pedump 0.2.0 → 0.2.1

data/VERSION

@@ -1 +1 @@
-0.2.0
+0.2.1

data/lib/pedump.rb

@@ -511,8 +511,12 @@ class PEdump
             end
         end
       end
-      if x.original_first_thunk != x.first_thunk
-        logger.warn "[?] import table: #{x.module_name}: original_first_thunk != first_thunk"
+      if x.original_first_thunk && !x.first_thunk
+        logger.warn "[?] import table: empty FirstThunk of #{x.module_name}"
+      elsif !x.original_first_thunk && x.first_thunk
+        logger.warn "[?] import table: empty OriginalFirstThunk of #{x.module_name}"
+      elsif x.original_first_thunk != x.first_thunk
+        logger.warn "[?] import table: OriginalFirstThunk != FirstThunk of #{x.module_name}"
       end
     end
   end
@@ -650,7 +654,7 @@ class PEdump
 
   def va2file va
     sections.each do |s|
-      if (s.VirtualAddress..(s.VirtualAddress+s.VirtualSize)).include?(va)
+      if (s.VirtualAddress...(s.VirtualAddress+s.VirtualSize)).include?(va)
         return va - s.VirtualAddress + s.PointerToRawData
       end
     end

data/lib/pedump/cli.rb

@@ -48,6 +48,9 @@ class PEdump::CLI
       opts.on "--all", "Dump all but #{(KNOWN_ACTIONS-DEFAULT_ALL_ACTIONS).join(',')} (default)" do
         @actions = DEFAULT_ALL_ACTIONS
       end
+      opts.on "--va2file VA", "Convert RVA to file offset" do |va|
+        @actions << [:va2file,va]
+      end
     end
 
     if (@argv = optparser.parse(@argv)).empty?
@@ -55,7 +58,7 @@ class PEdump::CLI
       return
     end
 
-    if (@actions-KNOWN_ACTIONS).any?
+    if (@actions-KNOWN_ACTIONS).any?{ |x| !x.is_a?(Array) }
       puts "[?] unknown actions: #{@actions-KNOWN_ACTIONS}"
       @actions.delete_if{ |x| !KNOWN_ACTIONS.include?(x) }
     end
@@ -95,6 +98,18 @@ class PEdump::CLI
   end
 
   def dump_action action, f
+    if action.is_a?(Array)
+      case action[0]
+      when :va2file
+        @pedump.sections(f)
+        va = action[1] =~ /(^0x)|(h$)/i ? action[1].to_i(16) : action[1].to_i
+        file_offset = @pedump.va2file(va)
+        printf "va2file(0x%x) = 0x%x  (%d)\n", va, file_offset, file_offset
+        return
+      else raise "unknown action #{action.inspect}"
+      end
+    end
+
     data = @pedump.send(action, f)
     return if !data || (data.respond_to?(:empty?) && data.empty?)
 

data/pedump.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = "pedump"
-  s.version = "0.2.0"
+  s.version = "0.2.1"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andrey \"Zed\" Zaikin"]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pedump
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ date: 2011-12-10 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70291670384640 !ruby/object:Gem::Requirement
+  requirement: &70303206510780 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,10 +21,10 @@ dependencies:
         version: 2.3.0
   type: :development
   prerelease: false
-  version_requirements: *70291670384640
+  version_requirements: *70303206510780
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70291670381860 !ruby/object:Gem::Requirement
+  requirement: &70303206635540 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -32,10 +32,10 @@ dependencies:
         version: 1.0.0
   type: :development
   prerelease: false
-  version_requirements: *70291670381860
+  version_requirements: *70303206635540
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &70291670379240 !ruby/object:Gem::Requirement
+  requirement: &70303206642320 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +43,10 @@ dependencies:
         version: 1.6.4
   type: :development
   prerelease: false
-  version_requirements: *70291670379240
+  version_requirements: *70303206642320
 - !ruby/object:Gem::Dependency
   name: rcov
-  requirement: &70291670377460 !ruby/object:Gem::Requirement
+  requirement: &70303206648540 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,7 +54,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70291670377460
+  version_requirements: *70303206648540
 description: dump headers, sections, extract resources of win32 PE exe,dll,etc
 email: zed.0xff@gmail.com
 executables:
@@ -93,7 +93,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3280002266277389467
+      hash: -1918854361818125320
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: