pedump 0.4.10 → 0.4.11

data/VERSION

@@ -1 +1 @@
-0.4.10
+0.4.11

data/lib/pedump.rb

@@ -18,7 +18,8 @@ require 'pedump/ne/version_info'
 class PEdump
   attr_accessor :fname, :logger, :force, :io
 
-  VERSION = Version::STRING
+  VERSION    = Version::STRING
+  MAX_ERRORS = 100
 
   @@logger = nil
 
@@ -394,7 +395,11 @@ class PEdump
 
     # TODO: not all VirtualAdresses == 0 case
 
-    logger.error "[?] can't find file_offset of VA 0x#{va.to_i.to_s(16)}" unless h[:quiet]
+    if h[:quiet]
+      logger.debug "[?] can't find file_offset of VA 0x#{va.to_i.to_s(16)} (quiet=true)"
+    else
+      logger.error "[?] can't find file_offset of VA 0x#{va.to_i.to_s(16)}"
+    end
     nil
   end
 
@@ -519,7 +524,12 @@ class PEdump
     logger.warn "[?] non-empty last IMAGE_IMPORT_DESCRIPTOR: #{t.inspect}" unless t.empty?
     @imports = r.each do |x|
       if x.Name.to_i != 0 && (ofs = va2file(x.Name))
+        begin
         f.seek ofs
+        rescue
+          logger.warn "[?] cannot seek to #{ofs} (VA=0x#{x.Name.to_i.to_s(16)} for reading imports, skipped"
+          next
+        end
         x.module_name = f.gets("\x00").to_s.chomp("\x00")
       end
       [:original_first_thunk, :first_thunk].each do |tbl|
@@ -680,7 +690,7 @@ class PEdump
             x.names[i] = f.gets("\x00").to_s.chomp("\x00")
           rescue
             nErrors += 1
-            if nErrors > 100
+            if nErrors > MAX_ERRORS
               logger.warn "[?] too many errors getting export names, stopped on #{i} of #{x.names.size}"
               x.names = x.names[0,i]
               break

data/lib/pedump/packer.rb

@@ -99,7 +99,15 @@ class PEdump
         h[:deep] = 1 if h[:deep] == true
         h[:deep] = 0 if h[:deep] == false
 
-        f.seek(h[:ep_offset])             # offset of PE EntryPoint from start of file
+        begin
+          f.seek(h[:ep_offset])             # offset of PE EntryPoint from start of file
+        rescue
+          if h[:pedump] && h[:pedump].logger
+            h[:pedump].logger.warn "[?] failed to seek to EP at #{h[:ep_offset]}, skipping packer detect"
+          end
+          return
+        end
+
         r = Array(of_data(f.read(max_size)))
         return r if r && r.any? && h[:deep] < 2
         r += scan_whole_file(f,

data/lib/pedump/resources.rb

@@ -267,6 +267,8 @@ class PEdump
           @@loopchk1 = Hash.new(0)
           @@loopchk2 = Hash.new(0)
           @@loopchk3 = Hash.new(0)
+          @@nErrors1 = 0
+          @@nErrors2 = 0
         elsif (@@loopchk1[f.tell] += 1) > 1
           PEdump.logger.error "[!] #{self}: loop1 detected at file pos #{f.tell}" if @@loopchk1[f.tell] < 2
           return nil
@@ -286,27 +288,39 @@ class PEdump
             r.entries << IMAGE_RESOURCE_DIRECTORY_ENTRY.read(f)
           end
           #r.entries.uniq!
-          r.entries.each do |entry|
+          r.entries.each_with_index do |entry,idx|
             entry.name =
-              if entry.Name.to_i & 0x8000_0000 > 0
+              if (entry.Name.to_i & 0x8000_0000 > 0) && f.checked_seek(base + entry.Name & 0x7fff_ffff)
                 # Name is an address of unicode string
-                f.seek base + entry.Name & 0x7fff_ffff
                 nChars = f.read(2).to_s.unpack("v").first.to_i
                 begin
                   f.read(nChars*2).force_encoding('UTF-16LE').encode!('UTF-8')
                 rescue
                   PEdump.logger.error "[!] #{self} failed to read entry name: #{$!}"
+                  if (@@nErrors1+=1) > MAX_ERRORS
+                    PEdump.logger.warn "[?] too many errors getting resource names, stopped on #{idx} of #{r.entries.size}"
+                    r.entries = r.entries[0,idx]
+                    break
+
+                  end
                   "???"
                 end
               else
                 # Name is a numeric id
                 "##{entry.Name}"
               end
-            if entry.OffsetToData && f.checked_seek(base + entry.OffsetToData & 0x7fff_ffff)
-              if (@@loopchk3[f.tell] += 1) > 1
+            if entry.OffsetToData
+              if (@@loopchk3[entry.OffsetToData] += 1) > 1
                 PEdump.logger.error "[!] #{self}: loop3 detected at file pos #{f.tell}" if @@loopchk3[f.tell] < 2
+                if (@@nErrors2+=1) > MAX_ERRORS
+                  PEdump.logger.warn "[?] too many errors getting resource data, stopped on #{idx} of #{r.entries.size}"
+                  r.entries = r.entries[0,idx]
+                  break
+
+                end
                 next
               end
+              next unless f.checked_seek(base + entry.OffsetToData & 0x7fff_ffff)
               entry.data =
                 if entry.OffsetToData & 0x8000_0000 > 0
                   # child is a directory
@@ -326,7 +340,9 @@ class PEdump
   def _scan_pe_resources f=@io, dir=nil
     dir ||= resource_directory(f)
     return nil unless dir
-    dir.entries.map do |entry|
+    @pe_res_errors ||= 0
+    r = []
+    dir.entries.each_with_index do |entry,idx|
       case entry.data
         when IMAGE_RESOURCE_DIRECTORY
           if dir == @resource_directory # root resource directory
@@ -337,32 +353,45 @@ class PEdump
               else
                 entry.name
               end
-            _scan_pe_resources(f,entry.data).each do |res|
+            r += _scan_pe_resources(f,entry.data).each do |res|
               res.type = entry_type
               res.parse f
             end
           else
-            _scan_pe_resources(f,entry.data).each do |res|
+            r += _scan_pe_resources(f,entry.data).each do |res|
               res.name = res.name == "##{res.lang}" ? entry.name : "#{entry.name} / #{res.name}"
               res.id ||= entry.Name if entry.Name.is_a?(Numeric) && entry.Name < 0x8000_0000
             end
           end
         when IMAGE_RESOURCE_DATA_ENTRY
-          Resource.new(
+          file_offset = va2file(entry.data.OffsetToData, :quiet => (@pe_res_errors > MAX_ERRORS))
+          unless file_offset
+            @pe_res_errors += 1
+            if @pe_res_errors > MAX_ERRORS
+              PEdump.logger.warn "[?] too many errors getting resource data, stopped on #{idx} of #{dir.entries.size}"
+              break
+            end
+          end
+          r << Resource.new(
             nil,          # type
             entry.name,
             nil,          # id
             entry.Name,   # lang
             #entry.data.OffsetToData + @resource_data_base,
-            va2file(entry.data.OffsetToData),
+            file_offset,
             entry.data.Size,
             entry.data.CodePage,
             entry.data.Reserved
           )
         else
-          logger.error "[!] invalid resource entry: #{entry.data.inspect}"
-          nil
+          if entry.data
+            logger.error "[!] invalid resource entry: #{entry.data.inspect}"
+          else
+            # show NULL entries only in verbose mode
+            logger.info  "[!] invalid resource entry: #{entry.data.inspect}"
+          end
       end
-    end.flatten.compact
+    end
+    r.flatten.compact
   end
 end

data/lib/pedump/version.rb

@@ -2,7 +2,7 @@ class PEdump
   module Version
     MAJOR = 0
     MINOR = 4
-    PATCH = 10
+    PATCH = 11
     BUILD = nil
 
     STRING = [MAJOR, MINOR, PATCH, BUILD].compact.join('.')

data/pedump.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "pedump"
-  s.version = "0.4.10"
+  s.version = "0.4.11"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andrey \"Zed\" Zaikin"]
-  s.date = "2012-12-10"
+  s.date = "2012-12-11"
   s.description = "dump headers, sections, extract resources of win32 PE exe,dll,etc"
   s.email = "zed.0xff@gmail.com"
   s.executables = ["pedump"]
@@ -59,6 +59,7 @@ Gem::Specification.new do |s|
     "misc/nedump.c",
     "pedump.gemspec",
     "spec/65535sects_spec.rb",
+    "spec/bad_imports_spec.rb",
     "spec/composite_io_spec.rb",
     "spec/dllord_spec.rb",
     "spec/foldedhdr_spec.rb",

data/spec/bad_imports_spec.rb

@@ -0,0 +1,20 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+require File.expand_path(File.dirname(__FILE__) + '/../lib/pedump')
+
+describe 'bad_imports.exe' do
+  before :all do
+    @imports = sample.imports
+  end
+
+  it "should have IMAGE_IMPORT_DESCRIPTOR" do
+    @imports.size.should == 1
+  end
+
+  it "should have only IMAGE_IMPORT_DESCRIPTORs" do
+    @imports.map(&:class).uniq.should == [PEdump::IMAGE_IMPORT_DESCRIPTOR]
+  end
+
+  it "should not detect packer" do
+    sample.packer.should be_nil
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pedump
 version: !ruby/object:Gem::Version
-  version: 0.4.10
+  version: 0.4.11
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-10 00:00:00.000000000 Z
+date: 2012-12-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multipart-post
@@ -189,6 +189,7 @@ files:
 - misc/nedump.c
 - pedump.gemspec
 - spec/65535sects_spec.rb
+- spec/bad_imports_spec.rb
 - spec/composite_io_spec.rb
 - spec/dllord_spec.rb
 - spec/foldedhdr_spec.rb
@@ -221,7 +222,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 1643171094839400469
+      hash: -1370513960600577087
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: