pedump 0.4.7 → 0.4.8

data/VERSION

@@ -1 +1 @@
-0.4.7
+0.4.8

data/lib/pedump.rb

@@ -6,6 +6,7 @@ require 'pedump/resources'
 require 'pedump/version_info'
 require 'pedump/tls'
 require 'pedump/security'
+require 'pedump/packer'
 
 # pedump.rb by zed_0xff
 #
@@ -709,23 +710,11 @@ class PEdump
   def packer f=@io
     @packer ||= pe(f) && @pe.ioh &&
       begin
-        if !(va=@pe.ioh.AddressOfEntryPoint)
-          logger.error "[?] can't find EntryPoint RVA"
-          nil
-        elsif va == 0 && @pe.dll?
-          logger.debug "[.] it's a DLL with no EntryPoint"
-          nil
-        elsif !(ofs = va2file(va))
-          logger.error "[?] can't find EntryPoint RVA (0x#{va.to_s(16)}) file offset"
+        if PEdump::Packer.all.size == 0
+          logger.error "[?] no packer definitions found"
           nil
         else
-          require 'pedump/packer'
-          if PEdump::Packer.all.size == 0
-            logger.error "[?] no packer definitions found"
-            nil
-          else
-            Packer.of f, :ep_offset => ofs
-          end
+          Packer.of f, :pedump => self
         end
       end
   end

data/lib/pedump/packer.rb

@@ -12,6 +12,13 @@ class PEdump
       end
     end
 
+    class Guess < Match
+      def initialize name
+        self.offset = 0
+        self.packer = Packer.new(name, nil, nil, 0)
+      end
+    end
+
     class << self
       def all
         @@all ||=
@@ -47,13 +54,45 @@ class PEdump
       end
 
       def of data, h = {}
-        if data.respond_to?(:read) && data.respond_to?(:seek) && h[:ep_offset]
+        if data.respond_to?(:read) && data.respond_to?(:seek) && h[:pedump]
+          of_pedump data, h
+        elsif data.respond_to?(:read) && data.respond_to?(:seek) && h[:ep_offset]
           of_pe_file data, h
         else
           of_data data
         end
       end
 
+      # try to determine packer of FILE f, h[:pedump] is a PEdump instance
+      def of_pedump f, h
+        pedump = h[:pedump]
+        pe = pedump.pe
+        if !(va=pe.ioh.AddressOfEntryPoint)
+          pedump.logger.error "[?] can't find EntryPoint RVA"
+          nil
+        elsif va == 0 && pe.dll?
+          pedump.logger.debug "[.] it's a DLL with no EntryPoint"
+          nil
+        elsif !(ofs = pedump.va2file(va))
+          pedump.logger.error "[?] can't find EntryPoint RVA (0x#{va.to_s(16)}) file offset"
+          nil
+        else
+          r = of_pe_file(f, h.merge({:ep_offset => ofs}))
+          return r if r && r.any?
+
+          # nothing found, try to guess by pe section names
+          if pedump.sections
+            if pedump.sections.any?{ |s| s.Name.to_s =~ /upx/i }
+              return [Guess.new('UPX?')]
+            end
+            if pedump.sections.any?{ |s| s.Name.to_s =~ /aspack/i }
+              return [Guess.new('ASPack?')]
+            end
+          end
+          nil
+        end
+      end
+
       # try to determine packer of FILE f, ep_offset - offset to entrypoint from start of file
       def of_pe_file f, h
         h[:deep] = @@deep unless h.key?(:deep)

data/lib/pedump/version.rb

@@ -2,7 +2,7 @@ class PEdump
   module Version
     MAJOR = 0
     MINOR = 4
-    PATCH = 7
+    PATCH = 8
     BUILD = nil
 
     STRING = [MAJOR, MINOR, PATCH, BUILD].compact.join('.')

data/pedump.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "pedump"
-  s.version = "0.4.7"
+  s.version = "0.4.8"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andrey \"Zed\" Zaikin"]
-  s.date = "2012-01-07"
+  s.date = "2012-01-12"
   s.description = "dump headers, sections, extract resources of win32 PE exe,dll,etc"
   s.email = "zed.0xff@gmail.com"
   s.executables = ["pedump"]
@@ -62,6 +62,7 @@ Gem::Specification.new do |s|
     "spec/imports_badterm_spec.rb",
     "spec/imports_vterm_spec.rb",
     "spec/manyimportsW7_spec.rb",
+    "spec/packer_spec.rb",
     "spec/pe_spec.rb",
     "spec/pedump_spec.rb",
     "spec/resource_spec.rb",

data/spec/imports_badterm_spec.rb

@@ -16,11 +16,11 @@ describe 'corkami/imports_badterm.exe' do
     @imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
   end
 
-  it "should have all entries thunks equal" do
-    @imports.each do |iid|
-      iid.first_thunk.should == iid.original_first_thunk
-    end
-  end
+#  it "should have all entries thunks equal" do
+#    @imports.each do |iid|
+#      iid.first_thunk.should == iid.original_first_thunk
+#    end
+#  end
 
   describe "1st image_import_descriptor" do
     it "should be from kernel32.dll" do

data/spec/imports_vterm_spec.rb

@@ -16,11 +16,11 @@ describe 'corkami/imports_vterm.exe' do
     @imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
   end
 
-  it "should have all entries thunks equal" do
-    @imports.each do |iid|
-      iid.first_thunk.should == iid.original_first_thunk
-    end
-  end
+#  it "should have all entries thunks equal" do
+#    @imports.each do |iid|
+#      iid.first_thunk.should == iid.original_first_thunk
+#    end
+#  end
 
   describe "1st image_import_descriptor" do
     it "should be from kernel32.dll" do

data/spec/packer_spec.rb

@@ -0,0 +1,17 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
+
+%w'calc_upx.exe arm_upx.exe'.each do |fname|
+  describe fname do
+    before :all do
+      File.open(File.join("samples",fname),"rb") do |f|
+        @packer = PEdump.new(f).packer.first
+      end
+    end
+
+    it "should detect UPX" do
+      @packer.should_not be_nil
+      @packer.name.should include 'UPX'
+    end
+  end
+end

data/spec/pedump_spec.rb

@@ -1,7 +1,19 @@
 require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
 
-describe "Pedump" do
-#  it "fails" do
-#    fail "hey buddy, you should probably rename this file and start specing for real"
-#  end
+describe "PEdump#dump" do
+  describe "should save packer" do
+    it "when arg is a filename" do
+      dump = PEdump.dump("samples/arm_upx.exe", :log_level => Logger::FATAL)
+      dump.packers.size.should == 1
+      dump.packers.first.name.should =~ /UPX/
+    end
+
+    it "when arg is an IO" do
+      File.open("samples/arm_upx.exe", "rb") do |f|
+        dump = PEdump.dump(f, :log_level => Logger::FATAL)
+        dump.packers.size.should == 1
+        dump.packers.first.name.should =~ /UPX/
+      end
+    end
+  end
 end

data/spec/unpackers/find_spec.rb

@@ -7,6 +7,10 @@ describe PEdump::Unpacker do
     PEdump::Unpacker.find("#{root}/samples/calc_upx.exe").should == PEdump::Unpacker::UPX
   end
 
+  it "finds ARM UPX" do
+    PEdump::Unpacker.find("#{root}/samples/arm_upx.exe").should == PEdump::Unpacker::UPX
+  end
+
   it "finds ASPack" do
     PEdump::Unpacker.find("#{root}/samples/calc.asp212.exe").should == PEdump::Unpacker::ASPack
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pedump
 version: !ruby/object:Gem::Version
-  version: 0.4.7
+  version: 0.4.8
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-01-07 00:00:00.000000000 Z
+date: 2012-01-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multipart-post
-  requirement: &70164154992620 !ruby/object:Gem::Requirement
+  requirement: &70206434654160 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,10 +21,10 @@ dependencies:
         version: 1.1.4
   type: :runtime
   prerelease: false
-  version_requirements: *70164154992620
+  version_requirements: *70206434654160
 - !ruby/object:Gem::Dependency
   name: progressbar
-  requirement: &70164154991900 !ruby/object:Gem::Requirement
+  requirement: &70206434650540 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -32,10 +32,10 @@ dependencies:
         version: 0.9.2
   type: :runtime
   prerelease: false
-  version_requirements: *70164154991900
+  version_requirements: *70206434650540
 - !ruby/object:Gem::Dependency
   name: awesome_print
-  requirement: &70164154990160 !ruby/object:Gem::Requirement
+  requirement: &70206434649280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,10 +43,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70164154990160
+  version_requirements: *70206434649280
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70164154989100 !ruby/object:Gem::Requirement
+  requirement: &70206434647680 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -54,10 +54,10 @@ dependencies:
         version: 2.3.0
   type: :development
   prerelease: false
-  version_requirements: *70164154989100
+  version_requirements: *70206434647680
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70164155003740 !ruby/object:Gem::Requirement
+  requirement: &70206434646960 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -65,10 +65,10 @@ dependencies:
         version: 1.0.0
   type: :development
   prerelease: false
-  version_requirements: *70164155003740
+  version_requirements: *70206434646960
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &70164155002640 !ruby/object:Gem::Requirement
+  requirement: &70206434677380 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -76,10 +76,10 @@ dependencies:
         version: 1.6.4
   type: :development
   prerelease: false
-  version_requirements: *70164155002640
+  version_requirements: *70206434677380
 - !ruby/object:Gem::Dependency
   name: rcov
-  requirement: &70164155001260 !ruby/object:Gem::Requirement
+  requirement: &70206434676480 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -87,10 +87,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70164155001260
+  version_requirements: *70206434676480
 - !ruby/object:Gem::Dependency
   name: what_methods
-  requirement: &70164154999840 !ruby/object:Gem::Requirement
+  requirement: &70206434675740 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -98,10 +98,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70164154999840
+  version_requirements: *70206434675740
 - !ruby/object:Gem::Dependency
   name: looksee
-  requirement: &70164154998320 !ruby/object:Gem::Requirement
+  requirement: &70206434674700 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -109,7 +109,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70164154998320
+  version_requirements: *70206434674700
 description: dump headers, sections, extract resources of win32 PE exe,dll,etc
 email: zed.0xff@gmail.com
 executables:
@@ -163,6 +163,7 @@ files:
 - spec/imports_badterm_spec.rb
 - spec/imports_vterm_spec.rb
 - spec/manyimportsW7_spec.rb
+- spec/packer_spec.rb
 - spec/pe_spec.rb
 - spec/pedump_spec.rb
 - spec/resource_spec.rb
@@ -187,7 +188,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 2471928743190601423
+      hash: -1408674862654916848
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: