pedump 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. checksums.yaml +7 -0
  2. data/.github/FUNDING.yml +2 -0
  3. data/.github/dependabot.yml +8 -0
  4. data/CODE_OF_CONDUCT.md +76 -0
  5. data/Gemfile +11 -16
  6. data/Gemfile.lock +73 -27
  7. data/README.md +15 -6
  8. data/Rakefile +5 -44
  9. data/VERSION +1 -1
  10. data/lib/pedump.rb +101 -29
  11. data/lib/pedump/cli.rb +29 -18
  12. data/lib/pedump/loader.rb +1 -1
  13. data/lib/pedump/loader/minidump.rb +195 -31
  14. data/lib/pedump/ne.rb +1 -1
  15. data/lib/pedump/pe.rb +63 -54
  16. data/lib/pedump/te.rb +51 -0
  17. data/lib/pedump/unpacker/aspack.rb +1 -1
  18. data/lib/pedump/version.rb +2 -5
  19. data/misc/aspack/aspack_unlzx.c +5 -3
  20. data/pedump.gemspec +47 -74
  21. metadata +50 -101
  22. data/.document +0 -5
  23. data/.rspec +0 -1
  24. data/.travis.yml +0 -4
  25. data/samples/bad/68.exe +0 -0
  26. data/samples/bad/data_dir_15_entries.exe +0 -0
  27. data/spec/65535sects_spec.rb +0 -8
  28. data/spec/bad_imports_spec.rb +0 -20
  29. data/spec/bad_samples_spec.rb +0 -13
  30. data/spec/composite_io_spec.rb +0 -122
  31. data/spec/data/calc.exe_sections.yml +0 -49
  32. data/spec/data/data_dir_15_entries.exe_sections.yml +0 -95
  33. data/spec/dllord_spec.rb +0 -21
  34. data/spec/foldedhdr_spec.rb +0 -28
  35. data/spec/imports_badterm_spec.rb +0 -52
  36. data/spec/imports_vterm_spec.rb +0 -52
  37. data/spec/loader/names_spec.rb +0 -24
  38. data/spec/loader/va_spec.rb +0 -44
  39. data/spec/manyimportsW7_spec.rb +0 -22
  40. data/spec/ne_spec.rb +0 -125
  41. data/spec/packer_spec.rb +0 -17
  42. data/spec/pe_spec.rb +0 -67
  43. data/spec/pedump_spec.rb +0 -19
  44. data/spec/resource_spec.rb +0 -13
  45. data/spec/sections_spec.rb +0 -11
  46. data/spec/sig_all_packers_spec.rb +0 -24
  47. data/spec/sig_spec.rb +0 -68
  48. data/spec/spec_helper.rb +0 -24
  49. data/spec/support/samples.rb +0 -24
  50. data/spec/unpackers/aspack_spec.rb +0 -69
  51. data/spec/unpackers/find_spec.rb +0 -21
  52. data/spec/virtsectblXP_spec.rb +0 -12
  53. data/tmp/.keep +0 -0
data/.document DELETED
@@ -1,5 +0,0 @@
1
- lib/**/*.rb
2
- bin/*
3
- -
4
- features/**/*.feature
5
- LICENSE.txt
data/.rspec DELETED
@@ -1 +0,0 @@
1
- --color
@@ -1,4 +0,0 @@
1
- language: ruby
2
- before_install:
3
- - sudo apt-get update -qq
4
- - sudo apt-get install -qq upx-ucl p7zip
Binary file
@@ -1,8 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'corkami/65535sects.exe' do
5
- it "should have 65535 sections" do
6
- sample.sections.size.should == 65535
7
- end
8
- end
@@ -1,20 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'bad_imports.exe' do
5
- before :all do
6
- @imports = sample.imports
7
- end
8
-
9
- it "should have IMAGE_IMPORT_DESCRIPTOR" do
10
- @imports.size.should == 1
11
- end
12
-
13
- it "should have only IMAGE_IMPORT_DESCRIPTORs" do
14
- @imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
15
- end
16
-
17
- it "should not detect packer" do
18
- sample.packer.should be_nil
19
- end
20
- end
@@ -1,13 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- PEDUMP_BINARY = File.expand_path(File.dirname(__FILE__) + '/../bin/pedump')
5
-
6
- Dir[File.join(SAMPLES_DIR,"bad","*.exe")].each do |fname|
7
- describe fname do
8
- it "should not cause exception" do
9
- system "#{PEDUMP_BINARY} -qqq #{fname} > /dev/null"
10
- $?.should be_success
11
- end
12
- end
13
- end
@@ -1,122 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump/composite_io')
3
-
4
- describe PEdump::CompositeIO do
5
- it "concatenates" do
6
- io = PEdump::CompositeIO.new(
7
- StringIO.new('foo'),
8
- StringIO.new('bar'),
9
- StringIO.new('baz')
10
- )
11
- io.read.should == 'foobarbaz'
12
- end
13
-
14
- it "reads sequentally" do
15
- io = PEdump::CompositeIO.new(
16
- StringIO.new('foo1'),
17
- StringIO.new('bar2'),
18
- StringIO.new('baz')
19
- )
20
- io.read(3).should == 'foo'
21
- io.read(3).should == '1ba'
22
- io.read(3).should == 'r2b'
23
- io.read(3).should == 'az'
24
- end
25
-
26
- it "behaves like StringIO" do
27
- io1 = StringIO.new('foo')
28
- io2 = PEdump::CompositeIO.new(StringIO.new('foo'))
29
-
30
- io1.read.should == io2.read # 'foo'
31
- io1.read.should == io2.read # ''
32
- io1.read(3).should == io2.read(3) # nil
33
- end
34
-
35
- it "tracks number of bytes read" do
36
- io = PEdump::CompositeIO.new(
37
- StringIO.new('foo1'),
38
- StringIO.new('bar2'),
39
- StringIO.new('baz')
40
- )
41
- io.tell.should == 0
42
- io.read(3)
43
- io.tell.should == 3
44
- io.read(4)
45
- io.tell.should == 7
46
- io.read
47
- io.tell.should == 11
48
- io.read
49
- io.tell.should == 11
50
- io.read 10
51
- io.tell.should == 11
52
- end
53
-
54
- it "chains eof? call" do
55
- io = PEdump::CompositeIO.new(
56
- StringIO.new('foo1'),
57
- StringIO.new('bar2'),
58
- StringIO.new('baz')
59
- )
60
- io.eof?.should be_false
61
- io.read(3)
62
- io.eof?.should be_false
63
- io.read(4)
64
- io.eof?.should be_false
65
- io.read
66
- io.eof?.should be_true
67
- io.read
68
- io.eof?.should be_true
69
- io.read 10
70
- io.eof?.should be_true
71
- end
72
-
73
- it "seeks" do
74
- io = PEdump::CompositeIO.new(
75
- StringIO.new('foo1'),
76
- StringIO.new('bar2'),
77
- StringIO.new('baz')
78
- )
79
-
80
- io.seek(5)
81
- io.tell.should == 5
82
- io.read(4).should == "ar2b"
83
-
84
- io.seek(0)
85
- io.tell.should == 0
86
- io.read.should == "foo1bar2baz"
87
-
88
- io.seek(1)
89
- io.tell.should == 1
90
- io.read.should == "oo1bar2baz"
91
- end
92
-
93
- it "respects start positions" do
94
- ios = [
95
- StringIO.new('foo1'),
96
- StringIO.new('bar2'),
97
- StringIO.new('baz3')
98
- ]
99
- ios.each_with_index{ |io,idx| io.seek(idx+1) }
100
-
101
- s = "oo1r23"
102
-
103
- io = PEdump::CompositeIO.new(*ios)
104
- io.tell.should == 0
105
- io.read.should == s
106
-
107
- s.size.times do |pos|
108
- io.seek(pos)
109
- io.tell.should == pos
110
- io.read.should == s[pos..-1]
111
- end
112
- end
113
-
114
- it "summarizes size" do
115
- io = PEdump::CompositeIO.new(
116
- StringIO.new('foo1'),
117
- StringIO.new('bar2'),
118
- StringIO.new('baz')
119
- )
120
- io.size.should == 11
121
- end
122
- end
@@ -1,49 +0,0 @@
1
- ---
2
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
3
- Name: !binary |-
4
- LnRleHQ=
5
- VirtualSize: 305562
6
- VirtualAddress: 4096
7
- SizeOfRawData: 305664
8
- PointerToRawData: 1024
9
- PointerToRelocations: 0
10
- PointerToLinenumbers: 0
11
- NumberOfRelocations: 0
12
- NumberOfLinenumbers: 0
13
- Characteristics: 1610612768
14
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
15
- Name: !binary |-
16
- LmRhdGE=
17
- VirtualSize: 17180
18
- VirtualAddress: 311296
19
- SizeOfRawData: 12288
20
- PointerToRawData: 306688
21
- PointerToRelocations: 0
22
- PointerToLinenumbers: 0
23
- NumberOfRelocations: 0
24
- NumberOfLinenumbers: 0
25
- Characteristics: 3221225536
26
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
27
- Name: !binary |-
28
- LnJzcmM=
29
- VirtualSize: 305927
30
- VirtualAddress: 331776
31
- SizeOfRawData: 306176
32
- PointerToRawData: 318976
33
- PointerToRelocations: 0
34
- PointerToLinenumbers: 0
35
- NumberOfRelocations: 0
36
- NumberOfLinenumbers: 0
37
- Characteristics: 1073741888
38
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
39
- Name: !binary |-
40
- LnJlbG9j
41
- VirtualSize: 16886
42
- VirtualAddress: 638976
43
- SizeOfRawData: 16896
44
- PointerToRawData: 625152
45
- PointerToRelocations: 0
46
- PointerToLinenumbers: 0
47
- NumberOfRelocations: 0
48
- NumberOfLinenumbers: 0
49
- Characteristics: 1107296320
@@ -1,95 +0,0 @@
1
- ---
2
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
3
- Name: !binary ""
4
- VirtualSize: 245760
5
- VirtualAddress: 8192
6
- SizeOfRawData: 103936
7
- PointerToRawData: 8192
8
- PointerToRelocations: 0
9
- PointerToLinenumbers: 0
10
- NumberOfRelocations: 0
11
- NumberOfLinenumbers: 0
12
- Characteristics: 3758096448
13
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
14
- Name: !binary |-
15
- LnJzcmM=
16
- VirtualSize: 2624
17
- VirtualAddress: 253952
18
- SizeOfRawData: 1536
19
- PointerToRawData: 112128
20
- PointerToRelocations: 0
21
- PointerToLinenumbers: 0
22
- NumberOfRelocations: 0
23
- NumberOfLinenumbers: 0
24
- Characteristics: 3221225536
25
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
26
- Name: !binary |-
27
- LmlkYXRh
28
- VirtualSize: 8192
29
- VirtualAddress: 262144
30
- SizeOfRawData: 1024
31
- PointerToRawData: 113664
32
- PointerToRelocations: 0
33
- PointerToLinenumbers: 0
34
- NumberOfRelocations: 0
35
- NumberOfLinenumbers: 0
36
- Characteristics: 3221225536
37
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
38
- Name: !binary ""
39
- VirtualSize: 1679360
40
- VirtualAddress: 270336
41
- SizeOfRawData: 512
42
- PointerToRawData: 114688
43
- PointerToRelocations: 0
44
- PointerToLinenumbers: 0
45
- NumberOfRelocations: 0
46
- NumberOfLinenumbers: 0
47
- Characteristics: 3758096448
48
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
49
- Name: !binary |-
50
- cnVsbm1kdnE=
51
- VirtualSize: 1613824
52
- VirtualAddress: 1949696
53
- SizeOfRawData: 1607680
54
- PointerToRawData: 115200
55
- PointerToRelocations: 0
56
- PointerToLinenumbers: 0
57
- NumberOfRelocations: 0
58
- NumberOfLinenumbers: 0
59
- Characteristics: 3758096448
60
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
61
- Name: !binary |-
62
- Ym5uYm1jcWY=
63
- VirtualSize: 8192
64
- VirtualAddress: 3563520
65
- SizeOfRawData: 512
66
- PointerToRawData: 1722880
67
- PointerToRelocations: 0
68
- PointerToLinenumbers: 0
69
- NumberOfRelocations: 0
70
- NumberOfLinenumbers: 0
71
- Characteristics: 3758096448
72
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
73
- Name: !binary |-
74
- Ym5uYm1jcWY=
75
- VirtualSize: 8192
76
- VirtualAddress: 3571712
77
- SizeOfRawData: 3072
78
- PointerToRawData: 1723392
79
- PointerToRelocations: 0
80
- PointerToLinenumbers: 0
81
- NumberOfRelocations: 0
82
- NumberOfLinenumbers: 0
83
- Characteristics: 3758096448
84
- - !ruby/struct:PEdump::IMAGE_SECTION_HEADER
85
- Name: !binary |-
86
- LmRhdGEAQXA=
87
- VirtualSize: 8192
88
- VirtualAddress: 3579904
89
- SizeOfRawData: 0
90
- PointerToRawData: 1726464
91
- PointerToRelocations: 0
92
- PointerToLinenumbers: 0
93
- NumberOfRelocations: 0
94
- NumberOfLinenumbers: 0
95
- Characteristics: 3758096448
@@ -1,21 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'corkami/dllord.dll' do
5
- it "should have 1 import" do
6
- sample.imports.size.should == 1
7
- sample.imports.map(&:module_name).should == %w'msvcrt.dll'
8
- sample.imports.map do |iid|
9
- (iid.original_first_thunk + iid.first_thunk).uniq.map(&:name)
10
- end.flatten.should == ["printf"]
11
- end
12
-
13
- it "exports at least 2 entries" do
14
- sample.exports.Base.should == 0x313
15
- sample.exports.name.should be_nil
16
- sample.exports.names.should be_empty
17
- sample.exports.name_ordinals.should be_empty
18
- sample.exports.entry_points[0].should == 0xffff_ffff
19
- sample.exports.entry_points[1].should == 0x1008
20
- end
21
- end
@@ -1,28 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- [ 'corkami/foldedhdr.exe', 'corkami/foldedhdrW7.exe' ].each do |fname|
5
- describe fname do
6
- before :all do
7
- @sample = sample
8
- end
9
-
10
- it "should have 2 imports" do
11
- @sample.imports.size.should == 2
12
- @sample.imports.map(&:module_name).should == %w'kernel32.dll msvcrt.dll'
13
- @sample.imports.map do |iid|
14
- (iid.original_first_thunk + iid.first_thunk).uniq.map(&:name)
15
- end.flatten.should == ["ExitProcess", "printf"]
16
- end
17
-
18
- it "should have 1 section" do
19
- @sample.sections.size.should == 1
20
- s = @sample.sections.first
21
- s.VirtualSize.should == 0x1000
22
- s.VirtualAddress.should == 0x1000
23
- s.SizeOfRawData.should == 0x200
24
- s.PointerToRawData.should == 0x200
25
- s.flags.should == 0xa0000000
26
- end
27
- end
28
- end
@@ -1,52 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'corkami/imports_badterm.exe' do
5
- # PE with a 'bad' imports terminator, just the dll name is empty
6
- # http://code.google.com/p/corkami/source/browse/trunk/asm/PE/imports_badterm.asm
7
- before :all do
8
- @imports = sample.imports
9
- end
10
-
11
- it "should have 2 IMAGE_IMPORT_DESCRIPTORs" do
12
- @imports.size.should == 2
13
- end
14
-
15
- it "should have only IMAGE_IMPORT_DESCRIPTORs" do
16
- @imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
17
- end
18
-
19
- # it "should have all entries thunks equal" do
20
- # @imports.each do |iid|
21
- # iid.first_thunk.should == iid.original_first_thunk
22
- # end
23
- # end
24
-
25
- describe "1st image_import_descriptor" do
26
- it "should be from kernel32.dll" do
27
- @imports[0].module_name.should == "kernel32.dll"
28
- end
29
- it "should have 1 function" do
30
- @imports[0].first_thunk.size.should == 1
31
- end
32
- it "should have ExitProcess" do
33
- @imports[0].first_thunk.first.name.should == "ExitProcess"
34
- @imports[0].first_thunk.first.hint.should == 0
35
- @imports[0].first_thunk.first.ordinal.should be_nil
36
- end
37
- end
38
-
39
- describe "2nd image_import_descriptor" do
40
- it "should be from msvcrt.dll" do
41
- @imports[1].module_name.should == "msvcrt.dll"
42
- end
43
- it "should have 1 function" do
44
- @imports[1].first_thunk.size.should == 1
45
- end
46
- it "should have printf" do
47
- @imports[1].first_thunk.first.name.should == "printf"
48
- @imports[1].first_thunk.first.hint.should == 0
49
- @imports[1].first_thunk.first.ordinal.should be_nil
50
- end
51
- end
52
- end
@@ -1,52 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'corkami/imports_vterm.exe' do
5
- # http://code.google.com/p/corkami/source/browse/trunk/asm/PE/imports_vterm.asm
6
- #describe "import terminator in virtual space" do
7
- before :all do
8
- @imports = sample.imports
9
- end
10
-
11
- it "should have 2 IMAGE_IMPORT_DESCRIPTORs" do
12
- @imports.size.should == 2
13
- end
14
-
15
- it "should have only IMAGE_IMPORT_DESCRIPTORs" do
16
- @imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
17
- end
18
-
19
- # it "should have all entries thunks equal" do
20
- # @imports.each do |iid|
21
- # iid.first_thunk.should == iid.original_first_thunk
22
- # end
23
- # end
24
-
25
- describe "1st image_import_descriptor" do
26
- it "should be from kernel32.dll" do
27
- @imports[0].module_name.should == "kernel32.dll"
28
- end
29
- it "should have 1 function" do
30
- @imports[0].first_thunk.size.should == 1
31
- end
32
- it "should have ExitProcess" do
33
- @imports[0].first_thunk.first.name.should == "ExitProcess"
34
- @imports[0].first_thunk.first.hint.should == 0
35
- @imports[0].first_thunk.first.ordinal.should be_nil
36
- end
37
- end
38
-
39
- describe "2nd image_import_descriptor" do
40
- it "should be from msvcrt.dll" do
41
- @imports[1].module_name.should == "msvcrt.dll"
42
- end
43
- it "should have 1 function" do
44
- @imports[1].first_thunk.size.should == 1
45
- end
46
- it "should have printf" do
47
- @imports[1].first_thunk.first.name.should == "printf"
48
- @imports[1].first_thunk.first.hint.should == 0
49
- @imports[1].first_thunk.first.ordinal.should be_nil
50
- end
51
- end
52
- end