pedump 0.6.6 → 0.6.9

data/lib/pedump.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+require 'digest/md5'
 require 'stringio'
 require 'iostruct'
 require 'zhexdump'
@@ -9,6 +10,7 @@ unless Object.new.respond_to?(:try) && nil.respond_to?(:try)
 end
 
 require 'pedump/core'
+require 'pedump/ordlookup'
 require 'pedump/pe'
 require 'pedump/resources'
 require 'pedump/version_info'
@@ -573,11 +575,37 @@ class PEdump
     end
   end
 
+  def imphash f=@io
+    return @imphash if @imphash
+    return nil unless pe(f) && pe(f).ioh && f
+
+    imports = imports(f)
+    return nil if imports.empty?
+
+    a = []
+    imports.each do |iid|
+      next unless iid.module_name
+
+      names = [iid.original_first_thunk, iid.first_thunk].compact.flatten.map do |x|
+        x.name || PEdump.ordlookup(iid.module_name, x.ordinal, make_name: true)
+      end.compact.map(&:downcase).uniq
+      libname = iid.module_name.downcase.sub(/\.(ocx|sys|dll)$/,'') # as in python's pefile
+      names.each do |name|
+        a << "#{libname}.#{name}"
+      end
+    end
+
+    return nil if a.empty?
+    @imphash = Digest::MD5.hexdigest(a.join(","))
+  end
+
   def pe_imports f=@io
     return @imports if @imports
     return nil unless pe(f) && pe(f).ioh && f
+
     dir = @pe.ioh.DataDirectory[IMAGE_DATA_DIRECTORY::IMPORT]
     return [] if !dir || (dir.va == 0 && dir.size == 0)
+
     file_offset = va2file(dir.va)
     return nil unless file_offset
 

data/pedump.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Juwelier::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: pedump 0.6.6 ruby lib
+# stub: pedump 0.6.9 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "pedump".freeze
-  s.version = "0.6.6"
+  s.version = "0.6.9".freeze
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib".freeze]
   s.authors = ["Andrey \"Zed\" Zaikin".freeze]
-  s.date = "2023-04-16"
+  s.date = "2024-04-20"
   s.description = "dump headers, sections, extract resources of win32 PE exe,dll,etc".freeze
   s.email = "zed.0xff@gmail.com".freeze
   s.executables = ["pedump".freeze]
@@ -31,6 +31,10 @@ Gem::Specification.new do |s|
     "data/comp_id.txt",
     "data/fs.txt",
     "data/jc-userdb.txt",
+    "data/ordlookup/oleaut32.dll.yml",
+    "data/ordlookup/pefile2json.py",
+    "data/ordlookup/ws2_32.dll.yml",
+    "data/ordlookup/wsock32.dll.yml",
     "data/sig.bin",
     "data/signatures.txt",
     "data/userdb.txt",
@@ -46,6 +50,7 @@ Gem::Specification.new do |s|
     "lib/pedump/logger.rb",
     "lib/pedump/ne.rb",
     "lib/pedump/ne/version_info.rb",
+    "lib/pedump/ordlookup.rb",
     "lib/pedump/packer.rb",
     "lib/pedump/pe.rb",
     "lib/pedump/resources.rb",
@@ -68,33 +73,19 @@ Gem::Specification.new do |s|
   ]
   s.homepage = "http://github.com/zed-0xff/pedump".freeze
   s.licenses = ["MIT".freeze]
-  s.rubygems_version = "3.3.7".freeze
+  s.rubygems_version = "3.5.6".freeze
   s.summary = "dump win32 PE executable files with a pure ruby".freeze
 
-  if s.respond_to? :specification_version then
-    s.specification_version = 4
-  end
+  s.specification_version = 4
 
-  if s.respond_to? :add_runtime_dependency then
-    s.add_runtime_dependency(%q<rainbow>.freeze, [">= 0"])
-    s.add_runtime_dependency(%q<awesome_print>.freeze, [">= 0"])
-    s.add_runtime_dependency(%q<iostruct>.freeze, [">= 0.0.4"])
-    s.add_runtime_dependency(%q<multipart-post>.freeze, [">= 2.0.0"])
-    s.add_runtime_dependency(%q<zhexdump>.freeze, [">= 0.0.2"])
-    s.add_development_dependency(%q<rspec>.freeze, [">= 0"])
-    s.add_development_dependency(%q<rspec-its>.freeze, [">= 0"])
-    s.add_development_dependency(%q<bundler>.freeze, [">= 0"])
-    s.add_development_dependency(%q<juwelier>.freeze, [">= 0"])
-  else
-    s.add_dependency(%q<rainbow>.freeze, [">= 0"])
-    s.add_dependency(%q<awesome_print>.freeze, [">= 0"])
-    s.add_dependency(%q<iostruct>.freeze, [">= 0.0.4"])
-    s.add_dependency(%q<multipart-post>.freeze, [">= 2.0.0"])
-    s.add_dependency(%q<zhexdump>.freeze, [">= 0.0.2"])
-    s.add_dependency(%q<rspec>.freeze, [">= 0"])
-    s.add_dependency(%q<rspec-its>.freeze, [">= 0"])
-    s.add_dependency(%q<bundler>.freeze, [">= 0"])
-    s.add_dependency(%q<juwelier>.freeze, [">= 0"])
-  end
+  s.add_runtime_dependency(%q<rainbow>.freeze, [">= 0".freeze])
+  s.add_runtime_dependency(%q<awesome_print>.freeze, [">= 0".freeze])
+  s.add_runtime_dependency(%q<iostruct>.freeze, [">= 0.0.4".freeze])
+  s.add_runtime_dependency(%q<multipart-post>.freeze, [">= 2.0.0".freeze])
+  s.add_runtime_dependency(%q<zhexdump>.freeze, [">= 0.0.2".freeze])
+  s.add_development_dependency(%q<rspec>.freeze, [">= 0".freeze])
+  s.add_development_dependency(%q<rspec-its>.freeze, [">= 0".freeze])
+  s.add_development_dependency(%q<bundler>.freeze, [">= 0".freeze])
+  s.add_development_dependency(%q<juwelier>.freeze, [">= 0".freeze])
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pedump
 version: !ruby/object:Gem::Version
-  version: 0.6.6
+  version: 0.6.9
 platform: ruby
 authors:
 - Andrey "Zed" Zaikin
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-16 00:00:00.000000000 Z
+date: 2024-04-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rainbow
@@ -156,6 +156,10 @@ files:
 - data/comp_id.txt
 - data/fs.txt
 - data/jc-userdb.txt
+- data/ordlookup/oleaut32.dll.yml
+- data/ordlookup/pefile2json.py
+- data/ordlookup/ws2_32.dll.yml
+- data/ordlookup/wsock32.dll.yml
 - data/sig.bin
 - data/signatures.txt
 - data/userdb.txt
@@ -171,6 +175,7 @@ files:
 - lib/pedump/logger.rb
 - lib/pedump/ne.rb
 - lib/pedump/ne/version_info.rb
+- lib/pedump/ordlookup.rb
 - lib/pedump/packer.rb
 - lib/pedump/pe.rb
 - lib/pedump/resources.rb
@@ -209,7 +214,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.5.6
 signing_key:
 specification_version: 4
 summary: dump win32 PE executable files with a pure ruby