Check whether the file is a Windows driver. This will return true only if there are reliable indicators of the image being a driver.
(self)
| 7242 | return False |
| 7243 | |
| 7244 | def is_driver(self): |
| 7245 | """Check whether the file is a Windows driver. |
| 7246 | |
| 7247 | This will return true only if there are reliable indicators of the image |
| 7248 | being a driver. |
| 7249 | """ |
| 7250 | |
| 7251 | # Checking that the ImageBase field of the OptionalHeader is above or |
| 7252 | # equal to 0x80000000 (that is, whether it lies in the upper 2GB of |
| 7253 | # the address space, normally belonging to the kernel) is not a |
| 7254 | # reliable enough indicator. For instance, PEs that play the invalid |
| 7255 | # ImageBase trick to get relocated could be incorrectly assumed to be |
| 7256 | # drivers. |
| 7257 | |
| 7258 | # This is not reliable either... |
| 7259 | # |
| 7260 | # if any((section.Characteristics & |
| 7261 | # SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_NOT_PAGED']) for |
| 7262 | # section in self.sections ): |
| 7263 | # return True |
| 7264 | |
| 7265 | # If the import directory was not parsed (fast_load = True); do it now. |
| 7266 | if not hasattr(self, "DIRECTORY_ENTRY_IMPORT"): |
| 7267 | self.parse_data_directories( |
| 7268 | directories=[DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_IMPORT"]] |
| 7269 | ) |
| 7270 | |
| 7271 | # If there's still no import directory (the PE doesn't have one or it's |
| 7272 | # malformed), give up. |
| 7273 | if not hasattr(self, "DIRECTORY_ENTRY_IMPORT"): |
| 7274 | return False |
| 7275 | |
| 7276 | # self.DIRECTORY_ENTRY_IMPORT will now exist, although it may be empty. |
| 7277 | # If it imports from "ntoskrnl.exe" or other kernel components it should |
| 7278 | # be a driver |
| 7279 | # |
| 7280 | system_DLLs = set( |
| 7281 | (b"ntoskrnl.exe", b"hal.dll", b"ndis.sys", b"bootvid.dll", b"kdcom.dll") |
| 7282 | ) |
| 7283 | if system_DLLs.intersection( |
| 7284 | [imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT] |
| 7285 | ): |
| 7286 | return True |
| 7287 | |
| 7288 | driver_like_section_names = set((b"page", b"paged")) |
| 7289 | if driver_like_section_names.intersection( |
| 7290 | [section.Name.lower().rstrip(b"\x00") for section in self.sections] |
| 7291 | ) and ( |
| 7292 | self.OPTIONAL_HEADER.Subsystem |
| 7293 | in ( |
| 7294 | SUBSYSTEM_TYPE["IMAGE_SUBSYSTEM_NATIVE"], |
| 7295 | SUBSYSTEM_TYPE["IMAGE_SUBSYSTEM_NATIVE_WINDOWS"], |
| 7296 | ) |
| 7297 | ): |
| 7298 | return True |
| 7299 | |
| 7300 | return False |
| 7301 |
no test coverage detected