pedump 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/.github/FUNDING.yml +2 -0
- data/.github/dependabot.yml +8 -0
- data/CODE_OF_CONDUCT.md +76 -0
- data/Gemfile +11 -16
- data/Gemfile.lock +73 -27
- data/README.md +15 -6
- data/Rakefile +5 -44
- data/VERSION +1 -1
- data/lib/pedump.rb +101 -29
- data/lib/pedump/cli.rb +29 -18
- data/lib/pedump/loader.rb +1 -1
- data/lib/pedump/loader/minidump.rb +195 -31
- data/lib/pedump/ne.rb +1 -1
- data/lib/pedump/pe.rb +63 -54
- data/lib/pedump/te.rb +51 -0
- data/lib/pedump/unpacker/aspack.rb +1 -1
- data/lib/pedump/version.rb +2 -5
- data/misc/aspack/aspack_unlzx.c +5 -3
- data/pedump.gemspec +47 -74
- metadata +50 -101
- data/.document +0 -5
- data/.rspec +0 -1
- data/.travis.yml +0 -4
- data/samples/bad/68.exe +0 -0
- data/samples/bad/data_dir_15_entries.exe +0 -0
- data/spec/65535sects_spec.rb +0 -8
- data/spec/bad_imports_spec.rb +0 -20
- data/spec/bad_samples_spec.rb +0 -13
- data/spec/composite_io_spec.rb +0 -122
- data/spec/data/calc.exe_sections.yml +0 -49
- data/spec/data/data_dir_15_entries.exe_sections.yml +0 -95
- data/spec/dllord_spec.rb +0 -21
- data/spec/foldedhdr_spec.rb +0 -28
- data/spec/imports_badterm_spec.rb +0 -52
- data/spec/imports_vterm_spec.rb +0 -52
- data/spec/loader/names_spec.rb +0 -24
- data/spec/loader/va_spec.rb +0 -44
- data/spec/manyimportsW7_spec.rb +0 -22
- data/spec/ne_spec.rb +0 -125
- data/spec/packer_spec.rb +0 -17
- data/spec/pe_spec.rb +0 -67
- data/spec/pedump_spec.rb +0 -19
- data/spec/resource_spec.rb +0 -13
- data/spec/sections_spec.rb +0 -11
- data/spec/sig_all_packers_spec.rb +0 -24
- data/spec/sig_spec.rb +0 -68
- data/spec/spec_helper.rb +0 -24
- data/spec/support/samples.rb +0 -24
- data/spec/unpackers/aspack_spec.rb +0 -69
- data/spec/unpackers/find_spec.rb +0 -21
- data/spec/virtsectblXP_spec.rb +0 -12
- data/tmp/.keep +0 -0
data/.document
DELETED
data/.rspec
DELETED
@@ -1 +0,0 @@
|
|
1
|
-
--color
|
data/.travis.yml
DELETED
data/samples/bad/68.exe
DELETED
Binary file
|
Binary file
|
data/spec/65535sects_spec.rb
DELETED
data/spec/bad_imports_spec.rb
DELETED
@@ -1,20 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
describe 'bad_imports.exe' do
|
5
|
-
before :all do
|
6
|
-
@imports = sample.imports
|
7
|
-
end
|
8
|
-
|
9
|
-
it "should have IMAGE_IMPORT_DESCRIPTOR" do
|
10
|
-
@imports.size.should == 1
|
11
|
-
end
|
12
|
-
|
13
|
-
it "should have only IMAGE_IMPORT_DESCRIPTORs" do
|
14
|
-
@imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
|
15
|
-
end
|
16
|
-
|
17
|
-
it "should not detect packer" do
|
18
|
-
sample.packer.should be_nil
|
19
|
-
end
|
20
|
-
end
|
data/spec/bad_samples_spec.rb
DELETED
@@ -1,13 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
PEDUMP_BINARY = File.expand_path(File.dirname(__FILE__) + '/../bin/pedump')
|
5
|
-
|
6
|
-
Dir[File.join(SAMPLES_DIR,"bad","*.exe")].each do |fname|
|
7
|
-
describe fname do
|
8
|
-
it "should not cause exception" do
|
9
|
-
system "#{PEDUMP_BINARY} -qqq #{fname} > /dev/null"
|
10
|
-
$?.should be_success
|
11
|
-
end
|
12
|
-
end
|
13
|
-
end
|
data/spec/composite_io_spec.rb
DELETED
@@ -1,122 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump/composite_io')
|
3
|
-
|
4
|
-
describe PEdump::CompositeIO do
|
5
|
-
it "concatenates" do
|
6
|
-
io = PEdump::CompositeIO.new(
|
7
|
-
StringIO.new('foo'),
|
8
|
-
StringIO.new('bar'),
|
9
|
-
StringIO.new('baz')
|
10
|
-
)
|
11
|
-
io.read.should == 'foobarbaz'
|
12
|
-
end
|
13
|
-
|
14
|
-
it "reads sequentally" do
|
15
|
-
io = PEdump::CompositeIO.new(
|
16
|
-
StringIO.new('foo1'),
|
17
|
-
StringIO.new('bar2'),
|
18
|
-
StringIO.new('baz')
|
19
|
-
)
|
20
|
-
io.read(3).should == 'foo'
|
21
|
-
io.read(3).should == '1ba'
|
22
|
-
io.read(3).should == 'r2b'
|
23
|
-
io.read(3).should == 'az'
|
24
|
-
end
|
25
|
-
|
26
|
-
it "behaves like StringIO" do
|
27
|
-
io1 = StringIO.new('foo')
|
28
|
-
io2 = PEdump::CompositeIO.new(StringIO.new('foo'))
|
29
|
-
|
30
|
-
io1.read.should == io2.read # 'foo'
|
31
|
-
io1.read.should == io2.read # ''
|
32
|
-
io1.read(3).should == io2.read(3) # nil
|
33
|
-
end
|
34
|
-
|
35
|
-
it "tracks number of bytes read" do
|
36
|
-
io = PEdump::CompositeIO.new(
|
37
|
-
StringIO.new('foo1'),
|
38
|
-
StringIO.new('bar2'),
|
39
|
-
StringIO.new('baz')
|
40
|
-
)
|
41
|
-
io.tell.should == 0
|
42
|
-
io.read(3)
|
43
|
-
io.tell.should == 3
|
44
|
-
io.read(4)
|
45
|
-
io.tell.should == 7
|
46
|
-
io.read
|
47
|
-
io.tell.should == 11
|
48
|
-
io.read
|
49
|
-
io.tell.should == 11
|
50
|
-
io.read 10
|
51
|
-
io.tell.should == 11
|
52
|
-
end
|
53
|
-
|
54
|
-
it "chains eof? call" do
|
55
|
-
io = PEdump::CompositeIO.new(
|
56
|
-
StringIO.new('foo1'),
|
57
|
-
StringIO.new('bar2'),
|
58
|
-
StringIO.new('baz')
|
59
|
-
)
|
60
|
-
io.eof?.should be_false
|
61
|
-
io.read(3)
|
62
|
-
io.eof?.should be_false
|
63
|
-
io.read(4)
|
64
|
-
io.eof?.should be_false
|
65
|
-
io.read
|
66
|
-
io.eof?.should be_true
|
67
|
-
io.read
|
68
|
-
io.eof?.should be_true
|
69
|
-
io.read 10
|
70
|
-
io.eof?.should be_true
|
71
|
-
end
|
72
|
-
|
73
|
-
it "seeks" do
|
74
|
-
io = PEdump::CompositeIO.new(
|
75
|
-
StringIO.new('foo1'),
|
76
|
-
StringIO.new('bar2'),
|
77
|
-
StringIO.new('baz')
|
78
|
-
)
|
79
|
-
|
80
|
-
io.seek(5)
|
81
|
-
io.tell.should == 5
|
82
|
-
io.read(4).should == "ar2b"
|
83
|
-
|
84
|
-
io.seek(0)
|
85
|
-
io.tell.should == 0
|
86
|
-
io.read.should == "foo1bar2baz"
|
87
|
-
|
88
|
-
io.seek(1)
|
89
|
-
io.tell.should == 1
|
90
|
-
io.read.should == "oo1bar2baz"
|
91
|
-
end
|
92
|
-
|
93
|
-
it "respects start positions" do
|
94
|
-
ios = [
|
95
|
-
StringIO.new('foo1'),
|
96
|
-
StringIO.new('bar2'),
|
97
|
-
StringIO.new('baz3')
|
98
|
-
]
|
99
|
-
ios.each_with_index{ |io,idx| io.seek(idx+1) }
|
100
|
-
|
101
|
-
s = "oo1r23"
|
102
|
-
|
103
|
-
io = PEdump::CompositeIO.new(*ios)
|
104
|
-
io.tell.should == 0
|
105
|
-
io.read.should == s
|
106
|
-
|
107
|
-
s.size.times do |pos|
|
108
|
-
io.seek(pos)
|
109
|
-
io.tell.should == pos
|
110
|
-
io.read.should == s[pos..-1]
|
111
|
-
end
|
112
|
-
end
|
113
|
-
|
114
|
-
it "summarizes size" do
|
115
|
-
io = PEdump::CompositeIO.new(
|
116
|
-
StringIO.new('foo1'),
|
117
|
-
StringIO.new('bar2'),
|
118
|
-
StringIO.new('baz')
|
119
|
-
)
|
120
|
-
io.size.should == 11
|
121
|
-
end
|
122
|
-
end
|
@@ -1,49 +0,0 @@
|
|
1
|
-
---
|
2
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
3
|
-
Name: !binary |-
|
4
|
-
LnRleHQ=
|
5
|
-
VirtualSize: 305562
|
6
|
-
VirtualAddress: 4096
|
7
|
-
SizeOfRawData: 305664
|
8
|
-
PointerToRawData: 1024
|
9
|
-
PointerToRelocations: 0
|
10
|
-
PointerToLinenumbers: 0
|
11
|
-
NumberOfRelocations: 0
|
12
|
-
NumberOfLinenumbers: 0
|
13
|
-
Characteristics: 1610612768
|
14
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
15
|
-
Name: !binary |-
|
16
|
-
LmRhdGE=
|
17
|
-
VirtualSize: 17180
|
18
|
-
VirtualAddress: 311296
|
19
|
-
SizeOfRawData: 12288
|
20
|
-
PointerToRawData: 306688
|
21
|
-
PointerToRelocations: 0
|
22
|
-
PointerToLinenumbers: 0
|
23
|
-
NumberOfRelocations: 0
|
24
|
-
NumberOfLinenumbers: 0
|
25
|
-
Characteristics: 3221225536
|
26
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
27
|
-
Name: !binary |-
|
28
|
-
LnJzcmM=
|
29
|
-
VirtualSize: 305927
|
30
|
-
VirtualAddress: 331776
|
31
|
-
SizeOfRawData: 306176
|
32
|
-
PointerToRawData: 318976
|
33
|
-
PointerToRelocations: 0
|
34
|
-
PointerToLinenumbers: 0
|
35
|
-
NumberOfRelocations: 0
|
36
|
-
NumberOfLinenumbers: 0
|
37
|
-
Characteristics: 1073741888
|
38
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
39
|
-
Name: !binary |-
|
40
|
-
LnJlbG9j
|
41
|
-
VirtualSize: 16886
|
42
|
-
VirtualAddress: 638976
|
43
|
-
SizeOfRawData: 16896
|
44
|
-
PointerToRawData: 625152
|
45
|
-
PointerToRelocations: 0
|
46
|
-
PointerToLinenumbers: 0
|
47
|
-
NumberOfRelocations: 0
|
48
|
-
NumberOfLinenumbers: 0
|
49
|
-
Characteristics: 1107296320
|
@@ -1,95 +0,0 @@
|
|
1
|
-
---
|
2
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
3
|
-
Name: !binary ""
|
4
|
-
VirtualSize: 245760
|
5
|
-
VirtualAddress: 8192
|
6
|
-
SizeOfRawData: 103936
|
7
|
-
PointerToRawData: 8192
|
8
|
-
PointerToRelocations: 0
|
9
|
-
PointerToLinenumbers: 0
|
10
|
-
NumberOfRelocations: 0
|
11
|
-
NumberOfLinenumbers: 0
|
12
|
-
Characteristics: 3758096448
|
13
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
14
|
-
Name: !binary |-
|
15
|
-
LnJzcmM=
|
16
|
-
VirtualSize: 2624
|
17
|
-
VirtualAddress: 253952
|
18
|
-
SizeOfRawData: 1536
|
19
|
-
PointerToRawData: 112128
|
20
|
-
PointerToRelocations: 0
|
21
|
-
PointerToLinenumbers: 0
|
22
|
-
NumberOfRelocations: 0
|
23
|
-
NumberOfLinenumbers: 0
|
24
|
-
Characteristics: 3221225536
|
25
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
26
|
-
Name: !binary |-
|
27
|
-
LmlkYXRh
|
28
|
-
VirtualSize: 8192
|
29
|
-
VirtualAddress: 262144
|
30
|
-
SizeOfRawData: 1024
|
31
|
-
PointerToRawData: 113664
|
32
|
-
PointerToRelocations: 0
|
33
|
-
PointerToLinenumbers: 0
|
34
|
-
NumberOfRelocations: 0
|
35
|
-
NumberOfLinenumbers: 0
|
36
|
-
Characteristics: 3221225536
|
37
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
38
|
-
Name: !binary ""
|
39
|
-
VirtualSize: 1679360
|
40
|
-
VirtualAddress: 270336
|
41
|
-
SizeOfRawData: 512
|
42
|
-
PointerToRawData: 114688
|
43
|
-
PointerToRelocations: 0
|
44
|
-
PointerToLinenumbers: 0
|
45
|
-
NumberOfRelocations: 0
|
46
|
-
NumberOfLinenumbers: 0
|
47
|
-
Characteristics: 3758096448
|
48
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
49
|
-
Name: !binary |-
|
50
|
-
cnVsbm1kdnE=
|
51
|
-
VirtualSize: 1613824
|
52
|
-
VirtualAddress: 1949696
|
53
|
-
SizeOfRawData: 1607680
|
54
|
-
PointerToRawData: 115200
|
55
|
-
PointerToRelocations: 0
|
56
|
-
PointerToLinenumbers: 0
|
57
|
-
NumberOfRelocations: 0
|
58
|
-
NumberOfLinenumbers: 0
|
59
|
-
Characteristics: 3758096448
|
60
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
61
|
-
Name: !binary |-
|
62
|
-
Ym5uYm1jcWY=
|
63
|
-
VirtualSize: 8192
|
64
|
-
VirtualAddress: 3563520
|
65
|
-
SizeOfRawData: 512
|
66
|
-
PointerToRawData: 1722880
|
67
|
-
PointerToRelocations: 0
|
68
|
-
PointerToLinenumbers: 0
|
69
|
-
NumberOfRelocations: 0
|
70
|
-
NumberOfLinenumbers: 0
|
71
|
-
Characteristics: 3758096448
|
72
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
73
|
-
Name: !binary |-
|
74
|
-
Ym5uYm1jcWY=
|
75
|
-
VirtualSize: 8192
|
76
|
-
VirtualAddress: 3571712
|
77
|
-
SizeOfRawData: 3072
|
78
|
-
PointerToRawData: 1723392
|
79
|
-
PointerToRelocations: 0
|
80
|
-
PointerToLinenumbers: 0
|
81
|
-
NumberOfRelocations: 0
|
82
|
-
NumberOfLinenumbers: 0
|
83
|
-
Characteristics: 3758096448
|
84
|
-
- !ruby/struct:PEdump::IMAGE_SECTION_HEADER
|
85
|
-
Name: !binary |-
|
86
|
-
LmRhdGEAQXA=
|
87
|
-
VirtualSize: 8192
|
88
|
-
VirtualAddress: 3579904
|
89
|
-
SizeOfRawData: 0
|
90
|
-
PointerToRawData: 1726464
|
91
|
-
PointerToRelocations: 0
|
92
|
-
PointerToLinenumbers: 0
|
93
|
-
NumberOfRelocations: 0
|
94
|
-
NumberOfLinenumbers: 0
|
95
|
-
Characteristics: 3758096448
|
data/spec/dllord_spec.rb
DELETED
@@ -1,21 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
describe 'corkami/dllord.dll' do
|
5
|
-
it "should have 1 import" do
|
6
|
-
sample.imports.size.should == 1
|
7
|
-
sample.imports.map(&:module_name).should == %w'msvcrt.dll'
|
8
|
-
sample.imports.map do |iid|
|
9
|
-
(iid.original_first_thunk + iid.first_thunk).uniq.map(&:name)
|
10
|
-
end.flatten.should == ["printf"]
|
11
|
-
end
|
12
|
-
|
13
|
-
it "exports at least 2 entries" do
|
14
|
-
sample.exports.Base.should == 0x313
|
15
|
-
sample.exports.name.should be_nil
|
16
|
-
sample.exports.names.should be_empty
|
17
|
-
sample.exports.name_ordinals.should be_empty
|
18
|
-
sample.exports.entry_points[0].should == 0xffff_ffff
|
19
|
-
sample.exports.entry_points[1].should == 0x1008
|
20
|
-
end
|
21
|
-
end
|
data/spec/foldedhdr_spec.rb
DELETED
@@ -1,28 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
[ 'corkami/foldedhdr.exe', 'corkami/foldedhdrW7.exe' ].each do |fname|
|
5
|
-
describe fname do
|
6
|
-
before :all do
|
7
|
-
@sample = sample
|
8
|
-
end
|
9
|
-
|
10
|
-
it "should have 2 imports" do
|
11
|
-
@sample.imports.size.should == 2
|
12
|
-
@sample.imports.map(&:module_name).should == %w'kernel32.dll msvcrt.dll'
|
13
|
-
@sample.imports.map do |iid|
|
14
|
-
(iid.original_first_thunk + iid.first_thunk).uniq.map(&:name)
|
15
|
-
end.flatten.should == ["ExitProcess", "printf"]
|
16
|
-
end
|
17
|
-
|
18
|
-
it "should have 1 section" do
|
19
|
-
@sample.sections.size.should == 1
|
20
|
-
s = @sample.sections.first
|
21
|
-
s.VirtualSize.should == 0x1000
|
22
|
-
s.VirtualAddress.should == 0x1000
|
23
|
-
s.SizeOfRawData.should == 0x200
|
24
|
-
s.PointerToRawData.should == 0x200
|
25
|
-
s.flags.should == 0xa0000000
|
26
|
-
end
|
27
|
-
end
|
28
|
-
end
|
@@ -1,52 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
describe 'corkami/imports_badterm.exe' do
|
5
|
-
# PE with a 'bad' imports terminator, just the dll name is empty
|
6
|
-
# http://code.google.com/p/corkami/source/browse/trunk/asm/PE/imports_badterm.asm
|
7
|
-
before :all do
|
8
|
-
@imports = sample.imports
|
9
|
-
end
|
10
|
-
|
11
|
-
it "should have 2 IMAGE_IMPORT_DESCRIPTORs" do
|
12
|
-
@imports.size.should == 2
|
13
|
-
end
|
14
|
-
|
15
|
-
it "should have only IMAGE_IMPORT_DESCRIPTORs" do
|
16
|
-
@imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
|
17
|
-
end
|
18
|
-
|
19
|
-
# it "should have all entries thunks equal" do
|
20
|
-
# @imports.each do |iid|
|
21
|
-
# iid.first_thunk.should == iid.original_first_thunk
|
22
|
-
# end
|
23
|
-
# end
|
24
|
-
|
25
|
-
describe "1st image_import_descriptor" do
|
26
|
-
it "should be from kernel32.dll" do
|
27
|
-
@imports[0].module_name.should == "kernel32.dll"
|
28
|
-
end
|
29
|
-
it "should have 1 function" do
|
30
|
-
@imports[0].first_thunk.size.should == 1
|
31
|
-
end
|
32
|
-
it "should have ExitProcess" do
|
33
|
-
@imports[0].first_thunk.first.name.should == "ExitProcess"
|
34
|
-
@imports[0].first_thunk.first.hint.should == 0
|
35
|
-
@imports[0].first_thunk.first.ordinal.should be_nil
|
36
|
-
end
|
37
|
-
end
|
38
|
-
|
39
|
-
describe "2nd image_import_descriptor" do
|
40
|
-
it "should be from msvcrt.dll" do
|
41
|
-
@imports[1].module_name.should == "msvcrt.dll"
|
42
|
-
end
|
43
|
-
it "should have 1 function" do
|
44
|
-
@imports[1].first_thunk.size.should == 1
|
45
|
-
end
|
46
|
-
it "should have printf" do
|
47
|
-
@imports[1].first_thunk.first.name.should == "printf"
|
48
|
-
@imports[1].first_thunk.first.hint.should == 0
|
49
|
-
@imports[1].first_thunk.first.ordinal.should be_nil
|
50
|
-
end
|
51
|
-
end
|
52
|
-
end
|
data/spec/imports_vterm_spec.rb
DELETED
@@ -1,52 +0,0 @@
|
|
1
|
-
require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
|
2
|
-
require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
|
3
|
-
|
4
|
-
describe 'corkami/imports_vterm.exe' do
|
5
|
-
# http://code.google.com/p/corkami/source/browse/trunk/asm/PE/imports_vterm.asm
|
6
|
-
#describe "import terminator in virtual space" do
|
7
|
-
before :all do
|
8
|
-
@imports = sample.imports
|
9
|
-
end
|
10
|
-
|
11
|
-
it "should have 2 IMAGE_IMPORT_DESCRIPTORs" do
|
12
|
-
@imports.size.should == 2
|
13
|
-
end
|
14
|
-
|
15
|
-
it "should have only IMAGE_IMPORT_DESCRIPTORs" do
|
16
|
-
@imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
|
17
|
-
end
|
18
|
-
|
19
|
-
# it "should have all entries thunks equal" do
|
20
|
-
# @imports.each do |iid|
|
21
|
-
# iid.first_thunk.should == iid.original_first_thunk
|
22
|
-
# end
|
23
|
-
# end
|
24
|
-
|
25
|
-
describe "1st image_import_descriptor" do
|
26
|
-
it "should be from kernel32.dll" do
|
27
|
-
@imports[0].module_name.should == "kernel32.dll"
|
28
|
-
end
|
29
|
-
it "should have 1 function" do
|
30
|
-
@imports[0].first_thunk.size.should == 1
|
31
|
-
end
|
32
|
-
it "should have ExitProcess" do
|
33
|
-
@imports[0].first_thunk.first.name.should == "ExitProcess"
|
34
|
-
@imports[0].first_thunk.first.hint.should == 0
|
35
|
-
@imports[0].first_thunk.first.ordinal.should be_nil
|
36
|
-
end
|
37
|
-
end
|
38
|
-
|
39
|
-
describe "2nd image_import_descriptor" do
|
40
|
-
it "should be from msvcrt.dll" do
|
41
|
-
@imports[1].module_name.should == "msvcrt.dll"
|
42
|
-
end
|
43
|
-
it "should have 1 function" do
|
44
|
-
@imports[1].first_thunk.size.should == 1
|
45
|
-
end
|
46
|
-
it "should have printf" do
|
47
|
-
@imports[1].first_thunk.first.name.should == "printf"
|
48
|
-
@imports[1].first_thunk.first.hint.should == 0
|
49
|
-
@imports[1].first_thunk.first.ordinal.should be_nil
|
50
|
-
end
|
51
|
-
end
|
52
|
-
end
|