pedump 0.5.0 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,17 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- %w'calc_upx.exe arm_upx.exe'.each do |fname|
5
- describe fname do
6
- before :all do
7
- File.open(File.join("samples",fname),"rb") do |f|
8
- @packer = PEdump.new(f).packer.first
9
- end
10
- end
11
-
12
- it "should detect UPX" do
13
- @packer.should_not be_nil
14
- @packer.name.should include 'UPX'
15
- end
16
- end
17
- end
@@ -1,67 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'PE' do
5
- it "should assume TimeDateStamp is in UTC"
6
-
7
- KLASS = PEdump::ImportedFunction
8
-
9
- describe KLASS do
10
- it "should be equal" do
11
- pending "necessary?"
12
- a = []
13
- KLASS.new(*a).should == KLASS.new(*a)
14
- a = ['a']
15
- KLASS.new(*a).should == KLASS.new(*a)
16
- a = ['a','b']
17
- KLASS.new(*a).should == KLASS.new(*a)
18
- a = ['a','b','c']
19
- KLASS.new(*a).should == KLASS.new(*a)
20
- a = ['a','b','c','d']
21
- KLASS.new(*a).should == KLASS.new(*a)
22
- end
23
-
24
- it "should not be equal" do
25
- a = ['a']
26
- b = []
27
- KLASS.new(*a).should_not == KLASS.new(*b)
28
- a = ['a']
29
- b = ['b']
30
- KLASS.new(*a).should_not == KLASS.new(*b)
31
- a = ['a','B']
32
- b = ['a','b']
33
- KLASS.new(*a).should_not == KLASS.new(*b)
34
- a = ['a','b','c']
35
- b = ['a','b']
36
- KLASS.new(*a).should_not == KLASS.new(*b)
37
- a = ['a','b','c']
38
- b = ['a','b','X']
39
- KLASS.new(*a).should_not == KLASS.new(*b)
40
- end
41
-
42
- it "should be equal with different VA's" do
43
- pending "necessary?"
44
- a = ['a','b','c',nil]
45
- b = ['a','b','c','d']
46
- KLASS.new(*a).should == KLASS.new(*b)
47
- a = ['a','b','c',0x1000]
48
- b = ['a','b','c',0x2000]
49
- KLASS.new(*a).should == KLASS.new(*b)
50
- a = ['a','b','c',0x1000]
51
- b = ['a','b','c',0x1000]
52
- KLASS.new(*a).should == KLASS.new(*b)
53
- end
54
-
55
- it "should be equal in uniq() with different VA's" do
56
- a = ['a','b','c',nil]
57
- b = ['a','b','c','d']
58
- [KLASS.new(*a), KLASS.new(*b)].uniq.size.should == 1
59
- a = ['a','b','c',0x1000]
60
- b = ['a','b','c',0x2000]
61
- [KLASS.new(*a), KLASS.new(*b)].uniq.size.should == 1
62
- a = ['a','b','c',0x1000]
63
- b = ['a','b','c',0x1000]
64
- [KLASS.new(*a), KLASS.new(*b)].uniq.size.should == 1
65
- end
66
- end
67
- end
@@ -1,19 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
-
3
- describe "PEdump#dump" do
4
- describe "should save packer" do
5
- it "when arg is a filename" do
6
- dump = PEdump.dump("samples/arm_upx.exe", :log_level => Logger::FATAL)
7
- dump.packers.size.should == 1
8
- dump.packers.first.name.should =~ /UPX/
9
- end
10
-
11
- it "when arg is an IO" do
12
- File.open("samples/arm_upx.exe", "rb") do |f|
13
- dump = PEdump.dump(f, :log_level => Logger::FATAL)
14
- dump.packers.size.should == 1
15
- dump.packers.first.name.should =~ /UPX/
16
- end
17
- end
18
- end
19
- end
@@ -1,13 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'PEdump' do
5
- it "should get all resources" do
6
- fname = File.expand_path(File.dirname(__FILE__) + '/../samples/calc.exe')
7
- File.open(fname,"rb") do |f|
8
- @pedump = PEdump.new(fname)
9
- @resources = @pedump.resources(f)
10
- end
11
- @resources.size.should == 71
12
- end
13
- end
@@ -1,11 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
- require 'yaml'
4
-
5
- ['calc.exe', 'bad/data_dir_15_entries.exe'].each do |fname|
6
- describe fname do
7
- it "should match saved sections info" do
8
- sample.sections.should == YAML::load_file(File.join(DATA_DIR,"#{File.basename(fname)}_sections.yml"))
9
- end
10
- end
11
- end
@@ -1,24 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump/packer')
3
-
4
- describe "PEdump::Packer" do
5
- describe "matchers" do
6
- if ENV['SLOW']
7
- PEdump::SigParser.parse(:raw => true).each do |sig|
8
- data = sig.re.join
9
- next if data == "This program cannot be run in DOS mo"
10
- it "should find #{sig.name}" do
11
- a = PEdump::Packer.of(data).map(&:name)
12
- a.size.should > 0
13
-
14
- a = sig.name.split - a.join(' ').split - ['Exe','PE']
15
- a.delete_if{ |x| x[/[vV\.\/()\[\]]/] }
16
- p a if a.size > 1
17
- a.size.should < 2
18
- end
19
- end
20
- else
21
- pending "SLOW"
22
- end
23
- end
24
- end
@@ -1,68 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump/packer')
3
-
4
- describe "PEdump::Packer" do
5
- it "should have enough signatures" do
6
- PEdump::Packer.count.should > 1000
7
- end
8
-
9
- it "should not match" do
10
- maxlen = PEdump::Packer.map(&:size).max
11
- s = 'x'*maxlen
12
- PEdump::Packer.of_data(s).should be_nil
13
- end
14
-
15
- it "should parse" do
16
- a = PEdump::SigParser.parse
17
- a.should be_instance_of(Array)
18
- a.map(&:class).uniq.should == [PEdump::Packer]
19
- end
20
-
21
- it "should not react to DOS signature" do
22
- data = "This program cannot be run in DOS mode"
23
- PEdump::Packer.of(data).should be_nil
24
- end
25
-
26
- it "should match sigs" do
27
- n = 0
28
- File.open('data/signatures.txt', 'r:cp1252') do |f|
29
- while row = f.gets
30
- row.strip!
31
- next unless row =~ /^\[(.*)=(.*)\]$/
32
- s = ''
33
- title,hexstring = $1,$2
34
-
35
- # bad sigs
36
- next if hexstring == '909090909090909090909090909090909090909090909090909090909090909090909090'
37
- next if hexstring == 'E9::::0000000000000000'
38
-
39
- (hexstring.size/2).times do |i|
40
- c = hexstring[i*2,2]
41
- if c == '::'
42
- s << '.'
43
- else
44
- s << c.to_i(16).chr
45
- end
46
- end
47
- packers = PEdump::Packer.of(s)
48
- if packers
49
- names = packers.map(&:name)
50
- next if names.any? do |name|
51
- a = name.upcase.tr('V','')
52
- b = title.upcase.tr('V','')
53
- a[b] || b[a]
54
- end
55
- # puts "[.] #{title}"
56
- # names.each do |x|
57
- # puts "\t= #{x}"
58
- # end
59
- else
60
- puts "[?] #{title}: #{hexstring}"
61
- n += 1
62
- end
63
- end
64
- end
65
- #puts "[.] diff = #{n}"
66
- n.should == 0
67
- end
68
- end
@@ -1,24 +0,0 @@
1
- $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
2
- $LOAD_PATH.unshift(File.dirname(__FILE__))
3
- require 'rspec'
4
- require 'pedump'
5
- require 'fileutils'
6
-
7
- DATA_DIR = File.join(File.dirname(__FILE__), "data")
8
- Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
9
-
10
- def unarchive_samples fname
11
- flag_fname = File.join(File.dirname(fname), ".#{File.basename(fname)}_unpacked")
12
- # check if already unpacked
13
- return if File.exist?(flag_fname)
14
- system "7zr", "x", "-y", "-o#{SAMPLES_DIR}", fname
15
- FileUtils.touch(flag_fname) if $?.success?
16
- end
17
-
18
- RSpec.configure do |config|
19
- config.before :suite do
20
- Dir[File.join(SAMPLES_DIR,"*.7z")].each do |fname|
21
- unarchive_samples fname
22
- end
23
- end
24
- end
@@ -1,24 +0,0 @@
1
- SAMPLES_DIR = File.expand_path(File.dirname(__FILE__) + '/../../samples/')
2
-
3
- def sample
4
- @pedump ||=
5
- begin
6
- fname =
7
- if self.example
8
- # called from it(...)
9
- self.example.full_description.split.first
10
- else
11
- # called from before(:all)
12
- self.class.metadata[:example_group][:description_args].first
13
- end
14
- fname = File.join(SAMPLES_DIR, fname)
15
- File.open(fname,"rb") do |f|
16
- if block_given?
17
- yield PEdump.new(f)
18
- else
19
- PEdump.new(f).dump
20
- end
21
- end
22
- end
23
- end
24
-
@@ -1,69 +0,0 @@
1
- root = File.expand_path(File.dirname(File.dirname(File.dirname(__FILE__))))
2
- require "#{root}/spec/spec_helper"
3
- require "#{root}/lib/pedump"
4
- require "#{root}/lib/pedump/unpacker/aspack"
5
- require "#{root}/lib/pedump/comparer"
6
-
7
- describe PEdump::Unpacker::ASPack do
8
- Dir["#{root}/samples/*.asp[1-9]*.{exe}"].each do |pname|
9
- orig_fname = pname.sub(/\.asp[^.]+/,'')
10
-
11
- describe File.basename(orig_fname) + " vs " + File.basename(pname) do
12
- before :all do
13
- @ldr = PEdump::Loader.new(File.open(orig_fname,"rb"))
14
- end
15
-
16
- it "should have no differences" do
17
- File.open(pname,"rb") do |f|
18
- u = PEdump::Unpacker::ASPack.new(f)
19
- File.open("#{root}/tmp/unpacked.tmp","w+") do |fo|
20
- u.unpack.dump(fo)
21
- fo.rewind
22
- ldr = PEdump::Loader.new(fo)
23
-
24
- comparer = PEdump::Comparer.new(@ldr, ldr)
25
- comparer.ignored_data_dirs = [
26
- PEdump::IMAGE_DATA_DIRECTORY::LOAD_CONFIG,
27
- PEdump::IMAGE_DATA_DIRECTORY::Bound_IAT,
28
- PEdump::IMAGE_DATA_DIRECTORY::Delay_IAT
29
- ]
30
- comparer.ignored_sections = [ '.rsrc', '.aspack' ]
31
- comparer.diff.should == []
32
- end
33
- end
34
- end
35
- end
36
- end
37
-
38
- Dir["#{root}/samples/*.asp[1-9]*.{ocx}"].each do |pname|
39
- orig_fname = pname.sub(/\.asp[^.]+/,'')
40
-
41
- describe File.basename(orig_fname) + " vs " + File.basename(pname) do
42
- before :all do
43
- @ldr = PEdump::Loader.new(File.open(orig_fname,"rb"))
44
- end
45
-
46
- it "should have no differences" do
47
- File.open(pname,"rb") do |f|
48
- u = PEdump::Unpacker::ASPack.new(f)
49
- File.open("#{root}/tmp/unpacked.tmp","w+") do |fo|
50
- u.unpack.dump(fo)
51
- fo.rewind
52
- ldr = PEdump::Loader.new(fo)
53
-
54
- comparer = PEdump::Comparer.new(@ldr, ldr)
55
- comparer.ignored_data_dirs = [
56
- PEdump::IMAGE_DATA_DIRECTORY::LOAD_CONFIG,
57
- PEdump::IMAGE_DATA_DIRECTORY::Bound_IAT,
58
- PEdump::IMAGE_DATA_DIRECTORY::Delay_IAT,
59
- PEdump::IMAGE_DATA_DIRECTORY::BASERELOC, # 0x15496 vs 0x15494
60
- PEdump::IMAGE_DATA_DIRECTORY::IAT
61
- ]
62
- comparer.ignored_sections = [ '.rsrc', '.aspack', '.cas' ]
63
- comparer.diff.should == []
64
- end
65
- end
66
- end
67
- end
68
- end
69
- end
@@ -1,21 +0,0 @@
1
- root = File.expand_path(File.dirname(File.dirname(File.dirname(__FILE__))))
2
- require "#{root}/spec/spec_helper"
3
- require "#{root}/lib/pedump/unpacker"
4
-
5
- describe PEdump::Unpacker do
6
- it "finds UPX" do
7
- PEdump::Unpacker.find("#{root}/samples/calc_upx.exe").should == PEdump::Unpacker::UPX
8
- end
9
-
10
- it "finds ARM UPX" do
11
- PEdump::Unpacker.find("#{root}/samples/arm_upx.exe").should == PEdump::Unpacker::UPX
12
- end
13
-
14
- it "finds ASPack" do
15
- PEdump::Unpacker.find("#{root}/samples/calc.asp212.exe").should == PEdump::Unpacker::ASPack
16
- end
17
-
18
- it "finds nothing" do
19
- PEdump::Unpacker.find("#{root}/samples/calc.exe").should be_nil
20
- end
21
- end
@@ -1,12 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'corkami/virtsectblXP.exe' do
5
- it "should have 2 imports" do
6
- sample.imports.size.should == 2
7
- sample.imports.map(&:module_name).should == %w'kernel32.dll msvcrt.dll'
8
- sample.imports.map do |iid|
9
- (iid.original_first_thunk + iid.first_thunk).uniq.map(&:name)
10
- end.flatten.should == ["ExitProcess", "printf"]
11
- end
12
- end
data/tmp/.keep DELETED
File without changes