pedump 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (70) hide show
  1. data/.travis.yml +4 -0
  2. data/Gemfile +10 -6
  3. data/Gemfile.lock +27 -19
  4. data/README.md +37 -25
  5. data/Rakefile +45 -6
  6. data/VERSION +1 -1
  7. data/data/fs.txt +37 -1408
  8. data/data/jc-userdb.txt +14371 -0
  9. data/data/sig.bin +0 -0
  10. data/lib/pedump.rb +355 -618
  11. data/lib/pedump/cli.rb +214 -113
  12. data/lib/pedump/comparer.rb +147 -0
  13. data/lib/pedump/composite_io.rb +56 -0
  14. data/lib/pedump/core.rb +38 -0
  15. data/lib/pedump/core_ext/try.rb +57 -0
  16. data/lib/pedump/loader.rb +393 -0
  17. data/lib/pedump/loader/minidump.rb +187 -0
  18. data/lib/pedump/loader/section.rb +57 -0
  19. data/lib/pedump/logger.rb +67 -0
  20. data/lib/pedump/ne.rb +425 -0
  21. data/lib/pedump/ne/version_info.rb +171 -0
  22. data/lib/pedump/packer.rb +50 -2
  23. data/lib/pedump/pe.rb +121 -0
  24. data/lib/pedump/resources.rb +436 -0
  25. data/lib/pedump/security.rb +58 -0
  26. data/lib/pedump/sig_parser.rb +145 -24
  27. data/lib/pedump/tls.rb +17 -0
  28. data/lib/pedump/unpacker.rb +26 -0
  29. data/lib/pedump/unpacker/aspack.rb +858 -0
  30. data/lib/pedump/unpacker/upx.rb +13 -0
  31. data/lib/pedump/version.rb +1 -1
  32. data/lib/pedump/version_info.rb +15 -10
  33. data/misc/aspack/Makefile +3 -0
  34. data/misc/aspack/aspack_unlzx.c +92 -0
  35. data/misc/aspack/lzxdec.c +479 -0
  36. data/misc/aspack/lzxdec.h +56 -0
  37. data/misc/nedump.c +751 -0
  38. data/pedump.gemspec +75 -25
  39. data/samples/bad/68.exe +0 -0
  40. data/samples/bad/data_dir_15_entries.exe +0 -0
  41. data/spec/65535sects_spec.rb +8 -0
  42. data/spec/bad_imports_spec.rb +20 -0
  43. data/spec/bad_samples_spec.rb +13 -0
  44. data/spec/composite_io_spec.rb +122 -0
  45. data/spec/data/calc.exe_sections.yml +49 -0
  46. data/spec/data/data_dir_15_entries.exe_sections.yml +95 -0
  47. data/spec/dllord_spec.rb +21 -0
  48. data/spec/foldedhdr_spec.rb +28 -0
  49. data/spec/imports_badterm_spec.rb +52 -0
  50. data/spec/imports_vterm_spec.rb +52 -0
  51. data/spec/loader/names_spec.rb +24 -0
  52. data/spec/loader/va_spec.rb +44 -0
  53. data/spec/manyimportsW7_spec.rb +22 -0
  54. data/spec/ne_spec.rb +125 -0
  55. data/spec/packer_spec.rb +17 -0
  56. data/spec/pe_spec.rb +67 -0
  57. data/spec/pedump_spec.rb +16 -4
  58. data/spec/sections_spec.rb +11 -0
  59. data/spec/sig_all_packers_spec.rb +15 -5
  60. data/spec/sig_spec.rb +6 -1
  61. data/spec/spec_helper.rb +15 -3
  62. data/spec/support/samples.rb +24 -0
  63. data/spec/unpackers/aspack_spec.rb +69 -0
  64. data/spec/unpackers/find_spec.rb +21 -0
  65. data/spec/virtsectblXP_spec.rb +12 -0
  66. data/tmp/.keep +0 -0
  67. metadata +146 -35
  68. data/README.md.tpl +0 -90
  69. data/samples/calc.7z +0 -0
  70. data/samples/zlib.dll +0 -0
@@ -1,7 +1,19 @@
1
1
  require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
2
 
3
- describe "Pedump" do
4
- # it "fails" do
5
- # fail "hey buddy, you should probably rename this file and start specing for real"
6
- # end
3
+ describe "PEdump#dump" do
4
+ describe "should save packer" do
5
+ it "when arg is a filename" do
6
+ dump = PEdump.dump("samples/arm_upx.exe", :log_level => Logger::FATAL)
7
+ dump.packers.size.should == 1
8
+ dump.packers.first.name.should =~ /UPX/
9
+ end
10
+
11
+ it "when arg is an IO" do
12
+ File.open("samples/arm_upx.exe", "rb") do |f|
13
+ dump = PEdump.dump(f, :log_level => Logger::FATAL)
14
+ dump.packers.size.should == 1
15
+ dump.packers.first.name.should =~ /UPX/
16
+ end
17
+ end
18
+ end
7
19
  end
@@ -0,0 +1,11 @@
1
+ require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
+ require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
+ require 'yaml'
4
+
5
+ ['calc.exe', 'bad/data_dir_15_entries.exe'].each do |fname|
6
+ describe fname do
7
+ it "should match saved sections info" do
8
+ sample.sections.should == YAML::load_file(File.join(DATA_DIR,"#{File.basename(fname)}_sections.yml"))
9
+ end
10
+ end
11
+ end
@@ -3,12 +3,22 @@ require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump/packer')
3
3
 
4
4
  describe "PEdump::Packer" do
5
5
  describe "matchers" do
6
- PEdump::SigParser.parse(:raw => true).each do |sig|
7
- data = sig.re.join
8
- next if data == "This program cannot be run in DOS mo"
9
- it "should find #{sig.name}" do
10
- PEdump::Packer.of(data).map(&:name).should include(sig.name)
6
+ if ENV['SLOW']
7
+ PEdump::SigParser.parse(:raw => true).each do |sig|
8
+ data = sig.re.join
9
+ next if data == "This program cannot be run in DOS mo"
10
+ it "should find #{sig.name}" do
11
+ a = PEdump::Packer.of(data).map(&:name)
12
+ a.size.should > 0
13
+
14
+ a = sig.name.split - a.join(' ').split - ['Exe','PE']
15
+ a.delete_if{ |x| x[/[vV\.\/()\[\]]/] }
16
+ p a if a.size > 1
17
+ a.size.should < 2
18
+ end
11
19
  end
20
+ else
21
+ pending "SLOW"
12
22
  end
13
23
  end
14
24
  end
@@ -31,6 +31,11 @@ describe "PEdump::Packer" do
31
31
  next unless row =~ /^\[(.*)=(.*)\]$/
32
32
  s = ''
33
33
  title,hexstring = $1,$2
34
+
35
+ # bad sigs
36
+ next if hexstring == '909090909090909090909090909090909090909090909090909090909090909090909090'
37
+ next if hexstring == 'E9::::0000000000000000'
38
+
34
39
  (hexstring.size/2).times do |i|
35
40
  c = hexstring[i*2,2]
36
41
  if c == '::'
@@ -52,7 +57,7 @@ describe "PEdump::Packer" do
52
57
  # puts "\t= #{x}"
53
58
  # end
54
59
  else
55
- puts "[?] #{title}"
60
+ puts "[?] #{title}: #{hexstring}"
56
61
  n += 1
57
62
  end
58
63
  end
@@ -2,11 +2,23 @@ $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
2
2
  $LOAD_PATH.unshift(File.dirname(__FILE__))
3
3
  require 'rspec'
4
4
  require 'pedump'
5
+ require 'fileutils'
5
6
 
6
- # Requires supporting files with custom matchers and macros, etc,
7
- # in ./support/ and its subdirectories.
7
+ DATA_DIR = File.join(File.dirname(__FILE__), "data")
8
8
  Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
9
9
 
10
+ def unarchive_samples fname
11
+ flag_fname = File.join(File.dirname(fname), ".#{File.basename(fname)}_unpacked")
12
+ # check if already unpacked
13
+ return if File.exist?(flag_fname)
14
+ system "7zr", "x", "-y", "-o#{SAMPLES_DIR}", fname
15
+ FileUtils.touch(flag_fname) if $?.success?
16
+ end
17
+
10
18
  RSpec.configure do |config|
11
-
19
+ config.before :suite do
20
+ Dir[File.join(SAMPLES_DIR,"*.7z")].each do |fname|
21
+ unarchive_samples fname
22
+ end
23
+ end
12
24
  end
@@ -0,0 +1,24 @@
1
+ SAMPLES_DIR = File.expand_path(File.dirname(__FILE__) + '/../../samples/')
2
+
3
+ def sample
4
+ @pedump ||=
5
+ begin
6
+ fname =
7
+ if self.example
8
+ # called from it(...)
9
+ self.example.full_description.split.first
10
+ else
11
+ # called from before(:all)
12
+ self.class.metadata[:example_group][:description_args].first
13
+ end
14
+ fname = File.join(SAMPLES_DIR, fname)
15
+ File.open(fname,"rb") do |f|
16
+ if block_given?
17
+ yield PEdump.new(f)
18
+ else
19
+ PEdump.new(f).dump
20
+ end
21
+ end
22
+ end
23
+ end
24
+
@@ -0,0 +1,69 @@
1
+ root = File.expand_path(File.dirname(File.dirname(File.dirname(__FILE__))))
2
+ require "#{root}/spec/spec_helper"
3
+ require "#{root}/lib/pedump"
4
+ require "#{root}/lib/pedump/unpacker/aspack"
5
+ require "#{root}/lib/pedump/comparer"
6
+
7
+ describe PEdump::Unpacker::ASPack do
8
+ Dir["#{root}/samples/*.asp[1-9]*.{exe}"].each do |pname|
9
+ orig_fname = pname.sub(/\.asp[^.]+/,'')
10
+
11
+ describe File.basename(orig_fname) + " vs " + File.basename(pname) do
12
+ before :all do
13
+ @ldr = PEdump::Loader.new(File.open(orig_fname,"rb"))
14
+ end
15
+
16
+ it "should have no differences" do
17
+ File.open(pname,"rb") do |f|
18
+ u = PEdump::Unpacker::ASPack.new(f)
19
+ File.open("#{root}/tmp/unpacked.tmp","w+") do |fo|
20
+ u.unpack.dump(fo)
21
+ fo.rewind
22
+ ldr = PEdump::Loader.new(fo)
23
+
24
+ comparer = PEdump::Comparer.new(@ldr, ldr)
25
+ comparer.ignored_data_dirs = [
26
+ PEdump::IMAGE_DATA_DIRECTORY::LOAD_CONFIG,
27
+ PEdump::IMAGE_DATA_DIRECTORY::Bound_IAT,
28
+ PEdump::IMAGE_DATA_DIRECTORY::Delay_IAT
29
+ ]
30
+ comparer.ignored_sections = [ '.rsrc', '.aspack' ]
31
+ comparer.diff.should == []
32
+ end
33
+ end
34
+ end
35
+ end
36
+ end
37
+
38
+ Dir["#{root}/samples/*.asp[1-9]*.{ocx}"].each do |pname|
39
+ orig_fname = pname.sub(/\.asp[^.]+/,'')
40
+
41
+ describe File.basename(orig_fname) + " vs " + File.basename(pname) do
42
+ before :all do
43
+ @ldr = PEdump::Loader.new(File.open(orig_fname,"rb"))
44
+ end
45
+
46
+ it "should have no differences" do
47
+ File.open(pname,"rb") do |f|
48
+ u = PEdump::Unpacker::ASPack.new(f)
49
+ File.open("#{root}/tmp/unpacked.tmp","w+") do |fo|
50
+ u.unpack.dump(fo)
51
+ fo.rewind
52
+ ldr = PEdump::Loader.new(fo)
53
+
54
+ comparer = PEdump::Comparer.new(@ldr, ldr)
55
+ comparer.ignored_data_dirs = [
56
+ PEdump::IMAGE_DATA_DIRECTORY::LOAD_CONFIG,
57
+ PEdump::IMAGE_DATA_DIRECTORY::Bound_IAT,
58
+ PEdump::IMAGE_DATA_DIRECTORY::Delay_IAT,
59
+ PEdump::IMAGE_DATA_DIRECTORY::BASERELOC, # 0x15496 vs 0x15494
60
+ PEdump::IMAGE_DATA_DIRECTORY::IAT
61
+ ]
62
+ comparer.ignored_sections = [ '.rsrc', '.aspack', '.cas' ]
63
+ comparer.diff.should == []
64
+ end
65
+ end
66
+ end
67
+ end
68
+ end
69
+ end
@@ -0,0 +1,21 @@
1
+ root = File.expand_path(File.dirname(File.dirname(File.dirname(__FILE__))))
2
+ require "#{root}/spec/spec_helper"
3
+ require "#{root}/lib/pedump/unpacker"
4
+
5
+ describe PEdump::Unpacker do
6
+ it "finds UPX" do
7
+ PEdump::Unpacker.find("#{root}/samples/calc_upx.exe").should == PEdump::Unpacker::UPX
8
+ end
9
+
10
+ it "finds ARM UPX" do
11
+ PEdump::Unpacker.find("#{root}/samples/arm_upx.exe").should == PEdump::Unpacker::UPX
12
+ end
13
+
14
+ it "finds ASPack" do
15
+ PEdump::Unpacker.find("#{root}/samples/calc.asp212.exe").should == PEdump::Unpacker::ASPack
16
+ end
17
+
18
+ it "finds nothing" do
19
+ PEdump::Unpacker.find("#{root}/samples/calc.exe").should be_nil
20
+ end
21
+ end
@@ -0,0 +1,12 @@
1
+ require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
+ require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
+
4
+ describe 'corkami/virtsectblXP.exe' do
5
+ it "should have 2 imports" do
6
+ sample.imports.size.should == 2
7
+ sample.imports.map(&:module_name).should == %w'kernel32.dll msvcrt.dll'
8
+ sample.imports.map do |iid|
9
+ (iid.original_first_thunk + iid.first_thunk).uniq.map(&:name)
10
+ end.flatten.should == ["ExitProcess", "printf"]
11
+ end
12
+ end
File without changes
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: pedump
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.4.0
4
+ version: 0.5.0
5
5
  prerelease:
6
6
  platform: ruby
7
7
  authors:
@@ -9,11 +9,11 @@ authors:
9
9
  autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
- date: 2011-12-17 00:00:00.000000000 Z
12
+ date: 2013-04-20 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
15
  name: multipart-post
16
- requirement: &70304131999160 !ruby/object:Gem::Requirement
16
+ requirement: !ruby/object:Gem::Requirement
17
17
  none: false
18
18
  requirements:
19
19
  - - ~>
@@ -21,65 +21,127 @@ dependencies:
21
21
  version: 1.1.4
22
22
  type: :runtime
23
23
  prerelease: false
24
- version_requirements: *70304131999160
24
+ version_requirements: !ruby/object:Gem::Requirement
25
+ none: false
26
+ requirements:
27
+ - - ~>
28
+ - !ruby/object:Gem::Version
29
+ version: 1.1.4
25
30
  - !ruby/object:Gem::Dependency
26
31
  name: progressbar
27
- requirement: &70304131998620 !ruby/object:Gem::Requirement
32
+ requirement: !ruby/object:Gem::Requirement
28
33
  none: false
29
34
  requirements:
30
- - - ~>
35
+ - - ! '>='
31
36
  - !ruby/object:Gem::Version
32
- version: 0.9.2
37
+ version: '0'
33
38
  type: :runtime
34
39
  prerelease: false
35
- version_requirements: *70304131998620
40
+ version_requirements: !ruby/object:Gem::Requirement
41
+ none: false
42
+ requirements:
43
+ - - ! '>='
44
+ - !ruby/object:Gem::Version
45
+ version: '0'
46
+ - !ruby/object:Gem::Dependency
47
+ name: awesome_print
48
+ requirement: !ruby/object:Gem::Requirement
49
+ none: false
50
+ requirements:
51
+ - - ! '>='
52
+ - !ruby/object:Gem::Version
53
+ version: '0'
54
+ type: :runtime
55
+ prerelease: false
56
+ version_requirements: !ruby/object:Gem::Requirement
57
+ none: false
58
+ requirements:
59
+ - - ! '>='
60
+ - !ruby/object:Gem::Version
61
+ version: '0'
62
+ - !ruby/object:Gem::Dependency
63
+ name: iostruct
64
+ requirement: !ruby/object:Gem::Requirement
65
+ none: false
66
+ requirements:
67
+ - - ! '>='
68
+ - !ruby/object:Gem::Version
69
+ version: 0.0.4
70
+ type: :runtime
71
+ prerelease: false
72
+ version_requirements: !ruby/object:Gem::Requirement
73
+ none: false
74
+ requirements:
75
+ - - ! '>='
76
+ - !ruby/object:Gem::Version
77
+ version: 0.0.4
78
+ - !ruby/object:Gem::Dependency
79
+ name: zhexdump
80
+ requirement: !ruby/object:Gem::Requirement
81
+ none: false
82
+ requirements:
83
+ - - ! '>='
84
+ - !ruby/object:Gem::Version
85
+ version: 0.0.2
86
+ type: :runtime
87
+ prerelease: false
88
+ version_requirements: !ruby/object:Gem::Requirement
89
+ none: false
90
+ requirements:
91
+ - - ! '>='
92
+ - !ruby/object:Gem::Version
93
+ version: 0.0.2
36
94
  - !ruby/object:Gem::Dependency
37
95
  name: rspec
38
- requirement: &70304131998140 !ruby/object:Gem::Requirement
96
+ requirement: !ruby/object:Gem::Requirement
39
97
  none: false
40
98
  requirements:
41
- - - ~>
99
+ - - ! '>='
42
100
  - !ruby/object:Gem::Version
43
- version: 2.3.0
101
+ version: '0'
44
102
  type: :development
45
103
  prerelease: false
46
- version_requirements: *70304131998140
104
+ version_requirements: !ruby/object:Gem::Requirement
105
+ none: false
106
+ requirements:
107
+ - - ! '>='
108
+ - !ruby/object:Gem::Version
109
+ version: '0'
47
110
  - !ruby/object:Gem::Dependency
48
111
  name: bundler
49
- requirement: &70304131997660 !ruby/object:Gem::Requirement
112
+ requirement: !ruby/object:Gem::Requirement
50
113
  none: false
51
114
  requirements:
52
- - - ~>
115
+ - - ! '>='
53
116
  - !ruby/object:Gem::Version
54
- version: 1.0.0
117
+ version: '0'
55
118
  type: :development
56
119
  prerelease: false
57
- version_requirements: *70304131997660
120
+ version_requirements: !ruby/object:Gem::Requirement
121
+ none: false
122
+ requirements:
123
+ - - ! '>='
124
+ - !ruby/object:Gem::Version
125
+ version: '0'
58
126
  - !ruby/object:Gem::Dependency
59
127
  name: jeweler
60
- requirement: &70304131997180 !ruby/object:Gem::Requirement
128
+ requirement: !ruby/object:Gem::Requirement
61
129
  none: false
62
130
  requirements:
63
- - - ~>
131
+ - - ! '>='
64
132
  - !ruby/object:Gem::Version
65
- version: 1.6.4
133
+ version: '0'
66
134
  type: :development
67
135
  prerelease: false
68
- version_requirements: *70304131997180
69
- - !ruby/object:Gem::Dependency
70
- name: rcov
71
- requirement: &70304131996680 !ruby/object:Gem::Requirement
136
+ version_requirements: !ruby/object:Gem::Requirement
72
137
  none: false
73
138
  requirements:
74
139
  - - ! '>='
75
140
  - !ruby/object:Gem::Version
76
141
  version: '0'
77
- type: :development
78
- prerelease: false
79
- version_requirements: *70304131996680
80
142
  - !ruby/object:Gem::Dependency
81
- name: awesome_print
82
- requirement: &70304131996200 !ruby/object:Gem::Requirement
143
+ name: what_methods
144
+ requirement: !ruby/object:Gem::Requirement
83
145
  none: false
84
146
  requirements:
85
147
  - - ! '>='
@@ -87,7 +149,12 @@ dependencies:
87
149
  version: '0'
88
150
  type: :development
89
151
  prerelease: false
90
- version_requirements: *70304131996200
152
+ version_requirements: !ruby/object:Gem::Requirement
153
+ none: false
154
+ requirements:
155
+ - - ! '>='
156
+ - !ruby/object:Gem::Version
157
+ version: '0'
91
158
  description: dump headers, sections, extract resources of win32 PE exe,dll,etc
92
159
  email: zed.0xff@gmail.com
93
160
  executables:
@@ -96,36 +163,80 @@ extensions: []
96
163
  extra_rdoc_files:
97
164
  - LICENSE.txt
98
165
  - README.md
99
- - README.md.tpl
100
166
  files:
101
167
  - .document
102
168
  - .rspec
169
+ - .travis.yml
103
170
  - Gemfile
104
171
  - Gemfile.lock
105
172
  - LICENSE.txt
106
173
  - README.md
107
- - README.md.tpl
108
174
  - Rakefile
109
175
  - VERSION
110
176
  - bin/pedump
111
177
  - data/fs.txt
178
+ - data/jc-userdb.txt
112
179
  - data/sig.bin
113
180
  - data/signatures.txt
114
181
  - data/userdb.txt
115
182
  - lib/pedump.rb
116
183
  - lib/pedump/cli.rb
184
+ - lib/pedump/comparer.rb
185
+ - lib/pedump/composite_io.rb
186
+ - lib/pedump/core.rb
187
+ - lib/pedump/core_ext/try.rb
188
+ - lib/pedump/loader.rb
189
+ - lib/pedump/loader/minidump.rb
190
+ - lib/pedump/loader/section.rb
191
+ - lib/pedump/logger.rb
192
+ - lib/pedump/ne.rb
193
+ - lib/pedump/ne/version_info.rb
117
194
  - lib/pedump/packer.rb
195
+ - lib/pedump/pe.rb
196
+ - lib/pedump/resources.rb
197
+ - lib/pedump/security.rb
118
198
  - lib/pedump/sig_parser.rb
199
+ - lib/pedump/tls.rb
200
+ - lib/pedump/unpacker.rb
201
+ - lib/pedump/unpacker/aspack.rb
202
+ - lib/pedump/unpacker/upx.rb
119
203
  - lib/pedump/version.rb
120
204
  - lib/pedump/version_info.rb
205
+ - misc/aspack/Makefile
206
+ - misc/aspack/aspack_unlzx.c
207
+ - misc/aspack/lzxdec.c
208
+ - misc/aspack/lzxdec.h
209
+ - misc/nedump.c
121
210
  - pedump.gemspec
122
- - samples/calc.7z
123
- - samples/zlib.dll
211
+ - samples/bad/68.exe
212
+ - samples/bad/data_dir_15_entries.exe
213
+ - spec/65535sects_spec.rb
214
+ - spec/bad_imports_spec.rb
215
+ - spec/bad_samples_spec.rb
216
+ - spec/composite_io_spec.rb
217
+ - spec/data/calc.exe_sections.yml
218
+ - spec/data/data_dir_15_entries.exe_sections.yml
219
+ - spec/dllord_spec.rb
220
+ - spec/foldedhdr_spec.rb
221
+ - spec/imports_badterm_spec.rb
222
+ - spec/imports_vterm_spec.rb
223
+ - spec/loader/names_spec.rb
224
+ - spec/loader/va_spec.rb
225
+ - spec/manyimportsW7_spec.rb
226
+ - spec/ne_spec.rb
227
+ - spec/packer_spec.rb
228
+ - spec/pe_spec.rb
124
229
  - spec/pedump_spec.rb
125
230
  - spec/resource_spec.rb
231
+ - spec/sections_spec.rb
126
232
  - spec/sig_all_packers_spec.rb
127
233
  - spec/sig_spec.rb
128
234
  - spec/spec_helper.rb
235
+ - spec/support/samples.rb
236
+ - spec/unpackers/aspack_spec.rb
237
+ - spec/unpackers/find_spec.rb
238
+ - spec/virtsectblXP_spec.rb
239
+ - tmp/.keep
129
240
  homepage: http://github.com/zed-0xff/pedump
130
241
  licenses:
131
242
  - MIT
@@ -141,7 +252,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
141
252
  version: '0'
142
253
  segments:
143
254
  - 0
144
- hash: 2685694954412936403
255
+ hash: -1369606751108388991
145
256
  required_rubygems_version: !ruby/object:Gem::Requirement
146
257
  none: false
147
258
  requirements:
@@ -150,7 +261,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
150
261
  version: '0'
151
262
  requirements: []
152
263
  rubyforge_project:
153
- rubygems_version: 1.8.10
264
+ rubygems_version: 1.8.24
154
265
  signing_key:
155
266
  specification_version: 3
156
267
  summary: dump win32 PE executable files with a pure ruby