pedump 0.2.1 → 0.3.0

data/Gemfile

@@ -2,6 +2,8 @@ source "http://rubygems.org"
 # Add dependencies required to use your gem here.
 # Example:
 #   gem "activesupport", ">= 2.3.5"
+gem "rest-client", "~> 1.6.7"
+gem "progressbar", "~> 0.9.2"
 
 # Add dependencies to develop your gem here.
 # Include everything needed to run rake, tests, features, etc.

data/Gemfile.lock

@@ -7,8 +7,12 @@ GEM
       bundler (~> 1.0)
       git (>= 1.2.5)
       rake
+    mime-types (1.16)
+    progressbar (0.9.2)
     rake (0.9.2.2)
     rcov (0.9.11)
+    rest-client (1.6.7)
+      mime-types (>= 1.16)
     rspec (2.3.0)
       rspec-core (~> 2.3.0)
       rspec-expectations (~> 2.3.0)
@@ -24,5 +28,7 @@ PLATFORMS
 DEPENDENCIES
   bundler (~> 1.0.0)
   jeweler (~> 1.6.4)
+  progressbar (~> 0.9.2)
   rcov
+  rest-client (~> 1.6.7)
   rspec (~> 2.3.0)

data/Rakefile

@@ -49,3 +49,29 @@ task :default => :spec
 #  rdoc.rdoc_files.include('README*')
 #  rdoc.rdoc_files.include('lib/**/*.rb')
 #end
+
+namespace :test do
+  desc "test on all files in given path"
+  task :all_files do
+    require './lib/pedump'
+    require './lib/pedump/cli'
+    path = ENV['path'] || raise("run me with path=...")
+    `find #{path} -type f`.split("\n").each do |fname|
+      puts "\n### #{fname}\n"
+      PEdump::CLI.new(fname).run
+    end
+  end
+
+  namespace :all_files do
+    desc "output file name to stderr, use with stdout redirection"
+    task :stderr do
+      require './lib/pedump'
+      require './lib/pedump/cli'
+      path = ENV['path'] || raise("run me with path=...")
+      `find #{path} -type f`.split("\n").each do |fname|
+        STDERR.puts "\n### #{fname}\n"
+        PEdump::CLI.new(fname).run
+      end
+    end
+  end
+end

data/VERSION

@@ -1 +1 @@
-0.2.1
+0.3.0

data/lib/pedump.rb

@@ -303,13 +303,17 @@ class PEdump
     end
 
     def dexor
-      self[4..-9].sub(/\A(#{Regexp::escape(key)})+/,'').xor(key)
+      self[4..-9].sub(/\A(#{Regexp::escape(key)}){3}/,'').xor(key)
     end
 
     def decode
       x = dexor
-      raise "dexored size must be a multiple of 8" unless x.size%8 == 0
-      x.unpack('vvV'*(x.size/8)).each_slice(3).map{ |slice| Entry.new(*slice)}
+      if x.size%8 == 0
+        x.unpack('vvV'*(x.size/8)).each_slice(3).map{ |slice| Entry.new(*slice)}
+      else
+        PEdump.logger.error "[?] #{self.class}: dexored size(#{x.size}) must be a multiple of 8"
+        nil
+      end
     end
   end
 
@@ -441,6 +445,8 @@ class PEdump
   def _dump_handle h
     rich_hdr(h)  # includes mz(h)
     resources(h) # includes pe(h)
+    imports h
+    exports h
   end
 
   def data_directory f=nil
@@ -472,16 +478,19 @@ class PEdump
   ImportedFunction = Struct.new(:hint, :name, :ordinal)
 
   def imports f=nil
+    return @imports if @imports
     return nil unless pe(f) && pe(f).ioh && f
     dir = @pe.ioh.DataDirectory[IMAGE_DATA_DIRECTORY::IMPORT]
     return [] if !dir || (dir.va == 0 && dir.size == 0)
     va = @pe.ioh.DataDirectory[IMAGE_DATA_DIRECTORY::IMPORT].va
-    f.seek va2file(va)
+    file_offset = va2file(va)
+    return nil unless file_offset
+    f.seek file_offset
     r = []
     until (t=IMAGE_IMPORT_DESCRIPTOR.read(f)).empty?
       r << t
     end
-    r.each do |x|
+    @imports = r.each do |x|
       if x.Name.to_i != 0 && (va = va2file(x.Name))
         f.seek va
         x.module_name = f.gets("\x00").chop
@@ -539,15 +548,21 @@ class PEdump
     :AddressOfNames,
     :AddressOfNameOrdinals,
     # manual:
-    :name, :entry_points, :names, :ordinals
+    :name, :entry_points, :names, :name_ordinals
 
   def exports f=nil
+    return @exports if @exports
     return nil unless pe(f) && pe(f).ioh && f
     dir = @pe.ioh.DataDirectory[IMAGE_DATA_DIRECTORY::EXPORT]
     return [] if !dir || (dir.va == 0 && dir.size == 0)
     va = @pe.ioh.DataDirectory[IMAGE_DATA_DIRECTORY::EXPORT].va
-    f.seek va2file(va)
-    IMAGE_EXPORT_DIRECTORY.read(f).tap do |x|
+    file_offset = va2file(va)
+    return nil unless file_offset
+    f.seek file_offset
+    @exports = IMAGE_EXPORT_DIRECTORY.read(f).tap do |x|
+      x.entry_points = []
+      x.name_ordinals = []
+      x.names = []
       if x.Name.to_i != 0 && (va = va2file(x.Name))
         f.seek va
         x.name = f.gets("\x00").chop
@@ -559,7 +574,7 @@ class PEdump
         end
         if x.AddressOfNameOrdinals.to_i !=0 && (va = va2file(x.AddressOfNameOrdinals))
           f.seek va
-          x.ordinals = f.read(x.NumberOfFunctions*2).unpack('v*').map{ |o| o+x.Base }
+          x.name_ordinals = f.read(x.NumberOfNames*2).unpack('v*').map{ |o| o+x.Base }
         end
       end
       if x.NumberOfNames.to_i != 0 && x.AddressOfNames.to_i !=0 && (va = va2file(x.AddressOfNames))
@@ -658,6 +673,13 @@ class PEdump
         return va - s.VirtualAddress + s.PointerToRawData
       end
     end
+    # not found with regular search. assume any of VirtualSize was 0, and try with RawSize
+    sections.each do |s|
+      if (s.VirtualAddress...(s.VirtualAddress+s.SizeOfRawData)).include?(va)
+        return va - s.VirtualAddress + s.PointerToRawData
+      end
+    end
+    logger.error "[?] can't find file_offset of VA 0x#{va.to_i.to_s(16)}"
     nil
   end
 
@@ -673,11 +695,11 @@ class PEdump
     end
     f.seek res_section.PointerToRawData
     IMAGE_RESOURCE_DIRECTORY.base = res_section.PointerToRawData
-    @resource_data_base = res_section.PointerToRawData - res_section.VirtualAddress
+    #@resource_data_base = res_section.PointerToRawData - res_section.VirtualAddress
     IMAGE_RESOURCE_DIRECTORY.read(f)
   end
 
-  class Resource < Struct.new(:type, :name, :id, :lang, :file_offset, :size, :cp, :reserved, :data)
+  class Resource < Struct.new(:type, :name, :id, :lang, :file_offset, :size, :cp, :reserved, :data, :valid)
     def bitmap_hdr
       bmp_info_hdr = data.find{ |x| x.is_a?(BITMAPINFOHEADER) }
       raise "no BITMAPINFOHEADER for #{self.type} #{self.name}" unless bmp_info_hdr
@@ -765,23 +787,70 @@ class PEdump
       when 'GROUP_CURSOR'
         f.seek file_offset
         data << CUR_ICO_HEADER.read(f)
+        nRead = CUR_ICO_HEADER::SIZE
         data.last.wNumImages.times do
-          data << CURDIRENTRY.read(f)
+          if nRead >= self.size
+            PEdump.logger.error "[!] refusing to read CURDIRENTRY beyond resource size"
+            break
+          end
+          data  << CURDIRENTRY.read(f)
+          nRead += CURDIRENTRY::SIZE
         end
       when 'GROUP_ICON'
         f.seek file_offset
         data << CUR_ICO_HEADER.read(f)
+        nRead = CUR_ICO_HEADER::SIZE
         data.last.wNumImages.times do
-          data << ICODIRENTRY.read(f)
+          if nRead >= self.size
+            PEdump.logger.error "[!] refusing to read ICODIRENTRY beyond resource size"
+            break
+          end
+          data  << ICODIRENTRY.read(f)
+          nRead += ICODIRENTRY::SIZE
         end
       when 'STRING'
         f.seek file_offset
         16.times do
-          nChars = f.read(2).unpack('v').first
-          data << f.read(nChars*2).force_encoding('UTF-16LE').encode!('UTF-8')
+          break if f.tell >= file_offset+self.size
+          nChars = f.read(2).to_s.unpack('v').first.to_i
+          t =
+            if nChars*2 + 1 > self.size
+              # TODO: if it's not 1st string in table then truncated size must be less
+              PEdump.logger.error "[!] string size(#{nChars*2}) > stringtable size(#{self.size}). truncated to #{self.size-2}"
+              f.read(self.size-2)
+            else
+              f.read(nChars*2)
+            end
+          data <<
+            begin
+              t.force_encoding('UTF-16LE').encode!('UTF-8')
+            rescue
+              t.force_encoding('ASCII')
+              tt = t.size > 0x10 ? t[0,0x10].inspect+'...' : t.inspect
+              PEdump.logger.error "[!] cannot convert #{tt} to UTF-16"
+              [nChars,t].pack('va*')
+            end
         end
         # XXX: check if readed strings summary length is less than resource data length
       end
+
+      data.delete_if do |x|
+        valid = !x.respond_to?(:valid?) || x.valid?
+        PEdump.logger.warn "[?] ignoring invalid #{x.class}" unless valid
+        !valid
+      end
+    ensure
+      validate
+    end
+
+    def validate
+      self.valid =
+        case type
+        when 'BITMAP','ICON','CURSOR'
+          data.any?{ |x| x.is_a?(BITMAPINFOHEADER) && x.valid? }
+        else
+          true
+        end
     end
   end
 
@@ -799,7 +868,7 @@ class PEdump
 
   # see also http://www.informit.com/articles/article.aspx?p=1186882 about icons format
 
-  BITMAPINFOHEADER = create_struct 'V3v2V6',
+  class BITMAPINFOHEADER < create_struct 'V3v2V6',
     :biSize,          # BITMAPINFOHEADER::SIZE
     :biWidth,
     :biHeight,
@@ -812,6 +881,11 @@ class PEdump
     :biClrUsed,
     :biClrImportant
 
+    def valid?
+      self.biSize == 40
+    end
+  end
+
   # http://www.devsource.com/c/a/Architecture/Resources-From-PE-I/2/
   CUR_ICO_HEADER = create_struct('v3',
     :wReserved, # always 0
@@ -878,7 +952,8 @@ class PEdump
             entry.name,
             nil,          # id
             entry.Name,   # lang
-            entry.data.OffsetToData + @resource_data_base,
+            #entry.data.OffsetToData + @resource_data_base,
+            va2file(entry.data.OffsetToData),
             entry.data.Size,
             entry.data.CodePage,
             entry.data.Reserved

data/lib/pedump/cli.rb

@@ -14,10 +14,12 @@ class PEdump::CLI
 
   KNOWN_ACTIONS = (
     %w'mz dos_stub rich pe data_directory sections' +
-    %w'strings resources resource_directory imports exports'
+    %w'strings resources resource_directory imports exports web'
   ).map(&:to_sym)
 
-  DEFAULT_ALL_ACTIONS = KNOWN_ACTIONS - %w'resource_directory'.map(&:to_sym)
+  DEFAULT_ALL_ACTIONS = KNOWN_ACTIONS - %w'resource_directory web'.map(&:to_sym)
+
+  URL_BASE = "http://pedump.me"
 
   def initialize argv = ARGV
     @argv = argv
@@ -41,7 +43,6 @@ class PEdump::CLI
         "Output format: bin,c,dump,hex,inspect,table (default)" do |v|
         @options[:format] = v
       end
-      # TODO: imports, exports
       KNOWN_ACTIONS.each do |t|
         opts.on "--#{t.to_s.tr('_','-')}", eval("lambda{ |_| @actions << :#{t.to_s.tr('-','_')} }")
       end
@@ -51,6 +52,9 @@ class PEdump::CLI
       opts.on "--va2file VA", "Convert RVA to file offset" do |va|
         @actions << [:va2file,va]
       end
+      opts.on "-W", "--web", "Upload file to a #{URL_BASE} for a nice HTML tables with image previews, candies & stuff" do
+        @actions << :web
+      end
     end
 
     if (@argv = optparser.parse(@argv)).empty?
@@ -79,10 +83,14 @@ class PEdump::CLI
           end
         end
 
-        return if !@options[:force] && !@pedump.mz(f)
+        next if !@options[:force] && !@pedump.mz(f)
 
         @actions.each do |action|
-          dump_action action,f
+          if action == :web
+            upload f
+          else
+            dump_action action,f
+          end
         end
       end
     end
@@ -91,6 +99,71 @@ class PEdump::CLI
     # prevents a 'Broken pipe - <STDOUT> (Errno::EPIPE)' message
   end
 
+  class ProgressProxy
+    def initialize file
+      @file = file
+      @pbar = ProgressBar.new("[.] uploading", file.size, STDOUT)
+      @pbar.try(:file_transfer_mode)
+      @pbar.bar_mark = '='
+    end
+    def read *args
+      @pbar.inc args.first
+      @file.read *args
+    end
+    def method_missing *args
+      @file.send *args
+    end
+    def respond_to? *args
+      @file.respond_to?(*args) || super(*args)
+    end
+  end
+
+  def upload f
+    if @pedump.mz(f).signature != 'MZ'
+      @pedump.logger.error "[!] refusing to upload a non-MZ file"
+      return
+    end
+
+    require 'digest/md5'
+    require 'open-uri'
+    require 'rest-client'
+    require 'progressbar'
+
+    stdout_sync = STDOUT.sync
+    STDOUT.sync = true
+
+    md5 = Digest::MD5.file(f.path).hexdigest
+    @pedump.logger.info "[.] md5: #{md5}"
+    url = "#{URL_BASE}/#{md5}/"
+
+    @pedump.logger.info "[.] checking if file already uploaded.."
+    begin
+      if (r=open(url).read) == "OK"
+        @pedump.logger.warn "[.] file already uploaded: #{url}"
+        return
+      else
+        raise "invalid server response: #{r}"
+      end
+    rescue OpenURI::HTTPError
+      raise unless $!.to_s == "404 Not Found"
+    end
+
+    f.rewind
+    if (r=RestClient.post(URL_BASE, :file => ProgressProxy.new(f))) != "OK"
+      raise "invalid server response: #{r}"
+    end
+    puts
+    puts "[.] analyzing..."
+
+    if (r=open(File.join(URL_BASE,md5,'analyze')).read) != "OK"
+      raise "invalid server response: #{r}"
+    end
+
+    puts "[.] uploaded: #{url}"
+  ensure
+    STDOUT.sync = stdout_sync
+  end
+
   def action_title action
     s = action.to_s.upcase.tr('_',' ')
     s += " Header" if [:mz, :pe, :rich].include?(action)
@@ -242,33 +315,52 @@ class PEdump::CLI
   end
 
   def dump_exports data
-    printf "# module_name=%s  flags=0x%x  ts=%s  version=%d.%d\n",
+    printf "# module %s\n# flags=0x%x  ts=%s  version=%d.%d  ord_base=%d\n",
       data.name.inspect,
       data.Characteristics,
       Time.at(data.TimeDateStamp.to_i).strftime('"%Y-%m-%d %H:%M:%S"'),
-      data.MajorVersion, data.MinorVersion
+      data.MajorVersion, data.MinorVersion,
+      data.Base
+
+    if @options[:verbose]
+      printf "# Names        rva=0x%08x  file_offset=%8d\n",
+        data.AddressOfNames, @pedump.va2file(data.AddressOfNames)
+      printf "# EntryPoints  rva=0x%08x  file_offset=%8d\n",
+        data.AddressOfFunctions, @pedump.va2file(data.AddressOfFunctions)
+      printf "# Ordinals     rva=0x%08x  file_offset=%8d\n",
+        data.AddressOfNameOrdinals, @pedump.va2file(data.AddressOfNameOrdinals)
+    end
 
-    printf "# n_funcs=%d  n_names=%d\n",
+    printf "# nFuncs=%d  nNames=%d\n",
       data.NumberOfFunctions,
       data.NumberOfNames
 
+    return unless data.name_ordinals.any? || data.entry_points.any? || data.names.any?
+
     puts
 
+    ord2name = {}
+    data.NumberOfNames.times do |i|
+      ord2name[data.name_ordinals[i]] ||= []
+      ord2name[data.name_ordinals[i]] << data.names[i]
+    end
+
     printf "%5s %8s  %s\n", "ORD", "ENTRY_VA", "NAME"
     data.NumberOfFunctions.times do |i|
-      printf "%5s %8x  %s\n",
-        data.ordinals[i].try(:to_s,16),
-        data.entry_points[i],
-        data.names[i]
+      ep = data.entry_points[i]
+      names = ord2name[i+data.Base].try(:join,', ')
+      next if ep.to_i == 0 && names.nil?
+      printf "%5d %8x  %s\n", i + data.Base, ep, names
     end
   end
 
   def dump_imports data
-    fmt = "%-15s %5s %5s %s\n"
+    fmt = "%-15s %5s %5s  %s\n"
     printf fmt, "MODULE_NAME", "HINT", "ORD", "FUNCTION_NAME"
     data.each do |iid|
       # image import descriptor
       (Array(iid.original_first_thunk) + Array(iid.first_thunk)).uniq.each do |f|
+        next unless f
         # imported function
         printf fmt,
           iid.module_name,
@@ -373,7 +465,7 @@ class PEdump::CLI
       fmt.each_with_index do |f,i|
         v = res.send(keys[i])
         if f['x']
-          printf f.tr('x','s'), v < 10 ? v.to_s : "0x#{v.to_s(16)}"
+          printf f.tr('x','s'), v.to_i < 10 ? v.to_s : "0x#{v.to_s(16)}"
         else
           printf f, v
         end
@@ -403,10 +495,18 @@ class PEdump::CLI
   end
 
   def dump_rich_hdr data
-    puts "    LIB_ID        VERSION        TIMES_USED   "
-    data.decode.each do |row|
-      printf " %5d  %2x    %7d  %4x   %7d %3x\n",
-        row.id, row.id, row.version, row.version, row.times, row.times
+    if decoded = data.decode
+      puts "    LIB_ID        VERSION        TIMES_USED   "
+      decoded.each do |row|
+        printf " %5d  %2x    %7d  %4x   %7d %3x\n",
+          row.id, row.id, row.version, row.version, row.times, row.times
+      end
+    else
+      puts "# raw:"
+      puts hexdump(data)
+      puts
+      puts "# dexored:"
+      puts hexdump(data.dexor)
     end
   end
 

data/pedump.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "pedump"
-  s.version = "0.2.1"
+  s.version = "0.3.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andrey \"Zed\" Zaikin"]
-  s.date = "2011-12-10"
+  s.date = "2011-12-11"
   s.description = "dump headers, sections, extract resources of win32 PE exe,dll,etc"
   s.email = "zed.0xff@gmail.com"
   s.executables = ["pedump"]
@@ -43,17 +43,23 @@ Gem::Specification.new do |s|
     s.specification_version = 3
 
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<rest-client>, ["~> 1.6.7"])
+      s.add_runtime_dependency(%q<progressbar>, ["~> 0.9.2"])
       s.add_development_dependency(%q<rspec>, ["~> 2.3.0"])
       s.add_development_dependency(%q<bundler>, ["~> 1.0.0"])
       s.add_development_dependency(%q<jeweler>, ["~> 1.6.4"])
       s.add_development_dependency(%q<rcov>, [">= 0"])
     else
+      s.add_dependency(%q<rest-client>, ["~> 1.6.7"])
+      s.add_dependency(%q<progressbar>, ["~> 0.9.2"])
       s.add_dependency(%q<rspec>, ["~> 2.3.0"])
       s.add_dependency(%q<bundler>, ["~> 1.0.0"])
       s.add_dependency(%q<jeweler>, ["~> 1.6.4"])
       s.add_dependency(%q<rcov>, [">= 0"])
     end
   else
+    s.add_dependency(%q<rest-client>, ["~> 1.6.7"])
+    s.add_dependency(%q<progressbar>, ["~> 0.9.2"])
     s.add_dependency(%q<rspec>, ["~> 2.3.0"])
     s.add_dependency(%q<bundler>, ["~> 1.0.0"])
     s.add_dependency(%q<jeweler>, ["~> 1.6.4"])

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pedump
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,33 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2011-12-10 00:00:00.000000000Z
+date: 2011-12-11 00:00:00.000000000Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: rest-client
+  requirement: &70185231241440 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.6.7
+  type: :runtime
+  prerelease: false
+  version_requirements: *70185231241440
+- !ruby/object:Gem::Dependency
+  name: progressbar
+  requirement: &70185231240020 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.9.2
+  type: :runtime
+  prerelease: false
+  version_requirements: *70185231240020
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70303206510780 !ruby/object:Gem::Requirement
+  requirement: &70185231238140 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,10 +43,10 @@ dependencies:
         version: 2.3.0
   type: :development
   prerelease: false
-  version_requirements: *70303206510780
+  version_requirements: *70185231238140
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70303206635540 !ruby/object:Gem::Requirement
+  requirement: &70185231228680 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -32,10 +54,10 @@ dependencies:
         version: 1.0.0
   type: :development
   prerelease: false
-  version_requirements: *70303206635540
+  version_requirements: *70185231228680
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &70303206642320 !ruby/object:Gem::Requirement
+  requirement: &70185231227000 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +65,10 @@ dependencies:
         version: 1.6.4
   type: :development
   prerelease: false
-  version_requirements: *70303206642320
+  version_requirements: *70185231227000
 - !ruby/object:Gem::Dependency
   name: rcov
-  requirement: &70303206648540 !ruby/object:Gem::Requirement
+  requirement: &70185231225760 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,7 +76,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70303206648540
+  version_requirements: *70185231225760
 description: dump headers, sections, extract resources of win32 PE exe,dll,etc
 email: zed.0xff@gmail.com
 executables:
@@ -93,7 +115,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -1918854361818125320
+      hash: 2723794485104812379
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: