pedump 0.5.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/Gemfile +3 -9
- data/Gemfile.lock +23 -24
- data/Rakefile +3 -72
- data/VERSION +1 -1
- data/lib/pedump.rb +9 -4
- data/lib/pedump/loader.rb +1 -1
- data/lib/pedump/loader/minidump.rb +66 -17
- data/lib/pedump/version.rb +1 -1
- data/pedump.gemspec +22 -132
- metadata +24 -164
- data/.document +0 -5
- data/.rspec +0 -1
- data/.travis.yml +0 -4
- data/samples/bad/68.exe +0 -0
- data/samples/bad/data_dir_15_entries.exe +0 -0
- data/spec/65535sects_spec.rb +0 -8
- data/spec/bad_imports_spec.rb +0 -20
- data/spec/bad_samples_spec.rb +0 -13
- data/spec/composite_io_spec.rb +0 -122
- data/spec/data/calc.exe_sections.yml +0 -49
- data/spec/data/data_dir_15_entries.exe_sections.yml +0 -95
- data/spec/dllord_spec.rb +0 -21
- data/spec/foldedhdr_spec.rb +0 -28
- data/spec/imports_badterm_spec.rb +0 -52
- data/spec/imports_vterm_spec.rb +0 -52
- data/spec/loader/names_spec.rb +0 -24
- data/spec/loader/va_spec.rb +0 -44
- data/spec/manyimportsW7_spec.rb +0 -22
- data/spec/ne_spec.rb +0 -125
- data/spec/packer_spec.rb +0 -17
- data/spec/pe_spec.rb +0 -67
- data/spec/pedump_spec.rb +0 -19
- data/spec/resource_spec.rb +0 -13
- data/spec/sections_spec.rb +0 -11
- data/spec/sig_all_packers_spec.rb +0 -24
- data/spec/sig_spec.rb +0 -68
- data/spec/spec_helper.rb +0 -24
- data/spec/support/samples.rb +0 -24
- data/spec/unpackers/aspack_spec.rb +0 -69
- data/spec/unpackers/find_spec.rb +0 -21
- data/spec/virtsectblXP_spec.rb +0 -12
- data/tmp/.keep +0 -0
data/spec/packer_spec.rb
DELETED
@@ -1,17 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
%w'calc_upx.exe arm_upx.exe'.each do |fname|
|
5
|
-
describe fname do
|
6
|
-
before :all do
|
7
|
-
File.open(File.join("samples",fname),"rb") do |f|
|
8
|
-
@packer = PEdump.new(f).packer.first
|
9
|
-
end
|
10
|
-
end
|
11
|
-
|
12
|
-
it "should detect UPX" do
|
13
|
-
@packer.should_not be_nil
|
14
|
-
@packer.name.should include 'UPX'
|
15
|
-
end
|
16
|
-
end
|
17
|
-
end
|
data/spec/pe_spec.rb
DELETED
@@ -1,67 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
describe 'PE' do
|
5
|
-
it "should assume TimeDateStamp is in UTC"
|
6
|
-
|
7
|
-
KLASS = PEdump::ImportedFunction
|
8
|
-
|
9
|
-
describe KLASS do
|
10
|
-
it "should be equal" do
|
11
|
-
pending "necessary?"
|
12
|
-
a = []
|
13
|
-
KLASS.new(*a).should == KLASS.new(*a)
|
14
|
-
a = ['a']
|
15
|
-
KLASS.new(*a).should == KLASS.new(*a)
|
16
|
-
a = ['a','b']
|
17
|
-
KLASS.new(*a).should == KLASS.new(*a)
|
18
|
-
a = ['a','b','c']
|
19
|
-
KLASS.new(*a).should == KLASS.new(*a)
|
20
|
-
a = ['a','b','c','d']
|
21
|
-
KLASS.new(*a).should == KLASS.new(*a)
|
22
|
-
end
|
23
|
-
|
24
|
-
it "should not be equal" do
|
25
|
-
a = ['a']
|
26
|
-
b = []
|
27
|
-
KLASS.new(*a).should_not == KLASS.new(*b)
|
28
|
-
a = ['a']
|
29
|
-
b = ['b']
|
30
|
-
KLASS.new(*a).should_not == KLASS.new(*b)
|
31
|
-
a = ['a','B']
|
32
|
-
b = ['a','b']
|
33
|
-
KLASS.new(*a).should_not == KLASS.new(*b)
|
34
|
-
a = ['a','b','c']
|
35
|
-
b = ['a','b']
|
36
|
-
KLASS.new(*a).should_not == KLASS.new(*b)
|
37
|
-
a = ['a','b','c']
|
38
|
-
b = ['a','b','X']
|
39
|
-
KLASS.new(*a).should_not == KLASS.new(*b)
|
40
|
-
end
|
41
|
-
|
42
|
-
it "should be equal with different VA's" do
|
43
|
-
pending "necessary?"
|
44
|
-
a = ['a','b','c',nil]
|
45
|
-
b = ['a','b','c','d']
|
46
|
-
KLASS.new(*a).should == KLASS.new(*b)
|
47
|
-
a = ['a','b','c',0x1000]
|
48
|
-
b = ['a','b','c',0x2000]
|
49
|
-
KLASS.new(*a).should == KLASS.new(*b)
|
50
|
-
a = ['a','b','c',0x1000]
|
51
|
-
b = ['a','b','c',0x1000]
|
52
|
-
KLASS.new(*a).should == KLASS.new(*b)
|
53
|
-
end
|
54
|
-
|
55
|
-
it "should be equal in uniq() with different VA's" do
|
56
|
-
a = ['a','b','c',nil]
|
57
|
-
b = ['a','b','c','d']
|
58
|
-
[KLASS.new(*a), KLASS.new(*b)].uniq.size.should == 1
|
59
|
-
a = ['a','b','c',0x1000]
|
60
|
-
b = ['a','b','c',0x2000]
|
61
|
-
[KLASS.new(*a), KLASS.new(*b)].uniq.size.should == 1
|
62
|
-
a = ['a','b','c',0x1000]
|
63
|
-
b = ['a','b','c',0x1000]
|
64
|
-
[KLASS.new(*a), KLASS.new(*b)].uniq.size.should == 1
|
65
|
-
end
|
66
|
-
end
|
67
|
-
end
|
data/spec/pedump_spec.rb
DELETED
@@ -1,19 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
|
3
|
-
describe "PEdump#dump" do
|
4
|
-
describe "should save packer" do
|
5
|
-
it "when arg is a filename" do
|
6
|
-
dump = PEdump.dump("samples/arm_upx.exe", :log_level => Logger::FATAL)
|
7
|
-
dump.packers.size.should == 1
|
8
|
-
dump.packers.first.name.should =~ /UPX/
|
9
|
-
end
|
10
|
-
|
11
|
-
it "when arg is an IO" do
|
12
|
-
File.open("samples/arm_upx.exe", "rb") do |f|
|
13
|
-
dump = PEdump.dump(f, :log_level => Logger::FATAL)
|
14
|
-
dump.packers.size.should == 1
|
15
|
-
dump.packers.first.name.should =~ /UPX/
|
16
|
-
end
|
17
|
-
end
|
18
|
-
end
|
19
|
-
end
|
data/spec/resource_spec.rb
DELETED
@@ -1,13 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
describe 'PEdump' do
|
5
|
-
it "should get all resources" do
|
6
|
-
fname = File.expand_path(File.dirname(__FILE__) + '/../samples/calc.exe')
|
7
|
-
File.open(fname,"rb") do |f|
|
8
|
-
@pedump = PEdump.new(fname)
|
9
|
-
@resources = @pedump.resources(f)
|
10
|
-
end
|
11
|
-
@resources.size.should == 71
|
12
|
-
end
|
13
|
-
end
|
data/spec/sections_spec.rb
DELETED
@@ -1,11 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
require 'yaml'
|
4
|
-
|
5
|
-
['calc.exe', 'bad/data_dir_15_entries.exe'].each do |fname|
|
6
|
-
describe fname do
|
7
|
-
it "should match saved sections info" do
|
8
|
-
sample.sections.should == YAML::load_file(File.join(DATA_DIR,"#{File.basename(fname)}_sections.yml"))
|
9
|
-
end
|
10
|
-
end
|
11
|
-
end
|
@@ -1,24 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump/packer')
|
3
|
-
|
4
|
-
describe "PEdump::Packer" do
|
5
|
-
describe "matchers" do
|
6
|
-
if ENV['SLOW']
|
7
|
-
PEdump::SigParser.parse(:raw => true).each do |sig|
|
8
|
-
data = sig.re.join
|
9
|
-
next if data == "This program cannot be run in DOS mo"
|
10
|
-
it "should find #{sig.name}" do
|
11
|
-
a = PEdump::Packer.of(data).map(&:name)
|
12
|
-
a.size.should > 0
|
13
|
-
|
14
|
-
a = sig.name.split - a.join(' ').split - ['Exe','PE']
|
15
|
-
a.delete_if{ |x| x[/[vV\.\/()\[\]]/] }
|
16
|
-
p a if a.size > 1
|
17
|
-
a.size.should < 2
|
18
|
-
end
|
19
|
-
end
|
20
|
-
else
|
21
|
-
pending "SLOW"
|
22
|
-
end
|
23
|
-
end
|
24
|
-
end
|
data/spec/sig_spec.rb
DELETED
@@ -1,68 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump/packer')
|
3
|
-
|
4
|
-
describe "PEdump::Packer" do
|
5
|
-
it "should have enough signatures" do
|
6
|
-
PEdump::Packer.count.should > 1000
|
7
|
-
end
|
8
|
-
|
9
|
-
it "should not match" do
|
10
|
-
maxlen = PEdump::Packer.map(&:size).max
|
11
|
-
s = 'x'*maxlen
|
12
|
-
PEdump::Packer.of_data(s).should be_nil
|
13
|
-
end
|
14
|
-
|
15
|
-
it "should parse" do
|
16
|
-
a = PEdump::SigParser.parse
|
17
|
-
a.should be_instance_of(Array)
|
18
|
-
a.map(&:class).uniq.should == [PEdump::Packer]
|
19
|
-
end
|
20
|
-
|
21
|
-
it "should not react to DOS signature" do
|
22
|
-
data = "This program cannot be run in DOS mode"
|
23
|
-
PEdump::Packer.of(data).should be_nil
|
24
|
-
end
|
25
|
-
|
26
|
-
it "should match sigs" do
|
27
|
-
n = 0
|
28
|
-
File.open('data/signatures.txt', 'r:cp1252') do |f|
|
29
|
-
while row = f.gets
|
30
|
-
row.strip!
|
31
|
-
next unless row =~ /^\[(.*)=(.*)\]$/
|
32
|
-
s = ''
|
33
|
-
title,hexstring = $1,$2
|
34
|
-
|
35
|
-
# bad sigs
|
36
|
-
next if hexstring == '909090909090909090909090909090909090909090909090909090909090909090909090'
|
37
|
-
next if hexstring == 'E9::::0000000000000000'
|
38
|
-
|
39
|
-
(hexstring.size/2).times do |i|
|
40
|
-
c = hexstring[i*2,2]
|
41
|
-
if c == '::'
|
42
|
-
s << '.'
|
43
|
-
else
|
44
|
-
s << c.to_i(16).chr
|
45
|
-
end
|
46
|
-
end
|
47
|
-
packers = PEdump::Packer.of(s)
|
48
|
-
if packers
|
49
|
-
names = packers.map(&:name)
|
50
|
-
next if names.any? do |name|
|
51
|
-
a = name.upcase.tr('V','')
|
52
|
-
b = title.upcase.tr('V','')
|
53
|
-
a[b] || b[a]
|
54
|
-
end
|
55
|
-
# puts "[.] #{title}"
|
56
|
-
# names.each do |x|
|
57
|
-
# puts "\t= #{x}"
|
58
|
-
# end
|
59
|
-
else
|
60
|
-
puts "[?] #{title}: #{hexstring}"
|
61
|
-
n += 1
|
62
|
-
end
|
63
|
-
end
|
64
|
-
end
|
65
|
-
#puts "[.] diff = #{n}"
|
66
|
-
n.should == 0
|
67
|
-
end
|
68
|
-
end
|
data/spec/spec_helper.rb
DELETED
@@ -1,24 +0,0 @@
|
|
1
|
-
$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
|
2
|
-
$LOAD_PATH.unshift(File.dirname(__FILE__))
|
3
|
-
require 'rspec'
|
4
|
-
require 'pedump'
|
5
|
-
require 'fileutils'
|
6
|
-
|
7
|
-
DATA_DIR = File.join(File.dirname(__FILE__), "data")
|
8
|
-
Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
|
9
|
-
|
10
|
-
def unarchive_samples fname
|
11
|
-
flag_fname = File.join(File.dirname(fname), ".#{File.basename(fname)}_unpacked")
|
12
|
-
# check if already unpacked
|
13
|
-
return if File.exist?(flag_fname)
|
14
|
-
system "7zr", "x", "-y", "-o#{SAMPLES_DIR}", fname
|
15
|
-
FileUtils.touch(flag_fname) if $?.success?
|
16
|
-
end
|
17
|
-
|
18
|
-
RSpec.configure do |config|
|
19
|
-
config.before :suite do
|
20
|
-
Dir[File.join(SAMPLES_DIR,"*.7z")].each do |fname|
|
21
|
-
unarchive_samples fname
|
22
|
-
end
|
23
|
-
end
|
24
|
-
end
|
data/spec/support/samples.rb
DELETED
@@ -1,24 +0,0 @@
|
|
1
|
-
SAMPLES_DIR = File.expand_path(File.dirname(__FILE__) + '/../../samples/')
|
2
|
-
|
3
|
-
def sample
|
4
|
-
@pedump ||=
|
5
|
-
begin
|
6
|
-
fname =
|
7
|
-
if self.example
|
8
|
-
# called from it(...)
|
9
|
-
self.example.full_description.split.first
|
10
|
-
else
|
11
|
-
# called from before(:all)
|
12
|
-
self.class.metadata[:example_group][:description_args].first
|
13
|
-
end
|
14
|
-
fname = File.join(SAMPLES_DIR, fname)
|
15
|
-
File.open(fname,"rb") do |f|
|
16
|
-
if block_given?
|
17
|
-
yield PEdump.new(f)
|
18
|
-
else
|
19
|
-
PEdump.new(f).dump
|
20
|
-
end
|
21
|
-
end
|
22
|
-
end
|
23
|
-
end
|
24
|
-
|
@@ -1,69 +0,0 @@
|
|
1
|
-
root = File.expand_path(File.dirname(File.dirname(File.dirname(__FILE__))))
|
2
|
-
require "#{root}/spec/spec_helper"
|
3
|
-
require "#{root}/lib/pedump"
|
4
|
-
require "#{root}/lib/pedump/unpacker/aspack"
|
5
|
-
require "#{root}/lib/pedump/comparer"
|
6
|
-
|
7
|
-
describe PEdump::Unpacker::ASPack do
|
8
|
-
Dir["#{root}/samples/*.asp[1-9]*.{exe}"].each do |pname|
|
9
|
-
orig_fname = pname.sub(/\.asp[^.]+/,'')
|
10
|
-
|
11
|
-
describe File.basename(orig_fname) + " vs " + File.basename(pname) do
|
12
|
-
before :all do
|
13
|
-
@ldr = PEdump::Loader.new(File.open(orig_fname,"rb"))
|
14
|
-
end
|
15
|
-
|
16
|
-
it "should have no differences" do
|
17
|
-
File.open(pname,"rb") do |f|
|
18
|
-
u = PEdump::Unpacker::ASPack.new(f)
|
19
|
-
File.open("#{root}/tmp/unpacked.tmp","w+") do |fo|
|
20
|
-
u.unpack.dump(fo)
|
21
|
-
fo.rewind
|
22
|
-
ldr = PEdump::Loader.new(fo)
|
23
|
-
|
24
|
-
comparer = PEdump::Comparer.new(@ldr, ldr)
|
25
|
-
comparer.ignored_data_dirs = [
|
26
|
-
PEdump::IMAGE_DATA_DIRECTORY::LOAD_CONFIG,
|
27
|
-
PEdump::IMAGE_DATA_DIRECTORY::Bound_IAT,
|
28
|
-
PEdump::IMAGE_DATA_DIRECTORY::Delay_IAT
|
29
|
-
]
|
30
|
-
comparer.ignored_sections = [ '.rsrc', '.aspack' ]
|
31
|
-
comparer.diff.should == []
|
32
|
-
end
|
33
|
-
end
|
34
|
-
end
|
35
|
-
end
|
36
|
-
end
|
37
|
-
|
38
|
-
Dir["#{root}/samples/*.asp[1-9]*.{ocx}"].each do |pname|
|
39
|
-
orig_fname = pname.sub(/\.asp[^.]+/,'')
|
40
|
-
|
41
|
-
describe File.basename(orig_fname) + " vs " + File.basename(pname) do
|
42
|
-
before :all do
|
43
|
-
@ldr = PEdump::Loader.new(File.open(orig_fname,"rb"))
|
44
|
-
end
|
45
|
-
|
46
|
-
it "should have no differences" do
|
47
|
-
File.open(pname,"rb") do |f|
|
48
|
-
u = PEdump::Unpacker::ASPack.new(f)
|
49
|
-
File.open("#{root}/tmp/unpacked.tmp","w+") do |fo|
|
50
|
-
u.unpack.dump(fo)
|
51
|
-
fo.rewind
|
52
|
-
ldr = PEdump::Loader.new(fo)
|
53
|
-
|
54
|
-
comparer = PEdump::Comparer.new(@ldr, ldr)
|
55
|
-
comparer.ignored_data_dirs = [
|
56
|
-
PEdump::IMAGE_DATA_DIRECTORY::LOAD_CONFIG,
|
57
|
-
PEdump::IMAGE_DATA_DIRECTORY::Bound_IAT,
|
58
|
-
PEdump::IMAGE_DATA_DIRECTORY::Delay_IAT,
|
59
|
-
PEdump::IMAGE_DATA_DIRECTORY::BASERELOC, # 0x15496 vs 0x15494
|
60
|
-
PEdump::IMAGE_DATA_DIRECTORY::IAT
|
61
|
-
]
|
62
|
-
comparer.ignored_sections = [ '.rsrc', '.aspack', '.cas' ]
|
63
|
-
comparer.diff.should == []
|
64
|
-
end
|
65
|
-
end
|
66
|
-
end
|
67
|
-
end
|
68
|
-
end
|
69
|
-
end
|
data/spec/unpackers/find_spec.rb
DELETED
@@ -1,21 +0,0 @@
|
|
1
|
-
root = File.expand_path(File.dirname(File.dirname(File.dirname(__FILE__))))
|
2
|
-
require "#{root}/spec/spec_helper"
|
3
|
-
require "#{root}/lib/pedump/unpacker"
|
4
|
-
|
5
|
-
describe PEdump::Unpacker do
|
6
|
-
it "finds UPX" do
|
7
|
-
PEdump::Unpacker.find("#{root}/samples/calc_upx.exe").should == PEdump::Unpacker::UPX
|
8
|
-
end
|
9
|
-
|
10
|
-
it "finds ARM UPX" do
|
11
|
-
PEdump::Unpacker.find("#{root}/samples/arm_upx.exe").should == PEdump::Unpacker::UPX
|
12
|
-
end
|
13
|
-
|
14
|
-
it "finds ASPack" do
|
15
|
-
PEdump::Unpacker.find("#{root}/samples/calc.asp212.exe").should == PEdump::Unpacker::ASPack
|
16
|
-
end
|
17
|
-
|
18
|
-
it "finds nothing" do
|
19
|
-
PEdump::Unpacker.find("#{root}/samples/calc.exe").should be_nil
|
20
|
-
end
|
21
|
-
end
|
data/spec/virtsectblXP_spec.rb
DELETED
@@ -1,12 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
describe 'corkami/virtsectblXP.exe' do
|
5
|
-
it "should have 2 imports" do
|
6
|
-
sample.imports.size.should == 2
|
7
|
-
sample.imports.map(&:module_name).should == %w'kernel32.dll msvcrt.dll'
|
8
|
-
sample.imports.map do |iid|
|
9
|
-
(iid.original_first_thunk + iid.first_thunk).uniq.map(&:name)
|
10
|
-
end.flatten.should == ["ExitProcess", "printf"]
|
11
|
-
end
|
12
|
-
end
|
data/tmp/.keep
DELETED
File without changes
|