Пример #1
0
    def _ConvertFromOffset(self):
        offset = self._offset.GetValue()
        
        if not offset:
            offset = 0
        else:
            offset = int(offset, 16)

        try:
            if not offset < self._pe.sections[0].PointerToRawData:
                rva = self._pe.get_rva_from_offset(offset)
            else:
                rva = offset
                
            va = rva + self._pe.OPTIONAL_HEADER.ImageBase
            
            idx = pedata.guess_section_from_rva(self._pe, rva)
            if idx == -1:
                section = "HEADER"
            else:
                section = self._pe.sections[idx].Name
            
            bytes = get_hex_bytes(self._pe.get_data(rva, 16))
            
            self.PrintDataInCtrls(rva, va, offset, section, bytes)
            
        except Exception, e:
            self._ShowError(e)
Пример #2
0
 def _ConvertFromRVA(self):
     rva = self._rva.GetValue()
     if not rva:
         rva = 0
     else:
         rva = int(rva, 16)
     
     try:
         offset = pedata.fromRvaToOffset(self._pe, rva)
         va = rva + self._pe.OPTIONAL_HEADER.ImageBase
         
         idx = pedata.guess_section_from_rva(self._pe, rva)
         if idx == -1:
             section = "Header"
         else:
             section = self._pe.sections[idx].Name
             
         bytes = get_hex_bytes(self._pe.get_data(rva, 16))
         
         self.PrintDataInCtrls(rva, va, offset, section, bytes)
         
     except Exception, e:
         #import traceback
         #traceback.print_exc()
         self._ShowError(e)
Пример #3
0
    def OnBlockSelected(self, event):
        self.BlocksItems.DeleteAllItems()
        item_id = self.Blocks.GetFirstSelected()
        item = self.Blocks.GetItem(item_id, 0)
        index = item.GetText()

        #wx.MessageBox("index: %d" % int(index), "index")

        reloc_dir = pedata.getRelocDirectory(self.__pe)

        items_index = 1
        entries = pedata.getRelocDataEntry(
            reloc_dir[int(index) - 1])  # -1 because index starts in 1

        for entry in entries:
            index = self.BlocksItems.InsertStringItem(sys.maxint,
                                                      str(items_index))

            entry_rva = entry.rva
            entry_type = entry.type

            if entry_type >= 0:

                entry_far_address = self.__pe.get_dword_at_rva(entry_rva)
                entry_offset = self.__pe.get_offset_from_rva(entry_rva)
                entry_rva_data = entry_far_address - self.__pe.OPTIONAL_HEADER.ImageBase

                try:
                    entry_data = self.__pe.get_data(entry_rva_data, 10)
                    bytes = get_hex_bytes(entry_data)
                    if not bytes:
                        bytes = "-"
                except pefile.PEFormatError:
                    bytes = "-"

                self.BlocksItems.SetStringItem(index, 5, "%s" % bytes)

                if entry_type == 0:  # ABSOLUTE
                    self.BlocksItems.SetStringItem(index, 0, str(items_index))
                    self.BlocksItems.SetStringItem(index, 1, "-")
                    self.BlocksItems.SetStringItem(index, 2, "-")
                    self.BlocksItems.SetStringItem(
                        index, 3,
                        "%s (%d)" % (reloc_types[entry_type], entry_type))
                    self.BlocksItems.SetStringItem(index, 4, "-")
                else:
                    self.BlocksItems.SetStringItem(index, 0, str(items_index))
                    self.BlocksItems.SetStringItem(index, 1, hex_up(entry_rva))
                    self.BlocksItems.SetStringItem(index, 2,
                                                   hex_up(entry_offset))
                    self.BlocksItems.SetStringItem(
                        index, 3,
                        "%s (%d)" % (reloc_types[entry_type], entry_type))
                    self.BlocksItems.SetStringItem(index, 4,
                                                   hex_up(entry_far_address))

                items_index += 1
Пример #4
0
    def OnBlockSelected(self, event):
        self.BlocksItems.DeleteAllItems()
        item_id = self.Blocks.GetFirstSelected()
        item = self.Blocks.GetItem(item_id, 0)
        index = item.GetText()
        
        #wx.MessageBox("index: %d" % int(index), "index")
        
        reloc_dir = pedata.getRelocDirectory(self.__pe)
        
        items_index = 1
        entries = pedata.getRelocDataEntry(reloc_dir[int(index) - 1]) # -1 because index starts in 1
        
        for entry in entries:
            index = self.BlocksItems.InsertStringItem(sys.maxint, str(items_index))
            
            entry_rva = entry.rva
            entry_type = entry.type

            if entry_type >= 0:
                
                entry_far_address = self.__pe.get_dword_at_rva(entry_rva)
                entry_offset = self.__pe.get_offset_from_rva(entry_rva)
                entry_rva_data = entry_far_address - self.__pe.OPTIONAL_HEADER.ImageBase
                
                try:
                    entry_data = self.__pe.get_data(entry_rva_data, 10)
                    bytes = get_hex_bytes(entry_data)
                    if not bytes:
                        bytes = "-"
                except pefile.PEFormatError:
                    bytes = "-"
                
                self.BlocksItems.SetStringItem(index, 5, "%s" % bytes)
                
                if entry_type == 0: # ABSOLUTE
                    self.BlocksItems.SetStringItem(index, 0, str(items_index))
                    self.BlocksItems.SetStringItem(index, 1, "-")
                    self.BlocksItems.SetStringItem(index, 2, "-")
                    self.BlocksItems.SetStringItem(index, 3, "%s (%d)" % (reloc_types[entry_type], entry_type))
                    self.BlocksItems.SetStringItem(index, 4, "-")
                else:
                    self.BlocksItems.SetStringItem(index, 0, str(items_index))
                    self.BlocksItems.SetStringItem(index, 1, hex_up(entry_rva))
                    self.BlocksItems.SetStringItem(index, 2, hex_up(entry_offset))
                    self.BlocksItems.SetStringItem(index, 3, "%s (%d)" % (reloc_types[entry_type], entry_type))
                    self.BlocksItems.SetStringItem(index, 4, hex_up(entry_far_address))
                
                items_index += 1
Пример #5
0
    def _ConvertFromVA(self):
        va = self._va.GetValue()
        if not va:
            va = 0
        else:
            va = int(va, 16)
            
        try:
            rva = va - self._pe.OPTIONAL_HEADER.ImageBase
            offset = pedata.fromRvaToOffset(self._pe, rva)

            idx = pedata.guess_section_from_rva(self._pe, rva)
            if idx == -1:
                section = "HEADER"
            else:
                section = self._pe.sections[idx].Name

            bytes = get_hex_bytes(self._pe.get_data(rva, 16))
            
            self.PrintDataInCtrls(rva, va, offset, section, bytes)
            
        except Exception, e:
            self._ShowError(e)