(self, rva, max_length=None, contains_addresses=False)
| 5639 | return imported_symbols |
| 5640 | |
| 5641 | def get_import_table(self, rva, max_length=None, contains_addresses=False): |
| 5642 | |
| 5643 | table = [] |
| 5644 | |
| 5645 | # We need the ordinal flag for a simple heuristic |
| 5646 | # we're implementing within the loop |
| 5647 | # |
| 5648 | if self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE: |
| 5649 | ordinal_flag = IMAGE_ORDINAL_FLAG |
| 5650 | format = self.__IMAGE_THUNK_DATA_format__ |
| 5651 | elif self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE_PLUS: |
| 5652 | ordinal_flag = IMAGE_ORDINAL_FLAG64 |
| 5653 | format = self.__IMAGE_THUNK_DATA64_format__ |
| 5654 | else: |
| 5655 | # Some PEs may have an invalid value in the Magic field of the |
| 5656 | # Optional Header. Just in case the remaining file is parseable |
| 5657 | # let's pretend it's a 32bit PE32 by default. |
| 5658 | ordinal_flag = IMAGE_ORDINAL_FLAG |
| 5659 | format = self.__IMAGE_THUNK_DATA_format__ |
| 5660 | |
| 5661 | expected_size = Structure(format).sizeof() |
| 5662 | MAX_ADDRESS_SPREAD = 128 * 2**20 # 128 MB |
| 5663 | ADDR_4GB = 2**32 |
| 5664 | MAX_REPEATED_ADDRESSES = 15 |
| 5665 | repeated_address = 0 |
| 5666 | addresses_of_data_set_64 = AddressSet() |
| 5667 | addresses_of_data_set_32 = AddressSet() |
| 5668 | start_rva = rva |
| 5669 | while rva: |
| 5670 | if max_length is not None and rva >= start_rva + max_length: |
| 5671 | self.__warnings.append( |
| 5672 | "Error parsing the import table. Entries go beyond bounds." |
| 5673 | ) |
| 5674 | break |
| 5675 | # Enforce an upper bounds on import symbols. |
| 5676 | if self.__total_import_symbols > MAX_IMPORT_SYMBOLS: |
| 5677 | self.__warnings.append( |
| 5678 | "Excessive number of imports %d (>%s)" |
| 5679 | % (self.__total_import_symbols, MAX_IMPORT_SYMBOLS) |
| 5680 | ) |
| 5681 | break |
| 5682 | |
| 5683 | self.__total_import_symbols += 1 |
| 5684 | |
| 5685 | # if we see too many times the same entry we assume it could be |
| 5686 | # a table containing bogus data (with malicious intent or otherwise) |
| 5687 | if repeated_address >= MAX_REPEATED_ADDRESSES: |
| 5688 | return [] |
| 5689 | |
| 5690 | # if the addresses point somewhere but the difference between the highest |
| 5691 | # and lowest address is larger than MAX_ADDRESS_SPREAD we assume a bogus |
| 5692 | # table as the addresses should be contained within a module |
| 5693 | if addresses_of_data_set_32.diff() > MAX_ADDRESS_SPREAD: |
| 5694 | return [] |
| 5695 | if addresses_of_data_set_64.diff() > MAX_ADDRESS_SPREAD: |
| 5696 | return [] |
| 5697 | |
| 5698 | failed = False |
no test coverage detected