MCPcopy Index your code
hub / github.com/ELMERIKH/PyinMemoryPE / get_data

Method get_data

pythonmemorymodule/pefile.py:5874–5906  ·  view source on GitHub ↗

Get data regardless of the section where it lies on. Given a RVA and the size of the chunk to retrieve, this method will find the section where the data lies and return the data.

(self, rva=0, length=None)

Source from the content-addressed store, hash-verified

5872 return resources_strings
5873
5874 def get_data(self, rva=0, length=None):
5875 """Get data regardless of the section where it lies on.
5876
5877 Given a RVA and the size of the chunk to retrieve, this method
5878 will find the section where the data lies and return the data.
5879 """
5880
5881 s = self.get_section_by_rva(rva)
5882
5883 if length:
5884 end = rva + length
5885 else:
5886 end = None
5887
5888 if not s:
5889 if rva < len(self.header):
5890 return self.header[rva:end]
5891
5892 # Before we give up we check whether the file might
5893 # contain the data anyway. There are cases of PE files
5894 # without sections that rely on windows loading the first
5895 # 8291 bytes into memory and assume the data will be
5896 # there
5897 # A functional file with these characteristics is:
5898 # MD5: 0008892cdfbc3bda5ce047c565e52295
5899 # SHA-1: c7116b9ff950f86af256defb95b5d4859d4752a9
5900 #
5901 if rva < len(self.__data__):
5902 return self.__data__[rva:end]
5903
5904 raise PEFormatError("data at RVA can't be fetched. Corrupt header?")
5905
5906 return s.get_data(rva, length)
5907
5908 def get_rva_from_offset(self, offset):
5909 """Get the RVA corresponding to this file offset."""

Calls 2

get_section_by_rvaMethod · 0.95
PEFormatErrorClass · 0.85

Tested by

no test coverage detected