Convenience section handling class.
| 1145 | |
| 1146 | |
| 1147 | class SectionStructure(Structure): |
| 1148 | """Convenience section handling class.""" |
| 1149 | |
| 1150 | def __init__(self, *argl, **argd): |
| 1151 | if "pe" in argd: |
| 1152 | self.pe = argd["pe"] |
| 1153 | del argd["pe"] |
| 1154 | |
| 1155 | Structure.__init__(self, *argl, **argd) |
| 1156 | self.PointerToRawData_adj = None |
| 1157 | self.VirtualAddress_adj = None |
| 1158 | self.section_min_addr = None |
| 1159 | self.section_max_addr = None |
| 1160 | |
| 1161 | def get_PointerToRawData_adj(self): |
| 1162 | if self.PointerToRawData_adj is None: |
| 1163 | if self.PointerToRawData is not None: |
| 1164 | self.PointerToRawData_adj = self.pe.adjust_FileAlignment( |
| 1165 | self.PointerToRawData, self.pe.OPTIONAL_HEADER.FileAlignment |
| 1166 | ) |
| 1167 | return self.PointerToRawData_adj |
| 1168 | |
| 1169 | def get_VirtualAddress_adj(self): |
| 1170 | if self.VirtualAddress_adj is None: |
| 1171 | if self.VirtualAddress is not None: |
| 1172 | self.VirtualAddress_adj = self.pe.adjust_SectionAlignment( |
| 1173 | self.VirtualAddress, |
| 1174 | self.pe.OPTIONAL_HEADER.SectionAlignment, |
| 1175 | self.pe.OPTIONAL_HEADER.FileAlignment, |
| 1176 | ) |
| 1177 | return self.VirtualAddress_adj |
| 1178 | |
| 1179 | def get_data(self, start=None, length=None, ignore_padding=False): |
| 1180 | """Get data chunk from a section. |
| 1181 | |
| 1182 | Allows to query data from the section by passing the |
| 1183 | addresses where the PE file would be loaded by default. |
| 1184 | It is then possible to retrieve code and data by their real |
| 1185 | addresses as they would be if loaded. |
| 1186 | |
| 1187 | Note that sections on disk can include padding that would |
| 1188 | not be loaded to memory. That is the case if `section.SizeOfRawData` |
| 1189 | is greater than `section.Misc_VirtualSize`, and that means |
| 1190 | that data past `section.Misc_VirtualSize` is padding. |
| 1191 | In case you are not interested in this padding, passing |
| 1192 | `ignore_padding=True` will truncate the result in order |
| 1193 | not to return the padding (if any). |
| 1194 | |
| 1195 | Returns bytes() under Python 3.x and set() under Python 2.7 |
| 1196 | """ |
| 1197 | |
| 1198 | if start is None: |
| 1199 | offset = self.get_PointerToRawData_adj() |
| 1200 | else: |
| 1201 | offset = ( |
| 1202 | start - self.get_VirtualAddress_adj() |
| 1203 | ) + self.get_PointerToRawData_adj() |
| 1204 |