pype32.pype32.PE

Package pype32 :: Module pype32 :: Class PE |
[hide private]
[frames] | no frames]

# Class PE

source code

    object --+
             |
            PE

PE object.

Instance Methods | [hide private]
__init__(self, pathToFile=None, data=None, fastLoad=False, verbose=False) A class representation of the Portable Executable format. | source code
bool |
hasMZSignature(self, rd) Check for MZ signature. | source code
bool |
hasPESignature(self, rd) Check for PE signature. | source code
validate(self) Performs validations over some fields of the PE structure to determine if the loaded file has a valid PE format. | source code
str |
readFile(self, pathToFile) Returns data from a file. | source code
str |
write(self, filename=`'````'`) Writes data from PE object to a file. | source code
__write(self, thePath, theData) Write data to a file. | source code
__len__(self) | source code
__str__(self) str(x) | source code
str |
_updateDirectoriesData(self, peStr) Updates the data in every Directory object. | source code
str |
_getPaddingDataToSectionOffset(self) Returns the data between the last section header and the begenning of data from the first section. | source code
str |
_getSignature(self, readDataInstance, dataDirectoryInstance) Returns the digital signature within a digital signed PE file. | source code
str |
_getOverlay(self, readDataInstance, sectionHdrsInstance) Returns the overlay data from the PE file. | source code
int |
getOffsetFromRva(self, rva) Converts an offset to an RVA. | source code
int |
getRvaFromOffset(self, offset) Converts a RVA to an offset. | source code
int |
getSectionByOffset(self, offset) Given an offset in the file, tries to determine the section this offset belong to. | source code
int |
getSectionByRva(self, rva) Given a RVA in the file, tries to determine the section this RVA belongs to. | source code
int |
_getPaddingToSectionOffset(self) Returns the offset to last section header present in the PE file. | source code
fullLoad(self) Parse all the directories in the PE file. | source code
_internalParse(self, readDataInstance) Populates the attributes of the PE object. | source code
addSection(self, data, name=`'``.pype32\x00``'`, flags=1610612736) Adds a new section to the existing PE instance. | source code
extendSection(self, sectionIndex, data) Extends an existing section in the PE instance. | source code
_fixPe(self) Fixes the necessary fields in the PE file instance in order to create a valid PE32. | source code
int |
_adjustFileAlignment(self, value, fileAlignment) Align a value to `FileAligment`. | source code
int |
_adjustSectionAlignment(self, value, fileAlignment, sectionAlignment) Align a value to `SectionAligment`. | source code
DWORD |
getDwordAtRva(self, rva) Returns a `DWORD` from a given RVA. | source code
WORD |
getWordAtRva(self, rva) Returns a `WORD` from a given RVA. | source code
DWORD |
getDwordAtOffset(self, offset) Returns a `DWORD` from a given offset. | source code
WORD |
getWordAtOffset(self, offset) Returns a `WORD` from a given offset. | source code
QWORD |
getQwordAtRva(self, rva) Returns a `QWORD` from a given RVA. | source code
QWORD |
getQwordAtOffset(self, offset) Returns a `QWORD` from a given offset. | source code
str |
getDataAtRva(self, rva, size) Gets binary data at a given RVA. | source code
str |
getDataAtOffset(self, offset, size) Gets binary data at a given offset. | source code
String |
readStringAtRva(self, rva) Returns a String object from a given RVA. | source code
bool |
isExe(self) Determines if the current PE instance is an Executable file. | source code
bool |
isDll(self) Determines if the current PE instance is a Dynamic Link Library file. | source code
bool |
isDriver(self) Determines if the current PE instance is a driver (.sys) file. | source code
bool |
isPe32(self) Determines if the current PE instance is a PE32 file. | source code
bool |
isPe64(self) Determines if the current PE instance is a PE64 file. | source code
bool |
isPeBounded(self) Determines if the current PE instance is bounded, i.e. | source code
_parseDirectories(self, dataDirectoryInstance, magic=267) Parses all the directories in the PE instance. | source code
str |
_parseResourceDirectory(self, rva, size, magic=267) Parses the `IMAGE_RESOURCE_DIRECTORY` directory. | source code
str |
_parseExceptionDirectory(self, rva, size, magic=267) Parses the `IMAGE_EXCEPTION_DIRECTORY` directory. | source code
str |
_parseDelayImportDirectory(self, rva, size, magic=267) Parses the delay imports directory. | source code
ImageBoundImportDescriptor |
_parseBoundImportDirectory(self, rva, size, magic=267) Parses the bound import directory. | source code
TLSDirectory |
_parseTlsDirectory(self, rva, size, magic=267) Parses the TLS directory. | source code
ImageBaseRelocation |
_parseRelocsDirectory(self, rva, size, magic=267) Parses the relocation directory. | source code
ImageExportTable |
_parseExportDirectory(self, rva, size, magic=267) Parses the `IMAGE_EXPORT_DIRECTORY` directory. | source code
ImageDebugDirectory |
_parseDebugDirectory(self, rva, size, magic=267) Parses the `IMAGE_DEBUG_DIRECTORY` directory. | source code
ImageImportDescriptor |
_parseImportDirectory(self, rva, size, magic=267) Parses the `IMAGE_IMPORT_DIRECTORY` directory. | source code
NETDirectory |
_parseNetDirectory(self, rva, size, magic=267) Parses the NET directory. | source code
str |
getMd5(self) Get MD5 hash from PE file. | source code
str |
getSha1(self) Get SHA1 hash from PE file. | source code
str |
getSha256(self) Get SHA256 hash from PE file. | source code
str |
getSha512(self) Get SHA512 hash from PE file. | source code
int |
getCRC32(self) Get CRC32 checksum from PE file. | source code
Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__subclasshook__`

Static Methods | [hide private]
str |
getDosStub() Returns a default DOS stub. | source code

Instance Variables | [hide private]
| dosHeader DosHeader dosHeader.
| dosStub `str` dosStub.
| ntHeaders NtHeaders ntHeaders.
| sectionHeaders SectionHeaders sectionHeaders.
| sections Sections sections.

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, pathToFile=None, data=None, fastLoad=False, verbose=False) (Constructor) | source code
A class representation of the Portable Executable format. Parameters: `pathToFile` (str) - Path to the file to load. `data` (str) - PE data to process. `fastLoad` (bool) - If set to `False`, the PE class won't parse the directory data, just headers. The fullLoad method is available to load the directories in case the `fastLoad` parameter was set to `False`. If set to `True`, the entire PE will be parsed. `verbose` (bool) - Verbose output. Overrides: object.__init__ See Also: PE format http://msdn.microsoft.com/en-us/library/windows/desktop/ms680547%28v=vs.85%29.aspx To Do: Parse the Resource directory. Parse the Delay Imports directory. Parse the Exception directory. Add dump() method to show nicely all the structure of the PE file.

### hasMZSignature(self, rd) | source code
Check for MZ signature. Parameters: `rd` (ReadData) - A ReadData object. Returns: bool True is the given ReadData stream has the MZ signature. Otherwise, False.

### hasPESignature(self, rd) | source code
Check for PE signature. Parameters: `rd` (ReadData) - A ReadData object. Returns: bool True is the given ReadData stream has the PE signature. Otherwise, False.

### validate(self) | source code
Performs validations over some fields of the PE structure to determine if the loaded file has a valid PE format. Raises: `PEException` - If an invalid value is found into the PE instance.

### readFile(self, pathToFile) | source code
Returns data from a file. Parameters: `pathToFile` (str) - Path to the file. Returns: str The data from file.

### write(self, filename=`'````'`) | source code
Writes data from PE object to a file. Returns: str The PE stream data. Raises: `IOError` - If the file could not be opened for write operations.

### __write(self, thePath, theData) | source code
Write data to a file. Parameters: `thePath` (str) - The file path. `theData` (str) - The data to write.

### __str__(self) (Informal representation operator) | source code
str(x) Overrides: object.__str__ (inherited documentation)

### _updateDirectoriesData(self, peStr) | source code
Updates the data in every Directory object. Parameters: `peStr` (str) - `str` representation of the PE object. Returns: str A `str` representation of the PE object.

### _getPaddingDataToSectionOffset(self) | source code
Returns the data between the last section header and the begenning of data from the first section. Returns: str Data between last section header and the begenning of the first section.

### _getSignature(self, readDataInstance, dataDirectoryInstance) | source code
Returns the digital signature within a digital signed PE file. Parameters: `readDataInstance` (ReadData) - A ReadData instance containing a PE file data. `dataDirectoryInstance` (DataDirectory) - A DataDirectory object containing the information about directories. Returns: str A string with the digital signature. Raises: `InstanceErrorException` - If the `readDataInstance` or the `dataDirectoryInstance` were not specified.

### _getOverlay(self, readDataInstance, sectionHdrsInstance) | source code
Returns the overlay data from the PE file. Parameters: `readDataInstance` (ReadData) - A ReadData instance containing the PE file data. `sectionHdrsInstance` (SectionHeaders) - A SectionHeaders instance containing the information about the sections present in the PE file. Returns: str A string with the overlay data from the PE file. Raises: `InstanceErrorException` - If the `readDataInstance` or the `sectionHdrsInstance` were not specified.

### getOffsetFromRva(self, rva) | source code
Converts an offset to an RVA. Parameters: `rva` (int) - The RVA to be converted. Returns: int An integer value representing an offset in the PE file.

### getRvaFromOffset(self, offset) | source code
Converts a RVA to an offset. Parameters: `offset` (int) - The offset value to be converted to RVA. Returns: int The RVA obtained from the given offset.

### getSectionByOffset(self, offset) | source code
Given an offset in the file, tries to determine the section this offset belong to. Parameters: `offset` (int) - Offset value. Returns: int An index, starting at 1, that represents the section the given offset belongs to.

### getSectionByRva(self, rva) | source code
Given a RVA in the file, tries to determine the section this RVA belongs to. Parameters: `rva` (int) - RVA value. Returns: int An index, starting at 1, that represents the section the given RVA belongs to.

### getDosStub() Static Method | source code
Returns a default DOS stub. Returns: str A defaul DOS stub.

### _getPaddingToSectionOffset(self) | source code
Returns the offset to last section header present in the PE file. Returns: int The offset where the end of the last section header resides in the PE file.

### _internalParse(self, readDataInstance) | source code
Populates the attributes of the PE object. Parameters: `readDataInstance` (ReadData) - A ReadData instance with the data of a PE file.

### addSection(self, data, name=`'``.pype32\x00``'`, flags=1610612736) | source code
Adds a new section to the existing PE instance. Parameters: `data` (str) - The data to be added in the new section. `name` (str) - (Optional) The name for the new section. `flags` (int) - (Optional) The attributes for the new section.

### extendSection(self, sectionIndex, data) | source code
Extends an existing section in the PE instance. Parameters: `sectionIndex` (int) - The index for the section to be extended. `data` (str) - The data to include in the section. Raises: `IndexError` - If an invalid `sectionIndex` was specified. `SectionHeadersException` - If there is not section to extend.

### _fixPe(self) | source code
Fixes the necessary fields in the PE file instance in order to create a valid PE32. i.e. SizeOfImage.

### _adjustFileAlignment(self, value, fileAlignment) | source code
Align a value to `FileAligment`. Parameters: `value` (int) - The value to align. `fileAlignment` (int) - The value to be used to align the `value` parameter. Returns: int The aligned value.

### _adjustSectionAlignment(self, value, fileAlignment, sectionAlignment) | source code
Align a value to `SectionAligment`. Parameters: `value` (int) - The value to be aligned. `fileAlignment` (int) - The value to be used as `FileAlignment`. `sectionAlignment` (int) - The value to be used as `SectionAlignment`. Returns: int The aligned value.

### getDwordAtRva(self, rva) | source code
Returns a `DWORD` from a given RVA. Parameters: `rva` (int) - The RVA to get the `DWORD` from. Returns: DWORD The DWORD obtained at the given RVA.

### getWordAtRva(self, rva) | source code
Returns a `WORD` from a given RVA. Parameters: `rva` (int) - The RVA to get the `WORD` from. Returns: WORD The WORD obtained at the given RVA.

### getDwordAtOffset(self, offset) | source code
Returns a `DWORD` from a given offset. Parameters: `offset` (int) - The offset to get the `DWORD` from. Returns: DWORD The DWORD obtained at the given offset.

### getWordAtOffset(self, offset) | source code
Returns a `WORD` from a given offset. Parameters: `offset` (int) - The offset to get the `WORD` from. Returns: WORD The WORD obtained at the given offset.

### getQwordAtRva(self, rva) | source code
Returns a `QWORD` from a given RVA. Parameters: `rva` (int) - The RVA to get the `QWORD` from. Returns: QWORD The QWORD obtained at the given RVA.

### getQwordAtOffset(self, offset) | source code
Returns a `QWORD` from a given offset. Parameters: `offset` (int) - The offset to get the `QWORD` from. Returns: QWORD The QWORD obtained at the given offset.

### getDataAtRva(self, rva, size) | source code
Gets binary data at a given RVA. Parameters: `rva` (int) - The RVA to get the data from. `size` (int) - The size of the data to be obtained. Returns: str The data obtained at the given RVA.

### getDataAtOffset(self, offset, size) | source code
Gets binary data at a given offset. Parameters: `offset` (int) - The offset to get the data from. `size` (int) - The size of the data to be obtained. Returns: str The data obtained at the given offset.

### readStringAtRva(self, rva) | source code
Returns a String object from a given RVA. Parameters: `rva` (int) - The RVA to get the string from. Returns: String A new String object from the given RVA.

### isExe(self) | source code
Determines if the current PE instance is an Executable file. Returns: bool `True` if the current PE instance is an Executable file. Otherwise, returns `False`.

### isDll(self) | source code
Determines if the current PE instance is a Dynamic Link Library file. Returns: bool `True` if the current PE instance is a DLL. Otherwise, returns `False`.

### isDriver(self) | source code
Determines if the current PE instance is a driver (.sys) file. Returns: bool `True` if the current PE instance is a driver. Otherwise, returns `False`.

### isPe32(self) | source code
Determines if the current PE instance is a PE32 file. Returns: bool `True` if the current PE instance is a PE32 file. Otherwise, returns `False`.

### isPe64(self) | source code
Determines if the current PE instance is a PE64 file. Returns: bool `True` if the current PE instance is a PE64 file. Otherwise, returns `False`.

### isPeBounded(self) | source code
Determines if the current PE instance is bounded, i.e. has a `BOUND_IMPORT_DIRECTORY`. Returns: bool Returns `True` if the current PE instance is bounded. Otherwise, returns `False`.

### _parseDirectories(self, dataDirectoryInstance, magic=267) | source code
Parses all the directories in the PE instance. Parameters: `dataDirectoryInstance` (DataDirectory) - A DataDirectory object with the directories data. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.

### _parseResourceDirectory(self, rva, size, magic=267) | source code
Parses the `IMAGE_RESOURCE_DIRECTORY` directory. Parameters: `rva` (int) - The RVA where the `IMAGE_RESOURCE_DIRECTORY` starts. `size` (int) - The size of the `IMAGE_RESOURCE_DIRECTORY` directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: str The `IMAGE_RESOURCE_DIRECTORY` data.

### _parseExceptionDirectory(self, rva, size, magic=267) | source code
Parses the `IMAGE_EXCEPTION_DIRECTORY` directory. Parameters: `rva` (int) - The RVA where the `IMAGE_EXCEPTION_DIRECTORY` starts. `size` (int) - The size of the `IMAGE_EXCEPTION_DIRECTORY` directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: str The `IMAGE_EXCEPTION_DIRECTORY` data.

### _parseDelayImportDirectory(self, rva, size, magic=267) | source code
Parses the delay imports directory. Parameters: `rva` (int) - The RVA where the delay imports directory starts. `size` (int) - The size of the delay imports directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: str The delay imports directory data.

### _parseBoundImportDirectory(self, rva, size, magic=267) | source code
Parses the bound import directory. Parameters: `rva` (int) - The RVA where the bound import directory starts. `size` (int) - The size of the bound import directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: ImageBoundImportDescriptor A new ImageBoundImportDescriptor object.

### _parseTlsDirectory(self, rva, size, magic=267) | source code
Parses the TLS directory. Parameters: `rva` (int) - The RVA where the TLS directory starts. `size` (int) - The size of the TLS directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: TLSDirectory A new TLSDirectory. Note: if the PE instance is a PE64 file then a new TLSDirectory64 is returned.

### _parseRelocsDirectory(self, rva, size, magic=267) | source code
Parses the relocation directory. Parameters: `rva` (int) - The RVA where the relocation directory starts. `size` (int) - The size of the relocation directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: ImageBaseRelocation A new ImageBaseRelocation object.

### _parseExportDirectory(self, rva, size, magic=267) | source code
Parses the `IMAGE_EXPORT_DIRECTORY` directory. Parameters: `rva` (int) - The RVA where the `IMAGE_EXPORT_DIRECTORY` directory starts. `size` (int) - The size of the `IMAGE_EXPORT_DIRECTORY` directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: ImageExportTable A new ImageExportTable object.

### _parseDebugDirectory(self, rva, size, magic=267) | source code
Parses the `IMAGE_DEBUG_DIRECTORY` directory. Parameters: `rva` (int) - The RVA where the `IMAGE_DEBUG_DIRECTORY` directory starts. `size` (int) - The size of the `IMAGE_DEBUG_DIRECTORY` directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: ImageDebugDirectory A new ImageDebugDirectory object. See Also: http://msdn.microsoft.com/es-es/library/windows/desktop/ms680307(v=vs.85).aspx

### _parseImportDirectory(self, rva, size, magic=267) | source code
Parses the `IMAGE_IMPORT_DIRECTORY` directory. Parameters: `rva` (int) - The RVA where the `IMAGE_IMPORT_DIRECTORY` directory starts. `size` (int) - The size of the `IMAGE_IMPORT_DIRECTORY` directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: ImageImportDescriptor A new ImageImportDescriptor object. Raises: `InvalidParameterException` - If wrong magic was specified.

### _parseNetDirectory(self, rva, size, magic=267) | source code
Parses the NET directory. Parameters: `rva` (int) - The RVA where the NET directory starts. `size` (int) - The size of the NET directory. `magic` (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64. Returns: NETDirectory A new NETDirectory object. See Also: http://www.ntcore.com/files/dotnetformat.htm

### getMd5(self) | source code
Get MD5 hash from PE file. Returns: str The MD5 hash from the PE instance.

### getSha1(self) | source code
Get SHA1 hash from PE file. Returns: str The SHA1 hash from the PE instance.

### getSha256(self) | source code
Get SHA256 hash from PE file. Returns: str The SHA256 hash from the PE instance.

### getSha512(self) | source code
Get SHA512 hash from PE file. Returns: str The SHA512 hash from the PE instance.

### getCRC32(self) | source code
Get CRC32 checksum from PE file. Returns: int The CRD32 checksum from the PE instance.