Returns a :class:`PEFile` to explore a PE loaded at `baseaddr` in process `target`. :rtype: :class:`PEFile` .. note:: If target is ``None`` it refers to the current process
(baseaddr, target=None, force_bitness=None)
| 53 | CtypesStructureTransformers = collections.namedtuple("CtypesStructureTransformers", ["ctypes_structure_transformer", "create_structure_at"]) |
| 54 | |
| 55 | def GetPEFile(baseaddr, target=None, force_bitness=None): |
| 56 | """Returns a :class:`PEFile` to explore a PE loaded at `baseaddr` in process `target`. |
| 57 | |
| 58 | :rtype: :class:`PEFile` |
| 59 | |
| 60 | .. note:: |
| 61 | |
| 62 | If target is ``None`` it refers to the current process |
| 63 | """ |
| 64 | proc_bitness = windows.current_process.bitness |
| 65 | |
| 66 | if force_bitness is None: |
| 67 | targetedbitness = get_pe_bitness(baseaddr, target) |
| 68 | else: |
| 69 | targetedbitness = force_bitness |
| 70 | |
| 71 | transformers = get_structure_transformer_for_target(target, targetedbitness) |
| 72 | #ctypes_structure_transformer, create_structure_at = transformers |
| 73 | transfor_funcs = CtypesStructureTransformers(*transformers) # TODO: rename |
| 74 | return PEFile(target, baseaddr, targetedbitness, transfor_funcs) |
| 75 | |
| 76 | |
| 77 | class THUNK_DATA(ctypes.Union): |
no test coverage detected