Package pype32 :: Module pype32 :: Class PE
[hide private]
[frames] | no frames]

Class PE

source code

object --+
         |
        PE

PE object.

Instance Methods [hide private]
 
__init__(self, pathToFile=None, data=None, fastLoad=False, verbose=False)
A class representation of the Portable Executable format.
source code
bool
hasMZSignature(self, rd)
Check for MZ signature.
source code
bool
hasPESignature(self, rd)
Check for PE signature.
source code
 
validate(self)
Performs validations over some fields of the PE structure to determine if the loaded file has a valid PE format.
source code
str
readFile(self, pathToFile)
Returns data from a file.
source code
str
write(self, filename='')
Writes data from PE object to a file.
source code
 
__write(self, thePath, theData)
Write data to a file.
source code
 
__len__(self) source code
 
__str__(self)
str(x)
source code
str
_updateDirectoriesData(self, peStr)
Updates the data in every Directory object.
source code
str
_getPaddingDataToSectionOffset(self)
Returns the data between the last section header and the begenning of data from the first section.
source code
str
_getSignature(self, readDataInstance, dataDirectoryInstance)
Returns the digital signature within a digital signed PE file.
source code
str
_getOverlay(self, readDataInstance, sectionHdrsInstance)
Returns the overlay data from the PE file.
source code
int
getOffsetFromRva(self, rva)
Converts an offset to an RVA.
source code
int
getRvaFromOffset(self, offset)
Converts a RVA to an offset.
source code
int
getSectionByOffset(self, offset)
Given an offset in the file, tries to determine the section this offset belong to.
source code
int
getSectionByRva(self, rva)
Given a RVA in the file, tries to determine the section this RVA belongs to.
source code
int
_getPaddingToSectionOffset(self)
Returns the offset to last section header present in the PE file.
source code
 
fullLoad(self)
Parse all the directories in the PE file.
source code
 
_internalParse(self, readDataInstance)
Populates the attributes of the PE object.
source code
 
addSection(self, data, name='.pype32\x00', flags=1610612736)
Adds a new section to the existing PE instance.
source code
 
extendSection(self, sectionIndex, data)
Extends an existing section in the PE instance.
source code
 
_fixPe(self)
Fixes the necessary fields in the PE file instance in order to create a valid PE32.
source code
int
_adjustFileAlignment(self, value, fileAlignment)
Align a value to FileAligment.
source code
int
_adjustSectionAlignment(self, value, fileAlignment, sectionAlignment)
Align a value to SectionAligment.
source code
DWORD
getDwordAtRva(self, rva)
Returns a DWORD from a given RVA.
source code
WORD
getWordAtRva(self, rva)
Returns a WORD from a given RVA.
source code
DWORD
getDwordAtOffset(self, offset)
Returns a DWORD from a given offset.
source code
WORD
getWordAtOffset(self, offset)
Returns a WORD from a given offset.
source code
QWORD
getQwordAtRva(self, rva)
Returns a QWORD from a given RVA.
source code
QWORD
getQwordAtOffset(self, offset)
Returns a QWORD from a given offset.
source code
str
getDataAtRva(self, rva, size)
Gets binary data at a given RVA.
source code
str
getDataAtOffset(self, offset, size)
Gets binary data at a given offset.
source code
String
readStringAtRva(self, rva)
Returns a String object from a given RVA.
source code
bool
isExe(self)
Determines if the current PE instance is an Executable file.
source code
bool
isDll(self)
Determines if the current PE instance is a Dynamic Link Library file.
source code
bool
isDriver(self)
Determines if the current PE instance is a driver (.sys) file.
source code
bool
isPe32(self)
Determines if the current PE instance is a PE32 file.
source code
bool
isPe64(self)
Determines if the current PE instance is a PE64 file.
source code
bool
isPeBounded(self)
Determines if the current PE instance is bounded, i.e.
source code
 
_parseDirectories(self, dataDirectoryInstance, magic=267)
Parses all the directories in the PE instance.
source code
str
_parseResourceDirectory(self, rva, size, magic=267)
Parses the IMAGE_RESOURCE_DIRECTORY directory.
source code
str
_parseExceptionDirectory(self, rva, size, magic=267)
Parses the IMAGE_EXCEPTION_DIRECTORY directory.
source code
str
_parseDelayImportDirectory(self, rva, size, magic=267)
Parses the delay imports directory.
source code
ImageBoundImportDescriptor
_parseBoundImportDirectory(self, rva, size, magic=267)
Parses the bound import directory.
source code
TLSDirectory
_parseTlsDirectory(self, rva, size, magic=267)
Parses the TLS directory.
source code
ImageBaseRelocation
_parseRelocsDirectory(self, rva, size, magic=267)
Parses the relocation directory.
source code
ImageExportTable
_parseExportDirectory(self, rva, size, magic=267)
Parses the IMAGE_EXPORT_DIRECTORY directory.
source code
ImageDebugDirectory
_parseDebugDirectory(self, rva, size, magic=267)
Parses the IMAGE_DEBUG_DIRECTORY directory.
source code
ImageImportDescriptor
_parseImportDirectory(self, rva, size, magic=267)
Parses the IMAGE_IMPORT_DIRECTORY directory.
source code
NETDirectory
_parseNetDirectory(self, rva, size, magic=267)
Parses the NET directory.
source code
str
getMd5(self)
Get MD5 hash from PE file.
source code
str
getSha1(self)
Get SHA1 hash from PE file.
source code
str
getSha256(self)
Get SHA256 hash from PE file.
source code
str
getSha512(self)
Get SHA512 hash from PE file.
source code
int
getCRC32(self)
Get CRC32 checksum from PE file.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __subclasshook__

Static Methods [hide private]
str
getDosStub()
Returns a default DOS stub.
source code
Instance Variables [hide private]
  dosHeader
DosHeader dosHeader.
  dosStub
str dosStub.
  ntHeaders
NtHeaders ntHeaders.
  sectionHeaders
SectionHeaders sectionHeaders.
  sections
Sections sections.
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, pathToFile=None, data=None, fastLoad=False, verbose=False)
(Constructor)

source code 

A class representation of the Portable Executable format.

Parameters:
  • pathToFile (str) - Path to the file to load.
  • data (str) - PE data to process.
  • fastLoad (bool) - If set to False, the PE class won't parse the directory data, just headers. The fullLoad method is available to load the directories in case the fastLoad parameter was set to False. If set to True, the entire PE will be parsed.
  • verbose (bool) - Verbose output.
Overrides: object.__init__

See Also: PE format http://msdn.microsoft.com/en-us/library/windows/desktop/ms680547%28v=vs.85%29.aspx

To Do:
  • Parse the Resource directory.
  • Parse the Delay Imports directory.
  • Parse the Exception directory.
  • Add dump() method to show nicely all the structure of the PE file.

hasMZSignature(self, rd)

source code 

Check for MZ signature.

Parameters:
Returns: bool
True is the given ReadData stream has the MZ signature. Otherwise, False.

hasPESignature(self, rd)

source code 

Check for PE signature.

Parameters:
Returns: bool
True is the given ReadData stream has the PE signature. Otherwise, False.

validate(self)

source code 

Performs validations over some fields of the PE structure to determine if the loaded file has a valid PE format.

Raises:
  • PEException - If an invalid value is found into the PE instance.

readFile(self, pathToFile)

source code 

Returns data from a file.

Parameters:
  • pathToFile (str) - Path to the file.
Returns: str
The data from file.

write(self, filename='')

source code 

Writes data from PE object to a file.

Returns: str
The PE stream data.
Raises:
  • IOError - If the file could not be opened for write operations.

__write(self, thePath, theData)

source code 

Write data to a file.

Parameters:
  • thePath (str) - The file path.
  • theData (str) - The data to write.

__str__(self)
(Informal representation operator)

source code 

str(x)

Overrides: object.__str__
(inherited documentation)

_updateDirectoriesData(self, peStr)

source code 

Updates the data in every Directory object.

Parameters:
  • peStr (str) - str representation of the PE object.
Returns: str
A str representation of the PE object.

_getPaddingDataToSectionOffset(self)

source code 

Returns the data between the last section header and the begenning of data from the first section.

Returns: str
Data between last section header and the begenning of the first section.

_getSignature(self, readDataInstance, dataDirectoryInstance)

source code 

Returns the digital signature within a digital signed PE file.

Parameters:
Returns: str
A string with the digital signature.
Raises:

_getOverlay(self, readDataInstance, sectionHdrsInstance)

source code 

Returns the overlay data from the PE file.

Parameters:
Returns: str
A string with the overlay data from the PE file.
Raises:

getOffsetFromRva(self, rva)

source code 

Converts an offset to an RVA.

Parameters:
  • rva (int) - The RVA to be converted.
Returns: int
An integer value representing an offset in the PE file.

getRvaFromOffset(self, offset)

source code 

Converts a RVA to an offset.

Parameters:
  • offset (int) - The offset value to be converted to RVA.
Returns: int
The RVA obtained from the given offset.

getSectionByOffset(self, offset)

source code 

Given an offset in the file, tries to determine the section this offset belong to.

Parameters:
  • offset (int) - Offset value.
Returns: int
An index, starting at 1, that represents the section the given offset belongs to.

getSectionByRva(self, rva)

source code 

Given a RVA in the file, tries to determine the section this RVA belongs to.

Parameters:
  • rva (int) - RVA value.
Returns: int
An index, starting at 1, that represents the section the given RVA belongs to.

getDosStub()
Static Method

source code 

Returns a default DOS stub.

Returns: str
A defaul DOS stub.

_getPaddingToSectionOffset(self)

source code 

Returns the offset to last section header present in the PE file.

Returns: int
The offset where the end of the last section header resides in the PE file.

_internalParse(self, readDataInstance)

source code 

Populates the attributes of the PE object.

Parameters:

addSection(self, data, name='.pype32\x00', flags=1610612736)

source code 

Adds a new section to the existing PE instance.

Parameters:
  • data (str) - The data to be added in the new section.
  • name (str) - (Optional) The name for the new section.
  • flags (int) - (Optional) The attributes for the new section.

extendSection(self, sectionIndex, data)

source code 

Extends an existing section in the PE instance.

Parameters:
  • sectionIndex (int) - The index for the section to be extended.
  • data (str) - The data to include in the section.
Raises:
  • IndexError - If an invalid sectionIndex was specified.
  • SectionHeadersException - If there is not section to extend.

_fixPe(self)

source code 

Fixes the necessary fields in the PE file instance in order to create a valid PE32. i.e. SizeOfImage.

_adjustFileAlignment(self, value, fileAlignment)

source code 

Align a value to FileAligment.

Parameters:
  • value (int) - The value to align.
  • fileAlignment (int) - The value to be used to align the value parameter.
Returns: int
The aligned value.

_adjustSectionAlignment(self, value, fileAlignment, sectionAlignment)

source code 

Align a value to SectionAligment.

Parameters:
  • value (int) - The value to be aligned.
  • fileAlignment (int) - The value to be used as FileAlignment.
  • sectionAlignment (int) - The value to be used as SectionAlignment.
Returns: int
The aligned value.

getDwordAtRva(self, rva)

source code 

Returns a DWORD from a given RVA.

Parameters:
  • rva (int) - The RVA to get the DWORD from.
Returns: DWORD
The DWORD obtained at the given RVA.

getWordAtRva(self, rva)

source code 

Returns a WORD from a given RVA.

Parameters:
  • rva (int) - The RVA to get the WORD from.
Returns: WORD
The WORD obtained at the given RVA.

getDwordAtOffset(self, offset)

source code 

Returns a DWORD from a given offset.

Parameters:
  • offset (int) - The offset to get the DWORD from.
Returns: DWORD
The DWORD obtained at the given offset.

getWordAtOffset(self, offset)

source code 

Returns a WORD from a given offset.

Parameters:
  • offset (int) - The offset to get the WORD from.
Returns: WORD
The WORD obtained at the given offset.

getQwordAtRva(self, rva)

source code 

Returns a QWORD from a given RVA.

Parameters:
  • rva (int) - The RVA to get the QWORD from.
Returns: QWORD
The QWORD obtained at the given RVA.

getQwordAtOffset(self, offset)

source code 

Returns a QWORD from a given offset.

Parameters:
  • offset (int) - The offset to get the QWORD from.
Returns: QWORD
The QWORD obtained at the given offset.

getDataAtRva(self, rva, size)

source code 

Gets binary data at a given RVA.

Parameters:
  • rva (int) - The RVA to get the data from.
  • size (int) - The size of the data to be obtained.
Returns: str
The data obtained at the given RVA.

getDataAtOffset(self, offset, size)

source code 

Gets binary data at a given offset.

Parameters:
  • offset (int) - The offset to get the data from.
  • size (int) - The size of the data to be obtained.
Returns: str
The data obtained at the given offset.

readStringAtRva(self, rva)

source code 

Returns a String object from a given RVA.

Parameters:
  • rva (int) - The RVA to get the string from.
Returns: String
A new String object from the given RVA.

isExe(self)

source code 

Determines if the current PE instance is an Executable file.

Returns: bool
True if the current PE instance is an Executable file. Otherwise, returns False.

isDll(self)

source code 

Determines if the current PE instance is a Dynamic Link Library file.

Returns: bool
True if the current PE instance is a DLL. Otherwise, returns False.

isDriver(self)

source code 

Determines if the current PE instance is a driver (.sys) file.

Returns: bool
True if the current PE instance is a driver. Otherwise, returns False.

isPe32(self)

source code 

Determines if the current PE instance is a PE32 file.

Returns: bool
True if the current PE instance is a PE32 file. Otherwise, returns False.

isPe64(self)

source code 

Determines if the current PE instance is a PE64 file.

Returns: bool
True if the current PE instance is a PE64 file. Otherwise, returns False.

isPeBounded(self)

source code 

Determines if the current PE instance is bounded, i.e. has a BOUND_IMPORT_DIRECTORY.

Returns: bool
Returns True if the current PE instance is bounded. Otherwise, returns False.

_parseDirectories(self, dataDirectoryInstance, magic=267)

source code 

Parses all the directories in the PE instance.

Parameters:

_parseResourceDirectory(self, rva, size, magic=267)

source code 

Parses the IMAGE_RESOURCE_DIRECTORY directory.

Parameters:
  • rva (int) - The RVA where the IMAGE_RESOURCE_DIRECTORY starts.
  • size (int) - The size of the IMAGE_RESOURCE_DIRECTORY directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: str
The IMAGE_RESOURCE_DIRECTORY data.

_parseExceptionDirectory(self, rva, size, magic=267)

source code 

Parses the IMAGE_EXCEPTION_DIRECTORY directory.

Parameters:
  • rva (int) - The RVA where the IMAGE_EXCEPTION_DIRECTORY starts.
  • size (int) - The size of the IMAGE_EXCEPTION_DIRECTORY directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: str
The IMAGE_EXCEPTION_DIRECTORY data.

_parseDelayImportDirectory(self, rva, size, magic=267)

source code 

Parses the delay imports directory.

Parameters:
  • rva (int) - The RVA where the delay imports directory starts.
  • size (int) - The size of the delay imports directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: str
The delay imports directory data.

_parseBoundImportDirectory(self, rva, size, magic=267)

source code 

Parses the bound import directory.

Parameters:
  • rva (int) - The RVA where the bound import directory starts.
  • size (int) - The size of the bound import directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: ImageBoundImportDescriptor
A new ImageBoundImportDescriptor object.

_parseTlsDirectory(self, rva, size, magic=267)

source code 

Parses the TLS directory.

Parameters:
  • rva (int) - The RVA where the TLS directory starts.
  • size (int) - The size of the TLS directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: TLSDirectory
A new TLSDirectory.

Note: if the PE instance is a PE64 file then a new TLSDirectory64 is returned.

_parseRelocsDirectory(self, rva, size, magic=267)

source code 

Parses the relocation directory.

Parameters:
  • rva (int) - The RVA where the relocation directory starts.
  • size (int) - The size of the relocation directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: ImageBaseRelocation
A new ImageBaseRelocation object.

_parseExportDirectory(self, rva, size, magic=267)

source code 

Parses the IMAGE_EXPORT_DIRECTORY directory.

Parameters:
  • rva (int) - The RVA where the IMAGE_EXPORT_DIRECTORY directory starts.
  • size (int) - The size of the IMAGE_EXPORT_DIRECTORY directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: ImageExportTable
A new ImageExportTable object.

_parseDebugDirectory(self, rva, size, magic=267)

source code 

Parses the IMAGE_DEBUG_DIRECTORY directory.

Parameters:
  • rva (int) - The RVA where the IMAGE_DEBUG_DIRECTORY directory starts.
  • size (int) - The size of the IMAGE_DEBUG_DIRECTORY directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: ImageDebugDirectory
A new ImageDebugDirectory object.

_parseImportDirectory(self, rva, size, magic=267)

source code 

Parses the IMAGE_IMPORT_DIRECTORY directory.

Parameters:
  • rva (int) - The RVA where the IMAGE_IMPORT_DIRECTORY directory starts.
  • size (int) - The size of the IMAGE_IMPORT_DIRECTORY directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: ImageImportDescriptor
A new ImageImportDescriptor object.
Raises:

_parseNetDirectory(self, rva, size, magic=267)

source code 

Parses the NET directory.

Parameters:
  • rva (int) - The RVA where the NET directory starts.
  • size (int) - The size of the NET directory.
  • magic (int) - (Optional) The type of PE. This value could be consts.PE32 or consts.PE64.
Returns: NETDirectory
A new NETDirectory object.

getMd5(self)

source code 

Get MD5 hash from PE file.

Returns: str
The MD5 hash from the PE instance.

getSha1(self)

source code 

Get SHA1 hash from PE file.

Returns: str
The SHA1 hash from the PE instance.

getSha256(self)

source code 

Get SHA256 hash from PE file.

Returns: str
The SHA256 hash from the PE instance.

getSha512(self)

source code 

Get SHA512 hash from PE file.

Returns: str
The SHA512 hash from the PE instance.

getCRC32(self)

source code 

Get CRC32 checksum from PE file.

Returns: int
The CRD32 checksum from the PE instance.