Python PE类代码示例

def prob37():
	num = 0
	summ = 0
	i = 10
	while num < 11:
		# print(i)
		i += 1
		k = i
		works = True
		while k:
			if not PE.isPrime(k):
				works = False
				break
			k /= 10
		if works:	
			k = i
			while k:
				if not PE.isPrime(k):
					works = False
					break
				if k < 10:
					k = 0
				else :
					k = int(str(k)[1:])
		if works:
			print(i)
			num += 1
			summ += i
	print(summ)

def prob21():
	summ=0
	for i in range(1,10000):
		x = PE.sumDivisors(i)
		if x!= i and PE.sumDivisors(x) == i:
			summ += i
			print(i)
	print(summ)

def saveDistinctElements(C6, arraymap, indexpe) :
    """retains within  arraymay  only those elements provably
       distinct from  indexpe
    """
    akeys = arraymap.keys()
    for key in akeys :
        elempe = PE.tupleToPe(key)  # get pe-value of element-index
        # is the following good enough?  Or will we need theorem proving?
        distinct = PE.prove(C6["rels"], ["!=", elempe, indexpe])
        if not distinct :
            del arraymap[key]

def insertAppend(C6, v, e) :
    """appends  e  to the end of array/list  v  in the heap.
       Does the same actions as an insertAssign to an indexed array,
       but preserves more heap info since the append does not produce
       any aliases within v

       params : C6; v - a vartee; e - an etree
    """
    sigma = C6["store"]
    heap = C6["heap"]
    vname = v[1]
    vold = Parse.makeOldVar(v)
    if lookupType(C6, vname) != "array" :
        error("cannot append to a non-list/array")
    else :
        loc = PE.peToTuple(sigma[vname])
        length = heap[loc][0]
        newlength = PE.add(length, PE.make(1))
        vector = heap[loc][1]

        # assign original to v_old:
        sigma[vold[1]] = sigma[vname]

        # make copy for the new value of  v:
        copy = {}
        for k in vector :
            copy[k] = vector[k]
        newloc = PE.make(PE.makeSym())
        rhs = PE.evall(C6, e)
        copy[ PE.peToTuple(length) ] = rhs
        sigma[vname] = newloc
        heap[ PE.peToTuple(newloc) ] = (newlength, copy)

def safeseh(vdb, line):
    """
    Show the SafeSEH status of all the loaded DLLs or list the
    handlers for a particular dll by normalized name.

    Usage: safeseh [libname]
    """
    t = vdb.getTrace()
    libs = t.getMeta("LibraryBases")
    if len(line):
        base = libs.get(line)
        if base == None:
            vdb.vprint("Unknown library: %s" % line)
            return

        vdb.vprint("%s:" % line)

        try:
            p = PE.peFromMemoryObject(t, base)
        except Exception as e:
            vdb.vprint('Error: %s (0x%.8x) %s' % (line, base, e))
            return

        if p.IMAGE_LOAD_CONFIG != None:
            va = int(p.IMAGE_LOAD_CONFIG.SEHandlerTable)
            if va != 0:
                count = int(p.IMAGE_LOAD_CONFIG.SEHandlerCount)
                for h in t.readMemoryFormat(va, "<%dL" % count):
                    vdb.vprint("\t0x%.8x %s" % (base+h, vdb.reprPointer(base+h)))
                return
        vdb.vprint("None...")

    else:
        lnames = list(libs.keys())
        lnames.sort()
        for name in lnames:
            base = libs.get(name)
            try:
                p = PE.peFromMemoryObject(t, base)
            except Exception as e:
                vdb.vprint('Error: %s (0x%.8x) %s' % (name, base, e))
                continue

            enabled = False
            if p.IMAGE_LOAD_CONFIG != None:
                va = int(p.IMAGE_LOAD_CONFIG.SEHandlerTable)
                if va != 0:
                    enabled = True

            vdb.vprint("%16s\t%s" % (name, enabled))

def deAslr(trace, va):
    '''
    Given an address in an ASLR'd library, rebase
    it back to the address as it would be if the
    given PE were at it's suggested address...
    '''

    if vtrace.remote:
        raise Exception('deAslr only works for local debuggers!')

    map = trace.getMemoryMap(va)
    if map == None:
        return va

    mapva, mapsize, mapperm, mapfname = map
    if not mapfname:
        return va

    normname = trace.normFileName(mapfname)
    sym = trace.getSymByName(normname)
    if sym == None:
        return va

    membase = long(sym)

    pe = PE.peFromFileName(mapfname)
    filebase = pe.IMAGE_NT_HEADERS.OptionalHeader.ImageBase

    rva = va - membase

    return filebase + rva

def showaslr(vdb, base, libname):
    t = vdb.getTrace()
    try:
        p = PE.peFromMemoryObject(t, base)
    except Exception, e:
        vdb.vprint('Error: %s (0x%.8x) %s' % (libname, base, e))
        return

    def platformParseBinaryPe(self, filename, baseaddr, normname):

        # If we're on windows, fake out the PE header and use dbghelp
        if False:
            # FIXME this code is stolen and should be a function!
            import vtrace.platforms.win32 as vt_win32
            fakepe = self.readMemory(baseaddr, 1024)
            tfile = tempfile.NamedTemporaryFile(delete=False)
            tfilename = tfile.name
            import ctypes
            pebuf = ctypes.create_string_buffer(fakepe)
            try:
                try:
                    tfile.write(fakepe)
                    tfile.close()
                    #parser = vt_win32.Win32SymbolParser(-1, tfilename, baseaddr)
                    parser = vt_win32.Win32SymbolParser(-1, None, ctypes.addressof(pebuf))
                    parser.parse()
                    parser.loadSymsIntoTrace(self, normname)
                finally:
                    os.unlink(tfilename)
            except Exception as e:
                print(e)

        else:
            pe = PE.peFromMemoryObject(self, baseaddr)
            for rva, ord, name in pe.getExports():
                self.addSymbol(e_resolv.Symbol(name, baseaddr+rva, 0, normname))

 def test_export_by_ordinal_base_45(self):
     file_path = helpers.getTestPath('windows', 'i386', 'export_by_ordinal_base_45.dll')
     pe = PE.peFromFileName(file_path)
     export_list = pe.getExports()
     self.assertEquals(len(export_list), 2, "expecting 2 exported functions")
     self.assertEquals(export_list[0][1], 45, "exported function with ordinal 45 not found")
     self.assertEquals(export_list[1][1], 55, "exported function with ordinal 55 not found")

def prob46():
	n = 3
	while True:
		print(n)
		if PE.isPrime(n):
			n+=2
			continue
		found = False
		for p in range(int(math.sqrt(n)) + 1):
			if PE.isPrime(n - 2*p*p):
				found = True
				break
		if not found:
			print("soln is: " + str(n))
			return
		n+=2

 def platformParseBinary(self, filename, baseaddr, normname):
     try:
         pe = PE.peFromMemoryObject(self, baseaddr)
         for rva, ord, name in pe.getExports():
             self.addSymbol(e_resolv.Symbol(name, baseaddr + rva, 0, normname))
     except Exception, e:
         print ("Error Parsing Binary (%s): %s" % (normname, e))

def main():
    parser = optparse.OptionParser()
    parser.add_option('--version', dest='version', default=False, action='store_true')
    parser.add_option('--resources', dest='resources', default=False, action='store_true')

    opts, argv = parser.parse_args()

    for fname in argv:

        print('Parsing: %s' % fname)

        vsver = None
        expname = None

        pe = PE.peFromFileName(fname)

        if opts.resources:
            print('Type Nameid - rva size sample')
            for rtype, nameid, (rva, size, codepage) in pe.getResources():
                hexstr = pe.readAtRva(rva, max(size, 8)).encode('hex')
                print(('0x%.4x 0x%.4x - 0x%.8x 0x%.8x %s' % (rtype, nameid, rva, size, hexstr)))

        if opts.version:
            vs = pe.getVS_VERSIONINFO()
            if vs is None:
                print('No VS_VERSIONINFO found!')

            else:
                keys = vs.getVersionKeys()
                keys.sort()
                for k in keys:
                    val = vs.getVersionValue(k)
                    print('%s: %r' % (k, val))

        code.interact(local=locals())

def printIAT(trace, fileName, verbose=False):
    #print "FileName: %s" % fileName
    
    libs = trace.getMeta("LibraryPaths")
    libBase = trace.getMeta("LibraryBases")
    #print "Lib Base: %s" % libBase
    #print "File Name: %s" % fileName

    base = libBase[fileName.lower()]

    p = PE.peFromMemoryObject(trace, base)

    IMAGE_DIRECTORY_ENTRY_IMPORT          =1   # Import Directory
    IMAGE_DIRECTORY_ENTRY_IAT            =12   # Import Address Table

    idir = p.IMAGE_NT_HEADERS.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]
    poff = p.rvaToOffset(idir.VirtualAddress)
    psize = idir.Size
    # Once you have VirtualAddress BP on that and you can stop 
    # the program before any external call.
   
    p.parseImports()
    if verbose == True:
        for i in p.imports:
            print("Address: %s \tLibrary: %s \tFirstThunk: %s" % (hex(base+i[0]), i[1], i[2]))
    return base, p.imports

def insertAssign(C6, v, etree):
    """updates the store of C6  with an assignment. 
       If v already exists in C6's store, saves former value as  v_old
       for later use in proof reasoning.

       params: v - has form,  ["var", s]  or  ["index", ["var", s], etree]
               etree - another etree, to be assigned to the var.
    """
    sigma = C6["store"]
    heap = C6["heap"]
    badvars = C6["novars"]
    if v[0] == "var" : vtree = v
    elif v[0] == "index" : vtree = v[1]
    vold = Parse.makeOldVar(vtree)  # ["var", vname_old]

    # first, check if we are allowed to update  v:
    if (vtree in badvars) :
        error("you may not update a protected global var outside of its maintenance function")
        return

    # if possible, rename current value of var v  as  v_old:

    if v[0] == "var" and v[1] in sigma : # and lookupType(C6, v[1]) != "array":
        sigma[vold[1]] = sigma[v[1]]  # assign v's current value to v_old
    elif v[0] == "index" and lookupType(C6, v[1][1]) == "array":
        vname = v[1][1]
        loc = PE.peToTuple(sigma[vname])
        length = heap[loc][0]
        vector = heap[loc][1]
        # make copy:
        copy = {}
        for k in vector :
            copy[k] = vector[k]
        # assign original to v_old and copy to v :
        sigma[vold[1]] = sigma[vname]
        newloc = PE.make(PE.makeSym())
        sigma[vname] = newloc
        heap[ PE.peToTuple(newloc) ] = (length, copy)

    # (later,  vold  will be erased from  sigma....)
    # now, eval assignment's  rhs  and store it into  v:
    rhs = PE.evall(C6, etree)

    if v[0] == "var":  # simple var
            sigma[v[1]] = rhs
    elif v[0] == "index":   # an array/list reference
        # eval  index  expression (NOTE: no nested indexing allowed):
        indexpe = PE.evall(C6, v[2])
        # save values in sigma[vname][1] provably distinct from  vname[index]:
        vname = v[1][1]
        if vname not in sigma or lookupType(C6, vname) != "array" :
            error(vname + " is not an array in the store")
            #sigma[vname] = PE.makeArray()
        else :
            vmap = heap[PE.peToTuple(sigma[vname])][1]
            saveDistinctElements(C6, vmap, indexpe)
            vmap[PE.peToTuple(indexpe)] = rhs

def showaslr(vdb, base, libname):
    t = vdb.getTrace()
    p = PE.peFromMemoryObject(t, base)
    enabled = False
    c = p.IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics
    if c & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE:
        enabled = True
    vdb.vprint("%16s\t%s" % (libname, enabled))