pedump 0.1.0 → 0.1.1

data/VERSION

@@ -1 +1 @@
-0.1.0
+0.1.1

data/lib/pedump.rb

@@ -322,9 +322,14 @@ class PEdump
   end
 
   def mz f=nil
-    @mz ||= MZ.read(f).tap do |mz|
+    @mz ||= f && MZ.read(f).tap do |mz|
       if mz.signature != 'MZ' && mz.signature != 'ZM'
-        logger.warn "[?] no MZ signature (want: 'MZ' or 'ZM', got: #{mz.signature.inspect}"
+        if @force
+          logger.warn  "[?] no MZ signature. want: 'MZ' or 'ZM', got: #{mz.signature.inspect}"
+        else
+          logger.error "[!] no MZ signature. want: 'MZ' or 'ZM', got: #{mz.signature.inspect}. (not forced)"
+          return nil
+        end
       end
     end
   end
@@ -332,7 +337,7 @@ class PEdump
   def dos_stub f=nil
     @dos_stub ||=
       begin
-        mz = mz(f)
+        return nil unless mz = mz(f)
         dos_stub_offset = mz.header_paragraphs.to_i * 0x10
         dos_stub_size   = mz.lfanew.to_i - dos_stub_offset
         if dos_stub_offset <= 0
@@ -374,7 +379,7 @@ class PEdump
   def pe f=nil
     @pe ||=
       begin
-        pe_offset = mz(f).try(:lfanew)
+        pe_offset = mz(f) && mz(f).lfanew
         if pe_offset.nil?
           logger.fatal "[!] NULL PE offset (e_lfanew). cannot continue."
           nil
@@ -385,7 +390,14 @@ class PEdump
           f.seek pe_offset
           pe_sig = f.read 4
           logger.error "[!] 'NE' format is not supported!" if pe_sig == "NE\x00\x00"
-          logger.warn  "[?] no PE signature (want: 'PE\\x00\\x00', got: #{pe_sig.inspect})" if pe_sig != "PE\x00\x00"
+          if pe_sig != "PE\x00\x00"
+            if @force
+              logger.warn  "[?] no PE signature (want: 'PE\\x00\\x00', got: #{pe_sig.inspect})"
+            else
+              logger.error "[?] no PE signature (want: 'PE\\x00\\x00', got: #{pe_sig.inspect}). (not forced)"
+              return nil
+            end
+          end
           PE.new(pe_sig).tap do |pe|
             pe.image_file_header = IMAGE_FILE_HEADER.read(f)
             if pe.ifh.SizeOfOptionalHeader > 0
@@ -397,7 +409,7 @@ class PEdump
             end
 
             if (nToRead=pe.ifh.NumberOfSections) > 32
-              if @force
+              if @force.is_a?(Numeric) && @force > 1
                 logger.warn "[!] too many sections (#{pe.ifh.NumberOfSections}). forced. reading all"
               else
                 logger.warn "[!] too many sections (#{pe.ifh.NumberOfSections}). not forced, reading first 32"
@@ -418,10 +430,15 @@ class PEdump
 
   # OPTIONAL: assigns @mz, @rich_hdr, @pe, etc
   def dump f=nil
-    f ? pe(f) : File.open(@fname){ |f| pe(f) }
+    f ? _dump_handle(f) : File.open(@fname){ |f| _dump_handle(f) }
     self
   end
 
+  def _dump_handle h
+    rich_hdr(h)  # includes mz(h)
+    resources(h) # includes pe(h)
+  end
+
   def data_directory f=nil
     pe(f) && pe.ioh && pe.ioh.DataDirectory
   end
@@ -517,7 +534,7 @@ class PEdump
   end
 
   def _read_resource_directory_tree f
-    return nil unless pe(f).try(:ioh)
+    return nil unless pe(f) && pe(f).ioh && f
     res_dir = @pe.ioh.DataDirectory[IMAGE_DATA_DIRECTORY::RESOURCE]
     return [] if !res_dir || (res_dir.va == 0 && res_dir.size == 0)
     res_va = @pe.ioh.DataDirectory[IMAGE_DATA_DIRECTORY::RESOURCE].va

data/lib/pedump/cli.rb

@@ -30,7 +30,8 @@ class PEdump::CLI
         @options[:verbose] += 1
       end
       opts.on "-F", "--force", "Try to dump by all means (can cause exceptions & heavy wounds)" do |v|
-        @options[:force] = true
+        @options[:force] ||= 0
+        @options[:force] += 1
       end
       opts.on "-f", "--format FORMAT", [:binary, :c, :dump, :hex, :inspect, :table],
         "Output format: bin,c,dump,hex,inspect,table (default)" do |v|
@@ -71,6 +72,8 @@ class PEdump::CLI
           end
         end
 
+        return if !@options[:force] && !@pedump.mz(f)
+
         @actions.each do |action|
           dump_action action,f
         end

data/pedump.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = "pedump"
-  s.version = "0.1.0"
+  s.version = "0.1.1"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andrey \"Zed\" Zaikin"]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pedump
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ date: 2011-12-09 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70102209592580 !ruby/object:Gem::Requirement
+  requirement: &70262192852620 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,10 +21,10 @@ dependencies:
         version: 2.3.0
   type: :development
   prerelease: false
-  version_requirements: *70102209592580
+  version_requirements: *70262192852620
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70102209591820 !ruby/object:Gem::Requirement
+  requirement: &70262192851380 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -32,10 +32,10 @@ dependencies:
         version: 1.0.0
   type: :development
   prerelease: false
-  version_requirements: *70102209591820
+  version_requirements: *70262192851380
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &70102209590740 !ruby/object:Gem::Requirement
+  requirement: &70262192849440 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +43,10 @@ dependencies:
         version: 1.6.4
   type: :development
   prerelease: false
-  version_requirements: *70102209590740
+  version_requirements: *70262192849440
 - !ruby/object:Gem::Dependency
   name: rcov
-  requirement: &70102209585380 !ruby/object:Gem::Requirement
+  requirement: &70262192846320 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,7 +54,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70102209585380
+  version_requirements: *70262192846320
 description: dump headers, sections, extract resources of win32 PE exe,dll,etc
 email: zed.0xff@gmail.com
 executables:
@@ -93,7 +93,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3334158789950577908
+      hash: -2508940562784118037
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: