19 Commits

Author SHA1 Message Date
Wesley Shields
ec5c49eaff Make resource parsing more resilient.
I have a UPX packed sample that corrupted the resource directory. These changes
allow the resources to be properly parsed.

They add an RVA and size to the resource struct. This is the address and size
of the resource as it is declared in the directory. If the address is invalid
create a zero-length buffer for the data. If the size is invalid (ie: it goes
off the end of the .rsrc section) create a zero-length buffer for the data.
Otherwise, return the actual data.

This allows consumers of the rsrc to figure out if the resource is corrupt
or not by comparing the length of the buffer to the size element. If the
size is greater than 0 but buffer is empty then it's invalid.

Also, it should never happen but just to be safe make pepy catch NULL
buffers (in pepy_data_converter) and return an empty bytearray.
2013-12-30 16:45:50 -05:00
Wesley Shields
a6af4cbd18 Implement resource parsing.
While here, fix a memory leak in pepy as I was not decrementing the
reference counter on self->data in section_dealloc().
2013-12-24 12:41:59 -05:00
munin
5531d3a249 . 2013-11-11 15:09:57 -05:00
munin
a67651d1f8 . 2013-07-31 14:10:16 -04:00
munin
5b55d18c2f change some names to reflect reality 2013-07-31 13:38:33 -04:00
Andrew
b858d71272 more descriptive output to dump, rename some things 2013-07-30 19:24:31 -04:00
Andrew
8e37530a50 neat, now an API that reads bytes from the supplied VA 2013-07-30 19:20:09 -04:00
Andrew
2244945059 add an API for reading a byte from a VA 2013-07-30 19:09:31 -04:00
Andrew
05f96a8a8b dumping relocations successfully now 2013-07-30 18:11:59 -04:00
Andrew
e83e171b8c support to print out relocations 2013-07-30 17:55:52 -04:00
Andrew
fe933ff9d6 now it gets the VAs of the addresses of imports 2013-07-26 21:37:23 -04:00
Andrew
afb2287fdd names, now, addresses 2013-07-26 21:32:16 -04:00
Andrew
182bad8cff problems somewhere 2013-07-26 21:21:05 -04:00
Andrew
fea370c30e find section logic 2013-07-26 17:52:53 -04:00
Andrew
94d9d1d468 section parsing okay.. 2013-07-26 16:41:36 -04:00
Andrew
32da0651ed dumping code and fields 2013-07-26 09:42:14 -04:00
Andrew
240928b373 pretty-printing meta-programming 2013-07-26 09:36:05 -04:00
Andrew
1a3b1f2ccb license time 2013-07-25 18:59:25 -04:00
Andrew
c91a37723d . 2013-07-24 18:33:07 -04:00