QuasarApp/pe-parse
4
0
Fork 0
mirror of https://github.com/QuasarApp/pe-parse.git synced 2025-04-30 06:14:36 +00:00
Code Issues Projects Releases Wiki Activity
109 Commits 3 Branches 0 Tags
Commit Graph

43 Commits

Author SHA1 Message Date
Wesley Shields
ec5c49eaff Make resource parsing more resilient. 
I have a UPX packed sample that corrupted the resource directory. These changes
allow the resources to be properly parsed.

They add an RVA and size to the resource struct. This is the address and size
of the resource as it is declared in the directory. If the address is invalid
create a zero-length buffer for the data. If the size is invalid (ie: it goes
off the end of the .rsrc section) create a zero-length buffer for the data.
Otherwise, return the actual data.

This allows consumers of the rsrc to figure out if the resource is corrupt
or not by comparing the length of the buffer to the size element. If the
size is greater than 0 but buffer is empty then it's invalid.

Also, it should never happen but just to be safe make pepy catch NULL
buffers (in pepy_data_converter) and return an empty bytearray.
 2013-12-30 16:45:50 -05:00
Wesley Shields
b9d1592c50 Fix a type and expand a comment a bit. 2013-12-25 21:10:23 -05:00
Wesley Shields
8f9662cc92 Fix resource parsing so it works. ;) 
I had initially written this in such a way that it would break if there
were multiple entries anywhere other than the first table. This change
now works across more complex samples that I have tested against.

While here, I did a little moving around and had to create a structure
that isn't used other than to know how far to move the offset when
parsing. This is because the struct into which I am parsing the data
keeps track of other things along the way, so it's size is incorrect.

While here, change parse_resource() to be parse_resource_table() as it
is more accurate to what it really does.
 2013-12-25 21:01:55 -05:00
Wesley Shields
a6af4cbd18 Implement resource parsing. 
While here, fix a memory leak in pepy as I was not decrementing the
reference counter on self->data in section_dealloc().
 2013-12-24 12:41:59 -05:00
munin
5956722feb oops 2013-11-22 21:19:43 -05:00
munin
9492bf2e98 . 2013-11-22 19:28:04 -05:00
munin
5531d3a249 . 2013-11-11 15:09:57 -05:00
munin
a24fa560c0 more name changes 2013-07-31 13:39:58 -04:00
munin
5b55d18c2f change some names to reflect reality 2013-07-31 13:38:33 -04:00
munin
b8ea38a6c0 names can be stored at either of these RVAs 2013-07-31 10:58:59 -04:00
Andrew
b858d71272 more descriptive output to dump, rename some things 2013-07-30 19:24:31 -04:00
Andrew
8e37530a50 neat, now an API that reads bytes from the supplied VA 2013-07-30 19:20:09 -04:00
Andrew
2244945059 add an API for reading a byte from a VA 2013-07-30 19:09:31 -04:00
Andrew
92169e1d6e oversight, wasn't getting correct import addresses 2013-07-30 18:20:40 -04:00
Andrew
05f96a8a8b dumping relocations successfully now 2013-07-30 18:11:59 -04:00
Andrew
e83e171b8c support to print out relocations 2013-07-30 17:55:52 -04:00
Andrew
fe933ff9d6 now it gets the VAs of the addresses of imports 2013-07-26 21:37:23 -04:00
Andrew
afb2287fdd names, now, addresses 2013-07-26 21:32:16 -04:00
Andrew
182bad8cff problems somewhere 2013-07-26 21:21:05 -04:00
Andrew
ff9ea62612 getting module names.. 2013-07-26 18:58:28 -04:00
Andrew
fea370c30e find section logic 2013-07-26 17:52:53 -04:00
Andrew
3e1b2ea8d2 some definitions 2013-07-26 17:12:47 -04:00
Andrew
214b9c0329 add some more things 2013-07-26 16:42:30 -04:00
Andrew
94d9d1d468 section parsing okay.. 2013-07-26 16:41:36 -04:00
Andrew
72b32e0910 section parsing 2013-07-26 13:22:26 -04:00
Andrew
feb1d3391a parsing sections 2013-07-26 13:13:24 -04:00
Andrew
a9daa93099 new header for sections.. 2013-07-26 10:12:26 -04:00
Andrew
240928b373 pretty-printing meta-programming 2013-07-26 09:36:05 -04:00
Andrew
f84bffdebe read in data directory table 2013-07-25 19:10:26 -04:00
Andrew
1a3b1f2ccb license time 2013-07-25 18:59:25 -04:00
Andrew
5c738fd195 . 2013-07-25 18:55:53 -04:00
Andrew
194c54c570 . 2013-07-25 17:52:31 -04:00
Andrew
7f1406397e . 2013-07-25 17:49:32 -04:00
Andrew
12d91daa6f . 2013-07-25 17:42:06 -04:00
Andrew
91118152c2 . 2013-07-25 17:10:26 -04:00
Andrew
faf770c598 . 2013-07-25 16:52:03 -04:00
Andrew
83c258e202 . 2013-07-25 16:44:12 -04:00
Andrew
9ed4759bc7 . 2013-07-25 13:31:49 -04:00
Andrew
66046afe2e . 2013-07-25 12:13:10 -04:00
Andrew
166dd4e8df . 2013-07-24 19:15:53 -04:00
Andrew
4a2eb58e82 . 2013-07-24 18:52:38 -04:00
Andrew
20aee7ccb9 . 2013-07-24 18:32:56 -04:00
Andrew
d57fa227a8 . 2013-07-24 17:32:23 -04:00