pedump 0.5.0 → 0.6.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (53) hide show
  1. checksums.yaml +7 -0
  2. data/.github/FUNDING.yml +2 -0
  3. data/.github/dependabot.yml +8 -0
  4. data/CODE_OF_CONDUCT.md +76 -0
  5. data/Gemfile +11 -16
  6. data/Gemfile.lock +73 -27
  7. data/README.md +15 -6
  8. data/Rakefile +5 -44
  9. data/VERSION +1 -1
  10. data/lib/pedump.rb +101 -29
  11. data/lib/pedump/cli.rb +29 -18
  12. data/lib/pedump/loader.rb +1 -1
  13. data/lib/pedump/loader/minidump.rb +195 -31
  14. data/lib/pedump/ne.rb +1 -1
  15. data/lib/pedump/pe.rb +63 -54
  16. data/lib/pedump/te.rb +51 -0
  17. data/lib/pedump/unpacker/aspack.rb +1 -1
  18. data/lib/pedump/version.rb +2 -5
  19. data/misc/aspack/aspack_unlzx.c +5 -3
  20. data/pedump.gemspec +47 -74
  21. metadata +50 -101
  22. data/.document +0 -5
  23. data/.rspec +0 -1
  24. data/.travis.yml +0 -4
  25. data/samples/bad/68.exe +0 -0
  26. data/samples/bad/data_dir_15_entries.exe +0 -0
  27. data/spec/65535sects_spec.rb +0 -8
  28. data/spec/bad_imports_spec.rb +0 -20
  29. data/spec/bad_samples_spec.rb +0 -13
  30. data/spec/composite_io_spec.rb +0 -122
  31. data/spec/data/calc.exe_sections.yml +0 -49
  32. data/spec/data/data_dir_15_entries.exe_sections.yml +0 -95
  33. data/spec/dllord_spec.rb +0 -21
  34. data/spec/foldedhdr_spec.rb +0 -28
  35. data/spec/imports_badterm_spec.rb +0 -52
  36. data/spec/imports_vterm_spec.rb +0 -52
  37. data/spec/loader/names_spec.rb +0 -24
  38. data/spec/loader/va_spec.rb +0 -44
  39. data/spec/manyimportsW7_spec.rb +0 -22
  40. data/spec/ne_spec.rb +0 -125
  41. data/spec/packer_spec.rb +0 -17
  42. data/spec/pe_spec.rb +0 -67
  43. data/spec/pedump_spec.rb +0 -19
  44. data/spec/resource_spec.rb +0 -13
  45. data/spec/sections_spec.rb +0 -11
  46. data/spec/sig_all_packers_spec.rb +0 -24
  47. data/spec/sig_spec.rb +0 -68
  48. data/spec/spec_helper.rb +0 -24
  49. data/spec/support/samples.rb +0 -24
  50. data/spec/unpackers/aspack_spec.rb +0 -69
  51. data/spec/unpackers/find_spec.rb +0 -21
  52. data/spec/virtsectblXP_spec.rb +0 -12
  53. data/tmp/.keep +0 -0
@@ -1,24 +0,0 @@
1
- $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
2
- $LOAD_PATH.unshift(File.dirname(__FILE__))
3
- require 'rspec'
4
- require 'pedump'
5
- require 'fileutils'
6
-
7
- DATA_DIR = File.join(File.dirname(__FILE__), "data")
8
- Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
9
-
10
- def unarchive_samples fname
11
- flag_fname = File.join(File.dirname(fname), ".#{File.basename(fname)}_unpacked")
12
- # check if already unpacked
13
- return if File.exist?(flag_fname)
14
- system "7zr", "x", "-y", "-o#{SAMPLES_DIR}", fname
15
- FileUtils.touch(flag_fname) if $?.success?
16
- end
17
-
18
- RSpec.configure do |config|
19
- config.before :suite do
20
- Dir[File.join(SAMPLES_DIR,"*.7z")].each do |fname|
21
- unarchive_samples fname
22
- end
23
- end
24
- end
@@ -1,24 +0,0 @@
1
- SAMPLES_DIR = File.expand_path(File.dirname(__FILE__) + '/../../samples/')
2
-
3
- def sample
4
- @pedump ||=
5
- begin
6
- fname =
7
- if self.example
8
- # called from it(...)
9
- self.example.full_description.split.first
10
- else
11
- # called from before(:all)
12
- self.class.metadata[:example_group][:description_args].first
13
- end
14
- fname = File.join(SAMPLES_DIR, fname)
15
- File.open(fname,"rb") do |f|
16
- if block_given?
17
- yield PEdump.new(f)
18
- else
19
- PEdump.new(f).dump
20
- end
21
- end
22
- end
23
- end
24
-
@@ -1,69 +0,0 @@
1
- root = File.expand_path(File.dirname(File.dirname(File.dirname(__FILE__))))
2
- require "#{root}/spec/spec_helper"
3
- require "#{root}/lib/pedump"
4
- require "#{root}/lib/pedump/unpacker/aspack"
5
- require "#{root}/lib/pedump/comparer"
6
-
7
- describe PEdump::Unpacker::ASPack do
8
- Dir["#{root}/samples/*.asp[1-9]*.{exe}"].each do |pname|
9
- orig_fname = pname.sub(/\.asp[^.]+/,'')
10
-
11
- describe File.basename(orig_fname) + " vs " + File.basename(pname) do
12
- before :all do
13
- @ldr = PEdump::Loader.new(File.open(orig_fname,"rb"))
14
- end
15
-
16
- it "should have no differences" do
17
- File.open(pname,"rb") do |f|
18
- u = PEdump::Unpacker::ASPack.new(f)
19
- File.open("#{root}/tmp/unpacked.tmp","w+") do |fo|
20
- u.unpack.dump(fo)
21
- fo.rewind
22
- ldr = PEdump::Loader.new(fo)
23
-
24
- comparer = PEdump::Comparer.new(@ldr, ldr)
25
- comparer.ignored_data_dirs = [
26
- PEdump::IMAGE_DATA_DIRECTORY::LOAD_CONFIG,
27
- PEdump::IMAGE_DATA_DIRECTORY::Bound_IAT,
28
- PEdump::IMAGE_DATA_DIRECTORY::Delay_IAT
29
- ]
30
- comparer.ignored_sections = [ '.rsrc', '.aspack' ]
31
- comparer.diff.should == []
32
- end
33
- end
34
- end
35
- end
36
- end
37
-
38
- Dir["#{root}/samples/*.asp[1-9]*.{ocx}"].each do |pname|
39
- orig_fname = pname.sub(/\.asp[^.]+/,'')
40
-
41
- describe File.basename(orig_fname) + " vs " + File.basename(pname) do
42
- before :all do
43
- @ldr = PEdump::Loader.new(File.open(orig_fname,"rb"))
44
- end
45
-
46
- it "should have no differences" do
47
- File.open(pname,"rb") do |f|
48
- u = PEdump::Unpacker::ASPack.new(f)
49
- File.open("#{root}/tmp/unpacked.tmp","w+") do |fo|
50
- u.unpack.dump(fo)
51
- fo.rewind
52
- ldr = PEdump::Loader.new(fo)
53
-
54
- comparer = PEdump::Comparer.new(@ldr, ldr)
55
- comparer.ignored_data_dirs = [
56
- PEdump::IMAGE_DATA_DIRECTORY::LOAD_CONFIG,
57
- PEdump::IMAGE_DATA_DIRECTORY::Bound_IAT,
58
- PEdump::IMAGE_DATA_DIRECTORY::Delay_IAT,
59
- PEdump::IMAGE_DATA_DIRECTORY::BASERELOC, # 0x15496 vs 0x15494
60
- PEdump::IMAGE_DATA_DIRECTORY::IAT
61
- ]
62
- comparer.ignored_sections = [ '.rsrc', '.aspack', '.cas' ]
63
- comparer.diff.should == []
64
- end
65
- end
66
- end
67
- end
68
- end
69
- end
@@ -1,21 +0,0 @@
1
- root = File.expand_path(File.dirname(File.dirname(File.dirname(__FILE__))))
2
- require "#{root}/spec/spec_helper"
3
- require "#{root}/lib/pedump/unpacker"
4
-
5
- describe PEdump::Unpacker do
6
- it "finds UPX" do
7
- PEdump::Unpacker.find("#{root}/samples/calc_upx.exe").should == PEdump::Unpacker::UPX
8
- end
9
-
10
- it "finds ARM UPX" do
11
- PEdump::Unpacker.find("#{root}/samples/arm_upx.exe").should == PEdump::Unpacker::UPX
12
- end
13
-
14
- it "finds ASPack" do
15
- PEdump::Unpacker.find("#{root}/samples/calc.asp212.exe").should == PEdump::Unpacker::ASPack
16
- end
17
-
18
- it "finds nothing" do
19
- PEdump::Unpacker.find("#{root}/samples/calc.exe").should be_nil
20
- end
21
- end
@@ -1,12 +0,0 @@
1
- require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
2
- require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
3
-
4
- describe 'corkami/virtsectblXP.exe' do
5
- it "should have 2 imports" do
6
- sample.imports.size.should == 2
7
- sample.imports.map(&:module_name).should == %w'kernel32.dll msvcrt.dll'
8
- sample.imports.map do |iid|
9
- (iid.original_first_thunk + iid.first_thunk).uniq.map(&:name)
10
- end.flatten.should == ["ExitProcess", "printf"]
11
- end
12
- end
data/tmp/.keep DELETED
File without changes