Class PEFile

windows/pe_parse.py:307–453

Represent a PE loaded in a process (current or remote)

    ]

class PEFile(object):
    """Represent a PE loaded in a process (current or remote)"""

    def __init__(self, target, baseaddr, targetedbitness, transformers):
        self.target = target
        self.baseaddr = baseaddr
        self.bitness = targetedbitness
        self.transformers = transformers

        if targetedbitness == 32:
            self.IMAGE_ORDINAL_FLAG = IMAGE_ORDINAL_FLAG32
        else:
            self.IMAGE_ORDINAL_FLAG = IMAGE_ORDINAL_FLAG64

    def get_DOS_HEADER(self):
        return self.transformers.create_structure_at(IMAGE_DOS_HEADER, self.baseaddr)

    def get_NT_HEADER(self):
        offset = self.get_DOS_HEADER().e_lfanew
        if self.bitness == 32:
            return self.transformers.create_structure_at(IMAGE_NT_HEADERS32, self.baseaddr + offset)
        return self.transformers.create_structure_at(IMAGE_NT_HEADERS64, self.baseaddr + offset)


    STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC = {
        IMAGE_NT_OPTIONAL_HDR32_MAGIC: IMAGE_OPTIONAL_HEADER32,
        IMAGE_NT_OPTIONAL_HDR64_MAGIC: IMAGE_OPTIONAL_HEADER64,
    }

    STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC = (
        (IMAGE_NT_OPTIONAL_HDR32_MAGIC, ctypes.sizeof(IMAGE_OPTIONAL_HEADER32)),
        (IMAGE_NT_OPTIONAL_HDR64_MAGIC, ctypes.sizeof(IMAGE_OPTIONAL_HEADER64)),
    )

    def get_OptionalHeader(self):
        # We can have a 32bits PE with a 64 bits OptionalHeader
        # Ex  : PE32 .NET that allow to be loaded in 64b process
        # See: https://github.com/dotnet/runtime/blob/8bbe33819464216becffb7cf8b7ea8dd3bab5836/src/coreclr/src/vm/peimagelayout.cpp#L599
        # In this case the OptionalHeader is transformed in 64bits & OptionalHeader.Magic is changed accordingly
        # So we cannot just rely on get_NT_HEADER() to give us the correct OptionalHeader type. some re-check are required
        default_opth = self.get_NT_HEADER().OptionalHeader
        # Cannot juste compare types with type(default_opth) as it may be a remoteType
        current_opth_infos = (default_opth.Magic, ctypes.sizeof(default_opth))
        if current_opth_infos in self.STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC:
            # The default OptionalHeader structure match what we expect based on the magic (most of the cases)
            return default_opth
        # Mismatch -> PE32 remapped as 64b (with OptionalHeader rewrite)
        # Remap the correct OptionalHeader
        opt_header_real_type = self.STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC[default_opth.Magic]
        opt_header_addr = default_opth._base_addr if self.target else ctypes.addressof(default_opth)
        return self.transformers.create_structure_at(opt_header_real_type, opt_header_addr)

    def get_DataDirectory(self):
        return self.get_OptionalHeader().DataDirectory


    def get_IMPORT_DESCRIPTORS(self):
        import_datadir = self.get_DataDirectory()[IMAGE_DIRECTORY_ENTRY_IMPORT]