pedump 0.4.1 → 0.4.2

data/VERSION

@@ -1 +1 @@
-0.4.1
+0.4.2

data/lib/pedump/packer.rb

@@ -100,6 +100,7 @@ class PEdump
 
       def of_data data
         r = []
+        return r unless data
         each do |packer|
           if (idx=data.index(packer.re)) == 0
             r << Match.new(idx, packer)

data/lib/pedump/version.rb

@@ -2,7 +2,7 @@ class PEdump
   module Version
     MAJOR = 0
     MINOR = 4
-    PATCH = 1
+    PATCH = 2
     BUILD = nil
 
     STRING = [MAJOR, MINOR, PATCH, BUILD].compact.join('.')

data/lib/pedump.rb

@@ -226,6 +226,7 @@ class PEdump
         cFORMAT = self.const_get 'FORMAT'
         size ||= cSIZE
         PEdump.logger.warn "[?] unusual size of IMAGE_OPTIONAL_HEADER = #{size} (must be #{usual_size})" if size != usual_size
+        PEdump.logger.warn "[?] #{size-usual_size} spare bytes after IMAGE_OPTIONAL_HEADER" if size > usual_size
         new(*file.read([size,cSIZE].min).to_s.unpack(cFORMAT)).tap do |ioh|
           ioh.DataDirectory = []
 
@@ -240,6 +241,9 @@ class PEdump
             ioh.DataDirectory.last.type = IMAGE_DATA_DIRECTORY::TYPES[idx]
           end
           #ioh.DataDirectory.pop while ioh.DataDirectory.last.empty?
+
+          # skip spare bytes, if any. XXX may contain suspicious data
+          file.seek(size-usual_size, IO::SEEK_CUR) if size > usual_size
         end
       end
     end
@@ -479,8 +483,24 @@ class PEdump
                 nToRead = 65535
               end
             end
-            pe.section_table = nToRead.times.map do
-              IMAGE_SECTION_HEADER.read(f)
+            pe.section_table = []
+            nToRead.times do
+              break if f.eof?
+              pe.section_table << IMAGE_SECTION_HEADER.read(f)
+            end
+
+#            if pe.section_table.empty?
+#              pe.section_table << IMAGE_SECTION_HEADER.new("")
+#              logger.warn "[?] no sections, appending empty one"
+#            end
+
+            if pe.section_table.any?
+              # zero all missing values of last section
+              pe.section_table.last.tap do |last_section|
+                last_section.each_pair do |k,v|
+                  last_section[k] = 0 if v.nil?
+                end
+              end
             end
           end
         end
@@ -731,12 +751,27 @@ class PEdump
         return va - s.VirtualAddress + s.PointerToRawData
       end
     end
+
     # not found with regular search. assume any of VirtualSize was 0, and try with RawSize
     sections.each do |s|
       if (s.VirtualAddress...(s.VirtualAddress+s.SizeOfRawData)).include?(va)
         return va - s.VirtualAddress + s.PointerToRawData
       end
     end
+
+    # still not found, bad/zero VirtualSizes & RawSizes ?
+
+    # a special case - PE without sections
+    return va if sections.empty?
+
+    # check if only one section
+    if sections.size == 1 || sections.all?{ |s| s.VirtualAddress.to_i == 0 }
+      s = sections.first
+      return va - s.VirtualAddress + s.PointerToRawData
+    end
+
+    # TODO: not all VirtualAdresses == 0 case
+
     logger.error "[?] can't find file_offset of VA 0x#{va.to_i.to_s(16)}"
     nil
   end

data/pedump.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = "pedump"
-  s.version = "0.4.1"
+  s.version = "0.4.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andrey \"Zed\" Zaikin"]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pedump
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ date: 2011-12-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multipart-post
-  requirement: &70337431501640 !ruby/object:Gem::Requirement
+  requirement: &70341710237060 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,10 +21,10 @@ dependencies:
         version: 1.1.4
   type: :runtime
   prerelease: false
-  version_requirements: *70337431501640
+  version_requirements: *70341710237060
 - !ruby/object:Gem::Dependency
   name: progressbar
-  requirement: &70337431501120 !ruby/object:Gem::Requirement
+  requirement: &70341710236340 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -32,10 +32,10 @@ dependencies:
         version: 0.9.2
   type: :runtime
   prerelease: false
-  version_requirements: *70337431501120
+  version_requirements: *70341710236340
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70337431500620 !ruby/object:Gem::Requirement
+  requirement: &70341710257880 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +43,10 @@ dependencies:
         version: 2.3.0
   type: :development
   prerelease: false
-  version_requirements: *70337431500620
+  version_requirements: *70341710257880
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70337431500120 !ruby/object:Gem::Requirement
+  requirement: &70341710257240 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -54,10 +54,10 @@ dependencies:
         version: 1.0.0
   type: :development
   prerelease: false
-  version_requirements: *70337431500120
+  version_requirements: *70341710257240
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &70337431499220 !ruby/object:Gem::Requirement
+  requirement: &70341710256380 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -65,10 +65,10 @@ dependencies:
         version: 1.6.4
   type: :development
   prerelease: false
-  version_requirements: *70337431499220
+  version_requirements: *70341710256380
 - !ruby/object:Gem::Dependency
   name: rcov
-  requirement: &70337431498520 !ruby/object:Gem::Requirement
+  requirement: &70341710255420 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,10 +76,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70337431498520
+  version_requirements: *70341710255420
 - !ruby/object:Gem::Dependency
   name: awesome_print
-  requirement: &70337431497620 !ruby/object:Gem::Requirement
+  requirement: &70341710253940 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -87,7 +87,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70337431497620
+  version_requirements: *70341710253940
 description: dump headers, sections, extract resources of win32 PE exe,dll,etc
 email: zed.0xff@gmail.com
 executables:
@@ -148,7 +148,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3050538541444126729
+      hash: 1913101081356959317
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: