pedump 0.6.0 → 0.6.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. checksums.yaml +4 -4
  2. data/Gemfile +4 -4
  3. data/Gemfile.lock +75 -43
  4. data/README.md +96 -10
  5. data/Rakefile +44 -9
  6. data/VERSION +1 -1
  7. data/data/comp_id.txt +776 -0
  8. data/lib/pedump/cli.rb +122 -20
  9. data/lib/pedump/loader/section.rb +5 -3
  10. data/lib/pedump/loader.rb +28 -6
  11. data/lib/pedump/rich.rb +562 -0
  12. data/lib/pedump/te.rb +15 -4
  13. data/lib/pedump.rb +30 -6
  14. data/pedump.gemspec +23 -33
  15. metadata +25 -26
  16. data/.github/FUNDING.yml +0 -2
  17. data/.github/dependabot.yml +0 -8
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 73c28547719cedc77a48cbcd0b519283d09d061c358c24fd14fcff8e130072bf
4
- data.tar.gz: 4444e01ee15c6920856ed30e63d118bc027758de0e696ea02d1c1bd3a6486bee
3
+ metadata.gz: ed5cf8d6da63d21d766d921afb91035107d72eb09715617deb3a0510e0a9b10d
4
+ data.tar.gz: '06594246525ac31a0ca890762ab6940e03b30d2341b6ec4812cc92d8b5c46ce5'
5
5
  SHA512:
6
- metadata.gz: d35bdf91d6081245a723b569837b7332baf0b61962747d6595a0afed6625fba3f15fa1e7ae5db9734ed7e08f03008031037254fc2df60f655c10b0e95db5d005
7
- data.tar.gz: e9ac50ac19c5814f6364dde31dd0a16c0e263015e752c4a82b04e707c08a3e999255572c643da990ce9fabb4d3e624e85bdab53697e702044f941772fc96974e
6
+ metadata.gz: a0dcc1224a0e1d37033c4ec10b8cb7cc78e0d29e7b48e2c93b669b376f1af98ce1c6dfa11df4363a730cda9155b1a7163c225dae782cdb1796fa2d04d92bbccc
7
+ data.tar.gz: b38264f296b3b170cc3229567f6ec9378fe4947010b7acce6773f28bf5de29995fea06c880ddfcaeb5a1c15471db9e8fe07696b0fc8848949f38fe1a89b082c2
data/Gemfile CHANGED
@@ -8,8 +8,8 @@ gem "multipart-post", ">= 2.0.0"
8
8
  gem "zhexdump", ">= 0.0.2"
9
9
 
10
10
  group :development do
11
- gem "rspec", "~> 3.9.0"
12
- gem "rspec-its", "~> 1.3.0"
13
- gem "bundler", "~> 2.1.4"
14
- gem "jeweler", "~> 2.3.9"
11
+ gem "rspec"
12
+ gem "rspec-its"
13
+ gem "bundler"
14
+ gem "juwelier"
15
15
  end
data/Gemfile.lock CHANGED
@@ -1,72 +1,104 @@
1
1
  GEM
2
2
  remote: https://rubygems.org/
3
3
  specs:
4
- addressable (2.4.0)
5
- awesome_print (1.8.0)
4
+ addressable (2.8.0)
5
+ public_suffix (>= 2.0.2, < 5.0)
6
+ awesome_print (1.9.2)
6
7
  builder (3.2.4)
7
8
  descendants_tracker (0.0.4)
8
9
  thread_safe (~> 0.3, >= 0.3.1)
9
- diff-lcs (1.3)
10
- faraday (0.9.2)
10
+ diff-lcs (1.5.0)
11
+ faraday (1.9.3)
12
+ faraday-em_http (~> 1.0)
13
+ faraday-em_synchrony (~> 1.0)
14
+ faraday-excon (~> 1.1)
15
+ faraday-httpclient (~> 1.0)
16
+ faraday-multipart (~> 1.0)
17
+ faraday-net_http (~> 1.0)
18
+ faraday-net_http_persistent (~> 1.0)
19
+ faraday-patron (~> 1.0)
20
+ faraday-rack (~> 1.0)
21
+ faraday-retry (~> 1.0)
22
+ ruby2_keywords (>= 0.0.4)
23
+ faraday-em_http (1.0.0)
24
+ faraday-em_synchrony (1.0.0)
25
+ faraday-excon (1.1.0)
26
+ faraday-httpclient (1.0.1)
27
+ faraday-multipart (1.0.3)
11
28
  multipart-post (>= 1.2, < 3)
12
- git (1.5.0)
13
- github_api (0.16.0)
14
- addressable (~> 2.4.0)
29
+ faraday-net_http (1.0.1)
30
+ faraday-net_http_persistent (1.2.0)
31
+ faraday-patron (1.0.0)
32
+ faraday-rack (1.0.0)
33
+ faraday-retry (1.0.3)
34
+ git (1.10.2)
35
+ rchardet (~> 1.8)
36
+ github_api (0.19.0)
37
+ addressable (~> 2.4)
15
38
  descendants_tracker (~> 0.0.4)
16
- faraday (~> 0.8, < 0.10)
17
- hashie (>= 3.4)
18
- mime-types (>= 1.16, < 3.0)
39
+ faraday (>= 0.8, < 2)
40
+ hashie (~> 3.5, >= 3.5.2)
19
41
  oauth2 (~> 1.0)
20
- hashie (4.0.0)
42
+ hashie (3.6.0)
21
43
  highline (2.0.3)
22
44
  iostruct (0.0.4)
23
- jeweler (2.3.9)
45
+ juwelier (2.4.9)
24
46
  builder
25
47
  bundler
26
- git (>= 1.2.5)
27
- github_api (~> 0.16.0)
28
- highline (>= 1.6.15)
29
- nokogiri (>= 1.5.10)
48
+ git
49
+ github_api
50
+ highline
51
+ kamelcase (~> 0)
52
+ nokogiri
30
53
  psych
31
54
  rake
32
55
  rdoc
33
56
  semver2
34
- jwt (2.2.1)
35
- mime-types (2.99.3)
36
- mini_portile2 (2.4.0)
37
- multi_json (1.14.1)
57
+ jwt (2.3.0)
58
+ kamelcase (0.0.2)
59
+ semver2 (~> 3)
60
+ mini_portile2 (2.7.1)
61
+ multi_json (1.15.0)
38
62
  multi_xml (0.6.0)
39
63
  multipart-post (2.1.1)
40
- nokogiri (1.10.8)
41
- mini_portile2 (~> 2.4.0)
42
- oauth2 (1.4.2)
64
+ nokogiri (1.13.1)
65
+ mini_portile2 (~> 2.7.0)
66
+ racc (~> 1.4)
67
+ oauth2 (1.4.7)
43
68
  faraday (>= 0.8, < 2.0)
44
69
  jwt (>= 1.0, < 3.0)
45
70
  multi_json (~> 1.3)
46
71
  multi_xml (~> 0.5)
47
72
  rack (>= 1.2, < 3)
48
- psych (3.1.0)
73
+ psych (4.0.3)
74
+ stringio
75
+ public_suffix (4.0.6)
76
+ racc (1.6.0)
49
77
  rack (2.2.3)
50
- rainbow (3.0.0)
51
- rake (13.0.1)
52
- rdoc (6.2.1)
53
- rspec (3.9.0)
54
- rspec-core (~> 3.9.0)
55
- rspec-expectations (~> 3.9.0)
56
- rspec-mocks (~> 3.9.0)
57
- rspec-core (3.9.1)
58
- rspec-support (~> 3.9.1)
59
- rspec-expectations (3.9.0)
78
+ rainbow (3.1.1)
79
+ rake (13.0.6)
80
+ rchardet (1.8.0)
81
+ rdoc (6.4.0)
82
+ psych (>= 4.0.0)
83
+ rspec (3.10.0)
84
+ rspec-core (~> 3.10.0)
85
+ rspec-expectations (~> 3.10.0)
86
+ rspec-mocks (~> 3.10.0)
87
+ rspec-core (3.10.2)
88
+ rspec-support (~> 3.10.0)
89
+ rspec-expectations (3.10.2)
60
90
  diff-lcs (>= 1.2.0, < 2.0)
61
- rspec-support (~> 3.9.0)
91
+ rspec-support (~> 3.10.0)
62
92
  rspec-its (1.3.0)
63
93
  rspec-core (>= 3.0.0)
64
94
  rspec-expectations (>= 3.0.0)
65
- rspec-mocks (3.9.1)
95
+ rspec-mocks (3.10.3)
66
96
  diff-lcs (>= 1.2.0, < 2.0)
67
- rspec-support (~> 3.9.0)
68
- rspec-support (3.9.2)
97
+ rspec-support (~> 3.10.0)
98
+ rspec-support (3.10.3)
99
+ ruby2_keywords (0.0.5)
69
100
  semver2 (3.4.2)
101
+ stringio (3.0.1)
70
102
  thread_safe (0.3.6)
71
103
  zhexdump (0.0.2)
72
104
 
@@ -75,14 +107,14 @@ PLATFORMS
75
107
 
76
108
  DEPENDENCIES
77
109
  awesome_print
78
- bundler (~> 2.1.4)
110
+ bundler
79
111
  iostruct (>= 0.0.4)
80
- jeweler (~> 2.3.9)
112
+ juwelier
81
113
  multipart-post (>= 2.0.0)
82
114
  rainbow
83
- rspec (~> 3.9.0)
84
- rspec-its (~> 1.3.0)
115
+ rspec
116
+ rspec-its
85
117
  zhexdump (>= 0.0.2)
86
118
 
87
119
  BUNDLED WITH
88
- 2.1.4
120
+ 2.2.32
data/README.md CHANGED
@@ -3,8 +3,14 @@ pedump [![Build Status](https://travis-ci.org/zed-0xff/pedump.png?branch=mast
3
3
 
4
4
  News
5
5
  ----
6
+ ```
7
+ 2021.02.18 - updated gems; changed open-uri to URI.open; enabled SSL on https://pedump.me/
8
+ 2020.08.09 - CLI: added resource extracting with --extract ID
9
+ 2020.07.28 - 0.6.1; better RICH HDR parsing/output
10
+ 2020.07.27 - 0.6.0
6
11
  2020.07.26 - now travis autotests run on ARM and OSX too!
7
12
  2020.07.25 - added EFI TE parsing; removed 'progressbar' gem dependency
13
+ ```
8
14
 
9
15
  Description
10
16
  -----------
@@ -30,7 +36,7 @@ Can dump:
30
36
  * Imports & Exports
31
37
  * VS_VERSIONINFO parsing
32
38
  * PE Packer/Compiler detection
33
- * a convenient way to upload your PE's to http://pedump.me for a nice HTML tables with image previews, candies & stuff
39
+ * a convenient way to upload your PE's to https://pedump.me for a nice HTML tables with image previews, candies & stuff
34
40
 
35
41
  Installation
36
42
  ------------
@@ -73,9 +79,17 @@ Usage
73
79
  mimics 'file' command output
74
80
  -r, --recursive recurse dirs in packer detect
75
81
  --all Dump all but resource-directory (default)
82
+
83
+ --extract ID Extract a resource/section/data_dir
84
+ ID: datadir:EXPORT - datadir by type
85
+ ID: resource:0x98478 - resource by offset
86
+ ID: resource:ICON/#1 - resource by type & name
87
+ ID: section:.text - section by name
88
+ ID: section:rva/0x1000 - section by RVA
89
+ ID: section:raw/0x400 - section by RAW_PTR
76
90
  --va2file VA Convert RVA to file offset
77
91
 
78
- -W, --web Uploads files to a http://pedump.me
92
+ -W, --web Uploads files to a https://pedump.me
79
93
  for a nice HTML tables with image previews,
80
94
  candies & stuff
81
95
  -C, --console opens IRB console with specified file loaded
@@ -127,14 +141,14 @@ Usage
127
141
 
128
142
  === RICH Header ===
129
143
 
130
- LIB_ID VERSION TIMES_USED
131
- 149 95 21022 521e 9 9
132
- 1 1 0 0 367 16f
133
- 147 93 21022 521e 29 1d
134
- 132 84 21022 521e 129 81
135
- 131 83 21022 521e 25 19
136
- 148 94 21022 521e 1 1
137
- 145 91 21022 521e 1 1
144
+ ID VER COUNT DESCRIPTION
145
+ 95 521e 9 [ASM] VS2008 build 21022
146
+ 1 0 367 [---] Unmarked objects
147
+ 93 521e 29 [IMP] VS2008 build 21022
148
+ 84 521e 129 [C++] VS2008 build 21022
149
+ 83 521e 25 [ C ] VS2008 build 21022
150
+ 94 521e 1 [RES] VS2008 build 21022
151
+ 91 521e 1 [LNK] VS2008 build 21022
138
152
 
139
153
  ### PE Header
140
154
 
@@ -414,6 +428,78 @@ Usage
414
428
  samples/unpackme.exe: ASProtect 1.33 - 2.1 Registered (Alexey Solodovnikov)
415
429
  samples/zlib.dll: Microsoft Visual C v2.0
416
430
 
431
+ ### Extracting
432
+
433
+ #### Resources
434
+
435
+ by name:
436
+
437
+ # pedump calc.exe --extract resource:VERSION/#1 | hexdump -C | head
438
+
439
+ 00000000 78 03 34 00 00 00 56 00 53 00 5f 00 56 00 45 00 |x.4...V.S._.V.E.|
440
+ 00000010 52 00 53 00 49 00 4f 00 4e 00 5f 00 49 00 4e 00 |R.S.I.O.N._.I.N.|
441
+ 00000020 46 00 4f 00 00 00 00 00 bd 04 ef fe 00 00 01 00 |F.O.............|
442
+ 00000030 01 00 06 00 00 00 91 1a 01 00 06 00 00 00 91 1a |................|
443
+ 00000040 3f 00 00 00 00 00 00 00 04 00 04 00 01 00 00 00 |?...............|
444
+ 00000050 00 00 00 00 00 00 00 00 00 00 00 00 d6 02 00 00 |................|
445
+ 00000060 01 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 |..S.t.r.i.n.g.F.|
446
+ 00000070 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 00 00 |i.l.e.I.n.f.o...|
447
+ 00000080 b2 02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 |......0.4.0.9.0.|
448
+ 00000090 34 00 42 00 30 00 00 00 4c 00 16 00 01 00 43 00 |4.B.0...L.....C.|
449
+
450
+ by offset:
451
+
452
+ # pedump calc.exe --extract resource:0x98478 | head
453
+
454
+ <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
455
+ <!-- Copyright (c) Microsoft Corporation -->
456
+ <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
457
+ <assemblyIdentity
458
+ name="Microsoft.Windows.Shell.calc"
459
+ processorArchitecture="x86"
460
+ version="5.1.0.0"
461
+ type="win32"/>
462
+ <description>Windows Shell</description>
463
+ <dependency>
464
+
465
+ #### Sections
466
+
467
+ by name:
468
+
469
+ # pedump calc.exe --extract section:.text | hexdump -C | head -4
470
+
471
+ 00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
472
+ 00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
473
+ 00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
474
+ 00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
475
+
476
+ by RVA:
477
+
478
+ # pedump calc.exe --extract section:rva/0x1000 | hexdump -C | head -4
479
+
480
+ 00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
481
+ 00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
482
+ 00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
483
+ 00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
484
+
485
+ by RAW_PTR (file offset):
486
+
487
+ # pedump calc.exe --extract section:raw/0x400 | hexdump -C | head -4
488
+
489
+ 00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
490
+ 00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
491
+ 00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
492
+ 00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
493
+
494
+ #### Data Directory
495
+
496
+ # pedump calc.exe --extract datadir:IMPORT | hexdump -C | head -4
497
+
498
+ 00000000 90 9f 04 00 ff ff ff ff ff ff ff ff dc a2 04 00 |................|
499
+ 00000010 48 12 00 00 f4 a0 04 00 ff ff ff ff ff ff ff ff |H...............|
500
+ 00000020 10 a5 04 00 ac 13 00 00 48 9d 04 00 ff ff ff ff |........H.......|
501
+ 00000030 ff ff ff ff f6 a5 04 00 00 10 00 00 5c 9f 04 00 |............\...|
502
+
417
503
  License
418
504
  -------
419
505
  Released under the MIT License. See the [LICENSE](https://github.com/zed-0xff/pedump/blob/master/LICENSE.txt) file for further details.
data/Rakefile CHANGED
@@ -11,8 +11,8 @@ rescue Bundler::BundlerError => e
11
11
  end
12
12
  require 'rake'
13
13
 
14
- require 'jeweler'
15
- Jeweler::Tasks.new do |gem|
14
+ require 'juwelier'
15
+ Juwelier::Tasks.new do |gem|
16
16
  # gem is a Gem::Specification... see http://docs.rubygems.org/read/chapter/20 for more options
17
17
  gem.name = "pedump"
18
18
  gem.homepage = "http://github.com/zed-0xff/pedump"
@@ -23,11 +23,11 @@ Jeweler::Tasks.new do |gem|
23
23
  gem.authors = ["Andrey \"Zed\" Zaikin"]
24
24
  gem.executables = %w'pedump'
25
25
  gem.files.include "lib/**/*.rb"
26
- gem.files.exclude %w'samples/**/* spec/**/* tmp/**/* tmp/.keep .* README.md.tpl'
26
+ gem.files.exclude %w'samples/**/* spec/**/* tmp/**/* tmp/.keep .* README.md.tpl .github/**/*'
27
27
  gem.extra_rdoc_files.exclude 'README.md.tpl'
28
28
  # dependencies defined in Gemfile
29
29
  end
30
- Jeweler::RubygemsDotOrgTasks.new
30
+ Juwelier::RubygemsDotOrgTasks.new
31
31
 
32
32
  require 'rspec/core'
33
33
  require 'rspec/core/rake_task'
@@ -35,7 +35,7 @@ require 'rspec/core/rake_task'
35
35
  desc "run specs"
36
36
  RSpec::Core::RakeTask.new
37
37
 
38
- task :default => :spec
38
+ task :default => [:spec, :readme]
39
39
 
40
40
  namespace :test do
41
41
  desc "test on all files in given path"
@@ -74,17 +74,20 @@ namespace :test do
74
74
  end
75
75
  end
76
76
 
77
- def check_file url, prefix=nil
77
+ def check_file url, params = {}
78
78
  require 'digest/md5'
79
79
  require 'open-uri'
80
80
 
81
+ params[:min_size] ||= 80_000
82
+
81
83
  STDOUT.sync = true
84
+ prefix = params[:prefix]
82
85
  fname = File.join 'data', (prefix ? "#{prefix}-" : '') + File.basename(url)
83
86
  existing_md5 = File.exist?(fname) ? Digest::MD5.file(fname).hexdigest : ''
84
87
  print "[.] fetching #{url} .. "
85
- remote_data = open(url).read.force_encoding('cp1252').encode('utf-8')
88
+ remote_data = URI.open(url).read.force_encoding('cp1252').encode('utf-8')
86
89
  puts "#{remote_data.size} bytes"
87
- raise "too small remote data (#{remote_data.size})" if remote_data.size < 80_000
90
+ raise "too small remote data (#{remote_data.size})" if remote_data.size < params[:min_size]
88
91
  remote_md5 = Digest::MD5.hexdigest(remote_data)
89
92
  if remote_md5 == existing_md5
90
93
  puts "[.] same as local"
@@ -95,13 +98,45 @@ def check_file url, prefix=nil
95
98
  end
96
99
  end
97
100
 
101
+ RICH_IDS_URL = "https://raw.githubusercontent.com/dishather/richprint/master/comp_id.txt"
102
+
103
+ namespace :rich do
104
+ desc "update rich comp_id db from net"
105
+ task :update do
106
+ check_file RICH_IDS_URL, :min_size => 30_000
107
+ end
108
+
109
+ desc "convert"
110
+ task :convert do
111
+ result = [
112
+ "class PEdump",
113
+ " # data from #{RICH_IDS_URL}",
114
+ " RICH_IDS = {"
115
+ ]
116
+ n = 0
117
+ t0 = Time.now
118
+ File.readlines(File.join("data", File.basename(RICH_IDS_URL))).each do |line|
119
+ line.strip!
120
+ next if line.empty? || line[0] == '#'
121
+ comp_id, desc = line.split(nil, 2)
122
+ raise unless comp_id =~ /\A[0-9a-fA-F]+\Z/
123
+ result << " 0x#{comp_id} => #{desc.inspect},"
124
+ n += 1
125
+ end
126
+ result << " }"
127
+ result << "end"
128
+ printf "[.] parsed %d definitions in %6.3fs\n", n, Time.now-t0
129
+ File.write("lib/pedump/rich.rb", result.join("\n") + "\n")
130
+ end
131
+ end
132
+
98
133
  namespace :sigs do
99
134
  desc "update packers db from net"
100
135
  task :update do
101
136
  require './lib/pedump/packer'
102
137
  check_file "http://research.pandasecurity.com/blogs/images/userdb.txt"
103
138
  check_file "http://fuu.googlecode.com/svn/trunk/src/x86/Tools/Signaturesdb/signatures.txt"
104
- check_file "http://handlers.sans.edu/jclausing/userdb.txt", "jc"
139
+ check_file "http://handlers.sans.edu/jclausing/userdb.txt", :prefix => "jc"
105
140
  end
106
141
 
107
142
  desc "convert txt2bin"
data/VERSION CHANGED
@@ -1 +1 @@
1
- 0.6.0
1
+ 0.6.4