Python PE.rva2ofs Examples

Example #1

File: flow2.py Project: logan-m-lamb/pev

        # read the next instruction
        code = f.read()
        iterable = distorm3.DecomposeGenerator(offset, code, dt, \
            distorm3.DF_RETURN_FC_ONLY | distorm3.DF_STOP_ON_FLOW_CONTROL)
        inst = iterable.next()

        # if we've encountered a loop exit
        if hasAddr(inst.address):
            print 'Found a loop!', hex(inst.address), inst, inst.flowControl
            return
        workRva = inst.address

if __name__ == '__main__':
    f = PE(open('print.exe', 'rb'))
    print 'ImageBase', f.imagebase
    print 'entrypoint ofs', hex(f.rva2ofs(f.entrypoint))
    getExterns(f)

    # some datastructure of interest
    workQ = collections.deque()

    # distorm3 
    dt = distorm3.Decode32Bits

    # inst1
    f.seek(f.rva2ofs(f.entrypoint))
    code = f.read()

    workQ.append(f.entrypoint)

    while workQ:

Example #2

File: test.py Project: logan-m-lamb/pev

import os
from pe import PE
import distorm3

# distorm3 things
offset = 0
dt = distorm3.Decode32Bits

f = open('print.exe', 'rb')
o = PE(f)

# distorm3 
f.seek(o.rva2ofs(o.entrypoint))
code = f.read()

iterable = distorm3.DecomposeGenerator(offset, code, dt, \
    distorm3.DF_RETURN_FC_ONLY | distorm3.DF_STOP_ON_FLOW_CONTROL)

print iterable.next()

Example #3

File: flow.py Project: logan-m-lamb/pev

import os
import sys
from pe import PE
import distorm3

encountered = list()
def hasAddr(addr):
    for r in encountered:
        if addr in r:
            return True
    return False

if __name__ == '__main__':
    pe = PE(open('print.exe', 'rb'))
    print 'ImageBase', pe.imagebase
    print 'entrypoint ofs', hex(pe.rva2ofs(pe.entrypoint))

    # distorm3 
    dt = distorm3.Decode32Bits

    # inst1
    pe.seek(pe.rva2ofs(pe.entrypoint))
    code = pe.read()

    offset = pe.entrypoint
    iterable = distorm3.DecomposeGenerator(offset, code, dt, \
        distorm3.DF_RETURN_FC_ONLY | distorm3.DF_STOP_ON_FLOW_CONTROL)

    inst = iterable.next()
    
    # add what we've encountered