Return the section that contains the entrypoint and is executable
(self)
| 95 | ## Section Access |
| 96 | |
| 97 | def get_code_section(self) -> pefile.SectionStructure: |
| 98 | """Return the section that contains the entrypoint and is executable""" |
| 99 | entrypoint = self.pe.OPTIONAL_HEADER.AddressOfEntryPoint |
| 100 | for sect in self.pe.sections: |
| 101 | if sect.Characteristics & pefile.SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_EXECUTE']: |
| 102 | if entrypoint >= sect.VirtualAddress and entrypoint <= sect.VirtualAddress + sect.Misc_VirtualSize: |
| 103 | return sect |
| 104 | |
| 105 | # there should always be a code section. Always. |
| 106 | raise Exception("pehelper::get_code_section(): Code section not found") |
| 107 | |
| 108 | |
| 109 | def get_code_section_data(self) -> bytes: |
no outgoing calls