MCPcopy Create free account
hub / github.com/ELMERIKH/PyinMemoryPE / finalize_sections

Method finalize_sections

pythonmemorymodule/__init__.py:715–773  ·  view source on GitHub ↗
(self)

Source from the content-addressed store, hash-verified

713 callback= IMAGE_TLS_CALLBACK.from_address(callbackaddr)
714
715 def finalize_sections(self):
716 sectionaddr = self.IMAGE_FIRST_SECTION()
717 numSections = self.pythonmemorymodule.contents.headers.contents.FileHeader.NumberOfSections
718 imageOffset = POINTER_TYPE(self.pythonmemorymodule.contents.headers.contents.OptionalHeader.ImageBase & 0xffffffff00000000) if isx64 else POINTER_TYPE(0)
719 checkCharacteristic = lambda sect, flag: 1 if (sect.contents.Characteristics & flag) != 0 else 0
720 getPhysAddr = lambda sect: section.contents.PhysicalAddress | imageOffset.value
721
722 self.dbg("Found %d total sections.",numSections)
723 for i in range(0, numSections):
724 self.dbg("Section n. %d",i)
725
726 section = cast(sectionaddr, PIMAGE_SECTION_HEADER)
727 size = section.contents.SizeOfRawData
728 if size == 0:
729 if checkCharacteristic(section, IMAGE_SCN_CNT_INITIALIZED_DATA):
730 self.dbg("Zero size rawdata section")
731 size = self.pythonmemorymodule.contents.headers.contents.OptionalHeader.SizeOfInitializedData
732 elif checkCharacteristic(section, IMAGE_SCN_CNT_UNINITIALIZED_DATA):
733 size = self.pythonmemorymodule.contents.headers.contents.OptionalHeader.SizeOfUninitializedData
734 self.dbg("Uninitialized data, return")
735 continue
736 if size == 0:
737 self.dbg("zero size section")
738 continue
739 self.dbg("size=%d",size)
740 oldProtect = DWORD(0)
741 self.dbg("execute %d",checkCharacteristic(section, IMAGE_SCN_MEM_EXECUTE))
742 executable = checkCharacteristic(section, IMAGE_SCN_MEM_EXECUTE)
743 self.dbg("read %d",checkCharacteristic(section, IMAGE_SCN_MEM_READ))
744 readable = checkCharacteristic(section, IMAGE_SCN_MEM_READ)
745 writeable = checkCharacteristic(section, IMAGE_SCN_MEM_WRITE)
746 self.dbg("write %d",checkCharacteristic(section, IMAGE_SCN_MEM_WRITE))
747
748 if checkCharacteristic(section, IMAGE_SCN_MEM_DISCARDABLE):
749 addr = self.sections[i].Misc_PhysicalAddress #getPhysAddr(section)
750 self.dbg("physaddr:0x%x", addr)
751 VirtualFree(addr, section.contents.SizeOfRawData, MEM_DECOMMIT)
752 continue
753
754 protect = ProtectionFlags[executable][readable][writeable]
755 self.dbg("Protection flag:%d",protect)
756 if checkCharacteristic(section, IMAGE_SCN_MEM_NOT_CACHED):
757 print("not cached")
758 protect |= PAGE_NOCACHE
759
760
761 size = section.contents.SizeOfRawData
762 if size == 0:
763 if checkCharacteristic(section, IMAGE_SCN_CNT_INITIALIZED_DATA):
764 size = self.pythonmemorymodule.contents.headers.contents.OptionalHeader.SizeOfInitializedData
765 elif checkCharacteristic(section, IMAGE_SCN_CNT_UNINITIALIZED_DATA):
766 size = self.pythonmemorymodule.contents.headers.contents.OptionalHeader.SizeOfUninitializedData
767 if size > 0:
768 addr = self.sections[i].Misc_PhysicalAddress #getPhysAddr(section)
769 self.dbg("physaddr:0x%x", addr)
770 if VirtualProtect(addr, size, protect, byref(oldProtect)) == 0:
771 raise WindowsError("Error protecting memory page")
772 sectionaddr += sizeof(IMAGE_SECTION_HEADER)

Callers 1

load_moduleMethod · 0.95

Calls 4

IMAGE_FIRST_SECTIONMethod · 0.95
dbgMethod · 0.95
VirtualFreeFunction · 0.85
VirtualProtectFunction · 0.85

Tested by

no test coverage detected