Skip to content

Commit a7a992a

Browse files
kdbghelpkdbghelp
committed
pe header dump
1 parent d732027 commit a7a992a

File tree

1 file changed

+206
-3
lines changed

1 file changed

+206
-3
lines changed

‎util/pedump.py

+206-3
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,115 @@ def __init__(self, data):
8181
self.NumberOfSymbols = struct.unpack("I", data[self.e_lfanew + 16:self.e_lfanew + 20])[0]
8282
self.SizeOfOptionalHeader = struct.unpack("H", data[self.e_lfanew + 20:self.e_lfanew + 22])[0]
8383
self.Characteristics = struct.unpack("H", data[self.e_lfanew + 22:self.e_lfanew + 24])[0]
84-
84+
85+
#COFF Fields
86+
self.Magic = struct.unpack("H", data[self.e_lfanew + 24:self.e_lfanew + 26])[0]
87+
self.MajorLinkerVersion = struct.unpack("B", data[self.e_lfanew + 26:self.e_lfanew + 27])[0]
88+
self.MinorLinkerVersion = struct.unpack("B", data[self.e_lfanew + 27:self.e_lfanew + 28])[0]
89+
self.SizeOfCode = struct.unpack("I", data[self.e_lfanew + 28:self.e_lfanew + 32])[0]
90+
self.SizeOfInitializedData = struct.unpack("I", data[self.e_lfanew + 32:self.e_lfanew + 36])[0]
91+
self.SizeOfUninitializedData = struct.unpack("I", data[self.e_lfanew + 36:self.e_lfanew + 40])[0]
92+
self.AddressOfEntryPoint = struct.unpack("I", data[self.e_lfanew + 40:self.e_lfanew + 44])[0]
93+
self.BaseOfCode = struct.unpack("I", data[self.e_lfanew + 44:self.e_lfanew + 48])[0]
94+
self.BaseOfData = struct.unpack("I", data[self.e_lfanew + 48:self.e_lfanew + 52])[0]
95+
96+
#Windows Specific Fields
97+
self.ImageBase = struct.unpack("I", data[self.e_lfanew + 52:self.e_lfanew + 56])[0]
98+
self.SectionAlignment = struct.unpack("I", data[self.e_lfanew + 56:self.e_lfanew + 60])[0]
99+
self.FileAlignment = struct.unpack("I", data[self.e_lfanew + 60:self.e_lfanew + 64])[0]
100+
self.MajorOperatingSystemVersion = struct.unpack("H", data[self.e_lfanew + 64:self.e_lfanew + 66])[0]
101+
self.MinorOperatingSystemVersion = struct.unpack("H", data[self.e_lfanew + 66:self.e_lfanew + 68])[0]
102+
self.MajorImageVersion = struct.unpack("H", data[self.e_lfanew + 68:self.e_lfanew + 70])[0]
103+
self.MinorImageVersion = struct.unpack("H", data[self.e_lfanew + 70:self.e_lfanew + 72])[0]
104+
self.MajorSubsystemVersion = struct.unpack("H", data[self.e_lfanew + 72:self.e_lfanew + 74])[0]
105+
self.MinorSubsystemVersion = struct.unpack("H", data[self.e_lfanew + 74:self.e_lfanew + 76])[0]
106+
self.Win32VersionValue = struct.unpack("I", data[self.e_lfanew + 76:self.e_lfanew + 80])[0]
107+
self.SizeOfImage = struct.unpack("I", data[self.e_lfanew + 80:self.e_lfanew + 84])[0]
108+
self.SizeOfHeaders = struct.unpack("I", data[self.e_lfanew + 84:self.e_lfanew + 88])[0]
109+
self.CheckSum = struct.unpack("I", data[self.e_lfanew + 88:self.e_lfanew + 92])[0]
110+
self.Subsystem = struct.unpack("H", data[self.e_lfanew + 92:self.e_lfanew + 94])[0]
111+
self.DllCharacteristics = struct.unpack("H", data[self.e_lfanew + 94:self.e_lfanew + 96])[0]
112+
self.SizeOfStackReserve = struct.unpack("I", data[self.e_lfanew + 96:self.e_lfanew + 100])[0]
113+
self.SizeOfStackCommit = struct.unpack("I", data[self.e_lfanew + 100:self.e_lfanew + 104])[0]
114+
self.SizeOfHeapReserve = struct.unpack("I", data[self.e_lfanew + 104:self.e_lfanew + 108])[0]
115+
self.SizeOfHeapCommit = struct.unpack("I", data[self.e_lfanew + 108:self.e_lfanew + 112])[0]
116+
self.LoaderFlags = struct.unpack("I", data[self.e_lfanew + 112:self.e_lfanew + 116])[0]
117+
self.NumberOfRvaAndSizes = struct.unpack("I", data[self.e_lfanew + 116:self.e_lfanew + 120])[0]
118+
119+
#Data Directory
120+
self.ExportTable = struct.unpack("I", data[self.e_lfanew + 120:self.e_lfanew + 124])[0]
121+
self.SizeOfExportTable = struct.unpack("I", data[self.e_lfanew + 124:self.e_lfanew + 128])[0]
122+
123+
self.ImportTable = struct.unpack("I", data[self.e_lfanew + 128:self.e_lfanew + 132])[0]
124+
self.SizeOfImportTable = struct.unpack("I", data[self.e_lfanew + 132:self.e_lfanew + 136])[0]
125+
126+
self.ResourceTable = struct.unpack("I", data[self.e_lfanew + 136:self.e_lfanew + 140])[0]
127+
self.SizeOfResourceTable = struct.unpack("I", data[self.e_lfanew + 140:self.e_lfanew + 144])[0]
128+
129+
self.ExceptionTable = struct.unpack("I", data[self.e_lfanew + 144:self.e_lfanew + 148])[0]
130+
self.SizeOfExceptionTable = struct.unpack("I", data[self.e_lfanew + 148:self.e_lfanew + 152])[0]
131+
132+
self.CertificateTable = struct.unpack("I", data[self.e_lfanew + 152:self.e_lfanew + 156])[0]
133+
self.SizeOfCertificateTable = struct.unpack("I", data[self.e_lfanew + 156:self.e_lfanew + 160])[0]
134+
135+
self.BaseRelocationTable = struct.unpack("I", data[self.e_lfanew + 160:self.e_lfanew + 164])[0]
136+
self.SizeOfBaseRelocationTable = struct.unpack("I", data[self.e_lfanew + 164:self.e_lfanew + 168])[0]
137+
138+
self.Debug = struct.unpack("I", data[self.e_lfanew + 168:self.e_lfanew + 172])[0]
139+
self.SizeOfDebug = struct.unpack("I", data[self.e_lfanew + 172:self.e_lfanew + 176])[0]
140+
141+
self.ArchitectureData = struct.unpack("I", data[self.e_lfanew + 176:self.e_lfanew + 180])[0]
142+
self.SizeOfArchitectureData = struct.unpack("I", data[self.e_lfanew + 180:self.e_lfanew + 184])[0]
143+
144+
self.GlobalPtr = struct.unpack("I", data[self.e_lfanew + 184:self.e_lfanew + 188])[0]
145+
self.SizeOfGlobalPtr = struct.unpack("I", data[self.e_lfanew + 188:self.e_lfanew + 192])[0]
146+
147+
self.TLSTable = struct.unpack("I", data[self.e_lfanew + 192:self.e_lfanew + 196])[0]
148+
self.SizeOfTLSTable = struct.unpack("I", data[self.e_lfanew + 196:self.e_lfanew + 200])[0]
149+
150+
self.LoadConfigTable = struct.unpack("I", data[self.e_lfanew + 200:self.e_lfanew + 204])[0]
151+
self.SizeOfLoadConfigTable = struct.unpack("I", data[self.e_lfanew + 204:self.e_lfanew + 208])[0]
152+
153+
self.BoundImport = struct.unpack("I", data[self.e_lfanew + 208:self.e_lfanew + 212])[0]
154+
self.SizeOfBoundImoprt = struct.unpack("I", data[self.e_lfanew + 212:self.e_lfanew + 216])[0]
155+
156+
self.ImportAddressTable = struct.unpack("I", data[self.e_lfanew + 216:self.e_lfanew + 220])[0]
157+
self.SizeOfImportAddressTable = struct.unpack("I", data[self.e_lfanew + 220:self.e_lfanew + 224])[0]
158+
159+
self.DelayImportDescriptor = struct.unpack("I", data[self.e_lfanew + 224:self.e_lfanew + 228])[0]
160+
self.SizeOfDelayImportDescriptor = struct.unpack("I", data[self.e_lfanew + 228:self.e_lfanew + 232])[0]
161+
162+
self.CLRRuntimeHeader = struct.unpack("I", data[self.e_lfanew + 232:self.e_lfanew + 236])[0]
163+
self.SizeOfCLRRuntimeHeader = struct.unpack("I", data[self.e_lfanew + 236:self.e_lfanew + 240])[0]
164+
165+
self.Reserved = struct.unpack("I", data[self.e_lfanew + 240:self.e_lfanew + 244])[0]
166+
self.SizeOfReserved = struct.unpack("I", data[self.e_lfanew + 244:self.e_lfanew + 248])[0]
167+
168+
self.sections = {}
169+
pos = self.e_lfanew + 248
170+
for _ in xrange(self.NumberOfSections):
171+
name = struct.unpack("8s", data[pos:pos + 8])[0]
172+
VirtualSize = struct.unpack("I", data[pos + 8:pos + 12])[0]
173+
VirtualAddress = struct.unpack("I", data[pos + 12:pos + 16])[0]
174+
SizeOfRawData = struct.unpack("I", data[pos + 16:pos + 20])[0]
175+
PointerToRawData = struct.unpack("I", data[pos + 20:pos + 24])[0]
176+
PointerToRelocations = struct.unpack("I", data[pos + 24:pos + 28])[0]
177+
PointerToLineNumbers = struct.unpack("I", data[pos + 28:pos + 32])[0]
178+
NumberOfRelocations = struct.unpack("H", data[pos + 32:pos + 34])[0]
179+
NumberOfLineNumbers = struct.unpack("H", data[pos + 34:pos + 36])[0]
180+
Characteristics = struct.unpack("I", data[pos + 36:pos + 40])[0]
181+
182+
self.sections[name] = (name, VirtualSize, VirtualAddress, SizeOfRawData,
183+
PointerToRawData, PointerToRelocations, PointerToLineNumbers,
184+
NumberOfRelocations, NumberOfLineNumbers, Characteristics)
185+
pos = pos + 8 + 4 + 4 + 4 + 4 + 4 + 4 + 2 + 2 + 4
186+
187+
188+
85189

86190
def __repr__(self, *args, **kwargs):
87191
dos_header = DosHeader.__repr__(self, *args, **kwargs)
88-
return dos_header + '''
192+
pe_header = '''
89193
**** Pe Header ****
90194
Signature: 0x%08X
91195
Machine: 0x%04X
@@ -95,10 +199,109 @@ def __repr__(self, *args, **kwargs):
95199
NumberOfSymbols: 0x%08X
96200
SizeOfOptionalHeader: 0x%04X
97201
Characteristics: 0x%04X
202+
203+
Magic: 0x%04X
204+
MajorLinkerVersion: 0x%02X
205+
MinorLinkerVersion: 0x%02X
206+
SizeOfCode: 0x%08X
207+
SizeOfInitializedData: 0x%08X
208+
SizeOfUninitializedData: 0x%08X
209+
AddressOfEntryPoint: 0x%08X
210+
BaseOfCode: 0x%08X
211+
BaseOfData: 0x%08X
212+
ImageBase: 0x%08X
213+
SectionAlignment: 0x%08X
214+
FileAlignment: 0x%08X
215+
MajorOperatingSystemVersion: 0x%04X
216+
MinorOperatingSystemVersion: 0x%04X
217+
MajorImageVersion: 0x%04X
218+
MinorImageVersion: 0x%04X
219+
MajorSubsystemVersion: 0x%04X
220+
MinorSubsystemVersion: 0x%04X
221+
Win32VersionValue 0x%08X
222+
SizeOfImage: 0x%08X
223+
SizeOfHeaders: 0x%08X
224+
CheckSum: 0x%08X
225+
Subsystem: 0x%04X
226+
DllCharacteristics: 0x%04X
227+
SizeOfStackReserve: 0x%08X
228+
SizeOfStackCommit: 0x%08X
229+
SizeOfHeapReserve: 0x%08X
230+
SizeOfHeapCommit: 0x%08X
231+
LoaderFlags: 0x%08X
232+
NumberOfRvaAndSizes: 0x%08X
233+
234+
#Data Directory
235+
ExportTable: 0x%08X, SizeOfExportTable: 0x%08X
236+
ImportTable: 0x%08X, SizeOfImportTable: 0x%08X
237+
ResourceTable: 0x%08X, SizeOfResourceTable: 0x%08X
238+
ExceptionTable: 0x%08X, SizeOfExceptionTable: 0x%08X
239+
CertificateTable: 0x%08X, SizeOfCertificateTable: 0x%08X
240+
BaseRelocationTable: 0x%08X, SizeOfBaseRelocationTable: 0x%08X
241+
Debug: 0x%08X, SizeOfDebug: 0x%08X
242+
ArchitectureData: 0x%08X, SizeOfArchitectureData: 0x%08X
243+
GlobalPtr: 0x%08X, SizeOfGlobalPtr: 0x%08X
244+
TLSTable: 0x%08X, SizeOfTLSTable: 0x%08X
245+
LoadConfigTable: 0x%08X, SizeOfLoadConfigTable: 0x%08X
246+
BoundImport: 0x%08X, SizeOfBoundImoprt: 0x%08X
247+
ImportAddressTable: 0x%08X, SizeOfImportAddressTable: 0x%08X
248+
DelayImportDescriptor: 0x%08X, SizeOfDelayImportDescriptor: 0x%08X
249+
CLRRuntimeHeader: 0x%08X, SizeOfCLRRuntimeHeader: 0x%08X
250+
Reserved: 0x%08X, SizeOfReserved: 0x%08X
98251
''' % (
99252
self.Signature, self.Machine, self.NumberOfSections, self.TimeDateStamp, time.ctime(self.TimeDateStamp),
100-
self.PointerToSymbolTable, self.NumberOfSymbols, self.SizeOfOptionalHeader, self.Characteristics
253+
self.PointerToSymbolTable, self.NumberOfSymbols, self.SizeOfOptionalHeader, self.Characteristics,
254+
255+
#COFF Fields
256+
self.Magic, self.MajorLinkerVersion, self.MinorLinkerVersion, self.SizeOfCode,
257+
self.SizeOfInitializedData, self.SizeOfUninitializedData, self.AddressOfEntryPoint ,
258+
self.BaseOfCode, self.BaseOfData ,
259+
260+
#Windows Specific Fields
261+
self.ImageBase, self.SectionAlignment, self.FileAlignment, self.MajorOperatingSystemVersion ,
262+
self.MinorOperatingSystemVersion, self.MajorImageVersion, self.MinorImageVersion,
263+
self.MajorSubsystemVersion, self.MinorSubsystemVersion, self.Win32VersionValue,
264+
self.SizeOfImage, self.SizeOfHeaders, self.CheckSum, self.Subsystem, self.DllCharacteristics ,
265+
self.SizeOfStackReserve, self.SizeOfStackCommit, self.SizeOfHeapReserve,
266+
self.SizeOfHeapCommit, self.LoaderFlags, self.NumberOfRvaAndSizes,
267+
268+
#Data Directory
269+
self.ExportTable, self.SizeOfExportTable,
270+
self.ImportTable, self.SizeOfImportTable,
271+
self.ResourceTable, self.SizeOfResourceTable,
272+
self.ExceptionTable, self.SizeOfExceptionTable,
273+
self.CertificateTable, self.SizeOfCertificateTable,
274+
self.BaseRelocationTable, self.SizeOfBaseRelocationTable,
275+
self.Debug, self.SizeOfDebug,
276+
self.ArchitectureData, self.SizeOfArchitectureData,
277+
self.GlobalPtr, self.SizeOfGlobalPtr,
278+
self.TLSTable, self.SizeOfTLSTable,
279+
self.LoadConfigTable, self.SizeOfLoadConfigTable,
280+
self.BoundImport, self.SizeOfBoundImoprt,
281+
self.ImportAddressTable, self.SizeOfImportAddressTable,
282+
self.DelayImportDescriptor, self.SizeOfDelayImportDescriptor,
283+
self.CLRRuntimeHeader, self.SizeOfCLRRuntimeHeader,
284+
self.Reserved, self.SizeOfReserved
101285
)
286+
287+
sections = "#sections blow, total: %d\n" % (self.NumberOfSections)
288+
for val in self.sections.values():
289+
sections += '''
290+
name: %s
291+
VirtualSize: 0x%08X
292+
VirtualAddress: 0x%08X
293+
SizeOfRawData 0x%08X
294+
PointerToRawData: 0x%08X
295+
PointerToRelocations: 0x%08X
296+
PointerToLineNumbers: 0x%08X
297+
NumberOfRelocations: 0x%04X
298+
NumberOfLineNumbers: 0x%04X
299+
Characteristics: 0x%08X
300+
'''%(val[0], val[1], val[2], val[3], val[4], val[5],
301+
val[6], val[7], val[8], val[9]
302+
)
303+
304+
return dos_header + pe_header + sections
102305

103306

104307

0 commit comments

Comments
 (0)