pedump 0.6.0 → 0.6.4

Sign up to get free protection for your applications and to get access to all the features.
Files changed (17) hide show
  1. checksums.yaml +4 -4
  2. data/Gemfile +4 -4
  3. data/Gemfile.lock +75 -43
  4. data/README.md +96 -10
  5. data/Rakefile +44 -9
  6. data/VERSION +1 -1
  7. data/data/comp_id.txt +776 -0
  8. data/lib/pedump/cli.rb +122 -20
  9. data/lib/pedump/loader/section.rb +5 -3
  10. data/lib/pedump/loader.rb +28 -6
  11. data/lib/pedump/rich.rb +562 -0
  12. data/lib/pedump/te.rb +15 -4
  13. data/lib/pedump.rb +30 -6
  14. data/pedump.gemspec +23 -33
  15. metadata +25 -26
  16. data/.github/FUNDING.yml +0 -2
  17. data/.github/dependabot.yml +0 -8
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 73c28547719cedc77a48cbcd0b519283d09d061c358c24fd14fcff8e130072bf
4
- data.tar.gz: 4444e01ee15c6920856ed30e63d118bc027758de0e696ea02d1c1bd3a6486bee
3
+ metadata.gz: ed5cf8d6da63d21d766d921afb91035107d72eb09715617deb3a0510e0a9b10d
4
+ data.tar.gz: '06594246525ac31a0ca890762ab6940e03b30d2341b6ec4812cc92d8b5c46ce5'
5
5
  SHA512:
6
- metadata.gz: d35bdf91d6081245a723b569837b7332baf0b61962747d6595a0afed6625fba3f15fa1e7ae5db9734ed7e08f03008031037254fc2df60f655c10b0e95db5d005
7
- data.tar.gz: e9ac50ac19c5814f6364dde31dd0a16c0e263015e752c4a82b04e707c08a3e999255572c643da990ce9fabb4d3e624e85bdab53697e702044f941772fc96974e
6
+ metadata.gz: a0dcc1224a0e1d37033c4ec10b8cb7cc78e0d29e7b48e2c93b669b376f1af98ce1c6dfa11df4363a730cda9155b1a7163c225dae782cdb1796fa2d04d92bbccc
7
+ data.tar.gz: b38264f296b3b170cc3229567f6ec9378fe4947010b7acce6773f28bf5de29995fea06c880ddfcaeb5a1c15471db9e8fe07696b0fc8848949f38fe1a89b082c2
data/Gemfile CHANGED
@@ -8,8 +8,8 @@ gem "multipart-post", ">= 2.0.0"
8
8
  gem "zhexdump", ">= 0.0.2"
9
9
 
10
10
  group :development do
11
- gem "rspec", "~> 3.9.0"
12
- gem "rspec-its", "~> 1.3.0"
13
- gem "bundler", "~> 2.1.4"
14
- gem "jeweler", "~> 2.3.9"
11
+ gem "rspec"
12
+ gem "rspec-its"
13
+ gem "bundler"
14
+ gem "juwelier"
15
15
  end
data/Gemfile.lock CHANGED
@@ -1,72 +1,104 @@
1
1
  GEM
2
2
  remote: https://rubygems.org/
3
3
  specs:
4
- addressable (2.4.0)
5
- awesome_print (1.8.0)
4
+ addressable (2.8.0)
5
+ public_suffix (>= 2.0.2, < 5.0)
6
+ awesome_print (1.9.2)
6
7
  builder (3.2.4)
7
8
  descendants_tracker (0.0.4)
8
9
  thread_safe (~> 0.3, >= 0.3.1)
9
- diff-lcs (1.3)
10
- faraday (0.9.2)
10
+ diff-lcs (1.5.0)
11
+ faraday (1.9.3)
12
+ faraday-em_http (~> 1.0)
13
+ faraday-em_synchrony (~> 1.0)
14
+ faraday-excon (~> 1.1)
15
+ faraday-httpclient (~> 1.0)
16
+ faraday-multipart (~> 1.0)
17
+ faraday-net_http (~> 1.0)
18
+ faraday-net_http_persistent (~> 1.0)
19
+ faraday-patron (~> 1.0)
20
+ faraday-rack (~> 1.0)
21
+ faraday-retry (~> 1.0)
22
+ ruby2_keywords (>= 0.0.4)
23
+ faraday-em_http (1.0.0)
24
+ faraday-em_synchrony (1.0.0)
25
+ faraday-excon (1.1.0)
26
+ faraday-httpclient (1.0.1)
27
+ faraday-multipart (1.0.3)
11
28
  multipart-post (>= 1.2, < 3)
12
- git (1.5.0)
13
- github_api (0.16.0)
14
- addressable (~> 2.4.0)
29
+ faraday-net_http (1.0.1)
30
+ faraday-net_http_persistent (1.2.0)
31
+ faraday-patron (1.0.0)
32
+ faraday-rack (1.0.0)
33
+ faraday-retry (1.0.3)
34
+ git (1.10.2)
35
+ rchardet (~> 1.8)
36
+ github_api (0.19.0)
37
+ addressable (~> 2.4)
15
38
  descendants_tracker (~> 0.0.4)
16
- faraday (~> 0.8, < 0.10)
17
- hashie (>= 3.4)
18
- mime-types (>= 1.16, < 3.0)
39
+ faraday (>= 0.8, < 2)
40
+ hashie (~> 3.5, >= 3.5.2)
19
41
  oauth2 (~> 1.0)
20
- hashie (4.0.0)
42
+ hashie (3.6.0)
21
43
  highline (2.0.3)
22
44
  iostruct (0.0.4)
23
- jeweler (2.3.9)
45
+ juwelier (2.4.9)
24
46
  builder
25
47
  bundler
26
- git (>= 1.2.5)
27
- github_api (~> 0.16.0)
28
- highline (>= 1.6.15)
29
- nokogiri (>= 1.5.10)
48
+ git
49
+ github_api
50
+ highline
51
+ kamelcase (~> 0)
52
+ nokogiri
30
53
  psych
31
54
  rake
32
55
  rdoc
33
56
  semver2
34
- jwt (2.2.1)
35
- mime-types (2.99.3)
36
- mini_portile2 (2.4.0)
37
- multi_json (1.14.1)
57
+ jwt (2.3.0)
58
+ kamelcase (0.0.2)
59
+ semver2 (~> 3)
60
+ mini_portile2 (2.7.1)
61
+ multi_json (1.15.0)
38
62
  multi_xml (0.6.0)
39
63
  multipart-post (2.1.1)
40
- nokogiri (1.10.8)
41
- mini_portile2 (~> 2.4.0)
42
- oauth2 (1.4.2)
64
+ nokogiri (1.13.1)
65
+ mini_portile2 (~> 2.7.0)
66
+ racc (~> 1.4)
67
+ oauth2 (1.4.7)
43
68
  faraday (>= 0.8, < 2.0)
44
69
  jwt (>= 1.0, < 3.0)
45
70
  multi_json (~> 1.3)
46
71
  multi_xml (~> 0.5)
47
72
  rack (>= 1.2, < 3)
48
- psych (3.1.0)
73
+ psych (4.0.3)
74
+ stringio
75
+ public_suffix (4.0.6)
76
+ racc (1.6.0)
49
77
  rack (2.2.3)
50
- rainbow (3.0.0)
51
- rake (13.0.1)
52
- rdoc (6.2.1)
53
- rspec (3.9.0)
54
- rspec-core (~> 3.9.0)
55
- rspec-expectations (~> 3.9.0)
56
- rspec-mocks (~> 3.9.0)
57
- rspec-core (3.9.1)
58
- rspec-support (~> 3.9.1)
59
- rspec-expectations (3.9.0)
78
+ rainbow (3.1.1)
79
+ rake (13.0.6)
80
+ rchardet (1.8.0)
81
+ rdoc (6.4.0)
82
+ psych (>= 4.0.0)
83
+ rspec (3.10.0)
84
+ rspec-core (~> 3.10.0)
85
+ rspec-expectations (~> 3.10.0)
86
+ rspec-mocks (~> 3.10.0)
87
+ rspec-core (3.10.2)
88
+ rspec-support (~> 3.10.0)
89
+ rspec-expectations (3.10.2)
60
90
  diff-lcs (>= 1.2.0, < 2.0)
61
- rspec-support (~> 3.9.0)
91
+ rspec-support (~> 3.10.0)
62
92
  rspec-its (1.3.0)
63
93
  rspec-core (>= 3.0.0)
64
94
  rspec-expectations (>= 3.0.0)
65
- rspec-mocks (3.9.1)
95
+ rspec-mocks (3.10.3)
66
96
  diff-lcs (>= 1.2.0, < 2.0)
67
- rspec-support (~> 3.9.0)
68
- rspec-support (3.9.2)
97
+ rspec-support (~> 3.10.0)
98
+ rspec-support (3.10.3)
99
+ ruby2_keywords (0.0.5)
69
100
  semver2 (3.4.2)
101
+ stringio (3.0.1)
70
102
  thread_safe (0.3.6)
71
103
  zhexdump (0.0.2)
72
104
 
@@ -75,14 +107,14 @@ PLATFORMS
75
107
 
76
108
  DEPENDENCIES
77
109
  awesome_print
78
- bundler (~> 2.1.4)
110
+ bundler
79
111
  iostruct (>= 0.0.4)
80
- jeweler (~> 2.3.9)
112
+ juwelier
81
113
  multipart-post (>= 2.0.0)
82
114
  rainbow
83
- rspec (~> 3.9.0)
84
- rspec-its (~> 1.3.0)
115
+ rspec
116
+ rspec-its
85
117
  zhexdump (>= 0.0.2)
86
118
 
87
119
  BUNDLED WITH
88
- 2.1.4
120
+ 2.2.32
data/README.md CHANGED
@@ -3,8 +3,14 @@ pedump [![Build Status](https://travis-ci.org/zed-0xff/pedump.png?branch=mast
3
3
 
4
4
  News
5
5
  ----
6
+ ```
7
+ 2021.02.18 - updated gems; changed open-uri to URI.open; enabled SSL on https://pedump.me/
8
+ 2020.08.09 - CLI: added resource extracting with --extract ID
9
+ 2020.07.28 - 0.6.1; better RICH HDR parsing/output
10
+ 2020.07.27 - 0.6.0
6
11
  2020.07.26 - now travis autotests run on ARM and OSX too!
7
12
  2020.07.25 - added EFI TE parsing; removed 'progressbar' gem dependency
13
+ ```
8
14
 
9
15
  Description
10
16
  -----------
@@ -30,7 +36,7 @@ Can dump:
30
36
  * Imports & Exports
31
37
  * VS_VERSIONINFO parsing
32
38
  * PE Packer/Compiler detection
33
- * a convenient way to upload your PE's to http://pedump.me for a nice HTML tables with image previews, candies & stuff
39
+ * a convenient way to upload your PE's to https://pedump.me for a nice HTML tables with image previews, candies & stuff
34
40
 
35
41
  Installation
36
42
  ------------
@@ -73,9 +79,17 @@ Usage
73
79
  mimics 'file' command output
74
80
  -r, --recursive recurse dirs in packer detect
75
81
  --all Dump all but resource-directory (default)
82
+
83
+ --extract ID Extract a resource/section/data_dir
84
+ ID: datadir:EXPORT - datadir by type
85
+ ID: resource:0x98478 - resource by offset
86
+ ID: resource:ICON/#1 - resource by type & name
87
+ ID: section:.text - section by name
88
+ ID: section:rva/0x1000 - section by RVA
89
+ ID: section:raw/0x400 - section by RAW_PTR
76
90
  --va2file VA Convert RVA to file offset
77
91
 
78
- -W, --web Uploads files to a http://pedump.me
92
+ -W, --web Uploads files to a https://pedump.me
79
93
  for a nice HTML tables with image previews,
80
94
  candies & stuff
81
95
  -C, --console opens IRB console with specified file loaded
@@ -127,14 +141,14 @@ Usage
127
141
 
128
142
  === RICH Header ===
129
143
 
130
- LIB_ID VERSION TIMES_USED
131
- 149 95 21022 521e 9 9
132
- 1 1 0 0 367 16f
133
- 147 93 21022 521e 29 1d
134
- 132 84 21022 521e 129 81
135
- 131 83 21022 521e 25 19
136
- 148 94 21022 521e 1 1
137
- 145 91 21022 521e 1 1
144
+ ID VER COUNT DESCRIPTION
145
+ 95 521e 9 [ASM] VS2008 build 21022
146
+ 1 0 367 [---] Unmarked objects
147
+ 93 521e 29 [IMP] VS2008 build 21022
148
+ 84 521e 129 [C++] VS2008 build 21022
149
+ 83 521e 25 [ C ] VS2008 build 21022
150
+ 94 521e 1 [RES] VS2008 build 21022
151
+ 91 521e 1 [LNK] VS2008 build 21022
138
152
 
139
153
  ### PE Header
140
154
 
@@ -414,6 +428,78 @@ Usage
414
428
  samples/unpackme.exe: ASProtect 1.33 - 2.1 Registered (Alexey Solodovnikov)
415
429
  samples/zlib.dll: Microsoft Visual C v2.0
416
430
 
431
+ ### Extracting
432
+
433
+ #### Resources
434
+
435
+ by name:
436
+
437
+ # pedump calc.exe --extract resource:VERSION/#1 | hexdump -C | head
438
+
439
+ 00000000 78 03 34 00 00 00 56 00 53 00 5f 00 56 00 45 00 |x.4...V.S._.V.E.|
440
+ 00000010 52 00 53 00 49 00 4f 00 4e 00 5f 00 49 00 4e 00 |R.S.I.O.N._.I.N.|
441
+ 00000020 46 00 4f 00 00 00 00 00 bd 04 ef fe 00 00 01 00 |F.O.............|
442
+ 00000030 01 00 06 00 00 00 91 1a 01 00 06 00 00 00 91 1a |................|
443
+ 00000040 3f 00 00 00 00 00 00 00 04 00 04 00 01 00 00 00 |?...............|
444
+ 00000050 00 00 00 00 00 00 00 00 00 00 00 00 d6 02 00 00 |................|
445
+ 00000060 01 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 |..S.t.r.i.n.g.F.|
446
+ 00000070 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 00 00 |i.l.e.I.n.f.o...|
447
+ 00000080 b2 02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 |......0.4.0.9.0.|
448
+ 00000090 34 00 42 00 30 00 00 00 4c 00 16 00 01 00 43 00 |4.B.0...L.....C.|
449
+
450
+ by offset:
451
+
452
+ # pedump calc.exe --extract resource:0x98478 | head
453
+
454
+ <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
455
+ <!-- Copyright (c) Microsoft Corporation -->
456
+ <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
457
+ <assemblyIdentity
458
+ name="Microsoft.Windows.Shell.calc"
459
+ processorArchitecture="x86"
460
+ version="5.1.0.0"
461
+ type="win32"/>
462
+ <description>Windows Shell</description>
463
+ <dependency>
464
+
465
+ #### Sections
466
+
467
+ by name:
468
+
469
+ # pedump calc.exe --extract section:.text | hexdump -C | head -4
470
+
471
+ 00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
472
+ 00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
473
+ 00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
474
+ 00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
475
+
476
+ by RVA:
477
+
478
+ # pedump calc.exe --extract section:rva/0x1000 | hexdump -C | head -4
479
+
480
+ 00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
481
+ 00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
482
+ 00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
483
+ 00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
484
+
485
+ by RAW_PTR (file offset):
486
+
487
+ # pedump calc.exe --extract section:raw/0x400 | hexdump -C | head -4
488
+
489
+ 00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
490
+ 00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
491
+ 00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
492
+ 00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
493
+
494
+ #### Data Directory
495
+
496
+ # pedump calc.exe --extract datadir:IMPORT | hexdump -C | head -4
497
+
498
+ 00000000 90 9f 04 00 ff ff ff ff ff ff ff ff dc a2 04 00 |................|
499
+ 00000010 48 12 00 00 f4 a0 04 00 ff ff ff ff ff ff ff ff |H...............|
500
+ 00000020 10 a5 04 00 ac 13 00 00 48 9d 04 00 ff ff ff ff |........H.......|
501
+ 00000030 ff ff ff ff f6 a5 04 00 00 10 00 00 5c 9f 04 00 |............\...|
502
+
417
503
  License
418
504
  -------
419
505
  Released under the MIT License. See the [LICENSE](https://github.com/zed-0xff/pedump/blob/master/LICENSE.txt) file for further details.
data/Rakefile CHANGED
@@ -11,8 +11,8 @@ rescue Bundler::BundlerError => e
11
11
  end
12
12
  require 'rake'
13
13
 
14
- require 'jeweler'
15
- Jeweler::Tasks.new do |gem|
14
+ require 'juwelier'
15
+ Juwelier::Tasks.new do |gem|
16
16
  # gem is a Gem::Specification... see http://docs.rubygems.org/read/chapter/20 for more options
17
17
  gem.name = "pedump"
18
18
  gem.homepage = "http://github.com/zed-0xff/pedump"
@@ -23,11 +23,11 @@ Jeweler::Tasks.new do |gem|
23
23
  gem.authors = ["Andrey \"Zed\" Zaikin"]
24
24
  gem.executables = %w'pedump'
25
25
  gem.files.include "lib/**/*.rb"
26
- gem.files.exclude %w'samples/**/* spec/**/* tmp/**/* tmp/.keep .* README.md.tpl'
26
+ gem.files.exclude %w'samples/**/* spec/**/* tmp/**/* tmp/.keep .* README.md.tpl .github/**/*'
27
27
  gem.extra_rdoc_files.exclude 'README.md.tpl'
28
28
  # dependencies defined in Gemfile
29
29
  end
30
- Jeweler::RubygemsDotOrgTasks.new
30
+ Juwelier::RubygemsDotOrgTasks.new
31
31
 
32
32
  require 'rspec/core'
33
33
  require 'rspec/core/rake_task'
@@ -35,7 +35,7 @@ require 'rspec/core/rake_task'
35
35
  desc "run specs"
36
36
  RSpec::Core::RakeTask.new
37
37
 
38
- task :default => :spec
38
+ task :default => [:spec, :readme]
39
39
 
40
40
  namespace :test do
41
41
  desc "test on all files in given path"
@@ -74,17 +74,20 @@ namespace :test do
74
74
  end
75
75
  end
76
76
 
77
- def check_file url, prefix=nil
77
+ def check_file url, params = {}
78
78
  require 'digest/md5'
79
79
  require 'open-uri'
80
80
 
81
+ params[:min_size] ||= 80_000
82
+
81
83
  STDOUT.sync = true
84
+ prefix = params[:prefix]
82
85
  fname = File.join 'data', (prefix ? "#{prefix}-" : '') + File.basename(url)
83
86
  existing_md5 = File.exist?(fname) ? Digest::MD5.file(fname).hexdigest : ''
84
87
  print "[.] fetching #{url} .. "
85
- remote_data = open(url).read.force_encoding('cp1252').encode('utf-8')
88
+ remote_data = URI.open(url).read.force_encoding('cp1252').encode('utf-8')
86
89
  puts "#{remote_data.size} bytes"
87
- raise "too small remote data (#{remote_data.size})" if remote_data.size < 80_000
90
+ raise "too small remote data (#{remote_data.size})" if remote_data.size < params[:min_size]
88
91
  remote_md5 = Digest::MD5.hexdigest(remote_data)
89
92
  if remote_md5 == existing_md5
90
93
  puts "[.] same as local"
@@ -95,13 +98,45 @@ def check_file url, prefix=nil
95
98
  end
96
99
  end
97
100
 
101
+ RICH_IDS_URL = "https://raw.githubusercontent.com/dishather/richprint/master/comp_id.txt"
102
+
103
+ namespace :rich do
104
+ desc "update rich comp_id db from net"
105
+ task :update do
106
+ check_file RICH_IDS_URL, :min_size => 30_000
107
+ end
108
+
109
+ desc "convert"
110
+ task :convert do
111
+ result = [
112
+ "class PEdump",
113
+ " # data from #{RICH_IDS_URL}",
114
+ " RICH_IDS = {"
115
+ ]
116
+ n = 0
117
+ t0 = Time.now
118
+ File.readlines(File.join("data", File.basename(RICH_IDS_URL))).each do |line|
119
+ line.strip!
120
+ next if line.empty? || line[0] == '#'
121
+ comp_id, desc = line.split(nil, 2)
122
+ raise unless comp_id =~ /\A[0-9a-fA-F]+\Z/
123
+ result << " 0x#{comp_id} => #{desc.inspect},"
124
+ n += 1
125
+ end
126
+ result << " }"
127
+ result << "end"
128
+ printf "[.] parsed %d definitions in %6.3fs\n", n, Time.now-t0
129
+ File.write("lib/pedump/rich.rb", result.join("\n") + "\n")
130
+ end
131
+ end
132
+
98
133
  namespace :sigs do
99
134
  desc "update packers db from net"
100
135
  task :update do
101
136
  require './lib/pedump/packer'
102
137
  check_file "http://research.pandasecurity.com/blogs/images/userdb.txt"
103
138
  check_file "http://fuu.googlecode.com/svn/trunk/src/x86/Tools/Signaturesdb/signatures.txt"
104
- check_file "http://handlers.sans.edu/jclausing/userdb.txt", "jc"
139
+ check_file "http://handlers.sans.edu/jclausing/userdb.txt", :prefix => "jc"
105
140
  end
106
141
 
107
142
  desc "convert txt2bin"
data/VERSION CHANGED
@@ -1 +1 @@
1
- 0.6.0
1
+ 0.6.4