pedump 0.4.15 → 0.4.16

data/VERSION

@@ -1 +1 @@
-0.4.15
+0.4.16

data/lib/pedump/resources.rb

@@ -65,6 +65,36 @@ class PEdump
       end
     end
 
+    # only valid for types BITMAP, ICON & CURSOR
+    def restore_icon src_fname
+      File.open(src_fname, "rb") do |f|
+        parse f
+        if data.first == "PNG"
+          "\x89PNG" +f.read(self.size-4)
+        else
+          icondir = [
+            0,        # Reserved. Must always be 0.
+            1,        # image type: 1 for icon (.ICO), 2 for cursor (.CUR). Other values are invalid
+            1,        # number of images in the file
+          ].pack("v3")
+          bitmap_hdr = data.first # BITMAPINFOHEADER
+          icondirentry = ICODIRENTRY.new(
+            bitmap_hdr.biWidth,
+            bitmap_hdr.biHeight / (%w'ICON CURSOR'.include?(type) ? 2 : 1),
+            0,   # XXX: bColors: may be wrong here
+            0,
+            1,
+            bitmap_hdr.biBitCount,
+            bitmap_hdr.biSizeImage,
+            icondir.size + 2 + ICODIRENTRY::SIZE # offset of BMP data from the beginning of ICO file
+          )
+          # ICONDIRENTRY is 2 bytes larger than ICODIRENTRY
+          icondir + icondirentry.pack + "\x00\x00" + bitmap_hdr.pack + f.read(self.size)
+        end
+      end
+    end
+
+    # only valid for types BITMAP, ICON & CURSOR
     def bitmap_mask src_fname
       File.open(src_fname, "rb") do |f|
         parse f
@@ -175,14 +205,21 @@ class PEdump
     end
 
     def validate
-      self.valid =
+      self.valid = self.file_offset &&
         case type
         when 'BITMAP','ICON','CURSOR'
           data.any?{ |x| x.is_a?(BITMAPINFOHEADER) && x.valid? } || data.first == 'PNG'
+        when 'GROUP_ICON'
+          # rough validation
+          data.first.is_a?(CUR_ICO_HEADER) && data.size == data.first.wNumImages.to_i+1
         else
           true
         end
     end
+
+    def valid?
+      valid
+    end
   end
 
   STRING = Struct.new(:id, :lang, :value)

data/lib/pedump/sig_parser.rb

@@ -171,10 +171,10 @@ class PEdump
         return if a_bad.include?(a_cur)
 
         # too short signatures
-#        if sig.re.split.delete_if{ |x| x['?'] }.size < 6
-#          require 'awesome_print'
-#          puts sig.inspect.red
-#        end
+        if sig.re.split.delete_if{ |x| x['?'] }.size < 3
+          require 'awesome_print'
+          puts sig.inspect.red
+        end
 
         # fs.txt contains a lot of signatures that copied from other sources
         # BUT have all 01 replaced with '??'
@@ -216,10 +216,18 @@ class PEdump
             'DLL','(DLL)','[DLL]',
             '[LZMA]','(LZMA)','LZMA',
             '-','~','(pack)','(1)','(2)',
-            '19??'
+            '19??',
+            'with:', 'with?'
           ]
         end
-        return if d.all?(&:empty?) # no different words
+        return if d.all?(&:empty?) # no different words => can keep ANY name
+
+
+#        if name1 =~ /pecompact/i
+#          require 'awesome_print'
+#          puts "[d] #{name1}".yellow
+#          puts "[d] #{name2}".yellow
+#        end
 
         # [["v1.14/v1.20"], ["v1.14,", "v1.20"]]]
         # [["EXEShield", "v0.3b/v0.3", "v0.6"], ["Shield", "v0.3b,", "v0.3"]]]
@@ -233,21 +241,53 @@ class PEdump
           end
         end
 
+#        require 'awesome_print'
+#        puts "[d] #{name1.yellow} #{name2.green}"
+
         a = name1.split
         b = name2.split
+
+        # merge common head
         new_name_head = []
         while a.any? && b.any? && a.first.upcase == b.first.upcase
           new_name_head << a.shift
           b.shift
         end
+
+        # merge common tail
         new_name_tail = []
         while a.any? && b.any? && a.last.upcase == b.last.upcase
           new_name_tail.unshift a.pop
           b.pop
         end
+
+        # rm common words from middle
+        separators = [ "/", "->" ]
+        was = true
+        while was
+          was = false
+          b.each do |bw|
+            next if bw == "/" || bw == "->"
+            if a.include?(bw) || a.include?(bw+")") || a.include?("("+bw) || a.include?("(#{bw})")
+              b -= [bw]
+              was = true
+              break
+            end
+          end
+        end
+        while separators.include?(b.last)
+          b.pop
+        end
+
         new_name = new_name_head
         new_name << [a.join(' '), b.join(' ')].delete_if{|x| x.empty?}.join(' / ')
         new_name += new_name_tail
+#        if name1 =~ /pecompact/i
+#          p a
+#          p b
+#          p new_name_tail
+#        puts "[=] #{new_name.inspect}".red
+#        end
         new_name = new_name.join(' ')
       end
 
@@ -291,14 +331,16 @@ class PEdump
             if rd = _re_diff(sig1.re, sig2.re, max_diff)
               if    rd.all?{ |x| x[0].nil? || x[0] == '.' } && sig2.re.size >= sig1.re.size
                 if new_name = _merge_names(sig2.name, sig1.name)
-                  #pp ["FIRST", sig1.name, sig2.name, new_name, sig1.re.join, sig2.re.join] if new_name
+#                  require 'pp'
+#                  pp ["FIRST", sig1.name, sig2.name, new_name, sig1.re.join, sig2.re.join] if new_name =~ /pecompact/i
                   sig1.name = new_name
                 end
                 sig2.ep_only ||= sig1.ep_only
                 sig2.re = []
               elsif rd.all?{ |x| x[1].nil? || x[1] == '.' } && sig1.re.size >= sig2.re.size
                 if new_name = _merge_names(sig2.name, sig1.name)
-                  #pp ["SECOND", sig1.name, sig2.name, new_name, sig1.re.join, sig2.re.join] if new_name
+#                  require 'pp'
+#                  pp ["SECOND", sig1.name, sig2.name, new_name, sig1.re.join, sig2.re.join] if new_name =~ /pecompact/i
                   sig2.name = new_name
                 end
                 sig1.re = []
@@ -350,18 +392,18 @@ class PEdump
       def optimize sigs
         optimize_names sigs
 
-        print "[.] sigs merge: #{sigs.size}"; _optimize(sigs); puts  " -> #{sigs.size}"
+        # XXX no optimize from now, prefer more precise sigs
+        #print "[.] sigs merge: #{sigs.size}"; _optimize(sigs); puts  " -> #{sigs.size}"
 
         # try to merge signatures with same name, size & ep_only
-        sigs.group_by{ |sig|
-          [sig.re.size, sig.name, sig.ep_only]
-        }.values.each do |a|
-          next if a.size == 1
-          if merged_re = _merge(a)
-            a.first.re = merged_re
-            a[1..-1].each{ |sig| sig.re = nil }
+        sigs.group_by{ |sig| [sig.re.size, sig.name, sig.ep_only] }.
+          values.each do |a|
+            next if a.size == 1
+            if merged_re = _merge(a)
+              a.first.re = merged_re
+              a[1..-1].each{ |sig| sig.re = nil }
+            end
           end
-        end
         print "[.] sigs merge: #{sigs.size}"; sigs.delete_if{ |x| x.re.nil? }; puts  " -> #{sigs.size}"
 
 
@@ -439,6 +481,7 @@ class PEdump
           end
           prev_eq = eq
         end
+        dstart ||= 0
         r = dstart..dend
         r == (0..(size-1)) ? nil : r
       end

data/lib/pedump/version.rb

@@ -2,7 +2,7 @@ class PEdump
   module Version
     MAJOR = 0
     MINOR = 4
-    PATCH = 15
+    PATCH = 16
     BUILD = nil
 
     STRING = [MAJOR, MINOR, PATCH, BUILD].compact.join('.')

data/pedump.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "pedump"
-  s.version = "0.4.15"
+  s.version = "0.4.16"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andrey \"Zed\" Zaikin"]
-  s.date = "2012-12-28"
+  s.date = "2013-01-03"
   s.description = "dump headers, sections, extract resources of win32 PE exe,dll,etc"
   s.email = "zed.0xff@gmail.com"
   s.executables = ["pedump"]

metadata

@@ -2,14 +2,14 @@
 name: pedump
 version: !ruby/object:Gem::Version
   prerelease: 
-  version: 0.4.15
+  version: 0.4.16
 platform: ruby
 authors:
 - Andrey "Zed" Zaikin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-28 00:00:00.000000000 Z
+date: 2013-01-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   prerelease: false
@@ -215,7 +215,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -4443824394784718020
+      hash: -2417171475449588298
   none: false
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements: