(self)
| 9 | class SuperPeTest(unittest.TestCase): |
| 10 | |
| 11 | def test_exe(self): |
| 12 | dll_filepath = PATH_INJECTABLES + "procexp64.exe" |
| 13 | superpe = SuperPe(dll_filepath) |
| 14 | |
| 15 | # Properties |
| 16 | self.assertFalse(superpe.is_dll()) |
| 17 | self.assertTrue(superpe.is_64()) |
| 18 | self.assertFalse(superpe.is_dotnet()) |
| 19 | self.assertEqual(superpe.get_entrypoint(), 0xE1D78) |
| 20 | self.assertIsNone(superpe.get_rwx_section()) |
| 21 | |
| 22 | self.assertEqual(superpe.get_image_base(), 0x140000000) |
| 23 | self.assertEqual(superpe.is_dynamic_base(), True) |
| 24 | |
| 25 | # Text Section 1 (pefile SectionStructure) |
| 26 | code_sect: pefile.SectionStructure = superpe.get_code_section() |
| 27 | self.assertEqual(code_sect.Name.decode(), ".text\x00\x00\x00") |
| 28 | self.assertEqual(code_sect.VirtualAddress, 0x1000) |
| 29 | self.assertEqual(code_sect.Misc_VirtualSize, 0x11B0CE) |
| 30 | |
| 31 | # Text Section 2 (PeSection) |
| 32 | code_pesect = superpe.get_section_by_name(".text") |
| 33 | self.assertIsNotNone(code_pesect) |
| 34 | if code_pesect is not None: |
| 35 | self.assertEqual(code_pesect.name, ".text") |
| 36 | self.assertEqual(code_pesect.virt_addr, 0x1000) |
| 37 | self.assertEqual(code_pesect.virt_size, 0x11B0CE) |
| 38 | |
| 39 | # Relocations |
| 40 | base_relocs: List[PeRelocEntry] = superpe.get_base_relocs() |
| 41 | self.assertEqual(len(base_relocs), 2864) |
| 42 | base_reloc = base_relocs[0] |
| 43 | self.assertEqual(base_reloc.rva, 0x11E618) |
| 44 | self.assertEqual(base_reloc.base_rva, 0x11E000) |
| 45 | self.assertEqual(base_reloc.offset, 0x618) |
| 46 | |
| 47 | # IAT |
| 48 | iat_entries: Dict[str, List[IatEntry]] = superpe.get_iat_entries() |
| 49 | self.assertEqual(len(iat_entries), 24) |
| 50 | self.assertTrue("kernel32.dll" in iat_entries) |
| 51 | self.assertTrue("uxtheme.dll" in iat_entries) |
| 52 | kernel32_entries = iat_entries["kernel32.dll"] |
| 53 | self.assertEqual(len(kernel32_entries), 218) |
| 54 | entry = kernel32_entries[0] |
| 55 | self.assertEqual(entry.dll_name, "kernel32.dll") |
| 56 | self.assertEqual(entry.func_name, "FileTimeToLocalFileTime") |
| 57 | self.assertEqual(entry.iat_vaddr, 0x14011D528) |
| 58 | |
| 59 | self.assertEqual(superpe.get_vaddr_of_iatentry("FileTimeToLocalFileTime"), 0x14011D528) |
| 60 | self.assertNotEqual(superpe.get_replacement_iat_for( |
| 61 | "kernel32.dll", "GetEnvironmentStringsW"), "GetEnvironmentStringsW") |
| 62 | |
| 63 | # Exports |
| 64 | exports = superpe.get_exports_full() |
| 65 | self.assertEqual(len(exports), 0) |
| 66 | |
| 67 | # VRA/Virt to Phys/Raw |
| 68 | #raw = superpe.get_offset_from_rva(0xD690) |
nothing calls this directly
no test coverage detected