Package pype32 :: Module directories |
[hide private]
[frames] | no frames]

# Source Code for Module pype32.directories

       1  #!/usr/bin/python
       2  # -*- coding: utf-8 -*-
       3
       4  # Copyright (c) 2013, Nahuel Riva
       5  # All rights reserved.
       6  #
       7  # Redistribution and use in source and binary forms, with or without
       8  # modification, are permitted provided that the following conditions are met:
       9  #
      10  #     * Redistributions of source code must retain the above copyright notice,
      11  #       this list of conditions and the following disclaimer.
      12  #     * Redistributions in binary form must reproduce the above copyright
      13  #       notice,this list of conditions and the following disclaimer in the
      14  #       documentation and/or other materials provided with the distribution.
      15  #     * Neither the name of the copyright holder nor the names of its
      16  #       contributors may be used to endorse or promote products derived from
      17  #       this software without specific prior written permission.
      18  #
      19  # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
      20  # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
      21  # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
      22  # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
      23  # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
      24  # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
      25  # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
      26  # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
      27  # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
      28  # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
      29  # POSSIBILITY OF SUCH DAMAGE.
      30
      31  """
      32  PE directory classes.
      33  """
      34
      35  __revision__ = "$Id$"
      36
      37  import datatypes
      38  import consts
      39  import datadirs
      40  import excep
      41  import utils
      42  import baseclasses
      43
      44  # typedef struct IMAGE_BOUND_FORWARDER_REF
      45  # {
      46  #    DWORD   TimeDateStamp;
      47  #    WORD    OffsetModuleName;
      48  #    WORD    Reserved;
      49  # }
      50 -class ImageBoundForwarderRefEntry(baseclasses.BaseStructClass):
      51      """ImageBoundForwarderRefEntry object."""
      52 -    def __init__(self,  shouldPack = True):
      53          """
      54          This class represents an element of type C{IMAGE_BOUND_FORWARDER_REF}.
      55          @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
      56
      57          @type shouldPack: bool
      58          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
      59          """
      60          baseclasses.BaseStructClass.__init__(self,  shouldPack)
      61
      62          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
      63          self.offsetModuleName = datatypes.WORD(0) #: L{WORD} offsetModuleName.
      64          self.reserved = datatypes.WORD(0) #: L{WORD} reserved.
      65          self.moduleName = datatypes.String(shouldPack = False) #: moduleName is metadata, not part of the structure.
      66
      67          self._attrsList = ["timeDateStamp",  "offsetModuleName",  "reserved",  "moduleName"]
      68
      69 -    def getType(self):
      70          """Returns L{consts.IMAGE_BOUND_FORWARDER_REF_ENTRY}."""
      71          return consts.IMAGE_BOUND_FORWARDER_REF_ENTRY
      72
      73      @staticmethod
      74 -    def parse(readDataInstance):
      75          """
      76          Returns a new L{ImageBoundForwarderRefEntry} object.
      77
      78          @type readDataInstance: L{ReadData}
      79          @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRefEntry} object.
      80
      81          @rtype: L{ImageBoundForwarderRefEntry}
      82          @return: A new L{ImageBoundForwarderRefEntry} object.
      83          """
      84          boundForwarderEntry = ImageBoundForwarderRefEntry()
      85          boundForwarderEntry.timeDateStamp.value = readDataInstance.readDword()
      86          boundForwarderEntry.offsetModuleName.value = readDataInstance.readWord()
      87          boundForwarderEntry.reserved.value = readDataInstance.readWord()
      88          return boundForwarderEntry
      89
      90 -class ImageBoundForwarderRef(list):
      91      """ImageBoundForwarderRef array object."""
      92 -    def __init__(self, shouldPack = True):
      93          """
      94          This class is a wrapper over an array of C{IMAGE_BOUND_FORWARDER_REF}.
      95
      96          @type shouldPack: bool
      97          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
      98          """
      99          list.__init__(self)
     100          self.shouldPack = shouldPack
     101
     102 -    def __str__(self):
     103          return ''.join([str(x) for x in self if x.shouldPack])
     104
     105      @staticmethod
     106 -    def parse(readDataInstance,  numberOfEntries):
     107          """
     108          Returns a L{ImageBoundForwarderRef} array where every element is a L{ImageBoundForwarderRefEntry} object.
     109
     110          @type readDataInstance: L{ReadData}
     111          @param readDataInstance: A L{ReadData} object with the corresponding data to generate a new L{ImageBoundForwarderRef} object.
     112
     113          @type numberOfEntries: int
     114          @param numberOfEntries: The number of C{IMAGE_BOUND_FORWARDER_REF} entries in the array.
     115
     116          @rtype: L{ImageBoundForwarderRef}
     117          @return: A new L{ImageBoundForwarderRef} object.
     118
     119          @raise DataLengthException: If the L{ReadData} instance has less data than C{NumberOfEntries} * sizeof L{ImageBoundForwarderRefEntry}.
     120          """
     121          imageBoundForwarderRefsList = ImageBoundForwarderRef()
     122          dLength = len(readDataInstance)
     123          entryLength = ImageBoundForwarderRefEntry().sizeof()
     124          toRead = numberOfEntries * entryLength
     125
     126          if dLength >= toRead:
     127              for i in range(numberOfEntries):
     128                  entryData = readDataInstance.read(entryLength)
     129                  rd = utils.ReadData(entryData)
     130                  imageBoundForwarderRefsList.append(ImageBoundForwarderRefEntry.parse(rd))
     131          else:
     132              raise excep.DataLengthException("Not enough bytes to read.")
     133
     134          return imageBoundForwarderRefsList
     135
     136 -class ImageBoundImportDescriptor(list):
     137      """ImageBoundImportDescriptor object."""
     138 -    def __init__(self, shouldPack = True):
     139          """
     140          Array of L{ImageBoundImportDescriptorEntry} objects.
     141
     142          @type shouldPack: bool
     143          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     144          """
     145          list.__init__(self)
     146          self.shouldPack = shouldPack
     147
     148 -    def __str__(self):
     149          return ''.join([str(x) for x in self if x.shouldPack])
     150
     151      @staticmethod
     152 -    def parse(readDataInstance):
     153          """
     154          Returns a new L{ImageBoundImportDescriptor} object.
     155
     156          @type readDataInstance: L{ReadData}
     157          @param readDataInstance: A L{ReadData} object containing the data to create a new L{ImageBoundImportDescriptor} object.
     158
     159          @rtype: L{ImageBoundImportDescriptor}
     160          @return: A new {ImageBoundImportDescriptor} object.
     161          """
     162          ibd = ImageBoundImportDescriptor()
     163
     164          entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32)
     165          readDataInstance.offset = 0
     166          while not utils.allZero(entryData):
     167              prevOffset = readDataInstance.offset
     168
     169              boundEntry = ImageBoundImportDescriptorEntry.parse(readDataInstance)
     170
     171              # if the parsed entry has numberOfModuleForwarderRefs we must adjust the value in the readDataInstance.offset field
     172              # in order to point after the last ImageBoundForwarderRefEntry.
     173              if boundEntry.numberOfModuleForwarderRefs.value:
     174                  readDataInstance.offset = prevOffset + (consts.SIZEOF_IMAGE_BOUND_FORWARDER_REF_ENTRY32 * boundEntry.numberOfModuleForwarderRefs.value)
     175              else:
     176                  readDataInstance.offset = prevOffset
     177
     178              ibd.append(boundEntry)
     179              entryData = readDataInstance.read(consts.SIZEOF_IMAGE_BOUND_IMPORT_ENTRY32)
     180
     181          return ibd
     182
     183  # typedef struct IMAGE_BOUND_IMPORT_DESCRIPTOR
     184  # {
     185  #    DWORD   TimeDateStamp;
     186  #    WORD    OffsetModuleName;
     187  #    WORD    NumberOfModuleForwarderRefs;
     188  # }
     189 -class ImageBoundImportDescriptorEntry(baseclasses.BaseStructClass):
     190      """ImageBoundImportDescriptorEntry object."""
     191 -    def __init__(self,  shouldPack = True):
     192          """
     193          This class represents a C{IMAGE_BOUND_IMPORT_DESCRIPTOR} structure.
     194          @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
     195
     196          @type shouldPack: bool
     197          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     198          """
     199          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     200
     201          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
     202          self.offsetModuleName = datatypes.WORD(0) #: L{WORD} offsetModuleName.
     203          self.numberOfModuleForwarderRefs = datatypes.WORD(0)#: L{WORD} numberOfModuleForwarderRefs.
     204          self.forwarderRefsList = ImageBoundForwarderRef() #: L{ImageBoundForwarderRef} forwarderRefsList.
     205          self.moduleName = datatypes.String(shouldPack = False) #: moduleName is metadata, not part of the structure.
     206
     207          self._attrsList = ["timeDateStamp",  "offsetModuleName",  "numberOfModuleForwarderRefs",  "forwarderRefsList",  "moduleName"]
     208
     209 -    def getType(self):
     210          """Returns L{consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY}"""
     211          return consts.IMAGE_BOUND_IMPORT_DESCRIPTOR_ENTRY
     212
     213      @staticmethod
     214 -    def parse(readDataInstance):
     215          """
     216          Returns a new L{ImageBoundImportDescriptorEntry} object.
     217
     218          @type readDataInstance: L{ReadData}
     219          @param readDataInstance: A L{ReadData} object containing data to create a new L{ImageBoundImportDescriptorEntry}.
     220
     221          @rtype: L{ImageBoundImportDescriptorEntry}
     222          @return: A new {ImageBoundImportDescriptorEntry} object.
     223          """
     224          boundEntry = ImageBoundImportDescriptorEntry()
     225          boundEntry.timeDateStamp.value = readDataInstance.readDword()
     226          boundEntry.offsetModuleName.value = readDataInstance.readWord()
     227          boundEntry.numberOfModuleForwarderRefs .value = readDataInstance.readWord()
     228
     229          numberOfForwarderRefsEntries = boundEntry.numberOfModuleForwarderRefs .value
     230          if numberOfForwarderRefsEntries:
     231              bytesToRead = numberOfForwarderRefsEntries * ImageBoundForwarderRefEntry().sizeof()
     232              rd = utils.ReadData(readDataInstance.read(bytesToRead))
     233              boundEntry.forwarderRefsList = ImageBoundForwarderRef.parse(rd,  numberOfForwarderRefsEntries)
     234
     235          return boundEntry
     236
     237 -class TLSDirectory(baseclasses.BaseStructClass):
     238      """TLS directory object."""
     239 -    def __init__(self, shouldPack = True):
     240          """
     241          Class representation of a C{IMAGE_TLS_DIRECTORY} structure.
     242
     243          @see: Figure 11 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx}
     244
     245          @type shouldPack: bool
     246          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     247          """
     248          baseclasses.BaseStructClass.__init__(self, shouldPack)
     249
     250          self.startAddressOfRawData = datatypes.DWORD(0) #: L{DWORD} startAddressOfRawData.
     251          self.endAddressOfRawData = datatypes.DWORD(0) #: L{DWORD} endAddressOfRawData.
     252          self.addressOfIndex = datatypes.DWORD(0) #: L{DWORD} addressOfIndex.
     253          self.addressOfCallbacks = datatypes.DWORD(0) #: L{DWORD} addressOfCallbacks.
     254          self.sizeOfZeroFill = datatypes.DWORD(0) #: L{DWORD} sizeOfZeroFill.
     255          self.characteristics = datatypes.DWORD(0) #:L{DWORD} characteristics.
     256
     257          self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\
     258                             "sizeOfZeroFill", "characteristics"]
     259
     260 -    def getType(self):
     261          """Returns L{consts.TLS_DIRECTORY}."""
     262          return consts.TLS_DIRECTORY32
     263
     264      @staticmethod
     265 -    def parse(readDataInstance):
     266          """
     267          Returns a new L{TLSDirectory} object.
     268
     269          @type readDataInstance: L{ReadData}
     270          @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory} object.
     271
     272          @rtype: L{TLSDirectory}
     273          @return: A new {TLSDirectory} object.
     274          """
     275          tlsDir = TLSDirectory()
     276
     277          tlsDir.startAddressOfRawData.value = readDataInstance.readDword()
     278          tlsDir.endAddressOfRawData.value = readDataInstance.readDword()
     279          tlsDir.addressOfIndex.value = readDataInstance.readDword()
     280          tlsDir.addressOfCallbacks.value = readDataInstance.readDword()
     281          tlsDir.sizeOfZeroFill.value = readDataInstance.readDword()
     282          tlsDir.characteristics.value = readDataInstance.readDword()
     283          return tlsDir
     284
     285 -class TLSDirectory64(baseclasses.BaseStructClass):
     286      """TLSDirectory64 object."""
     287 -    def __init__(self,  shouldPack = True):
     288          """
     289          Class representation of a C{IMAGE_TLS_DIRECTORY} structure in 64 bits systems.
     290
     291          @type shouldPack: bool
     292          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     293          """
     294          baseclasses.BaseStructClass.__init__(self, shouldPack)
     295
     296          self.startAddressOfRawData = datatypes.QWORD(0) #: L{QWORD} startAddressOfRawData.
     297          self.endAddressOfRawData = datatypes.QWORD(0) #: L{QWORD} endAddressOfRawData.
     298          self.addressOfIndex = datatypes.QWORD(0) #: L{QWORD} addressOfIndex.
     299          self.addressOfCallbacks = datatypes.QWORD(0) #: L{QWORD} addressOfCallbacks.
     300          self.sizeOfZeroFill = datatypes.DWORD(0) #: L{DWORD} sizeOfZeroFill.
     301          self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics.
     302
     303          self._attrsList = ["startAddressOfRawData", "endAddressOfRawData", "addressOfIndex", "addressOfCallbacks",\
     304                             "sizeOfZeroFill", "characteristics"]
     305
     306 -    def getType(self):
     307          """Returns L{consts.TLS_DIRECTORY64}."""
     308          return consts.TLS_DIRECTORY64
     309
     310      @staticmethod
     311 -    def parse(readDataInstance):
     312          """
     313          Returns a new L{TLSDirectory64} object.
     314
     315          @type readDataInstance: L{ReadData}
     316          @param readDataInstance: A L{ReadData} object containing data to create a new L{TLSDirectory64} object.
     317
     318          @rtype: L{TLSDirectory64}
     319          @return: A new L{TLSDirectory64} object.
     320          """
     321          tlsDir = TLSDirectory64()
     322
     323          tlsDir.startAddressOfRawData.value = readDataInstance.readQword()
     324          tlsDir.endAddressOfRawData.value = readDataInstance.readQword()
     325          tlsDir.addressOfIndex.value = readDataInstance.readQword()
     326          tlsDir.addressOfCallbacks.value = readDataInstance.readQword()
     327          tlsDir.sizeOfZeroFill.value = readDataInstance.readDword()
     328          tlsDir.characteristics.value = readDataInstance.readDword()
     329          return tlsDir
     330
     331 -class ImageBaseRelocationEntry(baseclasses.BaseStructClass):
     332      """ImageBaseRelocationEntry object."""
     333 -    def __init__(self,  shouldPack = True):
     334          """
     335          A class representation of a C{IMAGE_BASE_RELOCATION} structure.
     336          @see: U{http://msdn.microsoft.com/en-us/magazine/cc301808.aspx}
     337
     338          @type shouldPack: bool
     339          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     340          """
     341          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     342
     343          self.virtualAddress = datatypes.DWORD(0) #: L{DWORD} virtualAddress.
     344          self.sizeOfBlock = datatypes.DWORD(0) #: L{DWORD} sizeOfBlock
     345          self.items = datatypes.Array(datatypes.TYPE_WORD) #: L{Array} items.
     346
     347          self._attrsList = ["virtualAddress", "sizeOfBlock", "items"]
     348
     349 -    def getType(self):
     350          """Returns L{consts.IMAGE_BASE_RELOCATION_ENTRY}."""
     351          return consts.IMAGE_BASE_RELOCATION_ENTRY
     352
     353      @staticmethod
     354 -    def parse(readDataInstance):
     355          """
     356          Returns a new L{ImageBaseRelocationEntry} object.
     357
     358          @type readDataInstance: L{ReadData}
     359          @param readDataInstance: A L{ReadData} object with data to parse as a L{ImageBaseRelocationEntry} object.
     360
     361          @rtype: L{ImageBaseRelocationEntry}
     362          @return: A new L{ImageBaseRelocationEntry} object.
     363          """
     364          reloc = ImageBaseRelocationEntry()
     365          reloc.virtualAddress.value = readDataInstance.readDword()
     366          reloc.sizeOfBlock.value = readDataInstance.readDword()
     367          toRead = (reloc.sizeOfBlock.value - 8) / len(datatypes.WORD(0))
     368          reloc.items = datatypes.Array.parse(readDataInstance,  datatypes.TYPE_WORD,  toRead)
     369          return reloc
     370
     371 -class ImageBaseRelocation(list):
     372      """ImageBaseRelocation array."""
     373      pass
     374
     375 -class ImageDebugDirectory(baseclasses.BaseStructClass):
     376      """ImageDebugDirectory object."""
     377 -    def __init__(self,  shouldPack = True):
     378          """
     379          Class representation of a C{IMAGE_DEBUG_DIRECTORY} structure.
     380          @see: U{http://msdn.microsoft.com/es-es/library/windows/desktop/ms680307%28v=vs.85%29.aspx}
     381
     382          @type shouldPack: bool
     383          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     384          """
     385          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     386
     387          self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics.
     388          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
     389          self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion.
     390          self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion.
     391          self.type = datatypes.DWORD(0) #: L{DWORD} type.
     392          self.sizeOfData = datatypes.DWORD(0) #: L{DWORD} sizeOfData.
     393          self.addressOfData = datatypes.DWORD(0) #: L{DWORD} addressOfData.
     394          self.pointerToRawData = datatypes.DWORD(0) #: L{DWORD} pointerToRawData.
     395
     396          self._attrsList = ["characteristics",  "timeDateStamp",  "majorVersion",  "minorVersion",  "type",  "sizeOfData",\
     397                             "addressOfData",  "pointerToRawData"]
     398
     399 -    def getType(self):
     400          """Returns L{consts.IMAGE_DEBUG_DIRECTORY}."""
     401          return consts.IMAGE_DEBUG_DIRECTORY
     402
     403      @staticmethod
     404 -    def parse(readDataInstance):
     405          """
     406          Returns a new L{ImageDebugDirectory} object.
     407
     408          @type readDataInstance: L{ReadData}
     409          @param readDataInstance: A new L{ReadData} object with data to be parsed as a L{ImageDebugDirectory} object.
     410
     411          @rtype: L{ImageDebugDirectory}
     412          @return: A new L{ImageDebugDirectory} object.
     413          """
     414          dbgDir = ImageDebugDirectory()
     415
     416          dbgDir.characteristics.value = readDataInstance.readDword()
     417          dbgDir.timeDateStamp.value = readDataInstance.readDword()
     418          dbgDir.majorVersion.value = readDataInstance.readWord()
     419          dbgDir.minorVersion.value = readDataInstance.readWord()
     420          dbgDir.type.value = readDataInstance.readDword()
     421          dbgDir.sizeOfData.value = readDataInstance.readDword()
     422          dbgDir.addressOfData.value = readDataInstance.readDword()
     423          dbgDir.pointerToRawData.value = readDataInstance.readDword()
     424
     425          return dbgDir
     426
     427 -class ImageDebugDirectories(list):
     428      """ImageDebugDirectories object."""
     429 -    def __init__(self,  shouldPack = True):
     430          """
     431          Array of L{ImageDebugDirectory} objects.
     432
     433          @type shouldPack: bool
     434          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     435          """
     436          self.shouldPack = shouldPack
     437
     438 -    def __str__(self):
     439          return ''.join([str(x) for x in self if self.shouldPack])
     440
     441 -    def getType(self):
     442          """"Returns L{consts.IMAGE_DEBUG_DIRECTORIES}."""
     443          return consts.IMAGE_DEBUG_DIRECTORIES
     444
     445      @staticmethod
     446 -    def parse(readDataInstance,  nDebugEntries):
     447          """
     448          Returns a new L{ImageDebugDirectories} object.
     449
     450          @type readDataInstance: L{ReadData}
     451          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageDebugDirectories} object.
     452
     453          @type nDebugEntries: int
     454          @param nDebugEntries: Number of L{ImageDebugDirectory} objects in the C{readDataInstance} object.
     455
     456          @rtype: L{ImageDebugDirectories}
     457          @return: A new L{ImageDebugDirectories} object.
     458
     459          @raise DataLengthException: If not enough data to read in the C{readDataInstance} object.
     460          """
     461          dbgEntries = ImageDebugDirectories()
     462
     463          dataLength = len(readDataInstance)
     464          toRead = nDebugEntries * consts.SIZEOF_IMAGE_DEBUG_ENTRY32
     465          if dataLength >= toRead:
     466              for i in range(nDebugEntries):
     467                  dbgEntry = ImageDebugDirectory.parse(readDataInstance)
     468                  dbgEntries.append(dbgEntry)
     469          else:
     470              raise excep.DataLengthException("Not enough bytes to read.")
     471
     472          return dbgEntries
     473
     474 -class ImageImportDescriptorMetaData(baseclasses.BaseStructClass):
     475      """ImageImportDescriptorMetaData object."""
     476 -    def __init__(self,  shouldPack = True):
     477          """
     478          Class used to store metadata from the L{ImageImportDescriptor} object.
     479
     480          @type shouldPack: bool
     481          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     482          """
     483          baseclasses.BaseStructClass.__init__(self, shouldPack)
     484
     485          self.moduleName = datatypes.String("") #: L{String} moduleName.
     486          self.numberOfImports = datatypes.DWORD(0) #: L{DWORD} numberOfImports.
     487
     488          self._attrsList = ["moduleName", "numberOfImports"]
     489
     490 -    def getType(self):
     491          """Returns L{consts.IID_METADATA}."""
     492          return consts.IID_METADATA
     493
     494 -class ImageImportDescriptorEntry(baseclasses.BaseStructClass):
     495      """ImageImportDescriptorEntry object."""
     496 -    def __init__(self, shouldPack = True):
     497          """
     498          Class representation of a C{IMAGE_IMPORT_DESCRIPTOR} structure.
     499          @see: Figure 5 U{http://msdn.microsoft.com/es-ar/magazine/bb985996%28en-us%29.aspx}
     500
     501          @type shouldPack: bool
     502          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     503          """
     504          baseclasses.BaseStructClass.__init__(self, shouldPack)
     505
     506          self.metaData = ImageImportDescriptorMetaData() #: L{ImageImportDescriptorMetaData} metaData.
     507
     508          self.originalFirstThunk = datatypes.DWORD(0) #: L{DWORD} originalFirstThunk.
     509          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
     510          self.forwarderChain = datatypes.DWORD(0) #: L{DWORD} forwarderChain.
     511          self.name = datatypes.DWORD(0) #: L{DWORD} name.
     512          self.firstThunk = datatypes.DWORD(0) #: L{DWORD} firstThunk.
     513
     514          self.iat = ImportAddressTable() #: L{ImportAddressTable} iat.
     515
     516          self._attrsList = ["originalFirstThunk", "timeDateStamp",  "forwarderChain",  "name",  "firstThunk"]
     517
     518      @staticmethod
     519 -    def parse(readDataInstance):
     520          """
     521          Returns a new L{ImageImportDescriptorEntry} object.
     522
     523          @type readDataInstance: L{ReadData}
     524          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptorEntry}.
     525
     526          @rtype: L{ImageImportDescriptorEntry}
     527          @return: A new L{ImageImportDescriptorEntry} object.
     528          """
     529          iid = ImageImportDescriptorEntry()
     530          iid.originalFirstThunk.value = readDataInstance.readDword()
     531          iid.timeDateStamp.value = readDataInstance.readDword()
     532          iid.forwarderChain.value = readDataInstance.readDword()
     533          iid.name.value = readDataInstance.readDword()
     534          iid.firstThunk.value = readDataInstance.readDword()
     535          return iid
     536
     537 -    def getType(self):
     538          """Returns C{consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY}."""
     539          return consts.IMAGE_IMPORT_DESCRIPTOR_ENTRY
     540
     541 -class ImageImportDescriptor(list):
     542      """ImageImportDescriptor object."""
     543 -    def __init__(self,  shouldPack = True):
     544          """
     545          Array of L{ImageImportDescriptorEntry} objects.
     546
     547          @type shouldPack: bool
     548          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     549          """
     550          self.shouldPack = shouldPack
     551
     552 -    def __str__(self):
     553          return ''.join([str(x) for x in self if x.shouldPack])
     554
     555 -    def getType(self):
     556          """Returns L{consts.IMAGE_IMPORT_DESCRIPTOR}."""
     557          return consts.IMAGE_IMPORT_DESCRIPTOR
     558
     559      @staticmethod
     560 -    def parse(readDataInstance,  nEntries):
     561          """
     562          Returns a new L{ImageImportDescriptor} object.
     563
     564          @type readDataInstance: L{ReadData}
     565          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageImportDescriptor} object.
     566
     567          @type nEntries: int
     568          @param nEntries: The number of L{ImageImportDescriptorEntry} objects in the C{readDataInstance} object.
     569
     570          @rtype: L{ImageImportDescriptor}
     571          @return: A new L{ImageImportDescriptor} object.
     572
     573          @raise DataLengthException: If not enough data to read.
     574          """
     575          importEntries = ImageImportDescriptor()
     576
     577          dataLength = len(readDataInstance)
     578          toRead = nEntries * consts.SIZEOF_IMAGE_IMPORT_ENTRY32
     579          if dataLength >= toRead:
     580              for i in range(nEntries):
     581                  importEntry = ImageImportDescriptorEntry.parse(readDataInstance)
     582                  importEntries.append(importEntry)
     583          else:
     584              raise excep.DataLengthException("Not enough bytes to read.")
     585
     586          return importEntries
     587
     588 -class ImportAddressTableEntry(baseclasses.BaseStructClass):
     589      """ImportAddressTableEntry object."""
     590 -    def __init__(self,  shouldPack = True):
     591          """
     592          A class representation of a C{} structure.
     593
     594          @type shouldPack: bool
     595          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     596          """
     597          baseclasses.BaseStructClass.__init__(self, shouldPack)
     598
     599          self.firstThunk = datatypes.DWORD(0) #: L{DWORD} firstThunk.
     600          self.originalFirstThunk = datatypes.DWORD(0) #: L{DWORD} originalFirstThunk.
     601          self.hint = datatypes.WORD(0) #: L{WORD} hint.
     602          self.name = datatypes.String("") #: L{String} name.
     603
     604          self._attrsList = ["firstThunk",  "originalFirstThunk",  "hint",  "name"]
     605
     606 -    def getType(self):
     607          """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY}."""
     608          return consts.IMPORT_ADDRESS_TABLE_ENTRY
     609
     610 -class ImportAddressTableEntry64(baseclasses.BaseStructClass):
     611      """ImportAddressTableEntry64 object."""
     612 -    def __init__(self,  shouldPack = True):
     613          """
     614          A class representation of a C{} structure.
     615
     616          @type shouldPack: bool
     617          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     618          """
     619          baseclasses.BaseStructClass.__init__(self, shouldPack)
     620
     621          self.firstThunk = datatypes.QWORD(0) #: L{QWORD} firstThunk.
     622          self.originalFirstThunk = datatypes.QWORD(0) #: L{QWORD} originalFirstThunk.
     623          self.hint = datatypes.WORD(0) #: L{WORD} hint.
     624          self.name = datatypes.String("") #: L{String} name.
     625
     626          self._attrsList = ["firstThunk",  "originalFirstThunk",  "hint",  "name"]
     627
     628 -    def getType(self):
     629          """Returns L{consts.IMPORT_ADDRESS_TABLE_ENTRY64}."""
     630          return consts.IMPORT_ADDRESS_TABLE_ENTRY64
     631
     632 -class ImportAddressTable(list):
     633      """Array of L{ImportAddressTableEntry} objects."""
     634      pass
     635
     636 -class ExportTable(list):
     637      """Array of L{ExportTableEntry} objects."""
     638      pass
     639
     640 -class ExportTableEntry(baseclasses.BaseStructClass):
     641      """ExportTableEntry object."""
     642 -    def __init__(self,  shouldPack = True):
     643          """
     644          A class representation of a C{} structure.
     645
     646          @type shouldPack: bool
     647          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     648          """
     649          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     650
     651          self.ordinal = datatypes.DWORD(0) #: L{DWORD} ordinal.
     652          self.functionRva = datatypes.DWORD(0) #: L{DWORD} functionRva.
     653          self.nameOrdinal = datatypes.WORD(0) #: L{WORD} nameOrdinal.
     654          self.nameRva = datatypes.DWORD(0) #: L{DWORD} nameRva.
     655          self.name = datatypes.String("") #: L{String} name.
     656
     657          self._attrsList = ["ordinal", "functionRva",  "nameOrdinal",  "nameRva",  "name"]
     658
     659 -    def __repr__(self):
     660          return repr((self.ordinal,  self.functionRva,  self.nameOrdinal,  self.nameRva,  self.name))
     661
     662 -    def getType(self):
     663          """Returns L{consts.EXPORT_TABLE_ENTRY}."""
     664          return consts.EXPORT_TABLE_ENTRY
     665
     666      @staticmethod
     667 -    def parse(readDataInstance):
     668          """
     669          Returns a new L{ExportTableEntry} object.
     670
     671          @type readDataInstance: L{ReadData}
     672          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ExportTableEntry} object.
     673
     674          @rtype: L{ExportTableEntry}
     675          @return: A new L{ExportTableEntry} object.
     676          """
     677          exportEntry = ExportTableEntry()
     678
     679          exportEntry.functionRva.value = readDataInstance.readDword()
     680          exportEntry.nameOrdinal.value = readDataInstance.readWord()
     681          exportEntry.nameRva.value = readDataInstance.readDword()
     682          exportEntry.name.value = readDataInstance.readString()
     683          return exportEntry
     684
     685 -class ImageExportTable(baseclasses.BaseStructClass):
     686      """ImageExportTable object."""
     687 -    def __init__(self,  shouldPack = True):
     688          """
     689          Class representation of a C{IMAGE_EXPORT_DIRECTORY} structure.
     690          @see: Figure 2 U{http://msdn.microsoft.com/en-us/magazine/bb985996.aspx}
     691
     692          @type shouldPack: bool
     693          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     694          """
     695          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     696
     697          self.exportTable = ExportTable()
     698
     699          self.characteristics = datatypes.DWORD(0) #: L{DWORD} characteristics.
     700          self.timeDateStamp = datatypes.DWORD(0) #: L{DWORD} timeDateStamp.
     701          self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion.
     702          self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion.
     703          self.name = datatypes.DWORD(0) #: L{DWORD} name.
     704          self.base = datatypes.DWORD(0) #: L{DWORD} base.
     705          self.numberOfFunctions = datatypes.DWORD(0) #: L{DWORD} numberOfFunctions.
     706          self.numberOfNames = datatypes.DWORD(0) #: L{DWORD} numberOfNames.
     707          self.addressOfFunctions = datatypes.DWORD(0) #: L{DWORD} addressOfFunctions.
     708          self.addressOfNames = datatypes.DWORD(0) #: L{DWORD} addressOfNames.
     709          self.addressOfNameOrdinals = datatypes.DWORD(0) #: L{DWORD} addressOfNamesOrdinals.
     710
     711          self._attrsList = ["characteristics",  "timeDateStamp",  "majorVersion",  "minorVersion", "name",  "base",  "numberOfFunctions",\
     712                             "numberOfNames",  "addressOfFunctions",  "addressOfNames",  "addressOfNameOrdinals"]
     713
     714 -    def getType(self):
     715          """Returns L{consts.EXPORT_DIRECTORY}."""
     716          return consts.EXPORT_DIRECTORY
     717
     718      @staticmethod
     719 -    def parse(readDataInstance):
     720          """
     721          Returns a new L{ImageExportTable} object.
     722
     723          @type readDataInstance: L{ReadData}
     724          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{ImageExportTable} object.
     725
     726          @rtype: L{ImageExportTable}
     727          @return: A new L{ImageExportTable} object.
     728          """
     729          et = ImageExportTable()
     730
     731          et.characteristics.value = readDataInstance.readDword()
     732          et.timeDateStamp.value = readDataInstance.readDword()
     733          et.majorVersion.value = readDataInstance.readWord()
     734          et.minorVersion.value = readDataInstance.readWord()
     735          et.name.value = readDataInstance.readDword()
     736          et.base.value = readDataInstance.readDword()
     737          et.numberOfFunctions.value = readDataInstance.readDword()
     738          et.numberOfNames.value = readDataInstance.readDword()
     739          et.addressOfFunctions.value = readDataInstance.readDword()
     740          et.addressOfNames.value = readDataInstance.readDword()
     741          et.addressOfNameOrdinals.value = readDataInstance.readDword()
     742          return et
     743
     744 -class NETDirectory(baseclasses.BaseStructClass):
     745      """NETDirectory object."""
     746 -    def __init__(self,  shouldPack = True):
     747          """
     748          A class to abstract data from the .NET PE format.
     749
     750          @type shouldPack: bool
     751          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     752          """
     753          baseclasses.BaseStructClass.__init__(self, shouldPack)
     754
     755          self.directory = NetDirectory() #: L{NetDirectory} directory.
     756          self.netMetaDataHeader = NetMetaDataHeader() #: L{NetMetaDataHeader} netMetaDataHeader.
     757          self.netMetaDataStreams = NetMetaDataStreams() #: L{NetMetaDataStreams} netMetaDataStreams.
     758
     759          self._attrsList = ["directory",  "netMetaDataHeader",  "netMetaDataStreams"]
     760
     761      @staticmethod
     762 -    def parse(readDataInstance):
     763          """
     764          Returns a new L{NETDirectory} object.
     765
     766          @type readDataInstance: L{ReadData}
     767          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NETDirectory} object.
     768
     769          @rtype: L{NETDirectory}
     770          @return: A new L{NETDirectory} object.
     771          """
     772          nd = NETDirectory()
     773
     774          nd.directory = NetDirectory.parse(readDataInstance)
     775          nd.netMetaDataHeader = NetMetaDataHeader.parse(readDataInstance)
     776          nd.netMetaDataStreams = NetMetaDataStreams.parse(readDataInstance)
     777          return nd
     778
     779 -    def getType(self):
     780          """Returns L{consts.NET_DIRECTORY}."""
     781          return consts.NET_DIRECTORY
     782
     783 -class NetDirectory(baseclasses.BaseStructClass):
     784      """NetDirectory object."""
     785 -    def __init__(self,  shouldPack = True):
     786          """
     787          A class representation of the C{IMAGE_COR20_HEADER} structure.
     788          @see: U{http://www.ntcore.com/files/dotnetformat.htm}
     789
     790          @type shouldPack: bool
     791          @param shouldPack: (Optional) If set to c{True}, the object will be packed. If set to C{False}, the object won't be packed.
     792          """
     793          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     794
     795          self.cb = datatypes.DWORD(0) #: L{DWORD} cb.
     796          self.majorRuntimeVersion = datatypes.WORD(0) #: L{WORD} majorRuntimeVersion.
     797          self.minorRuntimeVersion = datatypes.WORD(0) #: L{WORD} minorRuntimeVersion.
     798          self.metaData = datadirs.Directory() #: L{Directory} metaData.
     799          self.flags = datatypes.DWORD(0) #: L{DWORD} flags.
     800          self.entryPointToken = datatypes.DWORD(0) #: L{DWORD} entryPointToken.
     801          self.resources = datadirs.Directory() #: L{Directory} resources.
     802          self.strongNameSignature = datadirs.Directory() #: L{Directory} strongNameSignature.
     803          self.codeManagerTable = datadirs.Directory() #: L{Directory} codeManagerTable.
     804          self.vTableFixups = datadirs.Directory() #: L{Directory} vTableFixups.
     805          self.exportAddressTableJumps = datadirs.Directory() #: L{Directory} exportAddressTableJumps.
     806          self.managedNativeHeader = datadirs.Directory() #: L{Directory} managedNativeHeader.
     807
     808          self._attrsList = ["cb","majorRuntimeVersion","minorRuntimeVersion","metaData", \
     809          "flags","entryPointToken","resources","strongNameSignature",\
     810          "codeManagerTable","vTableFixups", "exportAddressTableJumps",\
     811          "managedNativeHeader"]
     812
     813 -    def getType(self):
     814          """Returns L{consts.IMAGE_COR20_HEADER}."""
     815          return consts.IMAGE_COR20_HEADER
     816
     817      @staticmethod
     818 -    def parse(readDataInstance):
     819          """
     820          Returns a new L{NetDirectory} object.
     821
     822          @type readDataInstance: L{ReadData}
     823          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetDirectory} object.
     824
     825          @rtype: L{NetDirectory}
     826          @return: A new L{NetDirectory} object.
     827          """
     828          nd = NetDirectory()
     829
     830          nd.cb.value = readDataInstance.readDword()
     831          nd.majorRuntimeVersion.value= readDataInstance.readWord()
     832          nd.minorRuntimeVersion.value = readDataInstance.readWord()
     833
     834          nd.metaData.rva.value = readDataInstance.readDword()
     835          nd.metaData.size.value = readDataInstance.readDword()
     836          nd.metaData.name.value = datatypes.String("MetaData")
     837
     838          nd.flags.value = readDataInstance.readDword()
     839          nd.entryPointToken.value = readDataInstance.readDword()
     840
     841          nd.resources.rva.value = readDataInstance.readDword()
     842          nd.resources.size.value = readDataInstance.readDword()
     843          nd.resources.name.value = datatypes.String("Resources")
     844
     845          nd.strongNameSignature.rva.value = readDataInstance.readDword()
     846          nd.strongNameSignature.size.value = readDataInstance.readDword()
     847          nd.strongNameSignature.name.value = datatypes.String("StrongNameSignature")
     848
     849          nd.codeManagerTable.rva.value = readDataInstance.readDword()
     850          nd.codeManagerTable.size.value = readDataInstance.readDword()
     851          nd.codeManagerTable.name.value = datatypes.String("CodeManagerTable")
     852
     853          nd.vTableFixups.rva.value = readDataInstance.readDword()
     854          nd.vTableFixups.size.value = readDataInstance.readDword()
     855          nd.vTableFixups.name.value = datatypes.String("VTableFixups")
     856
     857          nd.exportAddressTableJumps.rva.value = readDataInstance.readDword()
     858          nd.exportAddressTableJumps.size.value = readDataInstance.readDword()
     859          nd.exportAddressTableJumps.name.value = datatypes.String("ExportAddressTableJumps")
     860
     861          nd.managedNativeHeader.rva.value = readDataInstance.readDword()
     862          nd.managedNativeHeader.size.value = readDataInstance.readDword()
     863          nd.managedNativeHeader.name.value = datatypes.String("ManagedNativeHeader")
     864
     865          return nd
     866
     867 -class NetMetaDataHeader(baseclasses.BaseStructClass):
     868      """NetMetaDataHeader object."""
     869 -    def __init__(self,  shouldPack = True):
     870          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     871
     872          self.signature = datatypes.DWORD(0) #: L{DWORD} signature.
     873          self.majorVersion = datatypes.WORD(0) #: L{WORD} majorVersion.
     874          self.minorVersion = datatypes.WORD(0) #: L{WORD} minorVersion.
     875          self.reserved = datatypes.DWORD(0) #: L{DWORD} reserved.
     876          self.versionLength = datatypes.DWORD(0) #: L{DWORD} versionLength.
     877          self.versionString = datatypes.AlignedString("") #: L{AlignedString} versionString.
     878          self.flags = datatypes.WORD(0) #: L{WORD} flags.
     879          self.numberOfStreams = datatypes.WORD(0) #: L{WORD} numberOfStreams.
     880
     881          self._attrsList = ["signature","majorVersion","minorVersion","reserved","versionLength","versionString","flags","numberOfStreams"]
     882
     883 -    def getType(self):
     884          """Returns L{consts.NET_METADATA_HEADER}."""
     885          return consts.NET_METADATA_HEADER
     886
     887      @staticmethod
     888 -    def parse(readDataInstance):
     889          """
     890          Returns a new L{NetMetaDataHeader} object.
     891
     892          @type readDataInstance: L{ReadData}
     893          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataHeader} object.
     894
     895          @rtype: L{NetMetaDataHeader}
     896          @return: A new L{NetMetaDataHeader} object.
     897          """
     898          nmh = NetMetaDataHeader()
     899
     900          nmh.signature.value = readDataInstance.readDword()
     901          nmh.majorVersion.value = readDataInstance.readWord()
     902          nmh.minorVersion.value = readDataInstance.readWord()
     903          nmh.reserved.value = readDataInstance.readDword()
     904          nmh.versionLength.value = readDataInstance.readDword()
     905          nmh.versionString.value = readDataInstance.readAlignedString()
     906          nmh.flags.value = readDataInstance.readWord()
     907          nmh.numberOfStreams.value = readDataInstance.readWord()
     908          return nmh
     909
     910 -class NetMetaDataStreamEntry(baseclasses.BaseStructClass):
     911      """NetMetaDataStreamEntry object."""
     912 -    def __init__(self,  shouldPack = True):
     913          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     914
     915          self.offset = datatypes.DWORD(0) #: L{DWORD} offset.
     916          self.size = datatypes.DWORD(0) #: L{DWORD} size.
     917          # this must be aligned to the next 4-byte boundary
     918          self.name = datatypes.AlignedString("") #: L{AlignedString} name.
     919          # the "info" attribute does not belong to the NETMetaDataStreamEntry struct. It is just a place holder where the
     920          # data for every entry will be stored.
     921          self.info = None
     922
     923          self._attrsList = ["offset",  "size",  "name",  "info"]
     924
     925 -    def getType(self):
     926          """Returns L{consts.NET_METADATA_STREAM_ENTRY}."""
     927          return consts.NET_METADATA_STREAM_ENTRY
     928
     929      @staticmethod
     930 -    def parse(readDataInstance):
     931          """
     932          Returns a new L{NetMetaDataStreamEntry} object.
     933
     934          @type readDataInstance: L{ReadData}
     935          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataStreamEntry}.
     936
     937          @rtype: L{NetMetaDataStreamEntry}
     938          @return: A new L{NetMetaDataStreamEntry} object.
     939          """
     940          n = NetMetaDataStreamEntry()
     941          n.offset.value = readDataInstance.readDword()
     942          n.size.value = readDataInstance.readDword()
     943          n.name.value = readDataInstance.readAlignedString()
     944          return n
     945
     946 -class NetMetaDataStreams(list):
     947      """NetMetaDataStreams object."""
     948 -    def __init__(self,  shouldPack = True):
     949          self.shouldPack = shouldPack
     950
     951 -    def __str__(self):
     952          return "".join([str(x) for x in self if x.shouldPack])
     953
     954 -    def getType(self):
     955          """Returns L{consts.NET_METADATA_STREAMS}."""
     956          return consts.NET_METADATA_STREAMS
     957
     958      @staticmethod
     959 -    def parse(readDataInstance,  nStreams):
     960          """
     961          Returns a new L{NetMetaDataStreams} object.
     962
     963          @type readDataInstance: L{ReadData}
     964          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataStreams} object.
     965
     966          @type nStreams: int
     967          @param nStreams: The number of L{NetMetaDataStreamEntry} objects in the C{readDataInstance} object.
     968
     969          @rtype: L{NetMetaDataStreams}
     970          @return: A new L{NetMetaDataStreams} object.
     971          """
     972          streams = NetMetaDataStreams()
     973
     974          for i in range(nStreams):
     975              streamEntry = NetMetaDataStreamEntry()
     976
     977              streamEntry.offset.value = readDataInstance.readDword()
     978              streamEntry.size.value = readDataInstance.readDword()
     979              streamEntry.name.value = readDataInstance.readAlignedString()
     980
     981              streams.append(streamEntry)
     982
     983          return streams
     984
     985 -class NetMetaDataTableHeader(baseclasses.BaseStructClass):
     986      """NetMetaDataTableHeader object."""
     987 -    def __init__(self,  shouldPack = True):
     988          baseclasses.BaseStructClass.__init__(self,  shouldPack)
     989
     990          self.reserved_1 = datatypes.DWORD(0) #: L{DWORD} reserved_1.
     991          self.majorVersion = datatypes.BYTE(0) #: L{BYTE} majorVersion.
     992          self.minorVersion = datatypes.BYTE(0) #: L{BYTE} minorVersion.
     993          self.heapOffsetSizes = datatypes.BYTE(0) #: L{BYTE} heapOffsetSizes.
     994          self.reserved_2 = datatypes.BYTE(0) #: L{BYTE} reserved_2.
     995          self.maskValid = datatypes.QWORD(0) #: L{QWORD} maskValid.
     996          self.maskSorted = datatypes.QWORD(0) #: L{QWORD} maskSorted.
     997
     998          self._attrsList = ["reserved_1",  "majorVersion",  "minorVersion",  "heapOffsetSizes",  "reserved_2",  "maskValid",  "maskSorted"]
     999
    1000 -    def getType(self):
    1001          """Returns L{consts.NET_METADATA_TABLE_HEADER}."""
    1002          return consts.NET_METADATA_TABLE_HEADER
    1003
    1004      @staticmethod
    1005 -    def parse(readDataInstance):
    1006          """
    1007          Returns a new L{NetMetaDataTableHeader} object.
    1008
    1009          @type readDataInstance: L{ReadData}
    1010          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataTableHeader} object.
    1011
    1012          @rtype: L{NetMetaDataTableHeader}
    1013          @return: A new L{NetMetaDataTableHeader} object.
    1014          """
    1015          th = NetMetaDataTableHeader()
    1016
    1017          th.reserved_1.value = readDataInstance.readDword()
    1018          th.majorVersion.value = readDataInstance.readByte()
    1019          th.minorVersion.value = readDataInstance.readByte()
    1020          th.heapOffsetSizes.value = readDataInstance.readByte()
    1021          th.reserved_2.value = readDataInstance.readByte()
    1022          th.maskValid.value = readDataInstance.readQword()
    1023          th.maskSorted.value = readDataInstance.readQword()
    1024
    1025          return th
    1026
    1027 -class NetMetaDataTables(baseclasses.BaseStructClass):
    1028      """NetMetaDataTables object."""
    1029 -    def __init__(self,  shouldPack = True):
    1030          """
    1031          NetMetaDataTables object.
    1032
    1033          @todo: Parse every table in this struct and store them in the C{self.tables} attribute.
    1034          """
    1035          baseclasses.BaseStructClass.__init__(self,  shouldPack)
    1036
    1037          self.netMetaDataTableHeader = NetMetaDataTableHeader() #: L{NetMetaDataTableHeader} netMetaDataTableHeader.
    1038          self.tables = None #: C{str} tables.
    1039
    1040          self._attrsList = ["netMetaDataTableHeader",  "tables"]
    1041
    1042 -    def getType(self):
    1043          """Returns L{consts.NET_METADATA_TABLES}."""
    1044          return consts.NET_METADATA_TABLES
    1045
    1046      @staticmethod
    1047 -    def parse(readDataInstance):
    1048          """
    1049          Returns a new L{NetMetaDataTables} object.
    1050
    1051          @type readDataInstance: L{ReadData}
    1052          @param readDataInstance: A L{ReadData} object with data to be parsed as a L{NetMetaDataTables} object.
    1053
    1054          @rtype: L{NetMetaDataTables}
    1055          @return: A new L{NetMetaDataTables} object.
    1056          """
    1057          dt = NetMetaDataTables()
    1058
    1059          dt.netMetaDataTableHeader = NetMetaDataTableHeader.parse(readDataInstance)
    1060          dt.tables = readDataInstance.read(len(readDataInstance))
    1061          return dt
    1062