;iGdZddlZddlZddlZddlZddlZddlZddlZdZ ej Z dZ Gdde Z dZdZd ZdS) zpeutils, Portable Executable utilities module Copyright (c) 2005-2023 Ero Carrera All rights reserved. Nz Ero Carrerazero.carrera@gmail.comcjeZdZdZddZddZddZ ddZdd Zdd Z d Z dd Z ddZ ddZ ddZdS)SignatureDatabaseaThis class loads and keeps a parsed PEiD signature database. Usage: sig_db = SignatureDatabase('/path/to/signature/file') and/or sig_db = SignatureDatabase() sig_db.load('/path/to/signature/file') Signature databases can be combined by performing multiple loads. The filename parameter can be a URL too. In that case the signature database will be downloaded from that location. Nc&tjdtj|_t |_d|_t |_d|_t |_ d|_ d|_ | ||dS)Nzh\[(.*?)\]\s+?signature\s*=\s*(.*?)(\s+\?\?)*\s*ep_only\s*=\s*(\w+)(?:\s*section_start_only\s*=\s*(\w+)|)rfilenamedata) recompileS parse_sigdictsignature_tree_eponly_truesignature_count_eponly_truesignature_tree_eponly_falsesignature_count_eponly_falsesignature_tree_section_startsignature_count_section_start max_depth_SignatureDatabase__loadselfrrs ;C:\PYTHON\MyICR_Workspace\venv\Lib\site-packages\peutils.py__init__zSignatureDatabase.__init__&s v D  "+/&&'+,(+/66(,-),0FF)-.* XD 11111c t}t|jD]\}}|j|kr|j}d||dzt |jdd|jDfz}|| |||dd|d|dzS) aGenerates signatures for all the sections in a PE file. If the section contains any data a signature will be created for it. The signature name will be a combination of the parameter 'name' and the section number and its name. z%s Section(%d/%d,%s)c.g|]}|tjv|S)string printable.0cs r zASignatureDatabase.generate_section_signatures..^s%JJJqA9I4I4I4I4I4IrFT)ep_onlysection_start_only sig_length ) list enumeratesections SizeOfRawDataPointerToRawDatalenjoinNameappend&_SignatureDatabase__generate_signature) rpenamer)section_signaturesidxsectionoffsetsig_names rgenerate_section_signaturesz-SignatureDatabase.generate_section_signaturesHs"VV%bk22  LC$z11-F-aBK  JJGLJJJKK 1H  % %))!'+) *    yy+,,t33rct||jj}||||d|S)zGenerate signatures for the entry point of a PE file. Creates a signature whose name will be the parameter 'name' and the section number and its name. T)r'r))get_offset_from_rvaOPTIONAL_HEADERAddressOfEntryPointr4)rr5r6r)r:s rgenerate_ep_signaturez'SignatureDatabase.generate_ep_signaturensE''(:(NOO(( dz)   rFc |j|||z}dd|D}|dkrd}nd}|dkrd}nd}d|d|d|d |d } | S) N c2g|]}dt|zS)z%02x)ordr#s rr&z:SignatureDatabase.__generate_signature..s"#B#B#BFSVVO#B#B#BrTtruefalse[z] signature = z ep_only = z section_start_only = r*)__data__r1) rr5r:r6r'r(r)rsignature_bytes signatures r__generate_signaturez&SignatureDatabase.__generate_signature{s{6FZ$778((#B#BT#B#B#BCC d??GGG  % %!'  !(  DD OO GG     rTcx||||}|r |dkr d|DS|ddSdS)aMatches and returns the exact match(es). If ep_only is True the result will be a string with the packer name. Otherwise it will be a list of the form (file_offset, packer_name) specifying where in the file the signature was found. Fc:g|]}|d|ddfS)rrr )r$matchs rr&z+SignatureDatabase.match..s)FFFUq58B<0FFFrrrON_SignatureDatabase__matchrr5r'r(matchess rrPzSignatureDatabase.matchsY,,r7,>??  "%GFgFFFF1:b> !trcX||||}|r|dkr|S|dSdS)z+Matches and returns all the likely matches.FrNrQrSs r match_allzSignatureDatabase.match_allsC,,r7,>??  %1: trc|dur5 |j}n#t$r}d}~wwxYw|j}d|jD}nn|dur@ |}n#t$r}d}~wwxYw|j}|jj}|g}n*|j}|j}tt|}g} |D]A} | ||| | |j z} | r| | | fB|dur | r| dS| S)NTcg|] }|j Sr )r/)r$r9s rr&z-SignatureDatabase.__match..sRRR7g6RRRrr)rI Exceptionrr-get_memory_mapped_imagerr?r@rranger0(_SignatureDatabase__match_signature_treerr3) rr5r'r(rexcp signaturesscan_addresseseprTr8results r__matchzSignatureDatabase.__matchsp  % %  {     :JSRbkRRRNN __  1133     8J #7B!TNN;D9J"3t99--N! . .C00DsT^';!;<F .V}--- d?? "qz!s' A A$AA$c|}dg}|dur|j}n |dur|j}g}|D]A}||||||jz} | r||| fB|dur |r|dS|S)NrT)rrr\rr3) r code_datar'r(rr_r^rTr8ras r match_datazSignatureDatabase.match_data s  % %:JJ __8J! . .C00DsT^';!;<F .V}--- d?? "qz!rrc t}|}td|DD] \}}|n||d}dt|vrjt} t|D]%} | d| | d&|| d|vrU|dd} ||dzd} | r0||| | ||zdz|} |dt|vrjt} t|D]%} | d| | d&|| |S)a Recursive function to find matches along the signature tree. signature_tree is the part of the tree left to walk data is the data being checked against the signature tree depth keeps track of how far we have gone down the tree cZg|](}t|tr|nt|)Sr ) isinstanceintrE)r$bs rr&z.Ds1#V#V#VAAs););$GAAQ#V#V#VrNrrz??)r+r,getvaluesitemsr3extendr\) rsignature_treerdepth matched_namesrPr8byte match_nextnamesitemmatch_tree_alternatedata_remainings r__match_signature_treez(SignatureDatabase.__match_signature_tree6s  ##V#VQU#V#V#VWW+ + IC}4..J tELLNN++++ !//..DAw T!W---$$U+++ u}}',yyt'<'<$!%cAgii!!((330.#+PQ/ EE  ellnn)=)=!=!=FFEU[[]]++ * *7?LLa)))   ' ' 'rc4|||dS)znLoad a PEiD signature file. Invoking this method on different files combines the signatures. rN)rrs rloadzSignatureDatabase.load~s XD 11111rc|tj|sX tj|}|}|nZ#t$rwxYw t|d}|}|n#t$rwxYw|}|sdSd|j |}|D]~\}}}} } | } |dd }fd|D} | dkrd} nd} | dkrd} nd} d } | dur|j} |xjd z c_n3| dur|j} |xjd z c_n|j} |xjd z c_t-| D]~\}}|d zt/| kr1| |t3| |<d| ||<n%| |t3| |<| |} | d z } | |jkr| |_dS) Nrtc.d|vr|St|dS)N?)ri)values rto_bytez)SignatureDatabase.__load..to_bytese|| ub>> !rz\nrc&g|] }|Sr r )r$rjrs rr&z,SignatureDatabase.__load..s!EEEawwqzzEEErrFTFrr)ospathexistsurllibrequesturlopenreadcloseIOErroropenr findallstriplowerreplacesplitrrrrrrr,r0rkr r)rrrsig_fsig_datarT packer_namerKsuperfluous_wildcardsr'r(rJrptreer8rrrs @r__loadzSignatureDatabase.__loads  7>>(++ "N228<> t05- ;..'')) w''))** s?? !X - ! 44;;481 44r)rrr r!urllib.requestr urllib.parse urllib.errorpefile __author__ __version__ __contact__objectrrrrr rrrs 111111111111   % V'V'V'V'V'V'V'V'r   3 3 3 l!5!5!5!5!5r