pedump 0.3.3 → 0.4.0

data/lib/pedump.rb

@@ -40,6 +40,8 @@ class PEdump
 
   VERSION = Version::STRING
 
+  @@logger = nil
+
   def initialize fname, params = {}
     @fname = fname
     @force = params[:force]
@@ -62,6 +64,17 @@ class PEdump
     end
   end
 
+  module Readable
+    def read file, size = nil
+      size ||= const_get 'SIZE'
+      data = file.read(size).to_s
+      if data.size < size && PEdump.logger
+        PEdump.logger.error "[!] #{self.to_s} want #{size} bytes, got #{data.size}"
+      end
+      new(*data.unpack(const_get('FORMAT')))
+    end
+  end
+
   class << self
     def logger;    @@logger;   end
     def logger= l; @@logger=l; end
@@ -89,14 +102,7 @@ class PEdump
             to_a.all?{ |t| t == 0 || t.nil? || t.to_s.tr("\x00","").empty? }
           end
         end
-        def x.read file, size = nil
-          size ||= const_get 'SIZE'
-          data = file.read(size).to_s
-          if data.size < size && PEdump.logger
-            PEdump.logger.error "[!] #{self.to_s} want #{size} bytes, got #{data.size}"
-          end
-          new(*data.unpack(const_get('FORMAT')))
-        end
+        x.extend Readable
       end
     end
   end
@@ -140,10 +146,13 @@ class PEdump
     def x64?
       ifh && ifh.Machine == 0x8664
     end
+    def dll?
+      ifh && ifh.flags.include?('DLL')
+    end
   end
 
   # http://msdn.microsoft.com/en-us/library/ms809762.aspx
-  IMAGE_FILE_HEADER = create_struct( 'v2V3v2',
+  class IMAGE_FILE_HEADER < create_struct( 'v2V3v2',
     :Machine,              # w
     :NumberOfSections,     # w
     :TimeDateStamp,        # dw
@@ -152,19 +161,97 @@ class PEdump
     :SizeOfOptionalHeader, # w
     :Characteristics       # w
   )
-  class IMAGE_FILE_HEADER
+    # Characteristics, http://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=VS.85).aspx)
+    FLAGS = {
+      0x0001 => 'RELOCS_STRIPPED',          # Relocation information was stripped from the file.
+                                            # The file must be loaded at its preferred base address.
+                                            # If the base address is not available, the loader reports an error.
+      0x0002 => 'EXECUTABLE_IMAGE',
+      0x0004 => 'LINE_NUMS_STRIPPED',
+      0x0008 => 'LOCAL_SYMS_STRIPPED',
+      0x0010 => 'AGGRESIVE_WS_TRIM',        # Aggressively trim the working set. This value is obsolete as of Windows 2000.
+      0x0020 => 'LARGE_ADDRESS_AWARE',      # The application can handle addresses larger than 2 GB.
+      0x0040 => '16BIT_MACHINE',
+      0x0080 => 'BYTES_REVERSED_LO',        # The bytes of the word are reversed. This flag is obsolete.
+      0x0100 => '32BIT_MACHINE',
+      0x0200 => 'DEBUG_STRIPPED',
+      0x0400 => 'REMOVABLE_RUN_FROM_SWAP',
+      0x0800 => 'NET_RUN_FROM_SWAP',
+      0x1000 => 'SYSTEM',
+      0x2000 => 'DLL',
+      0x4000 => 'UP_SYSTEM_ONLY',           # The file should be run only on a uniprocessor computer.
+      0x8000 => 'BYTES_REVERSED_HI'         # The bytes of the word are reversed. This flag is obsolete.
+    }
+
     def initialize *args
       super
       self.TimeDateStamp = Time.at(self.TimeDateStamp)
     end
-    def method_missing mname
-      mname = mname.to_s.capitalize
-      self.send(mname) if self.respond_to?(mname)
+    def flags
+      FLAGS.find_all{ |k,v| (self.Characteristics & k) != 0 }.map(&:last)
+    end
+  end
+
+  module IMAGE_OPTIONAL_HEADER
+    # DllCharacteristics, http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx)
+    FLAGS = {
+      0x0001 => '0x01', # reserved
+      0x0002 => '0x02', # reserved
+      0x0004 => '0x04', # reserved
+      0x0008 => '0x08', # reserved
+      0x0010 => '0x10', # ?
+      0x0020 => '0x20', # ?
+      0x0040 => 'DYNAMIC_BASE',
+      0x0080 => 'FORCE_INTEGRITY',
+      0x0100 => 'NX_COMPAT',
+      0x0200 => 'NO_ISOLATION',
+      0x0400 => 'NO_SEH',
+      0x0800 => 'NO_BIND',
+      0x1000 => '0x1000',               # ?
+      0x2000 => 'WDM_DRIVER',
+      0x4000 => '0x4000',               # ?
+      0x8000 => 'TERMINAL_SERVER_AWARE'
+    }
+    def initialize *args
+      super
+      self.extend InstanceMethods
+    end
+    def self.included base
+      base.extend ClassMethods
+    end
+    module ClassMethods
+      def read file, size = nil
+        usual_size = self.const_get('USUAL_SIZE')
+        cSIZE   = self.const_get 'SIZE'
+        cFORMAT = self.const_get 'FORMAT'
+        size ||= cSIZE
+        PEdump.logger.warn "[?] unusual size of IMAGE_OPTIONAL_HEADER = #{size} (must be #{usual_size})" if size != usual_size
+        new(*file.read([size,cSIZE].min).to_s.unpack(cFORMAT)).tap do |ioh|
+          ioh.DataDirectory = []
+
+          # check if "...this address is outside the memory mapped file and is zeroed by the OS"
+          # see http://www.phreedom.org/solar/code/tinype/, section "Removing the data directories"
+          ioh.each_pair{ |k,v| ioh[k] = 0 if v.nil? }
+
+          # http://opcode0x90.wordpress.com/2007/04/22/windows-loader-does-it-differently/
+          # maximum of 0x10 entries, even if bigger
+          [0x10,ioh.NumberOfRvaAndSizes].min.times do |idx|
+            ioh.DataDirectory << IMAGE_DATA_DIRECTORY.read(file)
+            ioh.DataDirectory.last.type = IMAGE_DATA_DIRECTORY::TYPES[idx]
+          end
+          #ioh.DataDirectory.pop while ioh.DataDirectory.last.empty?
+        end
+      end
+    end
+    module InstanceMethods
+      def flags
+        FLAGS.find_all{ |k,v| (self.DllCharacteristics & k) != 0 }.map(&:last)
+      end
     end
   end
 
   # http://msdn.microsoft.com/en-us/library/ms809762.aspx
-  IMAGE_OPTIONAL_HEADER = create_struct( 'vC2V9v6V4v2V6',
+  class IMAGE_OPTIONAL_HEADER32 < create_struct( 'vC2V9v6V4v2V6',
     :Magic, # w
     :MajorLinkerVersion, :MinorLinkerVersion, # 2b
     :SizeOfCode, :SizeOfInitializedData, :SizeOfUninitializedData, :AddressOfEntryPoint, # 9dw
@@ -177,9 +264,12 @@ class PEdump
     :LoaderFlags, :NumberOfRvaAndSizes,
     :DataDirectory # readed manually
   )
+    USUAL_SIZE = 224
+    include IMAGE_OPTIONAL_HEADER
+  end
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=VS.85).aspx)
-  IMAGE_OPTIONAL_HEADER64 = create_struct( 'vC2V5QV2v6V4v2Q4V2',
+  class IMAGE_OPTIONAL_HEADER64 < create_struct( 'vC2V5QV2v6V4v2Q4V2',
     :Magic, # w
     :MajorLinkerVersion, :MinorLinkerVersion, # 2b
     :SizeOfCode, :SizeOfInitializedData, :SizeOfUninitializedData, :AddressOfEntryPoint, :BaseOfCode, # 5dw
@@ -193,49 +283,8 @@ class PEdump
     :LoaderFlags, :NumberOfRvaAndSizes, #2dw
     :DataDirectory # readed manually
   )
-
-  class IMAGE_OPTIONAL_HEADER
-    def self.read file, size = SIZE
-      usual_size = 224
-      PEdump.logger.warn "[?] unusual size of IMAGE_OPTIONAL_HEADER = #{size} (must be #{usual_size})" if size != usual_size
-      new(*file.read([size,SIZE].min).to_s.unpack(FORMAT)).tap do |ioh|
-        ioh.DataDirectory = []
-
-        # check if "...this address is outside the memory mapped file and is zeroed by the OS"
-        # see http://www.phreedom.org/solar/code/tinype/, section "Removing the data directories"
-        ioh.each_pair{ |k,v| ioh[k] = 0 if v.nil? }
-
-        # http://opcode0x90.wordpress.com/2007/04/22/windows-loader-does-it-differently/
-        # maximum of 0x10 entries, even if bigger
-        [0x10,ioh.NumberOfRvaAndSizes].min.times do |idx|
-          ioh.DataDirectory << IMAGE_DATA_DIRECTORY.read(file)
-          ioh.DataDirectory.last.type = IMAGE_DATA_DIRECTORY::TYPES[idx]
-        end
-        #ioh.DataDirectory.pop while ioh.DataDirectory.last.empty?
-      end
-    end
-  end
-
-  class IMAGE_OPTIONAL_HEADER64
-    def self.read file, size = SIZE
-      usual_size = 240
-      PEdump.logger.warn "[?] unusual size of IMAGE_OPTIONAL_HEADER = #{size} (must be #{usual_size})" if size != usual_size
-      new(*file.read([size,SIZE].min).unpack(FORMAT)).tap do |ioh|
-        ioh.DataDirectory = []
-
-        # check if "...this address is outside the memory mapped file and is zeroed by the OS"
-        # see http://www.phreedom.org/solar/code/tinype/, section "Removing the data directories"
-        ioh.each_pair{ |k,v| ioh[k] = 0 if v.nil? }
-
-        # http://opcode0x90.wordpress.com/2007/04/22/windows-loader-does-it-differently/
-        # maximum of 0x10 entries, even if bigger
-        [0x10,ioh.NumberOfRvaAndSizes].min.times do |idx|
-          ioh.DataDirectory << IMAGE_DATA_DIRECTORY.read(file)
-          ioh.DataDirectory.last.type = IMAGE_DATA_DIRECTORY::TYPES[idx]
-        end
-        #ioh.DataDirectory.pop while ioh.DataDirectory.last.empty?
-      end
-    end
+    USUAL_SIZE = 240
+    include IMAGE_OPTIONAL_HEADER
   end
 
   IMAGE_DATA_DIRECTORY = create_struct( "VV", :va, :size, :type )
@@ -418,7 +467,7 @@ class PEdump
               if pe.x64?
                 pe.image_optional_header = IMAGE_OPTIONAL_HEADER64.read(f, pe.ifh.SizeOfOptionalHeader)
               else
-                pe.image_optional_header = IMAGE_OPTIONAL_HEADER.read(f, pe.ifh.SizeOfOptionalHeader)
+                pe.image_optional_header = IMAGE_OPTIONAL_HEADER32.read(f, pe.ifh.SizeOfOptionalHeader)
               end
             end
 
@@ -444,7 +493,7 @@ class PEdump
 
   # OPTIONAL: assigns @mz, @rich_hdr, @pe, etc
   def dump f=nil
-    f ? _dump_handle(f) : File.open(@fname){ |f| _dump_handle(f) }
+    f ? _dump_handle(f) : File.open(@fname,'rb'){ |f| _dump_handle(f) }
     self
   end
 
@@ -453,6 +502,7 @@ class PEdump
     resources(h) # includes pe(h)
     imports h
     exports h
+    packer  h
   end
 
   def data_directory f=nil
@@ -795,7 +845,7 @@ class PEdump
         f.seek file_offset
         data << CUR_ICO_HEADER.read(f)
         nRead = CUR_ICO_HEADER::SIZE
-        data.last.wNumImages.times do
+        data.last.wNumImages.to_i.times do
           if nRead >= self.size
             PEdump.logger.error "[!] refusing to read CURDIRENTRY beyond resource size"
             break
@@ -807,7 +857,7 @@ class PEdump
         f.seek file_offset
         data << CUR_ICO_HEADER.read(f)
         nRead = CUR_ICO_HEADER::SIZE
-        data.last.wNumImages.times do
+        data.last.wNumImages.to_i.times do
           if nRead >= self.size
             PEdump.logger.error "[!] refusing to read ICODIRENTRY beyond resource size"
             break
@@ -839,6 +889,10 @@ class PEdump
             end
         end
         # XXX: check if readed strings summary length is less than resource data length
+      when 'VERSION'
+        require 'pedump/version_info'
+        f.seek file_offset
+        data << PEdump::VS_VERSIONINFO.read(f)
       end
 
       data.delete_if do |x|
@@ -854,7 +908,7 @@ class PEdump
       self.valid =
         case type
         when 'BITMAP','ICON','CURSOR'
-          data.any?{ |x| x.is_a?(BITMAPINFOHEADER) && x.valid? }
+          data.any?{ |x| x.is_a?(BITMAPINFOHEADER) && x.valid? } || data.first == 'PNG'
         else
           true
         end
@@ -929,6 +983,10 @@ class PEdump
     @resources ||= _scan_resources(f)
   end
 
+  def version_info f=nil
+    resources(f) && resources(f).find_all{ |res| res.type == 'VERSION' }.map(&:data).flatten
+  end
+
   def _scan_resources f=nil, dir=nil
     dir ||= resource_directory(f)
     return nil unless dir
@@ -978,6 +1036,9 @@ class PEdump
         if !(va=@pe.ioh.AddressOfEntryPoint)
           logger.error "[?] can't find EntryPoint RVA"
           nil
+        elsif va == 0 && @pe.dll?
+          logger.debug "[.] it's a DLL with no EntryPoint"
+          nil
         elsif !(ofs = va2file(va))
           logger.error "[?] can't find EntryPoint RVA (0x#{va.to_s(16)}) file offset"
           nil
@@ -987,7 +1048,7 @@ class PEdump
             logger.error "[?] no packer definitions found"
             nil
           else
-            Packer.of(f, ofs)
+            Packer.of f, :ep_offset => ofs
           end
         end
       end

data/lib/pedump/cli.rb

@@ -1,4 +1,5 @@
 require 'pedump'
+require 'pedump/packer'
 require 'optparse'
 
 unless Object.instance_methods.include?(:try)
@@ -14,7 +15,7 @@ class PEdump::CLI
 
   KNOWN_ACTIONS = (
     %w'mz dos_stub rich pe data_directory sections' +
-    %w'strings resources resource_directory imports exports packer web packer_only'
+    %w'strings resources resource_directory imports exports version_info packer web packer_only'
   ).map(&:to_sym)
 
   DEFAULT_ALL_ACTIONS = KNOWN_ACTIONS - %w'resource_directory web packer_only'.map(&:to_sym)
@@ -27,18 +28,20 @@ class PEdump::CLI
 
   def run
     @actions = []
-    @options = { :format => :table }
+    @options = { :format => :table, :verbose => 0 }
     optparser = OptionParser.new do |opts|
       opts.banner = "Usage: pedump [options]"
 
-      opts.on "-V", "--version", "Print version information and exit" do
+      opts.on "--version", "Print version information and exit" do
         puts PEdump::VERSION
         exit
       end
-      opts.on "-v", "--[no-]verbose", "Run verbosely" do |v|
-        @options[:verbose] ||= 0
+      opts.on "-v", "--verbose", "Run verbosely","(can be used multiple times)" do |v|
         @options[:verbose] += 1
       end
+      opts.on "-q", "--quiet", "Silent any warnings","(can be used multiple times)" do |v|
+        @options[:verbose] -= 1
+      end
       opts.on "-F", "--force", "Try to dump by all means","(can cause exceptions & heavy wounds)" do |v|
         @options[:force] ||= 0
         @options[:force] += 1
@@ -48,11 +51,25 @@ class PEdump::CLI
         @options[:format] = v
       end
       KNOWN_ACTIONS.each do |t|
-        opts.on "--#{t.to_s.tr('_','-')}", eval("lambda{ |_| @actions << :#{t.to_s.tr('-','_')} }")
+        a = [
+          "--#{t.to_s.tr('_','-')}",
+          eval("lambda{ |_| @actions << :#{t.to_s.tr('-','_')} }")
+        ]
+        a.unshift(a[0][1,2].upcase) if a[0] =~ /--(((ex|im)port|section|resource)s|version-info)/
+        a.unshift(a[0][1,2]) if a[0] =~ /--strings/
+        opts.on *a
+      end
+
+      opts.on "--deep", "packer deep scan, significantly slower" do
+        @options[:deep] ||= 0
+        @options[:deep] += 1
+        PEdump::Packer.default_deep = @options[:deep]
       end
+
       opts.on '-P', "--packer-only", "packer/compiler detect only,","mimics 'file' command output" do
         @actions << :packer_only
       end
+
       opts.on "--all", "Dump all but resource-directory (default)" do
         @actions = DEFAULT_ALL_ACTIONS
       end
@@ -87,11 +104,7 @@ class PEdump::CLI
       @file_name = fname
 
       File.open(fname,'rb') do |f|
-        @pedump = PEdump.new(fname, :force => @options[:force]).tap do |x|
-          if @options[:verbose]
-            x.logger.level = @options[:verbose] > 1 ? Logger::INFO : Logger::DEBUG
-          end
-        end
+        @pedump = create_pedump fname
 
         next if !@options[:force] && !@pedump.mz(f)
 
@@ -109,18 +122,34 @@ class PEdump::CLI
     # prevents a 'Broken pipe - <STDOUT> (Errno::EPIPE)' message
   end
 
+  def create_pedump fname
+    PEdump.new(fname, :force => @options[:force]).tap do |x|
+      x.logger.level =
+        case @options[:verbose]
+        when -100..-3
+          Logger::FATAL + 1
+        when -2
+          Logger::FATAL
+        when -1
+          Logger::ERROR
+        when 0
+          Logger::WARN  # default
+        when 1
+          Logger::INFO
+        when 2..100
+          Logger::DEBUG
+        end
+    end
+  end
+
   def dump_packer_only fnames
     max_fname_len = fnames.map(&:size).max
     fnames.each do |fname|
       File.open(fname,'rb') do |f|
-        @pedump = PEdump.new(fname, :force => @options[:force]).tap do |x|
-          if @options[:verbose]
-            x.logger.level = @options[:verbose] > 1 ? Logger::INFO : Logger::DEBUG
-          end
-        end
+        @pedump = create_pedump fname
         packers = @pedump.packers(f)
         pname = Array(packers).first.try(:packer).try(:name)
-        pname ||= "unknown" if @options[:verbose]
+        pname ||= "unknown" if @options[:verbose] > 0
         printf("%-*s %s\n", max_fname_len+1, "#{fname}:", pname) if pname
       end
     end
@@ -248,6 +277,8 @@ class PEdump::CLI
         return dump_imports(data)
       when :exports
         return dump_exports(data)
+      when :version_info
+        return dump_version_info(data)
       else
         if data.is_a?(Struct) && data.respond_to?(:pack)
           data = data.pack
@@ -298,8 +329,22 @@ class PEdump::CLI
     :Subsystem => PEdump::IMAGE_SUBSYSTEMS
   }
 
+  def _flags2string flags
+    return '' if !flags || flags.empty?
+    a = [flags.shift.dup]
+    flags.each do |f|
+      if (a.last.size + f.size) < 40
+        a.last << ", " << f
+      else
+        a << f.dup
+      end
+    end
+    a.join("\n"+ ' '*58)
+  end
+
   def dump_generic_table data
     data.each_pair do |k,v|
+      next if [:DataDirectory, :section_table].include?(k)
       case v
       when Numeric
         case k
@@ -309,20 +354,25 @@ class PEdump::CLI
         when /TimeDateStamp/
           printf "%30s: %24s\n", k, Time.at(v).strftime('"%Y-%m-%d %H:%M:%S"')
         else
+          comment = ''
           if COMMENTS[k]
-            printf "%30s: %10d  %12s  %s\n", k, v, v<10 ? v : ("0x"+v.to_s(16)),
-              COMMENTS[k][v] || (COMMENTS[k].is_a?(Hash) ? COMMENTS[k]['default'] : '') || ''
-          else
-            printf "%30s: %10d  %12s\n", k, v, v<10 ? v : ("0x"+v.to_s(16))
+            comment = COMMENTS[k][v] || (COMMENTS[k].is_a?(Hash) ? COMMENTS[k]['default'] : '') || ''
+          elsif data.is_a?(PEdump::IMAGE_FILE_HEADER) && k == :Characteristics
+            comment = _flags2string(data.flags)
+          elsif k == :DllCharacteristics
+            comment = _flags2string(data.flags)
           end
+          comment.strip!
+          comment = "  #{comment}" unless comment.empty?
+          printf "%30s: %10d  %12s%s\n", k, v, v<10 ? v : ("0x"+v.to_s(16)), comment
         end
       when Struct
+        # IMAGE_FILE_HEADER:
+        # IMAGE_OPTIONAL_HEADER:
         printf "\n# %s:\n", v.class.to_s.split('::').last
         dump_table v
       when Time
         printf "%30s: %24s\n", k, v.strftime('"%Y-%m-%d %H:%M:%S"')
-      when Array
-        next if %w'DataDirectory section_table'.include?(k)
       else
         printf "%30s: %24s\n", k, v.to_s.inspect
       end
@@ -348,6 +398,8 @@ class PEdump::CLI
         dump_imports data
       when PEdump::Packer::Match
         dump_packers data
+      when PEdump::VS_VERSIONINFO
+        dump_version_info data
       else
         puts "[?] don't know how to dump: #{data.inspect[0,50]}" unless data.empty?
       end
@@ -360,8 +412,66 @@ class PEdump::CLI
     end
   end
 
+  def dump_version_info data
+    if @options[:format] != :table
+      File.open(@file_name,'rb') do |f|
+        @pedump.resources.find_all{ |r| r.type == 'VERSION'}.each do |res|
+          f.seek res.file_offset
+          data = f.read(res.size)
+          dump data
+        end
+      end
+      return
+    end
+
+    fmt = "  %-20s:  %s\n"
+    data.each do |vi|
+      puts "# VS_FIXEDFILEINFO:"
+
+      if @options[:verbose] > 0 || vi.Value.dwSignature != 0xfeef04bd
+        printf(fmt, "Signature", "0x#{vi.Value.dwSignature.to_s(16)}")
+      end
+
+      printf fmt, 'FileVersion', [
+        vi.Value.dwFileVersionMS >> 16,
+        vi.Value.dwFileVersionMS &  0xffff,
+        vi.Value.dwFileVersionLS >> 16,
+        vi.Value.dwFileVersionLS &  0xffff
+      ].join('.')
+
+      printf fmt, 'ProductVersion', [
+        vi.Value.dwProductVersionMS >> 16,
+        vi.Value.dwProductVersionMS &  0xffff,
+        vi.Value.dwProductVersionLS >> 16,
+        vi.Value.dwProductVersionLS &  0xffff
+      ].join('.')
+
+      vi.Value.each_pair do |k,v|
+        next if k[/[ML]S$/] || k == :valid || k == :dwSignature
+        printf fmt, k.to_s.sub(/^dw/,''), v > 9 ? "0x#{v.to_s(16)}" : v
+      end
+
+      vi.Children.each do |file_info|
+        case file_info
+        when PEdump::StringFileInfo
+          file_info.Children.each do |string_table|
+            puts "\n# StringTable #{string_table.szKey}:"
+            string_table.Children.each do |string|
+              printf fmt, string.szKey, string.Value.inspect
+            end
+          end
+        when PEdump::VarFileInfo
+          puts
+          printf fmt, "VarFileInfo", '[ 0x' + file_info.Children.Value.map{|v| v.to_s(16)}.join(", 0x") + ' ]'
+        else
+          puts "[?] unknown child type: #{file_info.inspect}, use -fi to inspect"
+        end
+      end
+    end
+  end
+
   def dump_packers data
-    if @options[:verbose]
+    if @options[:verbose] > 0
       data.each do |p|
         printf "%8x %4d %s\n", p.offset, p.packer.size, p.packer.name
       end
@@ -379,7 +489,7 @@ class PEdump::CLI
       data.MajorVersion, data.MinorVersion,
       data.Base
 
-    if @options[:verbose]
+    if @options[:verbose] > 0
       [%w'Names', %w'EntryPoints Functions', %w'Ordinals NameOrdinals'].each do |x|
         va  = data["AddressOf"+x.last]
         ofs = @pedump.va2file(va) || '?'