pedump 0.5.4 → 0.6.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CODE_OF_CONDUCT.md +76 -0
- data/Gemfile +1 -2
- data/Gemfile.lock +25 -23
- data/README.md +104 -11
- data/Rakefile +41 -6
- data/VERSION +1 -1
- data/data/comp_id.txt +776 -0
- data/lib/pedump/cli.rb +144 -34
- data/lib/pedump/loader/section.rb +5 -3
- data/lib/pedump/loader.rb +28 -6
- data/lib/pedump/ne.rb +1 -1
- data/lib/pedump/pe.rb +63 -54
- data/lib/pedump/rich.rb +562 -0
- data/lib/pedump/te.rb +62 -0
- data/lib/pedump.rb +86 -18
- data/misc/aspack/aspack_unlzx.c +5 -3
- data/pedump.gemspec +20 -29
- metadata +12 -23
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: fec0ab884ccfca5ee83392a6a50f4d50ecfb0e81251ecbd687f2fc1d52217630
|
|
4
|
+
data.tar.gz: f2c76574347491eb4c96498fa566b3a8fc7e9bfad7691f14f28b1d4966c457bc
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 81b7b2fd8a6a33f17703db959fd6abe6fc5b229959432e841cba6b7fd9e44208b0ebf40d36e06668f6884447e38eb360b1a6dcf94cbb84a8be77d89db06e4b0f
|
|
7
|
+
data.tar.gz: b128b6f7e7d05806bf9e350a701d7ed14d1bf363938b4fccf89c36c43e761e78b7dc6a8b017c129d7c7981c86bebbfcad344ae11765e2ad588a22c7dfd14cae3
|
data/CODE_OF_CONDUCT.md
ADDED
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
# Contributor Covenant Code of Conduct
|
|
2
|
+
|
|
3
|
+
## Our Pledge
|
|
4
|
+
|
|
5
|
+
In the interest of fostering an open and welcoming environment, we as
|
|
6
|
+
contributors and maintainers pledge to making participation in our project and
|
|
7
|
+
our community a harassment-free experience for everyone, regardless of age, body
|
|
8
|
+
size, disability, ethnicity, sex characteristics, gender identity and expression,
|
|
9
|
+
level of experience, education, socio-economic status, nationality, personal
|
|
10
|
+
appearance, race, religion, or sexual identity and orientation.
|
|
11
|
+
|
|
12
|
+
## Our Standards
|
|
13
|
+
|
|
14
|
+
Examples of behavior that contributes to creating a positive environment
|
|
15
|
+
include:
|
|
16
|
+
|
|
17
|
+
* Using welcoming and inclusive language
|
|
18
|
+
* Being respectful of differing viewpoints and experiences
|
|
19
|
+
* Gracefully accepting constructive criticism
|
|
20
|
+
* Focusing on what is best for the community
|
|
21
|
+
* Showing empathy towards other community members
|
|
22
|
+
|
|
23
|
+
Examples of unacceptable behavior by participants include:
|
|
24
|
+
|
|
25
|
+
* The use of sexualized language or imagery and unwelcome sexual attention or
|
|
26
|
+
advances
|
|
27
|
+
* Trolling, insulting/derogatory comments, and personal or political attacks
|
|
28
|
+
* Public or private harassment
|
|
29
|
+
* Publishing others' private information, such as a physical or electronic
|
|
30
|
+
address, without explicit permission
|
|
31
|
+
* Other conduct which could reasonably be considered inappropriate in a
|
|
32
|
+
professional setting
|
|
33
|
+
|
|
34
|
+
## Our Responsibilities
|
|
35
|
+
|
|
36
|
+
Project maintainers are responsible for clarifying the standards of acceptable
|
|
37
|
+
behavior and are expected to take appropriate and fair corrective action in
|
|
38
|
+
response to any instances of unacceptable behavior.
|
|
39
|
+
|
|
40
|
+
Project maintainers have the right and responsibility to remove, edit, or
|
|
41
|
+
reject comments, commits, code, wiki edits, issues, and other contributions
|
|
42
|
+
that are not aligned to this Code of Conduct, or to ban temporarily or
|
|
43
|
+
permanently any contributor for other behaviors that they deem inappropriate,
|
|
44
|
+
threatening, offensive, or harmful.
|
|
45
|
+
|
|
46
|
+
## Scope
|
|
47
|
+
|
|
48
|
+
This Code of Conduct applies both within project spaces and in public spaces
|
|
49
|
+
when an individual is representing the project or its community. Examples of
|
|
50
|
+
representing a project or community include using an official project e-mail
|
|
51
|
+
address, posting via an official social media account, or acting as an appointed
|
|
52
|
+
representative at an online or offline event. Representation of a project may be
|
|
53
|
+
further defined and clarified by project maintainers.
|
|
54
|
+
|
|
55
|
+
## Enforcement
|
|
56
|
+
|
|
57
|
+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
|
58
|
+
reported by contacting the project team at zed.0xff@gmail.com. All
|
|
59
|
+
complaints will be reviewed and investigated and will result in a response that
|
|
60
|
+
is deemed necessary and appropriate to the circumstances. The project team is
|
|
61
|
+
obligated to maintain confidentiality with regard to the reporter of an incident.
|
|
62
|
+
Further details of specific enforcement policies may be posted separately.
|
|
63
|
+
|
|
64
|
+
Project maintainers who do not follow or enforce the Code of Conduct in good
|
|
65
|
+
faith may face temporary or permanent repercussions as determined by other
|
|
66
|
+
members of the project's leadership.
|
|
67
|
+
|
|
68
|
+
## Attribution
|
|
69
|
+
|
|
70
|
+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
|
|
71
|
+
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
|
|
72
|
+
|
|
73
|
+
[homepage]: https://www.contributor-covenant.org
|
|
74
|
+
|
|
75
|
+
For answers to common questions about this code of conduct, see
|
|
76
|
+
https://www.contributor-covenant.org/faq
|
data/Gemfile
CHANGED
|
@@ -5,12 +5,11 @@ gem 'rainbow'
|
|
|
5
5
|
gem "awesome_print"
|
|
6
6
|
gem "iostruct", ">= 0.0.4"
|
|
7
7
|
gem "multipart-post", ">= 2.0.0"
|
|
8
|
-
gem "progressbar"
|
|
9
8
|
gem "zhexdump", ">= 0.0.2"
|
|
10
9
|
|
|
11
10
|
group :development do
|
|
12
11
|
gem "rspec", "~> 3.9.0"
|
|
13
12
|
gem "rspec-its", "~> 1.3.0"
|
|
14
|
-
gem "bundler", "~> 2.
|
|
13
|
+
gem "bundler", "~> 2.2.3"
|
|
15
14
|
gem "jeweler", "~> 2.3.9"
|
|
16
15
|
end
|
data/Gemfile.lock
CHANGED
|
@@ -2,14 +2,15 @@ GEM
|
|
|
2
2
|
remote: https://rubygems.org/
|
|
3
3
|
specs:
|
|
4
4
|
addressable (2.4.0)
|
|
5
|
-
awesome_print (1.
|
|
5
|
+
awesome_print (1.9.2)
|
|
6
6
|
builder (3.2.4)
|
|
7
7
|
descendants_tracker (0.0.4)
|
|
8
8
|
thread_safe (~> 0.3, >= 0.3.1)
|
|
9
|
-
diff-lcs (1.
|
|
9
|
+
diff-lcs (1.4.4)
|
|
10
10
|
faraday (0.9.2)
|
|
11
11
|
multipart-post (>= 1.2, < 3)
|
|
12
|
-
git (1.
|
|
12
|
+
git (1.8.1)
|
|
13
|
+
rchardet (~> 1.8)
|
|
13
14
|
github_api (0.16.0)
|
|
14
15
|
addressable (~> 2.4.0)
|
|
15
16
|
descendants_tracker (~> 0.0.4)
|
|
@@ -17,7 +18,7 @@ GEM
|
|
|
17
18
|
hashie (>= 3.4)
|
|
18
19
|
mime-types (>= 1.16, < 3.0)
|
|
19
20
|
oauth2 (~> 1.0)
|
|
20
|
-
hashie (4.
|
|
21
|
+
hashie (4.1.0)
|
|
21
22
|
highline (2.0.3)
|
|
22
23
|
iostruct (0.0.4)
|
|
23
24
|
jeweler (2.3.9)
|
|
@@ -31,33 +32,35 @@ GEM
|
|
|
31
32
|
rake
|
|
32
33
|
rdoc
|
|
33
34
|
semver2
|
|
34
|
-
jwt (2.2.
|
|
35
|
+
jwt (2.2.2)
|
|
35
36
|
mime-types (2.99.3)
|
|
36
|
-
mini_portile2 (2.
|
|
37
|
-
multi_json (1.
|
|
37
|
+
mini_portile2 (2.6.1)
|
|
38
|
+
multi_json (1.15.0)
|
|
38
39
|
multi_xml (0.6.0)
|
|
39
|
-
multipart-post (2.
|
|
40
|
-
nokogiri (1.
|
|
41
|
-
mini_portile2 (~> 2.
|
|
42
|
-
|
|
40
|
+
multipart-post (2.1.1)
|
|
41
|
+
nokogiri (1.12.5)
|
|
42
|
+
mini_portile2 (~> 2.6.1)
|
|
43
|
+
racc (~> 1.4)
|
|
44
|
+
oauth2 (1.4.4)
|
|
43
45
|
faraday (>= 0.8, < 2.0)
|
|
44
46
|
jwt (>= 1.0, < 3.0)
|
|
45
47
|
multi_json (~> 1.3)
|
|
46
48
|
multi_xml (~> 0.5)
|
|
47
49
|
rack (>= 1.2, < 3)
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
rack (2.
|
|
50
|
+
psych (3.3.0)
|
|
51
|
+
racc (1.5.2)
|
|
52
|
+
rack (2.2.3)
|
|
51
53
|
rainbow (3.0.0)
|
|
52
|
-
rake (13.0.
|
|
53
|
-
|
|
54
|
+
rake (13.0.3)
|
|
55
|
+
rchardet (1.8.0)
|
|
56
|
+
rdoc (6.3.2)
|
|
54
57
|
rspec (3.9.0)
|
|
55
58
|
rspec-core (~> 3.9.0)
|
|
56
59
|
rspec-expectations (~> 3.9.0)
|
|
57
60
|
rspec-mocks (~> 3.9.0)
|
|
58
|
-
rspec-core (3.9.
|
|
59
|
-
rspec-support (~> 3.9.
|
|
60
|
-
rspec-expectations (3.9.
|
|
61
|
+
rspec-core (3.9.3)
|
|
62
|
+
rspec-support (~> 3.9.3)
|
|
63
|
+
rspec-expectations (3.9.4)
|
|
61
64
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
62
65
|
rspec-support (~> 3.9.0)
|
|
63
66
|
rspec-its (1.3.0)
|
|
@@ -66,7 +69,7 @@ GEM
|
|
|
66
69
|
rspec-mocks (3.9.1)
|
|
67
70
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
68
71
|
rspec-support (~> 3.9.0)
|
|
69
|
-
rspec-support (3.9.
|
|
72
|
+
rspec-support (3.9.4)
|
|
70
73
|
semver2 (3.4.2)
|
|
71
74
|
thread_safe (0.3.6)
|
|
72
75
|
zhexdump (0.0.2)
|
|
@@ -76,15 +79,14 @@ PLATFORMS
|
|
|
76
79
|
|
|
77
80
|
DEPENDENCIES
|
|
78
81
|
awesome_print
|
|
79
|
-
bundler (~> 2.
|
|
82
|
+
bundler (~> 2.2.3)
|
|
80
83
|
iostruct (>= 0.0.4)
|
|
81
84
|
jeweler (~> 2.3.9)
|
|
82
85
|
multipart-post (>= 2.0.0)
|
|
83
|
-
progressbar
|
|
84
86
|
rainbow
|
|
85
87
|
rspec (~> 3.9.0)
|
|
86
88
|
rspec-its (~> 1.3.0)
|
|
87
89
|
zhexdump (>= 0.0.2)
|
|
88
90
|
|
|
89
91
|
BUNDLED WITH
|
|
90
|
-
2.
|
|
92
|
+
2.2.3
|
data/README.md
CHANGED
|
@@ -1,6 +1,17 @@
|
|
|
1
|
-
pedump [](https://travis-ci.org/zed-0xff/pedump) [](https://travis-ci.org/zed-0xff/pedump) [](https://ko-fi.com/K3K81Z3W5)
|
|
2
2
|
======
|
|
3
3
|
|
|
4
|
+
News
|
|
5
|
+
----
|
|
6
|
+
```
|
|
7
|
+
2021.02.18 - updated gems; changed open-uri to URI.open; enabled SSL on https://pedump.me/
|
|
8
|
+
2020.08.09 - CLI: added resource extracting with --extract ID
|
|
9
|
+
2020.07.28 - 0.6.1; better RICH HDR parsing/output
|
|
10
|
+
2020.07.27 - 0.6.0
|
|
11
|
+
2020.07.26 - now travis autotests run on ARM and OSX too!
|
|
12
|
+
2020.07.25 - added EFI TE parsing; removed 'progressbar' gem dependency
|
|
13
|
+
```
|
|
14
|
+
|
|
4
15
|
Description
|
|
5
16
|
-----------
|
|
6
17
|
A pure ruby implementation of win32 PE binary files dumper.
|
|
@@ -11,6 +22,7 @@ Supported formats:
|
|
|
11
22
|
* win16 NE
|
|
12
23
|
* win32 PE
|
|
13
24
|
* win64 PE
|
|
25
|
+
* EFI TE
|
|
14
26
|
|
|
15
27
|
Can dump:
|
|
16
28
|
|
|
@@ -24,7 +36,7 @@ Can dump:
|
|
|
24
36
|
* Imports & Exports
|
|
25
37
|
* VS_VERSIONINFO parsing
|
|
26
38
|
* PE Packer/Compiler detection
|
|
27
|
-
* a convenient way to upload your PE's to
|
|
39
|
+
* a convenient way to upload your PE's to https://pedump.me for a nice HTML tables with image previews, candies & stuff
|
|
28
40
|
|
|
29
41
|
Installation
|
|
30
42
|
------------
|
|
@@ -50,6 +62,7 @@ Usage
|
|
|
50
62
|
--rich
|
|
51
63
|
--pe
|
|
52
64
|
--ne
|
|
65
|
+
--te
|
|
53
66
|
--data-directory
|
|
54
67
|
-S, --sections
|
|
55
68
|
--tls
|
|
@@ -66,9 +79,17 @@ Usage
|
|
|
66
79
|
mimics 'file' command output
|
|
67
80
|
-r, --recursive recurse dirs in packer detect
|
|
68
81
|
--all Dump all but resource-directory (default)
|
|
82
|
+
|
|
83
|
+
--extract ID Extract a resource/section/data_dir
|
|
84
|
+
ID: datadir:EXPORT - datadir by type
|
|
85
|
+
ID: resource:0x98478 - resource by offset
|
|
86
|
+
ID: resource:ICON/#1 - resource by type & name
|
|
87
|
+
ID: section:.text - section by name
|
|
88
|
+
ID: section:rva/0x1000 - section by RVA
|
|
89
|
+
ID: section:raw/0x400 - section by RAW_PTR
|
|
69
90
|
--va2file VA Convert RVA to file offset
|
|
70
91
|
|
|
71
|
-
-W, --web Uploads files to a
|
|
92
|
+
-W, --web Uploads files to a https://pedump.me
|
|
72
93
|
for a nice HTML tables with image previews,
|
|
73
94
|
candies & stuff
|
|
74
95
|
-C, --console opens IRB console with specified file loaded
|
|
@@ -120,14 +141,14 @@ Usage
|
|
|
120
141
|
|
|
121
142
|
=== RICH Header ===
|
|
122
143
|
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
144
|
+
ID VER COUNT DESCRIPTION
|
|
145
|
+
95 521e 9 [ASM] VS2008 build 21022
|
|
146
|
+
1 0 367 [---] Unmarked objects
|
|
147
|
+
93 521e 29 [IMP] VS2008 build 21022
|
|
148
|
+
84 521e 129 [C++] VS2008 build 21022
|
|
149
|
+
83 521e 25 [ C ] VS2008 build 21022
|
|
150
|
+
94 521e 1 [RES] VS2008 build 21022
|
|
151
|
+
91 521e 1 [LNK] VS2008 build 21022
|
|
131
152
|
|
|
132
153
|
### PE Header
|
|
133
154
|
|
|
@@ -407,6 +428,78 @@ Usage
|
|
|
407
428
|
samples/unpackme.exe: ASProtect 1.33 - 2.1 Registered (Alexey Solodovnikov)
|
|
408
429
|
samples/zlib.dll: Microsoft Visual C v2.0
|
|
409
430
|
|
|
431
|
+
### Extracting
|
|
432
|
+
|
|
433
|
+
#### Resources
|
|
434
|
+
|
|
435
|
+
by name:
|
|
436
|
+
|
|
437
|
+
# pedump calc.exe --extract resource:VERSION/#1 | hexdump -C | head
|
|
438
|
+
|
|
439
|
+
00000000 78 03 34 00 00 00 56 00 53 00 5f 00 56 00 45 00 |x.4...V.S._.V.E.|
|
|
440
|
+
00000010 52 00 53 00 49 00 4f 00 4e 00 5f 00 49 00 4e 00 |R.S.I.O.N._.I.N.|
|
|
441
|
+
00000020 46 00 4f 00 00 00 00 00 bd 04 ef fe 00 00 01 00 |F.O.............|
|
|
442
|
+
00000030 01 00 06 00 00 00 91 1a 01 00 06 00 00 00 91 1a |................|
|
|
443
|
+
00000040 3f 00 00 00 00 00 00 00 04 00 04 00 01 00 00 00 |?...............|
|
|
444
|
+
00000050 00 00 00 00 00 00 00 00 00 00 00 00 d6 02 00 00 |................|
|
|
445
|
+
00000060 01 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 |..S.t.r.i.n.g.F.|
|
|
446
|
+
00000070 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 00 00 |i.l.e.I.n.f.o...|
|
|
447
|
+
00000080 b2 02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 |......0.4.0.9.0.|
|
|
448
|
+
00000090 34 00 42 00 30 00 00 00 4c 00 16 00 01 00 43 00 |4.B.0...L.....C.|
|
|
449
|
+
|
|
450
|
+
by offset:
|
|
451
|
+
|
|
452
|
+
# pedump calc.exe --extract resource:0x98478 | head
|
|
453
|
+
|
|
454
|
+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
|
455
|
+
<!-- Copyright (c) Microsoft Corporation -->
|
|
456
|
+
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
|
|
457
|
+
<assemblyIdentity
|
|
458
|
+
name="Microsoft.Windows.Shell.calc"
|
|
459
|
+
processorArchitecture="x86"
|
|
460
|
+
version="5.1.0.0"
|
|
461
|
+
type="win32"/>
|
|
462
|
+
<description>Windows Shell</description>
|
|
463
|
+
<dependency>
|
|
464
|
+
|
|
465
|
+
#### Sections
|
|
466
|
+
|
|
467
|
+
by name:
|
|
468
|
+
|
|
469
|
+
# pedump calc.exe --extract section:.text | hexdump -C | head -4
|
|
470
|
+
|
|
471
|
+
00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
|
|
472
|
+
00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
|
|
473
|
+
00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
|
|
474
|
+
00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
|
|
475
|
+
|
|
476
|
+
by RVA:
|
|
477
|
+
|
|
478
|
+
# pedump calc.exe --extract section:rva/0x1000 | hexdump -C | head -4
|
|
479
|
+
|
|
480
|
+
00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
|
|
481
|
+
00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
|
|
482
|
+
00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
|
|
483
|
+
00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
|
|
484
|
+
|
|
485
|
+
by RAW_PTR (file offset):
|
|
486
|
+
|
|
487
|
+
# pedump calc.exe --extract section:raw/0x400 | hexdump -C | head -4
|
|
488
|
+
|
|
489
|
+
00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
|
|
490
|
+
00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
|
|
491
|
+
00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
|
|
492
|
+
00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
|
|
493
|
+
|
|
494
|
+
#### Data Directory
|
|
495
|
+
|
|
496
|
+
# pedump calc.exe --extract datadir:IMPORT | hexdump -C | head -4
|
|
497
|
+
|
|
498
|
+
00000000 90 9f 04 00 ff ff ff ff ff ff ff ff dc a2 04 00 |................|
|
|
499
|
+
00000010 48 12 00 00 f4 a0 04 00 ff ff ff ff ff ff ff ff |H...............|
|
|
500
|
+
00000020 10 a5 04 00 ac 13 00 00 48 9d 04 00 ff ff ff ff |........H.......|
|
|
501
|
+
00000030 ff ff ff ff f6 a5 04 00 00 10 00 00 5c 9f 04 00 |............\...|
|
|
502
|
+
|
|
410
503
|
License
|
|
411
504
|
-------
|
|
412
505
|
Released under the MIT License. See the [LICENSE](https://github.com/zed-0xff/pedump/blob/master/LICENSE.txt) file for further details.
|
data/Rakefile
CHANGED
|
@@ -23,7 +23,7 @@ Jeweler::Tasks.new do |gem|
|
|
|
23
23
|
gem.authors = ["Andrey \"Zed\" Zaikin"]
|
|
24
24
|
gem.executables = %w'pedump'
|
|
25
25
|
gem.files.include "lib/**/*.rb"
|
|
26
|
-
gem.files.exclude %w'samples/**/* spec/**/* tmp/**/* tmp/.keep .* README.md.tpl'
|
|
26
|
+
gem.files.exclude %w'samples/**/* spec/**/* tmp/**/* tmp/.keep .* README.md.tpl .github/**/*'
|
|
27
27
|
gem.extra_rdoc_files.exclude 'README.md.tpl'
|
|
28
28
|
# dependencies defined in Gemfile
|
|
29
29
|
end
|
|
@@ -35,7 +35,7 @@ require 'rspec/core/rake_task'
|
|
|
35
35
|
desc "run specs"
|
|
36
36
|
RSpec::Core::RakeTask.new
|
|
37
37
|
|
|
38
|
-
task :default => :spec
|
|
38
|
+
task :default => [:spec, :readme]
|
|
39
39
|
|
|
40
40
|
namespace :test do
|
|
41
41
|
desc "test on all files in given path"
|
|
@@ -74,17 +74,20 @@ namespace :test do
|
|
|
74
74
|
end
|
|
75
75
|
end
|
|
76
76
|
|
|
77
|
-
def check_file url,
|
|
77
|
+
def check_file url, params = {}
|
|
78
78
|
require 'digest/md5'
|
|
79
79
|
require 'open-uri'
|
|
80
80
|
|
|
81
|
+
params[:min_size] ||= 80_000
|
|
82
|
+
|
|
81
83
|
STDOUT.sync = true
|
|
84
|
+
prefix = params[:prefix]
|
|
82
85
|
fname = File.join 'data', (prefix ? "#{prefix}-" : '') + File.basename(url)
|
|
83
86
|
existing_md5 = File.exist?(fname) ? Digest::MD5.file(fname).hexdigest : ''
|
|
84
87
|
print "[.] fetching #{url} .. "
|
|
85
|
-
remote_data
|
|
88
|
+
remote_data = URI.open(url).read.force_encoding('cp1252').encode('utf-8')
|
|
86
89
|
puts "#{remote_data.size} bytes"
|
|
87
|
-
raise "too small remote data (#{remote_data.size})" if remote_data.size <
|
|
90
|
+
raise "too small remote data (#{remote_data.size})" if remote_data.size < params[:min_size]
|
|
88
91
|
remote_md5 = Digest::MD5.hexdigest(remote_data)
|
|
89
92
|
if remote_md5 == existing_md5
|
|
90
93
|
puts "[.] same as local"
|
|
@@ -95,13 +98,45 @@ def check_file url, prefix=nil
|
|
|
95
98
|
end
|
|
96
99
|
end
|
|
97
100
|
|
|
101
|
+
RICH_IDS_URL = "https://raw.githubusercontent.com/dishather/richprint/master/comp_id.txt"
|
|
102
|
+
|
|
103
|
+
namespace :rich do
|
|
104
|
+
desc "update rich comp_id db from net"
|
|
105
|
+
task :update do
|
|
106
|
+
check_file RICH_IDS_URL, :min_size => 30_000
|
|
107
|
+
end
|
|
108
|
+
|
|
109
|
+
desc "convert"
|
|
110
|
+
task :convert do
|
|
111
|
+
result = [
|
|
112
|
+
"class PEdump",
|
|
113
|
+
" # data from #{RICH_IDS_URL}",
|
|
114
|
+
" RICH_IDS = {"
|
|
115
|
+
]
|
|
116
|
+
n = 0
|
|
117
|
+
t0 = Time.now
|
|
118
|
+
File.readlines(File.join("data", File.basename(RICH_IDS_URL))).each do |line|
|
|
119
|
+
line.strip!
|
|
120
|
+
next if line.empty? || line[0] == '#'
|
|
121
|
+
comp_id, desc = line.split(nil, 2)
|
|
122
|
+
raise unless comp_id =~ /\A[0-9a-fA-F]+\Z/
|
|
123
|
+
result << " 0x#{comp_id} => #{desc.inspect},"
|
|
124
|
+
n += 1
|
|
125
|
+
end
|
|
126
|
+
result << " }"
|
|
127
|
+
result << "end"
|
|
128
|
+
printf "[.] parsed %d definitions in %6.3fs\n", n, Time.now-t0
|
|
129
|
+
File.write("lib/pedump/rich.rb", result.join("\n") + "\n")
|
|
130
|
+
end
|
|
131
|
+
end
|
|
132
|
+
|
|
98
133
|
namespace :sigs do
|
|
99
134
|
desc "update packers db from net"
|
|
100
135
|
task :update do
|
|
101
136
|
require './lib/pedump/packer'
|
|
102
137
|
check_file "http://research.pandasecurity.com/blogs/images/userdb.txt"
|
|
103
138
|
check_file "http://fuu.googlecode.com/svn/trunk/src/x86/Tools/Signaturesdb/signatures.txt"
|
|
104
|
-
check_file "http://handlers.sans.edu/jclausing/userdb.txt", "jc"
|
|
139
|
+
check_file "http://handlers.sans.edu/jclausing/userdb.txt", :prefix => "jc"
|
|
105
140
|
end
|
|
106
141
|
|
|
107
142
|
desc "convert txt2bin"
|
data/VERSION
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
0.
|
|
1
|
+
0.6.3
|