"i}#|"j- |"j-|#d'<n|"j(j8|#d1<|#+|"j(|!|#t|"d2rg}$|$|"j;j(|!|$|"j;j!D]}%t|%d3ri}&|%j<j=|&d4<|%j<j>|&d5<t~:|%j<j=d6|&d7<t|%j<j=|%j<j>|&d8<|&+|%j(|&+|%j<j(|$|&t|"j;d9ry|"j;jArmtA|"j;jA"D]A\} }'|$|'Bd:d;Cd<BPOt|d=r4|jDr-|jDj(r!|jDj(|d><t|d?r4|jEr-|jEj(r!|jEj(|d@<t|dArg|dB<|jFD]}}(i})|dB|)|)+|(j(t:|(j(jH|(j(jH|)dC<~|Irg|dD<|jJD]}*g}+|dD|+|+|*j(|*j!D][},i}-|+|-|,jK|-dE< t|,jMdFd |-dC<B#t$r |,jM|-dC<YXwxYw|S)Gz5Dump all the PE header information into a dictionary.rrrrryr5rrSNrzrrraEntropyMD5SHA1SHA256SHA512rrrrrrr!rr9r#rYrOrrrrBrTDLLrrHintBoundrrrrrrrmrrr/r?rAr> LANG_NAME SUBLANG_NAMErrr rrrrrrrrsrrr5)OrrrBrrr`rrrrcrSrrbrUrur rrrxrrzrr}rrrrrIrr!rrrrrr#rYrr_rOrJrrrrrrrBr&rbr'rcrrrrrrr@rr/rrr?rFrrnrMrrrrrsrrrrrr).rwrBrrr\rrdr section_dictrrvs_vinfoversion_info_list fileinfo_listrYstringtable_dictrrrvar_dictr export_dictr import_listrD symbol_dictrbound_imp_desc_dictrbound_imp_ref_dict module_listrresource_type_dictdirectory_listrresource_id_dictresource_id_listrresource_lang_dictrrdbg_dictrbase_reloc_listr reloc_dicts. rrBz PE.dump_dicts $$&&  5,4I( )"&/";";"="= ,"&/";";"="= ,#'#3#=#=#?#? - $%:MJJ  ' 3 3Dt'a11 3'"))$q'222 4* + + L0D0P+/+?+I+I+K+KI' ($2 !<% % !+- &'- @ @Dt+T!W55 @./66tAw???#% - &'> MM } C CG",,..L m $ + +L 9 9 9$&L !% : :7DG,,: )00a999&-&9&9&;&;L #&-&:&:&<&< U#'.'<'<'>'> V$!)0)@)@)B)B X&!)0)@)@)B)B X& 4* + + K  "21 1  K(*Im $"+D,@,O"P"P K KY(m,33I4G4G4I4IJJJ 4) * *" K/1I+ ,!*4+>!?!? K K X$&!!((););)=)=>>>4!344U%,,T-B3-G-Q-Q-S-STTT4,,CT]1C1Cc1I1I$&M%,,];;;!%s!3CC%,,U__->->???"5-88C/1,,1,=RR - 4 4X5G5G5I5I J J J=E_ 0 :15h6F6L6L6N6N1O1O!R!RIENq\$4Yq\$B$B!R)001ABBBB$UE22C-2YCC +-#*9g#>#>!C$1$8$89L9L9N9N$O$O$OPT(1(>(>(@(@Q&Q&&'Q)HT)/2F2F2H2H-I-I!-L$M%2$8$8$B$B$B/0778IJJJJ 41 2 2 B,.I( ) ( ) 0 0+2<<>>   5= B B >-&&'-~#)>$*K'D393C K0,-44[AAAA 41 2 2 4,.I( )5 4 4 ,-44[AAA""6=#:#:#<#<===$n 4 4F"$K/477-3Z E*17 I..-3Z E*.4k F+.4k F+|+@+J+J+L+LMMM-;-@#E*%3%;CCM)+&&--m.B.L.L.N.NOOO0=0B&u--C 47 8 8 424I. /; 4 4 23::;GGG""6=#:#:#<#<===$n 4 4F"$K/477-3Z E*17 I..-3Z E*.4k F+.4k F+|>@@   !9AG &G &%'"=,19&v..!*%))(/*JJJ'/'9'A4&4& +-(&+77B7G,V445@5G5J,T2(// 0B0L0L0N0NOOO&--.>???"; <<)&/1,,33 + 5 < F F H H+112BCCC1<1F1NPP #*=&#A#A!P9;$6ANASAX$6v$>)6(:(B%7(1%&GKhh(5(:(?G&G&$6{$C )B(5(:(?(5(:(B)&)&%7(6%& %7$=$=(5(<(F(F(H(H%&%&%&%7$=$=(5(:(A(K(K(M(M%&%&%&%5$;$;P)*)**0&//%&%&%&%& D/ 0 0 K( K(/ K $7>HHJJIe  D7 8 8 D0 D07 D07AACC   40 1 1 T-/I) *1 T T-.55h??? 4 4 6 6777#->>#*/3:?#S#S  ??   8,.I( )"< 8 8 "$,-44_EEE&&z'8'B'B'D'DEEE'/88E!#J#**:666(- Ju%8-,>rr,BAFF F   44 rc|dzt|jkrdS||j||dzdS)zDReturn the quad-word value at the given file offset. (little endian)rQNr)rIr[r!rs rget_qword_from_offsetzPE.get_qword_from_offsetor rcT||||S)zJSet the quad-word value at the file offset corresponding to the given RVA.)r r)rwrqwords rset_qword_at_rvazPE.set_qword_at_rvawr rcT||||S)z1Set the quad-word value at the given file offset.)rr)rwrr's rset_qword_at_offsetzPE.set_qword_at_offset{rrct|tstd||}|sdS|||S)zOverwrite, with the given string, the bytes at the file offset corresponding to the given RVA. Return True if successful, False otherwise. It can fail if the offset is outside the file's boundaries. data should be of type: bytesF)rXrZ TypeErrorrr)rwrr/rs rr zPE.set_bytes_at_rvas[$&& =;<< <))#.. 5''555rct|tstdd|cxkrt|jkrnn|||ndSdS)zOverwrite the bytes at the given file offset with the given string. Return True if successful, False otherwise. It can fail if the offset is outside the file's boundaries. r,rFT)rXrZr-rIr[set_data_bytesrwrr/s rrzPE.set_bytes_at_offsetst$&& =;<< <  + + + +T]++ + + + + +    - - - -5trrr/ct|jtst|j|_||j||t|z<dSr)rXr[rlrIr0s rr/zPE.set_data_bytessI$-33 5%dm44DM59 fvD 11222rc(|jD]}||j|jj}||jz}|t |jkr@|t |jkr(||| dS)zeUpdate the PE image content with any individual section data that has been modified. N) rUrRrGrSrTrIrIr[r/r)rwrsection_data_startsection_data_ends rmerge_modified_section_datazPE.merge_modified_section_datas } L LG!%!:!:($*>*L""  2G4II !C $6$666;Kc OO<<##$68H8H8J8JKKK L Lrc ||jjz }t|jjdkr|jjdjrt |ds"|tdgt |ds|j dn1|j D](}d}|t|j kr |j |}|dz }|j td krn|j td kr>||j||j|zd z d zns|j td kr;||j||j|zd zn"|j tdkr7||j||j|zn|j tdkrs|t|j krn|j |}|dz }||j||jd z|jz|zdzd z nL|j tdkr6||j||j|z|t|j k *||j_t |dr$|jD]}|jD]}|xj|z c_t |drh|jjxj|z c_|jjxj|z c_|jjxj|z c_|jjxj|z c_t |drk|jj} t | dr| jr| xj|z c_t | dr| j r| xj |z c_ t | dr| j!r| xj!|z c_!t | dr| j"r| xj"|z c_"t | dr| j#r| xj#|z c_#t | dr| j$r| xj$|z c_$t | dr| j%r| xj%|z c_%t | dr| j&r| xj&|z c_&t | dr| j'r| xj'|z c_'t | dr| j(r| xj(|z c_(|j)tTkr't | dr| j+r| xj+|z c_+t | d r| j,r| xj,|z c_,t | d!r| j-r| xj.|z c_.t | d"r| j.r| xj.|z c_.t | d#r| j/r| xj/|z c_/d$Sd$Sd$Sd$Sd$Sd$S)%a2Apply the relocation information to the image using the provided image base. This method will apply the relocation information to the image. Given the new base, all the relocations will be processed and both the raw data and the section's data will be fixed accordingly. The resulting image can be retrieved as well through the method: get_memory_mapped_image() In order to get something that would more closely match what could be found in memory once the Windows loader finished its work. rMrKrrJr zZRelocating image but PE does not have (or pefile cannot parse) a DIRECTORY_ENTRY_BASERELOCrr9rrr5rrrrrrrBrrLockPrefixTableEditListSecurityCookieSEHandlerTableGuardCFCheckFunctionPointerGuardCFDispatchFunctionPointerGuardCFFunctionTableGuardAddressTakenIatEntryTableGuardLongJumpTargetTableDynamicValueRelocTableCHPEMetadataPointerGuardRFFailureRoutine$GuardRFFailureRoutineFunctionPointer(GuardRFVerifyStackPointerFunctionPointerEnclaveConfigurationPointerN)0rSrrIrrrcrrrVrrrrrrrrr r7r(r#rBr&rrrJStartAddressOfRawDataEndAddressOfRawDataAddressOfIndexAddressOfCallBacksrr8r9r:r;r<r=r>r?r@rArrrBrCrDrErF) rw new_ImageBaserelocation_differencer entry_idxrY next_entryr'func load_configs rrzPE.relocate_images!.0D0N N $3 4 4 9 9$3A6; :4!<== ++!01R!S T,4!<==b &&9 ";\\E !"I#c%-&8&888 % i 8!Q  :9S)TTT "Z?;Q+RRR !00 % $($8$8$C$C&;%<')%*#) !)#Z?;P+QQQ !00 % $($8$8$C$C&;%<#) !)#Z?;T+UUU !11 % $ 5 5ei @ @"7!8 #Z?;T+UUU )C ,>,>>> %).y)AJ%NI 00 % %)%9%9%)%D%D%J&0n%5&;%<'1%1 $& !&    #Z?;R+SSS!11 % $ 5 5ei @ @"7!8c$c%-&8&888n.;D *t566 >6>>C # >> (== >t233 (/EE)EE(/CC)CC(/>>BWW>>(/BB)BBt:;;N U">E K):;;I#3I //3HH//; 33B 8LB((,AA((K)9::H#2H ..2GG..K)9::H#2H ..2GG..K)FGGU#?U ;;?TT;;K)IJJX#BX >>BWW>>K)?@@N#8N 448MM44K)IJJX#BX >>BWW>>K)CDDR#<R 88>@@4G &&* t}%%!i-IN)KLs8a<(()) F FAC!+,,,,1uX\**++ + q1uww/5A M3JK c4=QQ9J+KLLQO  H5  $z1h"nEv%(b.9R0f$#dm,,,,rctd}|s)|s||jjz|krdSdS)zCheck whether the file is a standard executable. This will return true only if the file has the IMAGE_FILE_EXECUTABLE_IMAGE flag set and the IMAGE_FILE_DLL not set and the file does not appear to be a driver either. raTF)ris_dllrrr`)rwEXE_flags ris_exez PE.is_exesU))FG ^^%% D,<<II4urcJtd}||jjz|krdSdS)zCheck whether the file is a standard DLL. This will return true only if the image has the IMAGE_FILE_DLL flag set. rpTF)rrr`)rwDLL_flags rrZz PE.is_dlls/ ))9: t'7 7H D D4urct|ds"|tdgt|dsdStd}|d|jDrdStd}|d |jDr(|jjtd td fvrdSdS) zCheck whether the file is a Windows driver. This will return true only if there are reliable indicators of the image being a driver. rBrCr7F)s ntoskrnl.exeshal.dllsndis.syss bootvid.dlls kdcom.dllc@g|]}|jSr:)r'r5)r<rLs rr>z PE.is_driver..s" D D DSW]]__ D D DrT)spagespagedcfg|].}|jd/S)r+)rr5r6)r<rs rr>z PE.is_driver..s4 O O OgW\   ! ! ( ( 1 1 O O Orrr) rcrrr intersectionrBrUrS SubsystemSUBSYSTEM_TYPE)rw system_DLLsdriver_like_section_namess rrz PE.is_drivers,t566   ' ',-KLM (    t566 5  T    # # D D(C D D D   4$'(;$<$<! $ 1 1 O O O O O    *78?@   4urc>dt|jffd }t|dr.||j|jjf|jD]}||j|j ftdg}t|jj D]E\}}||vr || |j|jf6#t $rYBwxYwt|jt#krt#SdS)zoGet the offset of data appended to the file and not contained within the area described in the headers.rcrt||kr"t|tkr|SSr)sum)offset_and_size file_sizelargest_offset_and_sizes r'update_if_sum_is_larger_and_within_filezQPE.get_overlay_data_start_offset..update_if_sum_is_larger_and_within_file,sK?##y00S5I5IC'MM66'&* *rrSrHN)rIr[rcrSrrrrUrGrIrrrrjrHrrri)rwrmrskip_directoriesrrrls @rget_overlay_data_start_offsetz PE.get_overlay_data_start_offset&s#)(+4='9'9 + + + + + + 4* + + &M&M(88::$9'' #}  G&M&M)7+@A'' # #,,LMN'(<(KLL  NC&&& *Q*Q--i.FGGX++''!     t}  $; < < < <.// /ts.*C C&%C&cP|}||j|dSdS)zeGet the data appended to the file and not contained within the area described in the headers.Nror[rwoverlay_data_offsets r get_overlayzPE.get_overlayTs5#@@BB  *=!4!5!56 6trcj|}||jd|S|jddS)zKReturn the just data defined by the PE headers, removing any overlaid data.Nrqrrs rtrimzPE.trim_sA#@@BB  *=!5"5!56 6}QQQrc|tkr<|jdur3t|s$|jd|zd|_t ||S)NFz=If FileAlignment > 0x200 it should be a power of 2. Value: %xT)r#rYrirVrr')rwr%r&s rrRzPE.adjust_FileAlignmentvsh : : :)U22<;W;W2&&S%'.2*)#~>>>rc|tkr5||kr/|jdur&|jd||fzd|_t |||S)NFzAIf FileAlignment(%x) < 0x200 it should equal SectionAlignment(%x)T)r#rZrVrr+)rwr%r*r&s rrWzPE.adjust_SectionAlignmentsp : : :"3331U::&&W%'89:15-,S2C^TTTrr)NFF)rNrNFr)NF)rN)rN)rN)r)Nr)r~rrrrrrrrrrr(rWrrrrrrrrrrr{r|rrrUr_r^r_r`r2r3r8r9rFrGrH&__IMAGE_DYNAMIC_RELOCATION_V2_format__(__IMAGE_DYNAMIC_RELOCATION64_V2_format__r r#rMAX_SYMBOL_EXPORT_COUNTrtrfrirdrqrtrcrrrrrrrrrrrr:rrKrXrYrrrrrrrr"rr>rMrRrr0rgrrrrgrjr&r rr%rr!rrrrrrrBrrrr7rr rrrrrrrrr!r#r%r(r*r rr$rZr/r5rrTrSr\rZrrortrvrRrWr:rrrr sBBP#2 $ '# "($H!*&F#I'# 0, *&)%" +'1- ,( ! #&! VKEN# %! ($($ .* C? B>>: &" ($/.*b00,d1- +' -) .* 0, 0, ,( # 2 4444l   ,,nnn` OOOb    $$$.5555nLLL^TY`4`4`4`4DXXXtuuun***83 3 3 jX#X#X#t@@@ ;;;;z***X&&&PiiiVu'u'u'u'n 0>s$s$s$j G G G G RHHH   kkkZ ? ? ? ?.;.;.;`BBB2hhhh^ ] ] ] ] ~BBBBHGGGGR!!!8 ' ' ' 'D--->****1B P P P P)9)9)9)9V    :::1111]]]]~ cccL 555 K K K   OOOKKKQQQ''' K K K   NNNIIIOOO''' K K K   OOOKKKQQQ666"":S::::: L L L\U\U\U|III.-.-.-`&   888t,,,\      . ? ? ?$ U U U U Urrcddl}d}|jddst|dS|jddkr|jdds|dt |jd}|jjD]<}tt|jj |j z|j |j =dStt |jd dS)Nrz1pefile.py pefile.py exports r9rrEzerror: required)rAargvrexitrrOrr7rSrrrrr)rAusagerrs rmainrsJJJ E 8ABB< + e ! ! !x| 3 HH1 2 2 2  __,4  C B&03;>??3;       b!oo''))*****r__main__)r FFry)r __author__ __version__ __contact__rr}rJrmr2rrrkrwrtypingrhashlibrrrr rrrr3register_error lookup_errorr$r1rr'r+r0rQr&r1rhr2r rrrr|rrrrrrr IMAGE_NUMBEROF_DIRECTORY_ENTRIESrrrrrAdirectory_entry_typesrimage_characteristicsrsection_characteristicsrb debug_typesrsubsystem_typesrd machine_typesrrelocation_typesrdll_characteristicsrr#rMrQ registersrmrhrqrrrrrrrr resource_typerrr?rrAr?rErCrrFrUr`rgrirLrrqrrrrrrrrrErrrrrrrrrrr r r rrrrrrr!r\rgrprrrrrrrrr9ascii_lowercaseascii_uppercaserrrrrYrZrlboolrrrr~r:rrrs    %  )+>6+>?Q+R+RSSS  " 4&&&  4      !#% )  %777(,455&% %:;;///b','>?? *\+ & & "o..%%% N|M**    ,/00$#l#677!&  !L!233    & L # #   0 ]++ ___B|Dh h h T ,w   $w--#*00L- %%l3333". 888.    ' ' '///*** R R R R R R R RHHHHHHHHV     I   &;&;&;&;&;&;&;&;T & 4+++ 4d###(($#(VFFFFFFFFREEEEEyEEEP 4e$$$NXNX%$NXbi,i,i,i,i,Yi,i,i,X%%%%%%%%]?"?"?"?"?"?"?"?"DCCCCCMCCC."."."."."."."."bm=*M M"""""]"""Bm-&]]i$i$i$i$i$'i$i$i$XOOOOOOOO288888N888;;;;;~;;;8 ; ; ; ; ;~ ; ; ;      .   &XXXXXNXXX&YYYYY~YYY&XXXXXNXXX&YYYYY~YYY&HHHHHnHHH= = = = = = = = @        D1   m  --- V33fmC  4FK   S% "# ?C      @VU@VU@VU@VU@VU@VU@VU@VUFl+++* zDFFFFFr