(self)
| 70 | |
| 71 | |
| 72 | def test_dll(self): |
| 73 | dll_filepath = PATH_INJECTABLES + "TestDLL.dll" |
| 74 | superpe = SuperPe(dll_filepath) |
| 75 | |
| 76 | # Properties |
| 77 | self.assertTrue(superpe.is_dll()) |
| 78 | self.assertTrue(superpe.is_64()) |
| 79 | self.assertFalse(superpe.is_dotnet()) |
| 80 | self.assertEqual(superpe.get_entrypoint(), 0x13B0) |
| 81 | self.assertIsNone(superpe.get_rwx_section()) |
| 82 | |
| 83 | self.assertEqual(superpe.get_image_base(), 0x180000000) |
| 84 | self.assertEqual(superpe.is_dynamic_base(), True) |
| 85 | |
| 86 | # Text Section 1 (pefile SectionStructure) |
| 87 | code_sect: pefile.SectionStructure = superpe.get_code_section() |
| 88 | self.assertEqual(code_sect.Name.decode(), ".text\x00\x00\x00") |
| 89 | self.assertEqual(code_sect.VirtualAddress, 0x1000) |
| 90 | self.assertEqual(code_sect.Misc_VirtualSize, 3912) |
| 91 | |
| 92 | # Text Section 2 (PeSection) |
| 93 | code_pesect: PeSection|None = superpe.get_section_by_name(".text") |
| 94 | self.assertIsNotNone(code_pesect) |
| 95 | if code_pesect is not None: |
| 96 | self.assertEqual(code_pesect.name, ".text") |
| 97 | self.assertEqual(code_pesect.virt_addr, 0x1000) |
| 98 | self.assertEqual(code_pesect.virt_size, 3912) |
| 99 | |
| 100 | # Relocations |
| 101 | base_relocs: List[PeRelocEntry] = superpe.get_base_relocs() |
| 102 | self.assertEqual(len(base_relocs), 17) |
| 103 | base_reloc = base_relocs[0] |
| 104 | self.assertEqual(base_reloc.rva, 0x20F8) |
| 105 | self.assertEqual(base_reloc.base_rva, 0x2000) |
| 106 | self.assertEqual(base_reloc.offset, 0xF8) |
| 107 | |
| 108 | # IAT |
| 109 | iat_entries: Dict[str, List[IatEntry]] = superpe.get_iat_entries() |
| 110 | self.assertEqual(len(iat_entries), 4) |
| 111 | self.assertTrue("kernel32.dll" in iat_entries) |
| 112 | self.assertTrue("vcruntime140.dll" in iat_entries) |
| 113 | |
| 114 | kernel32_entries = iat_entries["kernel32.dll"] |
| 115 | self.assertEqual(len(kernel32_entries), 14) |
| 116 | entry = kernel32_entries[0] |
| 117 | self.assertEqual(entry.dll_name, "kernel32.dll") |
| 118 | self.assertEqual(entry.func_name, "GetSystemTimeAsFileTime") |
| 119 | self.assertEqual(entry.iat_vaddr, 0x180002000) |
| 120 | |
| 121 | self.assertIsNone(superpe.get_vaddr_of_iatentry("asdf")) |
| 122 | self.assertEqual(superpe.get_vaddr_of_iatentry("RtlCaptureContext"), 0x180002008) |
| 123 | |
| 124 | # bad test, but result is random |
| 125 | self.assertNotEqual(superpe.get_replacement_iat_for( |
| 126 | "kernel32.dll", "GetEnvironmentStringsW"), "GetEnvironmentStringsW") |
| 127 | |
| 128 | # Exports |
| 129 | exports = superpe.get_exports_full() |
nothing calls this directly
no test coverage detected