Package pype32 :: Module directories |
[hide private]
[frames] | no frames]

# Source Code for Module pype32.directories

       1  #!/usr/bin/python
       2  # -*- coding: utf-8 -*-
       3
       4  # Copyright (c) 2013, Nahuel Riva
       5  # All rights reserved.
       6  #
       7  # Redistribution and use in source and binary forms, with or without
       8  # modification, are permitted provided that the following conditions are met:
       9  #
      10  #     * Redistributions of source code must retain the above copyright notice,
      11  #       this list of conditions and the following disclaimer.
      12  #     * Redistributions in binary form must reproduce the above copyright
      13  #       notice,this list of conditions and the following disclaimer in the
      14  #       documentation and/or other materials provided with the distribution.
      15  #     * Neither the name of the copyright holder nor the names of its
      16  #       contributors may be used to endorse or promote products derived from
      17  #       this software without specific prior written permission.
      18  #
      19  # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
      20  # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
      21  # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
      22  # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
      23  # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
      24  # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
      25  # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
      26  # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
      27  # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
      28  # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
      29  # POSSIBILITY OF SUCH DAMAGE.
      30
      31  """
      32  PE directory classes.
      33  """
      34
      35  __revision__ = "$Id$"
      36
      37  import datatypes
      38  import consts
      39  import datadirs
      40  import excep
      41  import utils
      42  import baseclasses
      43  import dotnet
      44
      45  # typedef struct IMAGE_BOUND_FORWARDER_REF
      46  # {
      47  #    DWORD   TimeDateStamp;
      48  #    WORD    OffsetModuleName;
      49  #    WORD    Reserved;
      50  # }
      51 -class ImageBoundForwarderRefEntry(baseclasses.BaseStructClass):
      52      """ImageBoundForwarderRefEntry object."""
      53 -    def __init__(self,  shouldPack = True):
      54          """
      55          This class represents an element of type C{IMAGE_BOUND_FORWARDER_REF}.
      56          @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
      57
      58          @type shouldPack: bool
      59          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
      60          """
      61          baseclasses.BaseStructClass.__init__(self,  shouldPack)
      62
      63          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
      64          self.offsetModuleName = datatypes.WORD(0) #: L{WORD} offsetModuleName.
      65          self.reserved = datatypes.WORD(0) #: L{WORD} reserved.
      66          self.moduleName = datatypes.String(shouldPack = False) #: moduleName is metadata, not part of the structure.
      67
      68          self._attrsList = ["timeDateStamp",  "offsetModuleName",  "reserved",  "moduleName"]
      69
      70 -    def getType(self):
      71          """Returns L{consts.IMAGE_BOUND_FORWARDER_REF_ENTRY}."""
      72          return consts.IMAGE_BOUND_FORWARDER_REF_ENTRY
      73
      74      @staticmethod
      75 -    def parse(readDataInstance):
      76          """
      77          Returns a new L{ImageBoundForwarderRefEntry} object.
      78
      79          @type readDataInstance: L{ReadData}
      80          @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRefEntry} object.
      81
      82          @rtype: L{ImageBoundForwarderRefEntry}
      83          @return: A new L{ImageBoundForwarderRefEntry} object.
      84          """
      85          boundForwarderEntry = ImageBoundForwarderRefEntry()
      86          boundForwarderEntry.timeDateStamp.value = readDataInstance.readDword()
      87          boundForwarderEntry.offsetModuleName.value = readDataInstance.readWord()
      88          boundForwarderEntry.reserved.value = readDataInstance.readWord()
      89          return boundForwarderEntry
      90
      91 -class ImageBoundForwarderRef(list):
      92      """ImageBoundForwarderRef array object."""
      93 -    def __init__(self, shouldPack = True):
      94          """
      95          This class is a wrapper over an array of C{IMAGE_BOUND_FORWARDER_REF}.
      96
      97          @type shouldPack: bool
      98          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
      99          """
     100          list.__init__(self)
     101          self.shouldPack = shouldPack
     102
     103 -    def __str__(self):
     104          return ''.join([str(x) for x in self if x.shouldPack])
     105
     106      @staticmethod
     107 -    def parse(readDataInstance,  numberOfEntries):
     108          """
     109          Returns a L{ImageBoundForwarderRef} array where every element is a L{ImageBoundForwarderRefEntry} object.
     110
     111          @type readDataInstance: L{ReadData}
     112          @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRef} object.
     113
     114          @type numberOfEntries: int
     115          @param numberOfEntries: The number of C{IMAGE_BOUND_FORWARDER_REF} entries in the array.
     116
     117          @rtype: L{ImageBoundForwarderRef}
     118          @return: A new L{ImageBoundForwarderRef} object.
     119
     120          @raise DataLengthException: If the L{ReadData} instance has less data than C{NumberOfEntries} * sizeof L{ImageBoundForwarderRefEntry}.
     121          """
     122          imageBoundForwarderRefsList = ImageBoundForwarderRef()
     123          dLength = len(readDataInstance)
     124          entryLength = ImageBoundForwarderRefEntry().sizeof()
     125          toRead = numberOfEntries * entryLength
     126
     127          if dLength >= toRead:
     128              for i in range(numberOfEntries):
     129                  entryData = readDataInstance.read(entryLength)
     130                  rd = utils.ReadData(entryData)
     131                  imageBoundForwarderRefsList.append(ImageBoundForwarderRefEntry.parse(rd))
     132          else:
     133              raise excep.DataLengthException("Not enough bytes to read.")
     134
     135          return imageBoundForwarderRefsList
     136
     137 -class ImageBoundImportDescriptor(list):
     138      """ImageBoundImportDescriptor object."""
     139 -    def __init__(self, shouldPack = True):
     140          """
     141          Array of L{ImageBoundImportDescriptorEntry} objects.
     142
     143          @type shouldPack: bool
     144          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     145          """
     146          list.__init__(self)
     147          self.shouldPack = shouldPack
     148
     149 -    def __str__(self):
     150          return ''.join([str(x) for x in self if x.shouldPack])
     151
     152      @staticmethod
     153 -    def parse(readDataInstance):
     154          """
     155          Returns a new L{ImageBoundImportDescriptor} object.
     156
     157          @type readDataInstance: L{ReadData}
     158          @param readDataInstance: A L{ReadData} object containing the data to create a new L{ImageBoundImportDescriptor} object.
     159
     160          @rtype: L{ImageBoundImportDescriptor}
     161          @return: A new {ImageBoundImportDescriptor} object.
     162          """
     163          ibd = ImageBoundImportDescriptor()
     164
     165          entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32)
     166          readDataInstance.offset = 0
     167          while not utils.allZero(entryData):
     168              prevOffset = readDataInstance.offset
     169
     170              boundEntry = ImageBoundImportDescriptorEntry.parse(readDataInstance)
     171
     172              # if the parsed entry has numberOfModuleForwarderRefs we must adjust the value in the readDataInstance.offset field
     173              # in order to point after the last ImageBoundForwarderRefEntry.
     174              if boundEntry.numberOfModuleForwarderRefs.value:
     175                  readDataInstance.offset = prevOffset + (consts.SIZEOF_IMAGE_BOUND_FORWARDER_REF_ENTRY32 * boundEntry.numberOfModuleForwarderRefs.value)
     176              else:
     177                  readDataInstance.offset = prevOffset
     178
     179              ibd.append(boundEntry)
     180              entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32)
     181
     182          return ibd
     183
     184  # typedef struct IMAGE_BOUND_IMPORT_DESCRIPTOR
     185  # {
     186  #    DWORD   TimeDateStamp;
     187  #    WORD    OffsetModuleName;
     188  #    WORD    NumberOfModuleForwarderRefs;
     189  # }
     190 -class ImageBoundImportDescriptorEntry(baseclasses.BaseStructClass):
     191      """ImageBoundImportDescriptorEntry object."""
     192 -    def __init__(self,  shouldPack = True):
     193          """
     194          This class represents a C{IMAGE_BOUND_IMPORT_DESCRIPTOR} structure.
     195          @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
     196
     197          @type shouldPack: bool
     198          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     199          """
     200          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     201
     202          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
     203          self.offsetModuleName = datatypes.WORD(0) #: L{WORD} offsetModuleName.
     204          self.numberOfModuleForwarderRefs = datatypes.WORD(0)#: L{WORD} numberOfModuleForwarderRefs.
     205          self.forwarderRefsList = ImageBoundForwarderRef() #: L{ImageBoundForwarderRef} forwarderRefsList.
     206          self.moduleName = datatypes.String(shouldPack = False) #: moduleName is metadata, not part of the structure.
     207
     208          self._attrsList = ["timeDateStamp",  "offsetModuleName",  "numberOfModuleForwarderRefs",  "forwarderRefsList",  "moduleName"]
     209
     210 -    def getType(self):
     211          """Returns L{consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY}"""
     212          return consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY
     213
     214      @staticmethod
     215 -    def parse(readDataInstance):
     216          """
     217          Returns a new L{ImageBoundImportDescriptorEntry} object.
     218
     219          @type readDataInstance: L{ReadData}
     220          @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageBoundImportDescriptorEntry}.
     221
     222          @rtype: L{ImageBoundImportDescriptorEntry}
     223          @return: A new {ImageBoundImportDescriptorEntry} object.
     224          """
     225          boundEntry = ImageBoundImportDescriptorEntry()
     226          boundEntry.timeDateStamp.value = readDataInstance.readDword()
     227          boundEntry.offsetModuleName.value = readDataInstance.readWord()
     228          boundEntry.numberOfModuleForwarderRefs.value = readDataInstance.readWord()
     229
     230          numberOfForwarderRefsEntries = boundEntry.numberOfModuleForwarderRefs .value
     231          if numberOfForwarderRefsEntries:
     232              bytesToRead = numberOfForwarderRefsEntries * ImageBoundForwarderRefEntry().sizeof()
     233              rd = utils.ReadData(readDataInstance.read(bytesToRead))
     234              boundEntry.forwarderRefsList = ImageBoundForwarderRef.parse(rd,  numberOfForwarderRefsEntries)
     235
     236          return boundEntry
     237
     238 -class TLSDirectory(baseclasses.BaseStructClass):
     239      """TLS directory object."""
     240 -    def __init__(self, shouldPack = True):
     241          """
     242          Class representation of a C{IMAGE_TLS_DIRECTORY} structure.
     243
     244          @see: Figure 11 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx}
     245
     246          @type shouldPack: bool
     247          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     248          """
     249          baseclasses.BaseStructClass.__init__(self, shouldPack)
     250
     251          self.startAddressOfRawData = datatypes.DWORD(0) #: L{DWORD} startAddressOfRawData.
     252          self.endAddressOfRawData = datatypes.DWORD(0) #: L{DWORD} endAddressOfRawData.
     253          self.addressOfIndex = datatypes.DWORD(0) #: L{DWORD} addressOfIndex.
     254          self.addressOfCallbacks = datatypes.DWORD(0) #: L{DWORD} addressOfCallbacks.
     255          self.sizeOfZeroFill = datatypes.DWORD(0) #: L{DWORD} sizeOfZeroFill.
     256          self.characteristics = datatypes.DWORD(0) #:L{DWORD} characteristics.
     257
     258          self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\
     259                             "sizeOfZeroFill", "characteristics"]
     260
     261 -    def getType(self):
     262          """Returns L{consts.TLS_DIRECTORY}."""
     263          return consts.TLS_DIRECTORY32
     264
     265      @staticmethod
     266 -    def parse(readDataInstance):
     267          """
     268          Returns a new L{TLSDirectory} object.
     269
     270          @type readDataInstance: L{ReadData}
     271          @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory} object.
     272
     273          @rtype: L{TLSDirectory}
     274          @return: A new {TLSDirectory} object.
     275          """
     276          tlsDir = TLSDirectory()
     277
     278          tlsDir.startAddressOfRawData.value = readDataInstance.readDword()
     279          tlsDir.endAddressOfRawData.value = readDataInstance.readDword()
     280          tlsDir.addressOfIndex.value = readDataInstance.readDword()
     281          tlsDir.addressOfCallbacks.value = readDataInstance.readDword()
     282          tlsDir.sizeOfZeroFill.value = readDataInstance.readDword()
     283          tlsDir.characteristics.value = readDataInstance.readDword()
     284          return tlsDir
     285
     286 -class TLSDirectory64(baseclasses.BaseStructClass):
     287      """TLSDirectory64 object."""
     288 -    def __init__(self,  shouldPack = True):
     289          """
     290          Class representation of a C{IMAGE_TLS_DIRECTORY} structure in 64 bits systems.
     291
     292          @type shouldPack: bool
     293          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     294          """
     295          baseclasses.BaseStructClass.__init__(self, shouldPack)
     296
     297          self.startAddressOfRawData = datatypes.QWORD(0) #: L{QWORD} startAddressOfRawData.
     298          self.endAddressOfRawData = datatypes.QWORD(0) #: L{QWORD} endAddressOfRawData.
     299          self.addressOfIndex = datatypes.QWORD(0) #: L{QWORD} addressOfIndex.
     300          self.addressOfCallbacks = datatypes.QWORD(0) #: L{QWORD} addressOfCallbacks.
     301          self.sizeOfZeroFill = datatypes.DWORD(0) #: L{DWORD} sizeOfZeroFill.
     302          self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics.
     303
     304          self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\
     305                             "sizeOfZeroFill", "characteristics"]
     306
     307 -    def getType(self):
     308          """Returns L{consts.TLS_DIRECTORY64}."""
     309          return consts.TLS_DIRECTORY64
     310
     311      @staticmethod
     312 -    def parse(readDataInstance):
     313          """
     314          Returns a new L{TLSDirectory64} object.
     315
     316          @type readDataInstance: L{ReadData}
     317          @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory64} object.
     318
     319          @rtype: L{TLSDirectory64}
     320          @return: A new L{TLSDirectory64} object.
     321          """
     322          tlsDir = TLSDirectory64()
     323
     324          tlsDir.startAddressOfRawData.value = readDataInstance.readQword()
     325          tlsDir.endAddressOfRawData.value = readDataInstance.readQword()
     326          tlsDir.addressOfIndex.value = readDataInstance.readQword()
     327          tlsDir.addressOfCallbacks.value = readDataInstance.readQword()
     328          tlsDir.sizeOfZeroFill.value = readDataInstance.readDword()
     329          tlsDir.characteristics.value = readDataInstance.readDword()
     330          return tlsDir
     331
     332  # http://msdn.microsoft.com/en-us/library/windows/desktop/ms680328%28v=vs.85%29.aspx
     333 -class ImageLoadConfigDirectory(baseclasses.BaseStructClass):
     334      "IMAGE_LOAD_CONFIG_DIRECTORY32 object aka CONFIGURATION_DIRECTORY"
     335 -    def __init__(self, shouldPack = True):
     336          """
     337          Class representation of a C{IMAGE_LOAD_CONFIG_DIRECTORY32} structure.
     338
     339          @type shouldPack: bool
     340          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     341          """
     342          baseclasses.BaseStructClass.__init__(self, shouldPack)
     343
     344          self.size = datatypes.DWORD()
     345          self.timeDateStamp = datatypes.DWORD()
     346          self.majorVersion = datatypes.WORD()
     347          self.minorVersion = datatypes.WORD()
     348          self.globalFlagsClear = datatypes.DWORD()
     349          self.globalFlagsSet = datatypes.DWORD()
     350          self.criticalSectionDefaultTimeout = datatypes.DWORD()
     351          self.deCommitFreeBlockThreshold = datatypes.DWORD()
     352          self.deCommitTotalFreeThreshold = datatypes.DWORD()
     353          self.lockPrefixTable = datatypes.DWORD() # VA
     354          self.maximumAllocationSize = datatypes.DWORD()
     355          self.virtualMemoryThreshold = datatypes.DWORD()
     356          self.processHeapFlags = datatypes.DWORD()
     357          self.processAffinityMask = datatypes.DWORD()
     358          self.csdVersion = datatypes.WORD()
     359          self.reserved1 = datatypes.WORD()
     360          self.editList = datatypes.DWORD() # VA
     361          self.securityCookie = datatypes.DWORD() # VA
     362          self.SEHandlerTable = datatypes.DWORD() # VA
     363          self.SEHandlerCount = datatypes.DWORD()
     364
     365          # Fields for Control Flow Guard
     366          self.GuardCFCheckFunctionPointer = datatypes.DWORD() # VA
     367          self.Reserved2 = datatypes.DWORD()
     368          self.GuardCFFunctionTable = datatypes.DWORD() # VA
     369          self.GuardCFFunctionCount = datatypes.DWORD()
     370          self.GuardFlags = datatypes.DWORD()
     371
     372          self._attrsList = ["size", "timeDateStamp", "majorVersion", "minorVersion", "globalFlagsClear", "globalFlagsSet", "criticalSectionDefaultTimeout", "deCommitFreeBlockThreshold",\
     373                              "deCommitTotalFreeThreshold", "lockPrefixTable", "maximumAllocationSize", "virtualMemoryThreshold", "processHeapFlags", "processAffinityMask", "csdVersion",\
     374                              "reserved1", "editList", "securityCookie", "SEHandlerTable","SEHandlerCount", "GuardCFCheckFunctionPointer", "Reserved2", "GuardCFFunctionTable",\
     375                              "GuardCFFunctionCount", "GuardFlags"]
     376
     377 -    def getType(self):
     378          """Returns L{consts.IMAGE_LOAD_CONFIG_DIRECTORY32}."""
     379          return consts.IMAGE_LOAD_CONFIG_DIRECTORY32
     380
     381      @staticmethod
     382 -    def parse(readDataInstance):
     383          """
     384          Returns a new L{ImageLoadConfigDirectory} object.
     385
     386          @type readDataInstance: L{ReadData}
     387          @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageLoadConfigDirectory} object.
     388
     389          @rtype: L{ImageLoadConfigDirectory}
     390          @return: A new L{ImageLoadConfigDirectory} object.
     391          """
     392          configDir = ImageLoadConfigDirectory()
     393
     394          configDir.size.value = readDataInstance.readDword()
     395          configDir.timeDateStamp.value = readDataInstance.readDword()
     396          configDir.majorVersion.value = readDataInstance.readWord()
     397          configDir.minorVersion.value = readDataInstance.readWord()
     398          configDir.globalFlagsClear.value = readDataInstance.readDword()
     399          configDir.globalFlagsSet.value = readDataInstance.readDword()
     400          configDir.criticalSectionDefaultTimeout.value = readDataInstance.readDword()
     401          configDir.deCommitFreeBlockThreshold.value = readDataInstance.readDword()
     402          configDir.deCommitTotalFreeThreshold.value = readDataInstance.readDword()
     403          configDir.lockPrefixTable.value = readDataInstance.readDword() # VA
     404          configDir.maximumAllocationSize.value = readDataInstance.readDword()
     405          configDir.virtualMemoryThreshold.value = readDataInstance.readDword()
     406          configDir.processHeapFlags.value = readDataInstance.readDword()
     407          configDir.processAffinityMask.value = readDataInstance.readDword()
     408          configDir.csdVersion.value = readDataInstance.readWord()
     409          configDir.reserved1.value = readDataInstance.readWord()
     410          configDir.editList.value = readDataInstance.readDword() # VA
     411          configDir.securityCookie.value = readDataInstance.readDword() # VA
     412          configDir.SEHandlerTable.value = readDataInstance.readDword() # VA
     413          configDir.SEHandlerCount.value = readDataInstance.readDword()
     414
     415          # Fields for Control Flow Guard
     416          configDir.GuardCFCheckFunctionPointer.value = readDataInstance.readDword() # VA
     417          configDir.Reserved2.value = readDataInstance.readDword()
     418          configDir.GuardCFFunctionTable.value = readDataInstance.readDword() # VA
     419          configDir.GuardCFFunctionCount.value = readDataInstance.readDword()
     420          configDir.GuardFlags.value = readDataInstance.readDword()
     421          return configDir
     422
     423 -class ImageLoadConfigDirectory64(baseclasses.BaseStructClass):
     424      "IMAGE_LOAD_CONFIG_DIRECTORY64 object"
     425 -    def __init__(self, shouldPack = True):
     426          """
     427          Class representation of a C{IMAGE_LOAD_CONFIG_DIRECTORY64} structure in 64 bits systems.
     428
     429          @type shouldPack: bool
     430          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     431          """
     432          baseclasses.BaseStructClass.__init__(self, shouldPack)
     433
     434          self.size = datatypes.DWORD()
     435          self.timeDateStamp = datatypes.DWORD()
     436          self.majorVersion = datatypes.WORD()
     437          self.minorVersion = datatypes.WORD()
     438          self.globalFlagsClear = datatypes.DWORD()
     439          self.globalFlagsSet = datatypes.DWORD()
     440          self.criticalSectionDefaultTimeout = datatypes.DWORD()
     441          self.deCommitFreeBlockThreshold = datatypes.QWORD()
     442          self.deCommitTotalFreeThreshold = datatypes.QWORD()
     443          self.lockPrefixTable = datatypes.QWORD()
     444          self.maximumAllocationSize = datatypes.QWORD()
     445          self.virtualMemoryThreshold = datatypes.QWORD()
     446          self.processAffinityMask = datatypes.QWORD()
     447          self.processHeapFlags = datatypes.DWORD()
     448          self.cdsVersion = datatypes.WORD()
     449          self.reserved1 = datatypes.WORD()
     450          self.editList = datatypes.QWORD()
     451          self.securityCookie = datatypes.QWORD()
     452          self.SEHandlerTable = datatypes.QWORD()
     453          self.SEHandlerCount = datatypes.QWORD()
     454
     455          # Fields for Control Flow Guard
     456          self.GuardCFCheckFunctionPointer = datatypes.QWORD() # VA
     457          self.Reserved2 = datatypes.QWORD()
     458          self.GuardCFFunctionTable = datatypes.QWORD() # VA
     459          self.GuardCFFunctionCount = datatypes.QWORD()
     460          self.GuardFlags = datatypes.QWORD()
     461
     462          self._attrsList = ["size", "timeDateStamp", "majorVersion", "minorVersion", "globalFlagsClear", "globalFlagsSet", "criticalSectionDefaultTimeout", "deCommitFreeBlockThreshold",\
     463                              "deCommitTotalFreeThreshold", "lockPrefixTable", "maximumAllocationSize", "virtualMemoryThreshold", "processAffinityMask", "processHeapFlags", "cdsVersion",\
     464                              "reserved1", "editList", "securityCookie", "SEHandlerTable", "SEHandlerCount", "GuardCFCheckFunctionPointer", "Reserved2", "GuardCFFunctionTable",\
     465                              "GuardCFFunctionCount", "GuardFlags"]
     466
     467
     468 -    def getType(self):
     469          """Returns L{consts.IMAGE_LOAD_CONFIG_DIRECTORY64}."""
     470          return consts.IMAGE_LOAD_CONFIG_DIRECTORY64
     471
     472      @staticmethod
     473 -    def parse(readDataInstance):
     474          """
     475          Returns a new L{ImageLoadConfigDirectory64} object.
     476
     477          @type readDataInstance: L{ReadData}
     478          @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageLoadConfigDirectory64} object.
     479
     480          @rtype: L{ImageLoadConfigDirectory64}
     481          @return: A new L{ImageLoadConfigDirectory64} object.
     482          """
     483          configDir = ImageLoadConfigDirectory64()
     484
     485          configDir.size.value = readDataInstance.readDword()
     486          configDir.timeDateStamp.value = readDataInstance.readDword()
     487          configDir.majorVersion.value = readDataInstance.readWord()
     488          configDir.minorVersion.value = readDataInstance.readWord()
     489          configDir.globalFlagsClear.value = readDataInstance.readDword()
     490          configDir.globalFlagsSet.value = readDataInstance.readDword()
     491          configDir.criticalSectionDefaultTimeout.value = readDataInstance.readDword()
     492          configDir.deCommitFreeBlockThreshold.value = readDataInstance.readQword()
     493          configDir.deCommitTotalFreeThreshold.value = readDataInstance.readQword()
     494          configDir.lockPrefixTable.value = readDataInstance.readQword()
     495          configDir.maximumAllocationSize.value = readDataInstance.readQword()
     496          configDir.virtualMemoryThreshold.value = readDataInstance.readQword()
     497          configDir.processAffinityMask.value = readDataInstance.readQword()
     498          configDir.processHeapFlags.value = readDataInstance.readDword()
     499          configDir.cdsVersion.value = readDataInstance.readWord()
     500          configDir.reserved1.value = readDataInstance.readWord()
     501          configDir.editList.value = readDataInstance.readQword()
     502          configDir.securityCookie.value = readDataInstance.readQword()
     503          configDir.SEHandlerTable.value = readDataInstance.readQword()
     504          configDir.SEHandlerCount.value = readDataInstance.readQword()
     505
     506          # Fields for Control Flow Guard
     507          configDir.GuardCFCheckFunctionPointer.value = readDataInstance.readQword() # VA
     508          configDir.Reserved2.value = readDataInstance.readQword()
     509          configDir.GuardCFFunctionTable.value = readDataInstance.readQword() # VA
     510          configDir.GuardCFFunctionCount.value = readDataInstance.readQword()
     511          configDir.GuardFlags.value = readDataInstance.readQword()
     512          return configDir
     513
     514 -class ImageBaseRelocationEntry(baseclasses.BaseStructClass):
     515      """ImageBaseRelocationEntry object."""
     516 -    def __init__(self,  shouldPack = True):
     517          """
     518          A class representation of a C{IMAGE_BASE_RELOCATION} structure.
     519          @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
     520
     521          @type shouldPack: bool
     522          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     523          """
     524          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     525
     526          self.virtualAddress = datatypes.DWORD(0) #: L{DWORD} virtualAddress.
     527          self.sizeOfBlock = datatypes.DWORD(0) #: L{DWORD} sizeOfBlock
     528          self.items = datatypes.Array(datatypes.TYPE_WORD) #: L{Array} items.
     529
     530          self._attrsList = ["virtualAddress", "sizeOfBlock", "items"]
     531
     532 -    def getType(self):
     533          """Returns L{consts.IMAGE_BASE_RELOCATION_ENTRY}."""
     534          return consts.IMAGE_BASE_RELOCATION_ENTRY
     535
     536      @staticmethod
     537 -    def parse(readDataInstance):
     538          """
     539          Returns a new L{ImageBaseRelocationEntry} object.
     540
     541          @type readDataInstance: L{ReadData}
     542          @param readDataInstance: A L{ReadData} object with data to parse as a L{ImageBaseRelocationEntry} object.
     543
     544          @rtype: L{ImageBaseRelocationEntry}
     545          @return: A new L{ImageBaseRelocationEntry} object.
     546          """
     547          reloc = ImageBaseRelocationEntry()
     548          reloc.virtualAddress.value = readDataInstance.readDword()
     549          reloc.sizeOfBlock.value = readDataInstance.readDword()
     550          toRead = (reloc.sizeOfBlock.value - 8) / len(datatypes.WORD(0))
     551          reloc.items = datatypes.Array.parse(readDataInstance,  datatypes.TYPE_WORD,  toRead)
     552          return reloc
     553
     554 -class ImageBaseRelocation(list):
     555      """ImageBaseRelocation array."""
     556      pass
     557
     558 -class ImageDebugDirectory(baseclasses.BaseStructClass):
     559      """ImageDebugDirectory object."""
     560 -    def __init__(self,  shouldPack = True):
     561          """
     562          Class representation of a C{IMAGE_DEBUG_DIRECTORY} structure.
     563          @see: U{http://msdn.microsoft.com/es-es/library/windows/desktop/ms680307%28v=vs.85%29.aspx}
     564
     565          @type shouldPack: bool
     566          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     567          """
     568          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     569
     570          self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics.
     571          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
     572          self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion.
     573          self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion.
     574          self.type = datatypes.DWORD(0) #: L{DWORD} type.
     575          self.sizeOfData = datatypes.DWORD(0) #: L{DWORD} sizeOfData.
     576          self.addressOfData = datatypes.DWORD(0) #: L{DWORD} addressOfData.
     577          self.pointerToRawData = datatypes.DWORD(0) #: L{DWORD} pointerToRawData.
     578
     579          self._attrsList = ["characteristics",  "timeDateStamp",  "majorVersion",  "minorVersion",  "type",  "sizeOfData",\
     580                             "addressOfData",  "pointerToRawData"]
     581
     582 -    def getType(self):
     583          """Returns L{consts.IMAGE_DEBUG_DIRECTORY}."""
     584          return consts.IMAGE_DEBUG_DIRECTORY
     585
     586      @staticmethod
     587 -    def parse(readDataInstance):
     588          """
     589          Returns a new L{ImageDebugDirectory} object.
     590
     591          @type readDataInstance: L{ReadData}
     592          @param readDataInstance: A new L{ReadData} object with data to be parsed as a L{ImageDebugDirectory} object.
     593
     594          @rtype: L{ImageDebugDirectory}
     595          @return: A new L{ImageDebugDirectory} object.
     596          """
     597          dbgDir = ImageDebugDirectory()
     598
     599          dbgDir.characteristics.value = readDataInstance.readDword()
     600          dbgDir.timeDateStamp.value = readDataInstance.readDword()
     601          dbgDir.majorVersion.value = readDataInstance.readWord()
     602          dbgDir.minorVersion.value = readDataInstance.readWord()
     603          dbgDir.type.value = readDataInstance.readDword()
     604          dbgDir.sizeOfData.value = readDataInstance.readDword()
     605          dbgDir.addressOfData.value = readDataInstance.readDword()
     606          dbgDir.pointerToRawData.value = readDataInstance.readDword()
     607
     608          return dbgDir
     609
     610 -class ImageDebugDirectories(list):
     611      """ImageDebugDirectories object."""
     612 -    def __init__(self,  shouldPack = True):
     613          """
     614          Array of L{ImageDebugDirectory} objects.
     615
     616          @type shouldPack: bool
     617          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     618          """
     619          self.shouldPack = shouldPack
     620
     621 -    def __str__(self):
     622          return ''.join([str(x) for x in self if self.shouldPack])
     623
     624 -    def getType(self):
     625          """"Returns L{consts.IMAGE_DEBUG_DIRECTORIES}."""
     626          return consts.IMAGE_DEBUG_DIRECTORIES
     627
     628      @staticmethod
     629 -    def parse(readDataInstance,  nDebugEntries):
     630          """
     631          Returns a new L{ImageDebugDirectories} object.
     632
     633          @type readDataInstance: L{ReadData}
     634          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageDebugDirectories} object.
     635
     636          @type nDebugEntries: int
     637          @param nDebugEntries: Number of L{ImageDebugDirectory} objects in the C{readDataInstance} object.
     638
     639          @rtype: L{ImageDebugDirectories}
     640          @return: A new L{ImageDebugDirectories} object.
     641
     642          @raise DataLengthException: If not enough data to read in the C{readDataInstance} object.
     643          """
     644          dbgEntries = ImageDebugDirectories()
     645
     646          dataLength = len(readDataInstance)
     647          toRead = nDebugEntries * consts.SIZEOF_IMAGE_DEBUG_ENTRY32
     648          if dataLength >= toRead:
     649              for i in range(nDebugEntries):
     650                  dbgEntry = ImageDebugDirectory.parse(readDataInstance)
     651                  dbgEntries.append(dbgEntry)
     652          else:
     653              raise excep.DataLengthException("Not enough bytes to read.")
     654
     655          return dbgEntries
     656
     657 -class ImageImportDescriptorMetaData(baseclasses.BaseStructClass):
     658      """ImageImportDescriptorMetaData object."""
     659 -    def __init__(self,  shouldPack = True):
     660          """
     661          Class used to store metadata from the L{ImageImportDescriptor} object.
     662
     663          @type shouldPack: bool
     664          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     665          """
     666          baseclasses.BaseStructClass.__init__(self, shouldPack)
     667
     668          self.moduleName = datatypes.String("") #: L{String} moduleName.
     669          self.numberOfImports = datatypes.DWORD(0) #: L{DWORD} numberOfImports.
     670
     671          self._attrsList = ["moduleName", "numberOfImports"]
     672
     673 -    def getType(self):
     674          """Returns L{consts.IID_METADATA}."""
     675          return consts.IID_METADATA
     676
     677 -class ImageImportDescriptorEntry(baseclasses.BaseStructClass):
     678      """ImageImportDescriptorEntry object."""
     679 -    def __init__(self, shouldPack = True):
     680          """
     681          Class representation of a C{IMAGE_IMPORT_DESCRIPTOR} structure.
     682          @see: Figure 5 U{http://msdn.microsoft.com/es-ar/magazine/bb985996%28en-us%29.aspx}
     683
     684          @type shouldPack: bool
     685          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     686          """
     687          baseclasses.BaseStructClass.__init__(self, shouldPack)
     688
     689          self.metaData = ImageImportDescriptorMetaData() #: L{ImageImportDescriptorMetaData} metaData.
     690
     691          self.originalFirstThunk = datatypes.DWORD(0) #: L{DWORD} originalFirstThunk.
     692          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
     693          self.forwarderChain = datatypes.DWORD(0) #: L{DWORD} forwarderChain.
     694          self.name = datatypes.DWORD(0) #: L{DWORD} name.
     695          self.firstThunk = datatypes.DWORD(0) #: L{DWORD} firstThunk.
     696
     697          self.iat = ImportAddressTable() #: L{ImportAddressTable} iat.
     698
     699          self._attrsList = ["originalFirstThunk", "timeDateStamp",  "forwarderChain",  "name",  "firstThunk"]
     700
     701      @staticmethod
     702 -    def parse(readDataInstance):
     703          """
     704          Returns a new L{ImageImportDescriptorEntry} object.
     705
     706          @type readDataInstance: L{ReadData}
     707          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptorEntry}.
     708
     709          @rtype: L{ImageImportDescriptorEntry}
     710          @return: A new L{ImageImportDescriptorEntry} object.
     711          """
     712          iid = ImageImportDescriptorEntry()
     713          iid.originalFirstThunk.value = readDataInstance.readDword()
     714          iid.timeDateStamp.value = readDataInstance.readDword()
     715          iid.forwarderChain.value = readDataInstance.readDword()
     716          iid.name.value = readDataInstance.readDword()
     717          iid.firstThunk.value = readDataInstance.readDword()
     718          return iid
     719
     720 -    def getType(self):
     721          """Returns C{consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY}."""
     722          return consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY
     723
     724 -class ImageImportDescriptor(list):
     725      """ImageImportDescriptor object."""
     726 -    def __init__(self, shouldPack = True):
     727          """
     728          Array of L{ImageImportDescriptorEntry} objects.
     729
     730          @type shouldPack: bool
     731          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     732          """
     733          self.shouldPack = shouldPack
     734
     735 -    def __str__(self):
     736          return ''.join([str(x) for x in self if x.shouldPack])
     737
     738 -    def getType(self):
     739          """Returns L{consts.IMAGE_IMPORT_DESCRIPTOR}."""
     740          return consts.IMAGE_IMPORT_DESCRIPTOR
     741
     742      @staticmethod
     743 -    def parse(readDataInstance,  nEntries):
     744          """
     745          Returns a new L{ImageImportDescriptor} object.
     746
     747          @type readDataInstance: L{ReadData}
     748          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptor} object.
     749
     750          @type nEntries: int
     751          @param nEntries: The number of L{ImageImportDescriptorEntry} objects in the C{readDataInstance} object.
     752
     753          @rtype: L{ImageImportDescriptor}
     754          @return: A new L{ImageImportDescriptor} object.
     755
     756          @raise DataLengthException: If not enough data to read.
     757          """
     758          importEntries = ImageImportDescriptor()
     759
     760          dataLength = len(readDataInstance)
     761          toRead = nEntries * consts.SIZEOF_IMAGE_IMPORT_ENTRY32
     762          if dataLength >= toRead:
     763              for i in range(nEntries):
     764                  importEntry = ImageImportDescriptorEntry.parse(readDataInstance)
     765                  importEntries.append(importEntry)
     766          else:
     767              raise excep.DataLengthException("Not enough bytes to read.")
     768
     769          return importEntries
     770
     771 -class ImportAddressTableEntry(baseclasses.BaseStructClass):
     772      """ImportAddressTableEntry object."""
     773 -    def __init__(self,  shouldPack = True):
     774          """
     775          A class representation of a C{} structure.
     776
     777          @type shouldPack: bool
     778          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     779          """
     780          baseclasses.BaseStructClass.__init__(self, shouldPack)
     781
     782          self.firstThunk = datatypes.DWORD(0) #: L{DWORD} firstThunk.
     783          self.originalFirstThunk = datatypes.DWORD(0) #: L{DWORD} originalFirstThunk.
     784          self.hint = datatypes.WORD(0) #: L{WORD} hint.
     785          self.name = datatypes.String("") #: L{String} name.
     786
     787          self._attrsList = ["firstThunk",  "originalFirstThunk",  "hint",  "name"]
     788
     789 -    def getType(self):
     790          """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY}."""
     791          return consts.IMPORT_ADDRESS_TABLE_ENTRY
     792
     793 -class ImportAddressTableEntry64(baseclasses.BaseStructClass):
     794      """ImportAddressTableEntry64 object."""
     795 -    def __init__(self,  shouldPack = True):
     796          """
     797          A class representation of a C{} structure.
     798
     799          @type shouldPack: bool
     800          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     801          """
     802          baseclasses.BaseStructClass.__init__(self, shouldPack)
     803
     804          self.firstThunk = datatypes.QWORD(0) #: L{QWORD} firstThunk.
     805          self.originalFirstThunk = datatypes.QWORD(0) #: L{QWORD} originalFirstThunk.
     806          self.hint = datatypes.WORD(0) #: L{WORD} hint.
     807          self.name = datatypes.String("") #: L{String} name.
     808
     809          self._attrsList = ["firstThunk",  "originalFirstThunk",  "hint",  "name"]
     810
     811 -    def getType(self):
     812          """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY64}."""
     813          return consts.IMPORT_ADDRESS_TABLE_ENTRY64
     814
     815 -class ImportAddressTable(list):
     816      """Array of L{ImportAddressTableEntry} objects."""
     817      pass
     818
     819 -class ExportTable(list):
     820      """Array of L{ExportTableEntry} objects."""
     821      pass
     822
     823 -class ExportTableEntry(baseclasses.BaseStructClass):
     824      """ExportTableEntry object."""
     825 -    def __init__(self,  shouldPack = True):
     826          """
     827          A class representation of a C{} structure.
     828
     829          @type shouldPack: bool
     830          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     831          """
     832          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     833
     834          self.ordinal = datatypes.DWORD(0) #: L{DWORD} ordinal.
     835          self.functionRva = datatypes.DWORD(0) #: L{DWORD} functionRva.
     836          self.nameOrdinal = datatypes.WORD(0) #: L{WORD} nameOrdinal.
     837          self.nameRva = datatypes.DWORD(0) #: L{DWORD} nameRva.
     838          self.name = datatypes.String("") #: L{String} name.
     839
     840          self._attrsList = ["ordinal", "functionRva",  "nameOrdinal",  "nameRva",  "name"]
     841
     842 -    def __repr__(self):
     843          return repr((self.ordinal,  self.functionRva,  self.nameOrdinal,  self.nameRva,  self.name))
     844
     845 -    def getType(self):
     846          """Returns L{consts.EXPORT_TABLE_ENTRY}."""
     847          return consts.EXPORT_TABLE_ENTRY
     848
     849      @staticmethod
     850 -    def parse(readDataInstance):
     851          """
     852          Returns a new L{ExportTableEntry} object.
     853
     854          @type readDataInstance: L{ReadData}
     855          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ExportTableEntry} object.
     856
     857          @rtype: L{ExportTableEntry}
     858          @return: A new L{ExportTableEntry} object.
     859          """
     860          exportEntry = ExportTableEntry()
     861
     862          exportEntry.functionRva.value = readDataInstance.readDword()
     863          exportEntry.nameOrdinal.value = readDataInstance.readWord()
     864          exportEntry.nameRva.value = readDataInstance.readDword()
     865          exportEntry.name.value = readDataInstance.readString()
     866          return exportEntry
     867
     868 -class ImageExportTable(baseclasses.BaseStructClass):
     869      """ImageExportTable object."""
     870 -    def __init__(self,  shouldPack = True):
     871          """
     872          Class representation of a C{IMAGE_EXPORT_DIRECTORY} structure.
     873          @see: Figure 2 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx}
     874
     875          @type shouldPack: bool
     876          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     877          """
     878          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     879
     880          self.exportTable = ExportTable()
     881
     882          self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics.
     883          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
     884          self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion.
     885          self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion.
     886          self.name = datatypes.DWORD(0) #: L{DWORD} name.
     887          self.base = datatypes.DWORD(0) #: L{DWORD} base.
     888          self.numberOfFunctions = datatypes.DWORD(0) #: L{DWORD} numberOfFunctions.
     889          self.numberOfNames = datatypes.DWORD(0) #: L{DWORD} numberOfNames.
     890          self.addressOfFunctions = datatypes.DWORD(0) #: L{DWORD} addressOfFunctions.
     891          self.addressOfNames = datatypes.DWORD(0) #: L{DWORD} addressOfNames.
     892          self.addressOfNameOrdinals = datatypes.DWORD(0) #: L{DWORD} addressOfNamesOrdinals.
     893
     894          self._attrsList = ["characteristics",  "timeDateStamp",  "majorVersion",  "minorVersion", "name",  "base",  "numberOfFunctions",\
     895                             "numberOfNames",  "addressOfFunctions",  "addressOfNames",  "addressOfNameOrdinals"]
     896
     897 -    def getType(self):
     898          """Returns L{consts.EXPORT_DIRECTORY}."""
     899          return consts.EXPORT_DIRECTORY
     900
     901      @staticmethod
     902 -    def parse(readDataInstance):
     903          """
     904          Returns a new L{ImageExportTable} object.
     905
     906          @type readDataInstance: L{ReadData}
     907          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageExportTable} object.
     908
     909          @rtype: L{ImageExportTable}
     910          @return: A new L{ImageExportTable} object.
     911          """
     912          et = ImageExportTable()
     913
     914          et.characteristics.value = readDataInstance.readDword()
     915          et.timeDateStamp.value = readDataInstance.readDword()
     916          et.majorVersion.value = readDataInstance.readWord()
     917          et.minorVersion.value = readDataInstance.readWord()
     918          et.name.value = readDataInstance.readDword()
     919          et.base.value = readDataInstance.readDword()
     920          et.numberOfFunctions.value = readDataInstance.readDword()
     921          et.numberOfNames.value = readDataInstance.readDword()
     922          et.addressOfFunctions.value = readDataInstance.readDword()
     923          et.addressOfNames.value = readDataInstance.readDword()
     924          et.addressOfNameOrdinals.value = readDataInstance.readDword()
     925          return et
     926
     927 -class NETDirectory(baseclasses.BaseStructClass):
     928      """NETDirectory object."""
     929 -    def __init__(self,  shouldPack = True):
     930          """
     931          A class to abstract data from the .NET PE format.
     932
     933          @type shouldPack: bool
     934          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     935          """
     936          baseclasses.BaseStructClass.__init__(self, shouldPack)
     937
     938          self.directory = NetDirectory() #: L{NetDirectory} directory.
     939          self.netMetaDataHeader = NetMetaDataHeader() #: L{NetMetaDataHeader} netMetaDataHeader.
     940          self.netMetaDataStreams = NetMetaDataStreams() #: L{NetMetaDataStreams} netMetaDataStreams.
     941
     942          self._attrsList = ["directory",  "netMetaDataHeader",  "netMetaDataStreams"]
     943
     944      @staticmethod
     945 -    def parse(readDataInstance):
     946          """
     947          Returns a new L{NETDirectory} object.
     948
     949          @type readDataInstance: L{ReadData}
     950          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NETDirectory} object.
     951
     952          @rtype: L{NETDirectory}
     953          @return: A new L{NETDirectory} object.
     954          """
     955          nd = NETDirectory()
     956
     957          nd.directory = NetDirectory.parse(readDataInstance)
     958          nd.netMetaDataHeader = NetMetaDataHeader.parse(readDataInstance)
     959          nd.netMetaDataStreams = NetMetaDataStreams.parse(readDataInstance)
     960          return nd
     961
     962 -    def getType(self):
     963          """Returns L{consts.NET_DIRECTORY}."""
     964          return consts.NET_DIRECTORY
     965
     966 -class NetDirectory(baseclasses.BaseStructClass):
     967      """NetDirectory object."""
     968 -    def __init__(self,  shouldPack = True):
     969          """
     970          A class representation of the C{IMAGE_COR20_HEADER} structure.
     971          @see: U{http://www.ntcore.com/files/dotnetformat.htm}
     972
     973          @type shouldPack: bool
     974          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     975          """
     976          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     977
     978          self.cb = datatypes.DWORD(0) #: L{DWORD} cb.
     979          self.majorRuntimeVersion = datatypes.WORD(0) #: L{WORD} majorRuntimeVersion.
     980          self.minorRuntimeVersion = datatypes.WORD(0) #: L{WORD} minorRuntimeVersion.
     981          self.metaData = datadirs.Directory() #: L{Directory} metaData.
     982          self.flags = datatypes.DWORD(0) #: L{DWORD} flags.
     983          self.entryPointToken = datatypes.DWORD(0) #: L{DWORD} entryPointToken.
     984          self.resources = datadirs.Directory() #: L{Directory} resources.
     985          self.strongNameSignature = datadirs.Directory() #: L{Directory} strongNameSignature.
     986          self.codeManagerTable = datadirs.Directory() #: L{Directory} codeManagerTable.
     987          self.vTableFixups = datadirs.Directory() #: L{Directory} vTableFixups.
     988          self.exportAddressTableJumps = datadirs.Directory() #: L{Directory} exportAddressTableJumps.
     989          self.managedNativeHeader = datadirs.Directory() #: L{Directory} managedNativeHeader.
     990
     991          self._attrsList = ["cb","majorRuntimeVersion","minorRuntimeVersion","metaData", \
     992          "flags","entryPointToken","resources","strongNameSignature",\
     993          "codeManagerTable","vTableFixups", "exportAddressTableJumps",\
     994          "managedNativeHeader"]
     995
     996 -    def getType(self):
     997          """Returns L{consts.IMAGE_COR20_HEADER}."""
     998          return consts.IMAGE_COR20_HEADER
     999
    1000      @staticmethod
    1001 -    def parse(readDataInstance):
    1002          """
    1003          Returns a new L{NetDirectory} object.
    1004
    1005          @type readDataInstance: L{ReadData}
    1006          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetDirectory} object.
    1007
    1008          @rtype: L{NetDirectory}
    1009          @return: A new L{NetDirectory} object.
    1010          """
    1011          nd = NetDirectory()
    1012
    1013          nd.cb.value = readDataInstance.readDword()
    1014          nd.majorRuntimeVersion.value= readDataInstance.readWord()
    1015          nd.minorRuntimeVersion.value = readDataInstance.readWord()
    1016
    1017          nd.metaData.rva.value = readDataInstance.readDword()
    1018          nd.metaData.size.value = readDataInstance.readDword()
    1019          nd.metaData.name.value = "MetaData"
    1020
    1021          nd.flags.value = readDataInstance.readDword()
    1022          nd.entryPointToken.value = readDataInstance.readDword()
    1023
    1024          nd.resources.rva.value = readDataInstance.readDword()
    1025          nd.resources.size.value = readDataInstance.readDword()
    1026          nd.resources.name.value = "Resources"
    1027
    1028          nd.strongNameSignature.rva.value = readDataInstance.readDword()
    1029          nd.strongNameSignature.size.value = readDataInstance.readDword()
    1030          nd.strongNameSignature.name.value = "StrongNameSignature"
    1031
    1032          nd.codeManagerTable.rva.value = readDataInstance.readDword()
    1033          nd.codeManagerTable.size.value = readDataInstance.readDword()
    1034          nd.codeManagerTable.name.value = "CodeManagerTable"
    1035
    1036          nd.vTableFixups.rva.value = readDataInstance.readDword()
    1037          nd.vTableFixups.size.value = readDataInstance.readDword()
    1038          nd.vTableFixups.name.value = "VTableFixups"
    1039
    1040          nd.exportAddressTableJumps.rva.value = readDataInstance.readDword()
    1041          nd.exportAddressTableJumps.size.value = readDataInstance.readDword()
    1042          nd.exportAddressTableJumps.name.value = "ExportAddressTableJumps"
    1043
    1044          nd.managedNativeHeader.rva.value = readDataInstance.readDword()
    1045          nd.managedNativeHeader.size.value = readDataInstance.readDword()
    1046          nd.managedNativeHeader.name.value = "ManagedNativeHeader"
    1047
    1048          return nd
    1049
    1050 -class NetMetaDataHeader(baseclasses.BaseStructClass):
    1051      """NetMetaDataHeader object."""
    1052 -    def __init__(self,  shouldPack = True):
    1053          baseclasses.BaseStructClass.__init__(self,  shouldPack)
    1054
    1055          self.signature = datatypes.DWORD(0) #: L{DWORD} signature.
    1056          self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion.
    1057          self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion.
    1058          self.reserved = datatypes.DWORD(0) #: L{DWORD} reserved.
    1059          self.versionLength = datatypes.DWORD(0) #: L{DWORD} versionLength.
    1060          self.versionString = datatypes.AlignedString("") #: L{AlignedString} versionString.
    1061          self.flags = datatypes.WORD(0) #: L{WORD} flags.
    1062          self.numberOfStreams = datatypes.WORD(0) #: L{WORD} numberOfStreams.
    1063
    1064          self._attrsList = ["signature","majorVersion","minorVersion","reserved","versionLength","versionString","flags","numberOfStreams"]
    1065
    1066 -    def getType(self):
    1067          """Returns L{consts.NET_METADATA_HEADER}."""
    1068          return consts.NET_METADATA_HEADER
    1069
    1070      @staticmethod
    1071 -    def parse(readDataInstance):
    1072          """
    1073          Returns a new L{NetMetaDataHeader} object.
    1074
    1075          @type readDataInstance: L{ReadData}
    1076          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataHeader} object.
    1077
    1078          @rtype: L{NetMetaDataHeader}
    1079          @return: A new L{NetMetaDataHeader} object.
    1080          """
    1081          nmh = NetMetaDataHeader()
    1082
    1083          nmh.signature.value = readDataInstance.readDword()
    1084          nmh.majorVersion.value = readDataInstance.readWord()
    1085          nmh.minorVersion.value = readDataInstance.readWord()
    1086          nmh.reserved.value = readDataInstance.readDword()
    1087          nmh.versionLength.value = readDataInstance.readDword()
    1088          nmh.versionString.value = readDataInstance.readAlignedString()
    1089          nmh.flags.value = readDataInstance.readWord()
    1090          nmh.numberOfStreams.value = readDataInstance.readWord()
    1091          return nmh
    1092
    1093 -class NetMetaDataStreamEntry(baseclasses.BaseStructClass):
    1094      """NetMetaDataStreamEntry object."""
    1095 -    def __init__(self,  shouldPack = True):
    1096          baseclasses.BaseStructClass.__init__(self,  shouldPack)
    1097
    1098          self.offset = datatypes.DWORD(0) #: L{DWORD} offset.
    1099          self.size = datatypes.DWORD(0) #: L{DWORD} size.
    1100          # this must be aligned to the next 4-byte boundary
    1101          self.name = datatypes.AlignedString("") #: L{AlignedString} name.
    1102          # the "info" attribute does not belong to the NETMetaDataStreamEntry struct. It is just a place holder where the
    1103          # data for every entry will be stored.
    1104          self.info = None
    1105
    1106          self._attrsList = ["offset",  "size",  "name",  "info"]
    1107
    1108 -    def getType(self):
    1109          """Returns L{consts.NET_METADATA_STREAM_ENTRY}."""
    1110          return consts.NET_METADATA_STREAM_ENTRY
    1111
    1112      @staticmethod
    1113 -    def parse(readDataInstance):
    1114          """
    1115          Returns a new L{NetMetaDataStreamEntry} object.
    1116
    1117          @type readDataInstance: L{ReadData}
    1118          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataStreamEntry}.
    1119
    1120          @rtype: L{NetMetaDataStreamEntry}
    1121          @return: A new L{NetMetaDataStreamEntry} object.
    1122          """
    1123          n = NetMetaDataStreamEntry()
    1124          n.offset.value = readDataInstance.readDword()
    1125          n.size.value = readDataInstance.readDword()
    1126          n.name.value = readDataInstance.readAlignedString()
    1127          return n
    1128
    1129 -class NetMetaDataStreams(dict):
    1130      """NetMetaDataStreams object."""
    1131 -    def __init__(self,  shouldPack = True):
    1132          self.shouldPack = shouldPack
    1133
    1134 -    def __str__(self):
    1135          return "".join([str(x) for x in self if hasattr(x, "shouldPack") and x.shouldPack])
    1136
    1137 -    def getByNumber(self, number):
    1138          return self.get(name)
    1139
    1140 -    def getByName(self, name):
    1141          return self.get(name)
    1142
    1143 -    def getType(self):
    1144          """Returns L{consts.NET_METADATA_STREAMS}."""
    1145          return consts.NET_METADATA_STREAMS
    1146
    1147      @staticmethod
    1148 -    def parse(readDataInstance,  nStreams):
    1149          """
    1150          Returns a new L{NetMetaDataStreams} object.
    1151
    1152          @type readDataInstance: L{ReadData}
    1153          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataStreams} object.
    1154
    1155          @type nStreams: int
    1156          @param nStreams: The number of L{NetMetaDataStreamEntry} objects in the C{readDataInstance} object.
    1157
    1158          @rtype: L{NetMetaDataStreams}
    1159          @return: A new L{NetMetaDataStreams} object.
    1160          """
    1161          streams = NetMetaDataStreams()
    1162
    1163          for i in range(nStreams):
    1164              streamEntry = NetMetaDataStreamEntry()
    1165
    1166              streamEntry.offset.value = readDataInstance.readDword()
    1167              streamEntry.size.value = readDataInstance.readDword()
    1168              streamEntry.name.value = readDataInstance.readAlignedString()
    1169
    1170              #streams.append(streamEntry)
    1171              streams.update({ i: streamEntry, streamEntry.name.value: streamEntry })
    1172
    1173          return streams
    1174
    1175 -class NetMetaDataTableHeader(baseclasses.BaseStructClass):
    1176      """NetMetaDataTableHeader object."""
    1177 -    def __init__(self,  shouldPack = True):
    1178          baseclasses.BaseStructClass.__init__(self,  shouldPack)
    1179
    1180          self.reserved_1 = datatypes.DWORD(0) #: L{DWORD} reserved_1.
    1181          self.majorVersion = datatypes.BYTE(0) #: L{BYTE} majorVersion.
    1182          self.minorVersion = datatypes.BYTE(0) #: L{BYTE} minorVersion.
    1183          self.heapOffsetSizes = datatypes.BYTE(0) #: L{BYTE} heapOffsetSizes.
    1184          self.reserved_2 = datatypes.BYTE(0) #: L{BYTE} reserved_2.
    1185          self.maskValid = datatypes.QWORD(0) #: L{QWORD} maskValid.
    1186          self.maskSorted = datatypes.QWORD(0) #: L{QWORD} maskSorted.
    1187
    1188          self._attrsList = ["reserved_1",  "majorVersion",  "minorVersion",  "heapOffsetSizes",  "reserved_2",  "maskValid",  "maskSorted"]
    1189
    1190 -    def getType(self):
    1191          """Returns L{consts.NET_METADATA_TABLE_HEADER}."""
    1192          return consts.NET_METADATA_TABLE_HEADER
    1193
    1194      @staticmethod
    1195 -    def parse(readDataInstance):
    1196          """
    1197          Returns a new L{NetMetaDataTableHeader} object.
    1198
    1199          @type readDataInstance: L{ReadData}
    1200          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataTableHeader} object.
    1201
    1202          @rtype: L{NetMetaDataTableHeader}
    1203          @return: A new L{NetMetaDataTableHeader} object.
    1204          """
    1205          th = NetMetaDataTableHeader()
    1206
    1207          th.reserved_1.value = readDataInstance.readDword()
    1208          th.majorVersion.value = readDataInstance.readByte()
    1209          th.minorVersion.value = readDataInstance.readByte()
    1210          th.heapOffsetSizes.value = readDataInstance.readByte()
    1211          th.reserved_2.value = readDataInstance.readByte()
    1212          th.maskValid.value = readDataInstance.readQword()
    1213          th.maskSorted.value = readDataInstance.readQword()
    1214
    1215          return th
    1216
    1217 -class NetMetaDataTables(baseclasses.BaseStructClass):
    1218      """NetMetaDataTables object."""
    1219 -    def __init__(self,  shouldPack = True):
    1220          """
    1221          NetMetaDataTables object.
    1222
    1223          @todo: Parse every table in this struct and store them in the C{self.tables} attribute.
    1224          """
    1225          baseclasses.BaseStructClass.__init__(self,  shouldPack)
    1226
    1227          self.netMetaDataTableHeader = NetMetaDataTableHeader() #: L{NetMetaDataTableHeader} netMetaDataTableHeader.
    1228          self.tables = None #: C{str} tables.
    1229
    1230          self._attrsList = ["netMetaDataTableHeader",  "tables"]
    1231
    1232 -    def getType(self):
    1233          """Returns L{consts.NET_METADATA_TABLES}."""
    1234          return consts.NET_METADATA_TABLES
    1235
    1236      @staticmethod
    1237 -    def parse(readDataInstance, netMetaDataStreams):
    1238          """
    1239          Returns a new L{NetMetaDataTables} object.
    1240
    1241          @type readDataInstance: L{ReadData}
    1242          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataTables} object.
    1243
    1244          @rtype: L{NetMetaDataTables}
    1245          @return: A new L{NetMetaDataTables} object.
    1246          """
    1247          dt = NetMetaDataTables()
    1248          dt.netMetaDataTableHeader = NetMetaDataTableHeader.parse(readDataInstance)
    1249          dt.tables = {}
    1250
    1251          metadataTableDefinitions = dotnet.MetadataTableDefinitions(dt, netMetaDataStreams)
    1252
    1253          for i in xrange(64):
    1254              dt.tables[i] = { "rows": 0 }
    1255              if dt.netMetaDataTableHeader.maskValid.value >> i & 1:
    1256                  dt.tables[i]["rows"] = readDataInstance.readDword()
    1257              if i in dotnet.MetadataTableNames:
    1258                  dt.tables[dotnet.MetadataTableNames[i]] = dt.tables[i]
    1259
    1260          for i in xrange(64):
    1261              dt.tables[i]["data"] = []
    1262              for j in range(dt.tables[i]["rows"]):
    1263                  row = None
    1264                  if i in metadataTableDefinitions:
    1265                      row = readDataInstance.readFields(metadataTableDefinitions[i])
    1266                  dt.tables[i]["data"].append(row)
    1267
    1268          for i in xrange(64):
    1269              if i in dotnet.MetadataTableNames:
    1270                  dt.tables[dotnet.MetadataTableNames[i]] = dt.tables[i]["data"]
    1271              dt.tables[i] = dt.tables[i]["data"]
    1272
    1273          return dt
    1274
    1275 -class NetResources(baseclasses.BaseStructClass):
    1276      """NetResources object."""
    1277 -    def __init__(self,  shouldPack = True):
    1278          """
    1279          NetResources object.
    1280
    1281          @todo: Parse every resource in this struct and store them in the C{self.resources} attribute.
    1282          """
    1283          baseclasses.BaseStructClass.__init__(self,  shouldPack)
    1284
    1285          self.signature = datatypes.DWORD(0)
    1286          self.readerCount = datatypes.DWORD(0)
    1287          self.readerTypeLength = datatypes.DWORD(0)
    1288          self.version = datatypes.DWORD(0)
    1289          self.resourceCount = datatypes.DWORD(0)
    1290          self.resourceTypeCount = datatypes.DWORD(0)
    1291          self.resourceTypes = None
    1292          self.resourceHashes = None
    1293          self.resourceNameOffsets = None
    1294          self.dataSectionOffset = datatypes.DWORD(0)
    1295          self.resourceNames = None
    1296          self.resourceOffsets = None
    1297          self.info = None
    1298
    1299          self._attrsList = ["signature", "readerCount", "readerTypeLength", "version", "resourceCount", "resourceTypeCount", "resourceTypes", "resourceHashes", "resourceNameOffsets", "dataSectionOffset", "resourceNames", "resourceOffets", "info"]
    1300
    1301 -    def __str__(self):
    1302          return str(self.info)
    1303
    1304 -    def __repr__(self):
    1305          return repr(self.info)
    1306
    1307 -    def getType(self):
    1308          """Returns L{consts.NET_RESOURCES}."""
    1309          return consts.NET_RESOURCES
    1310
    1311      @staticmethod
    1312 -    def parse(readDataInstance):
    1313          """
    1314          Returns a new L{NetResources} object.
    1315
    1316          @type readDataInstance: L{ReadData}
    1317          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetResources} object.
    1318
    1319          @rtype: L{NetResources}
    1320          @return: A new L{NetResources} object.
    1321          """
    1322          r = NetResources()
    1323
    1324          r.signature = readDataInstance.readDword()
    1325          if r.signature != 0xbeefcace:
    1326              return r
    1327
    1328          r.readerCount = readDataInstance.readDword()
    1329          r.readerTypeLength = readDataInstance.readDword()
    1330          r.readerType = utils.ReadData(readDataInstance.read(r.readerTypeLength)).readDotNetBlob()
    1331          r.version = readDataInstance.readDword()
    1332          r.resourceCount = readDataInstance.readDword()
    1333          r.resourceTypeCount = readDataInstance.readDword()
    1334
    1335          r.resourceTypes = []
    1336          for i in xrange(r.resourceTypeCount):
    1337              r.resourceTypes.append(readDataInstance.readDotNetBlob())
    1338
    1339          # aligned to 8 bytes
    1340          readDataInstance.skipBytes(8 - readDataInstance.tell() & 0x7)
    1341
    1342          r.resourceHashes = []
    1343          for i in xrange(r.resourceCount):
    1344              r.resourceHashes.append(readDataInstance.readDword())
    1345
    1346          r.resourceNameOffsets = []
    1347          for i in xrange(r.resourceCount):
    1348              r.resourceNameOffsets.append(readDataInstance.readDword())
    1349
    1350          r.dataSectionOffset = readDataInstance.readDword()
    1351
    1352          r.resourceNames = []
    1353          r.resourceOffsets = []
    1354          base = readDataInstance.tell()
    1355          for i in xrange(r.resourceCount):
    1356              readDataInstance.setOffset(base + r.resourceNameOffsets[i])
    1357              r.resourceNames.append(readDataInstance.readDotNetUnicodeString())
    1358              r.resourceOffsets.append(readDataInstance.readDword())
    1359
    1360          r.info = {}
    1361          for i in xrange(r.resourceCount):
    1362              readDataInstance.setOffset(r.dataSectionOffset + r.resourceOffsets[i])
    1363              r.info[i] = readDataInstance.read(len(readDataInstance))
    1364              r.info[r.resourceNames[i]] = r.info[i]
    1365
    1366          return r
    1367