Ejemplo n.º 1
0
 def getPdataEntries(self):
     sec = self.getSectionByName('.pdata')
     if sec == None:
         return ()
     ret = []
     rbytes = self.readAtRva(sec.VirtualAddress, sec.VirtualSize)
     while len(rbytes):
         f = vs_pe.IMAGE_RUNTIME_FUNCTION_ENTRY()
         f.vsParse(rbytes)
         rbytes = rbytes[len(f):]
         ret.append(f)
     return ret
Ejemplo n.º 2
0
    def getPdataEntries(self):
        """
        Parse out the PE's .pdata section bytes. 

        No parameters, just uses :class:`PE.getSectionByName` to get and parse .pdata 
        entries. 

        If the section doesn't exist, returns an empty tuple. 
        
        :returns: list of items found
        """
        sec = self.getSectionByName('.pdata')
        if sec == None:
            return []
        ret = []
        rbytes = self.readAtRva(sec.VirtualAddress, sec.VirtualSize)
        while len(rbytes):
            f = vs_pe.IMAGE_RUNTIME_FUNCTION_ENTRY()
            f.vsParse(rbytes)
            rbytes = rbytes[len(f):]
            ret.append(f)
        return ret