././@PaxHeader0000000000000000000000000000003400000000000011452 xustar000000000000000028 mtime=1581287915.7058043 filebytes-0.10.2/0000755000175000017500000000000000000000000013477 5ustar00sashsash00000000000000././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1554495171.0 filebytes-0.10.2/COPYING0000644000175000017500000000266400000000000014542 0ustar00sashsash00000000000000Copyright 2018 Sascha Schirra Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" A ND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ././@PaxHeader0000000000000000000000000000003400000000000011452 xustar000000000000000028 mtime=1581287915.7058043 filebytes-0.10.2/PKG-INFO0000644000175000017500000000116100000000000014573 0ustar00sashsash00000000000000Metadata-Version: 1.1 Name: filebytes Version: 0.10.2 Summary: Scripts to parse the following file formats - Executable and Linking Format (ELF), Portable Executable (PE), Mach-O and OAT (Android Runtime). Home-page: https://scoding.de/filebytes-introduction/ Author: Sascha Schirra Author-email: sashs@scoding.de License: BSD-3-Clause Description: UNKNOWN Platform: UNKNOWN Classifier: Topic :: Security Classifier: Environment :: Console Classifier: Operating System :: OS Independent Classifier: License :: OSI Approved :: BSD License Classifier: Programming Language :: Python Classifier: Intended Audience :: Developers ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1528747978.0 filebytes-0.10.2/README.md0000644000175000017500000000361400000000000014762 0ustar00sashsash00000000000000FileBytes ================ Classes/Types to read and edit the following file formats: - Executable and Linking Format (ELF), - Portable Executable (PE) and - MachO - OAT (Android Runtime) Install ------- Install FileBytes $ python setup.py install Or install with PyPi $ pip install filebytes Samples ------- Parsing ELF file ```python from filebytes.elf import * elf_file = ELF('test-binaries/ls-x86') elf_header = elf_file.elfHeader sections = elf_file.sections segments = elf_file.segments # elf_file.programHeaders does the same ``` Parsing PE file ```python from filebytes.pe import * pe_file = PE('test-binaries/cmd-x86.exe') image_dos_header = pe_file.imageDosHeader image_nt_headers = pe_file.imageNtHeaders sections = pe_file.sections data_directory = pe_file.dataDirectory import_directory = data_directory[ImageDirectoryEntry.IMPORT] export_directory = data_directory[ImageDirectoryEntry.EXPORT] ``` Parsing MachO file ```python from filebytes.mach_o import * macho_file = MachO('test-binaries/ls-macho-x86_64') mach_header = macho_file.machHeader load_commands = macho_file.loadCommands ``` Parsing OAT file, read DEX files and save them ```python from filebytes.oat import * oat = OAT('test-binaries/boot.oat') for odh in oat.oatDexHeader: name = odh.name.split('/')[-1] with open(name, 'wb') as dex: dex.write(odh.dexBytes) ``` For further samples look at the sample folder. Contributions ---------------------- If you would like contribute, here some ideas: - Implementation of parsing of missing LoadCommand types for MachO files - Implementation of parsing of the missing section types for ELF files - Implementation of parsing of the missing data directory fields for PE files But any kind of contribution is welcome. :) Project page & Examples ------------------------------------ - https://scoding.de/filebytes-introduction - https://scoding.de/filebytes-edit-files ././@PaxHeader0000000000000000000000000000003400000000000011452 xustar000000000000000028 mtime=1581287915.7058043 filebytes-0.10.2/filebytes/0000755000175000017500000000000000000000000015465 5ustar00sashsash00000000000000././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1581287825.0 filebytes-0.10.2/filebytes/__init__.py0000644000175000017500000000304700000000000017602 0ustar00sashsash00000000000000# coding=utf-8 # Copyright 2018 Sascha Schirra # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of the copyright holder nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" A ND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. __all__ = ['elf','pe','mach_o'] VERSION = '0.10.2' ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1581287676.0 filebytes-0.10.2/filebytes/binary.py0000644000175000017500000000655300000000000017334 0ustar00sashsash00000000000000# coding=utf-8 # Copyright 2018 Sascha Schirra # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of the copyright holder nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" A ND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. from .ctypes_helper import * from struct import pack_into from ctypes import * class Container(object): def __init__(self, **args): setattr = super(Container, self).__setattr__ for key, value in args.items(): setattr(key, value) class Binary(object): def __init__(self, fileName, fileContent=None): if fileContent: if type(fileContent) == bytes: fileContent = to_ubyte_array(fileContent) self._bytes = fileContent else: self._bytes = self._readFile(fileName) if not self.__class__.isSupportedContent(self._bytes): raise BinaryError('Not a suitable filetype') self.__fileName = fileName @property def fileName(self): """ Returns the filename """ return self.__fileName @property def entryPoint(self): return 0x0 @property def imageBase(self): return 0x0 @property def type(self): return 'ELF' def _readFile(self, fileName): """ Returns the bytes of the file. """ with open(fileName, 'rb') as binFile: b = binFile.read() return to_ubyte_array(b) def assertFileRange(self, value): if type(value) == c_void_p: value = value.value file_data_pointer = get_ptr(self._bytes) assert value >= (file_data_pointer.value) and value <= ( file_data_pointer.value + len(self._bytes)), 'Pointer not in file range' @classmethod def isSupportedFile(cls, fileName): try: with open(fileName, 'rb') as f: return cls.isSupportedContent(f.read()) except BaseException as e: raise BinaryError(e) @classmethod def isSupportedContent(cls, fileContent): return False class BinaryError(BaseException): pass ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1554495171.0 filebytes-0.10.2/filebytes/ctypes_helper.py0000644000175000017500000000425200000000000020710 0ustar00sashsash00000000000000# coding=utf-8 # Copyright 2018 Sascha Schirra # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of the copyright holder nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" A ND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. from struct import pack_into import ctypes def get_ptr(data, offset=None, ptr_type=ctypes.c_void_p): """Returns a void pointer to the data""" ptr = ctypes.cast(ctypes.pointer(data), ctypes.c_void_p) if offset: ptr = ctypes.c_void_p(ptr.value + offset) if ptr_type != ctypes.c_void_p: ptr = ctypes.cast(ptr, ptr_type) return ptr def get_str(data, offset=None): return get_ptr(data, offset, ctypes.c_char_p).value.decode('ASCII') def to_ubyte_array(barray): """Returns a c_ubyte_array filled with the given data of a bytearray or bytes""" bs = (ctypes.c_ubyte * len(barray))() pack_into('%ds' % len(barray), bs, 0, barray) return bs ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1554495384.0 filebytes-0.10.2/filebytes/elf.py0000644000175000017500000006473500000000000016624 0ustar00sashsash00000000000000# coding=utf-8 # Copyright 2018 Sascha Schirra # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of the copyright holder nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" A ND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. from .enum import Enum from .binary import * ####################### Constants ############################ class ET(Enum): NONE = 0x0 REL = 0x1 EXEC = 0x2 DYN = 0x3 CORE = 0x4 LOOS = 0xfe00 HIOS = 0xfeff LOPROC = 0xff00 HIPROC = 0xffff class EM(Enum): NONE = 0 # No machine M32 = 1 # AT&T WE 32100 SPARC = 2 # SPARC INTEL_386 = 3 # Intel 80386 MOTOROLA_68k = 4 # Motorola 68000 MOTOROLA_88K = 5 # Motorola 88000 INTEL_80860 = 7 # Intel 80860 MIPS = 8 # MIPS RS3000 S370 = 9 MIPS_RS3_LE = 10 PARISC = 15 VPP500 = 17 SPARC32PLUS = 18 INTEL_80960 = 19 PPC = 20 PPC64 = 21 S390 = 22 V800 = 36 FR20 = 37 RH32 = 38 RCE = 39 ARM = 40 FAKE_ALPHA = 41 SH = 42 SPARCV9 = 43 TRICORE = 44 ARC = 45 H8_300 = 46 H8_300H = 47 H8S = 48 H8_500 = 49 IA_64 = 50 MIPS_X = 51 COLDFIRE = 52 MOTOROLA_68HC12 = 53 MMA = 54 PCP = 55 NCPU = 56 NDR1 = 57 STARCORE = 58 ME16 = 59 ST100 = 60 TINYJ = 61 X86_64 = 62 FX66 = 66 ST9PLUS = 67 ST7 = 68 MOTOROLA_68HC16 = 69 MOTOROLA_68HC11 = 70 MOTOROLA_68HC08 = 71 MOTOROLA_68HC05 = 72 SVX = 73 ST19 = 74 VAX = 75 CRIS = 76 JAVELIN = 77 FIREPATH = 78 ZSP = 79 MMIX = 80 HUANY = 81 PRISM = 82 AVR = 83 FR30 = 84 D10V = 85 D30V = 86 V850 = 87 M32R = 88 MN10300 = 89 MN10200 = 90 PJ = 91 OPENRISC = 92 ARC_A5 = 93 XTENSA = 94 NUM = 95 ARM64 = 183 class EI(Enum): MAG0 = 0x0 MAG1 = 0x1 MAG2 = 0x2 MAG3 = 0x3 CLASS = 0x4 DATA = 0x5 VERSION = 0x6 OSABI = 0x7 ABIVERSION = 0x8 PAD = 0x9 NIDENT = 0xf class ELFOSABI(Enum): SYSV = 0 HPUX = 1 STANDALONE = 255 class ELFCLASS(Enum): NONE = 0 BITS_32 = 1 BITS_64 = 2 class ELFDATA(Enum): NONE = 0 LSB = 1 MSB = 2 class SHN(Enum): UNDEF = 0 LOPROC = 0xff00 HIPROC = 0xff1f LOOS = 0xff20 HIOS = 0xff3f ABS = 0xfff1 COMMON = 0xfff2 HIRESERVE = 0xffff class SHF(Enum): WRITE = 0x1 ALLOC = 0x2 EXECINSTR = 0x4 MASKPROC = 0xf0000000 class SHT(Enum): NULL = 0x0 PROGBITS = 0x1 SYMTAB = 0x2 STRTAB = 0x3 RELA = 0x4 HASH = 0x5 DYNAMIC = 0x6 NOTE = 0x7 NOBITS = 0x8 REL = 0x9 SHLIB = 0xa DYNSYM = 0xb INIT_ARRAY = 0xe FINI_ARRAY = 0xf PREINIT_ARRAY = 0x10 GROUP = 0x11 SYMTAB_SHNDX = 0x12 NUM = 0x13 LOOS = 0x60000000 GNU_HASH = 0x6ffffff6 GNU_LIBLIST = 0x6ffffff7 CHECKSUM = 0x6ffffff8 LOSUNW = 0x6ffffffa SUNW_COMDAT = 0x6ffffffb SUNW_syminfo = 0x6ffffffc GNU_verdef = 0x6ffffffd GNU_verneed = 0x6ffffffe HIOS = 0x6fffffff LOPROC = 0x70000000 HIPROC = 0x7fffffff LOUSER = 0x80000000 HIUSER = 0x8fffffff class STT(Enum): NOTYPE = 0 OBJECT = 1 FUNC = 2 SECTION = 3 FILE = 4 COMMON = 5 TLS = 6 NUM = 7 LOOS = 10 HIOS = 12 LOPROC = 13 HIPROC = 15 class STB(Enum): LOCAL = 0 GLOBAL = 1 WEAK = 2 NUM = 3 LOOS = 10 HIOS = 12 LOPROC = 13 HIPROC = 15 class STV(Enum): DEFAULT = 0 INTERNAL = 1 HIDDEN = 2 PROTECTED = 3 EXPORTED = 4 SINGLETON = 5 ELIMINATE = 6 class PT(Enum): NULL = 0 LOAD = 1 DYNAMIC = 2 INTERP = 3 NOTE = 4 SHLIB = 5 PHDR = 6 TLS = 7 NUM = 8 LOPROC = 0x70000000 HIPROC = 0x7fffffff GNU_EH_FRAME = 0x6474e550 GNU_STACK = 0x6474e551 GNU_RELRO = 0x6474e552 class R_386(Enum): NONE = 0 R_32 = 1 PC32 = 2 GOT32 = 3 PLT32 = 4 COPY = 5 GLOB_DAT = 6 JMP_SLOT = 7 RELATIVE = 8 GOTOFF = 9 GOTPC = 10 TLS_TPOFF = 14 TLS_IE = 15 TLS_GOTIE = 16 TLS_LE = 17 TLS_GD = 18 TLS_LDM = 19 R16 = 20 PC16 = 21 R8 = 22 PC8 = 23 TLS_GD_32 = 24 TLS_GD_PUSH = 25 TLS_GD_CALL = 26 TLS_GD_POP = 27 TLS_LDM_32 = 28 TLS_LDM_PUSH = 29 TLS_LDM_CALL = 30 TLS_LDM_POP = 31 TLS_LDO_32 = 32 TLS_IE_32 = 33 TLS_LE_32 = 34 TLS_DTPMOD32 = 35 TLS_DTPOFF32 = 36 TLS_TPOFF32 = 37 NUM = 38 class PF(Enum): READ = 4 WRITE = 2 EXEC = 1 def shortString(self, perm): toReturn = '' toReturn += 'R' if perm & int(self.READ) > 0 else ' ' toReturn += 'W' if perm & int(self.WRITE) > 0 else ' ' toReturn += 'E' if perm & int(self.EXEC) > 0 else ' ' return toReturn class DT(Enum): NULL = 0 NEEDED = 1 PLTRELSZ = 2 PLTGOT = 3 HASH = 4 STRTAB = 5 SYMTAB = 6 RELA = 7 RELASZ = 8 RELAENT = 9 STRSZ = 10 SYMENT = 11 INIT = 12 FINI = 13 SONAME = 14 RPATH = 15 SYMBOLIC = 16 REL = 17 RELSZ = 18 RELENT = 19 PLTREL = 20 DEBUG = 21 TEXTREL = 22 JMPREL = 23 BIND_NOW = 24 INIT_ARRAY = 25 FINI_ARRAY = 26 INIT_ARRAYSZ = 27 FINI_ARRAYSZ = 28 RUNPATH = 29 FLAGS = 30 ENCODING = 31 PREINIT_ARRAY = 32 PREINIT_ARRAYSZ = 33 MAXPOSTAGS = 34 LOOS = 0x6000000d #SUNW_AUXILIARY = 0x6000000d SUNW_RTLDINF = 0x6000000e #SUNW_FILTER = 0x6000000e SUNW_CAP = 0x60000010 SUNW_SYMTAB = 0x60000011 SUNW_SYMSZ = 0x60000012 SUNW_ENCODING = 0x60000013 #SUNW_SORTENT = 0x60000013 SUNW_SYMSORT = 0x60000014 SUNW_SYMSORTSZ = 0x60000015 SUNW_TLSSORT = 0x60000016 SUNW_TLSSORTSZ = 0x60000017 SUNW_CAPINFO = 0x60000018 SUNW_STRPAD = 0x60000019 SUNW_CAPCHAIN = 0x6000001a SUNW_LDMACH = 0x6000001b SUNW_CAPCHAINENT = 0x6000001d SUNW_CAPCHAINSZ = 0x6000001f HIOS = 0x6ffff000 VALRNGLO = 0x6ffffd00 CHECKSUM = 0x6ffffdf8 PLTPADSZ = 0x6ffffdf9 MOVEENT = 0x6ffffdfa MOVESZ = 0x6ffffdfb POSFLAG_1 = 0x6ffffdfd SYMINSZ = 0x6ffffdfe SYMINENT = 0x6ffffdff #VALRNGHI = 0x6ffffdff ADDRRNGLO = 0x6ffffe00 GNU_HASH = 0x6ffffef5 TLSDESC_PLT = 0x6ffffef6 TLSDESC_GOT = 0x6ffffef7 GNU_CONFLICT = 0x6ffffef8 GNU_LIBLIST = 0x6ffffef9 CONFIG = 0x6ffffefa DEPAUDIT = 0x6ffffefb AUDIT = 0x6ffffefc PLTPAD = 0x6ffffefd MOVETAB = 0x6ffffefe SYMINFO = 0x6ffffeff #ADDRRNGHI = 0x6ffffeff VERSYM = 0x6ffffff0 RELACOUNT = 0x6ffffff9 RELCOUNT = 0x6ffffffa FLAGS_1 = 0x6ffffffb VERDEF = 0x6ffffffc VERDEFNUM = 0x6ffffffd VERNEED = 0x6ffffffe VERNEEDNUM = 0x6fffffff LOPROC = 0x70000000 SPARC_REGISTER = 0x70000001 AUXILIARY = 0x7ffffffd USED = 0x7ffffffe #FILTER = 0x7fffffff HIPROC = 0x7fffffff ########################### LSB 32 BIT Structures ########################### LSB_32_R_SYM = lambda i: i >> 8 LSB_32_R_TYPE = lambda i: i & 0xff class LSB_32_EHDR(LittleEndianStructure): _fields_ = [('e_ident', c_ubyte * 16), ('e_type', c_ushort), ('e_machine', c_ushort), ('e_version', c_uint), ('e_entry', c_uint), ('e_phoff', c_uint), ('e_shoff', c_uint), ('e_flags', c_uint), ('e_ehsize', c_ushort), ('e_phentsize', c_ushort), ('e_phnum', c_ushort), ('e_shentsize', c_ushort), ('e_shnum', c_ushort), ('e_shstrndx', c_ushort)] class LSB_32_SHDR(LittleEndianStructure): _fields_ = [('sh_name', c_uint), ('sh_type', c_uint), ('sh_flags', c_uint), ('sh_addr', c_uint), ('sh_offset', c_uint), ('sh_size', c_uint), ('sh_link', c_uint), ('sh_info', c_uint), ('sh_addralign', c_uint), ('sh_entsize', c_uint) ] class LSB_32_SYM(LittleEndianStructure): _fields_ = [('st_name', c_uint), ('st_value', c_uint), ('st_size', c_uint), ('st_info', c_ubyte), ('st_other', c_ubyte), ('st_shndx', c_ushort) ] class LSB_32_REL(LittleEndianStructure): _fields_ = [('r_offset', c_uint), ('r_info', c_uint)] class LSB_32_RELA(LittleEndianStructure): _fields_ = [('r_offset', c_uint), ('r_info', c_uint), ('r_addend', c_int) ] class LSB_32_PHDR(LittleEndianStructure): _fields_ = [('p_type', c_uint), ('p_offset', c_uint), ('p_vaddr', c_uint), ('p_paddr', c_uint), ('p_filesz', c_uint), ('p_memsz', c_uint), ('p_flags', c_uint), ('p_align', c_uint) ] class LSB_32_DYN(LittleEndianStructure): _fields_ = [('d_tag', c_uint), ('d_un', c_uint) ] class LSB_32(): PHDR = LSB_32_PHDR EHDR = LSB_32_EHDR SHDR = LSB_32_SHDR REL = LSB_32_REL RELA = LSB_32_RELA SYM = LSB_32_SYM DYN = LSB_32_DYN R_SYM = staticmethod(LSB_32_R_SYM) R_TYPE = staticmethod(LSB_32_R_TYPE) ########################### MSB 32 BIT Structures ########################### MSB_32_R_SYM = lambda i: i >> 8 MSB_32_R_TYPE = lambda i: i & 0xff class MSB_32_EHDR(BigEndianStructure): _fields_ = [('e_ident', c_ubyte * 16), ('e_type', c_ushort), ('e_machine', c_ushort), ('e_version', c_uint), ('e_entry', c_uint), ('e_phoff', c_uint), ('e_shoff', c_uint), ('e_flags', c_uint), ('e_ehsize', c_ushort), ('e_phentsize', c_ushort), ('e_phnum', c_ushort), ('e_shentsize', c_ushort), ('e_shnum', c_ushort), ('e_shstrndx', c_ushort)] class MSB_32_SHDR(BigEndianStructure): _fields_ = [('sh_name', c_uint), ('sh_type', c_uint), ('sh_flags', c_uint), ('sh_addr', c_uint), ('sh_offset', c_uint), ('sh_size', c_uint), ('sh_link', c_uint), ('sh_info', c_uint), ('sh_addralign', c_uint), ('sh_entsize', c_uint) ] class MSB_32_SYM(BigEndianStructure): _fields_ = [('st_name', c_uint), ('st_value', c_uint), ('st_size', c_uint), ('st_info', c_ubyte), ('st_other', c_ubyte), ('st_shndx', c_ushort) ] class MSB_32_REL(BigEndianStructure): _fields_ = [('r_offset', c_uint), ('r_info', c_uint)] class MSB_32_RELA(BigEndianStructure): _fields_ = [('r_offset', c_uint), ('r_info', c_uint), ('r_addend', c_int) ] class MSB_32_PHDR(BigEndianStructure): _fields_ = [('p_type', c_uint), ('p_offset', c_uint), ('p_vaddr', c_uint), ('p_paddr', c_uint), ('p_filesz', c_uint), ('p_memsz', c_uint), ('p_flags', c_uint), ('p_align', c_uint) ] class MSB_32_DYN(BigEndianStructure): _fields_ = [('d_tag', c_uint), ('d_un', c_uint) ] class MSB_32(): PHDR = MSB_32_PHDR EHDR = MSB_32_EHDR SHDR = MSB_32_SHDR REL = MSB_32_REL RELA = MSB_32_RELA SYM = MSB_32_SYM DYN = MSB_32_DYN R_SYM = staticmethod(MSB_32_R_SYM) R_TYPE = staticmethod(MSB_32_R_TYPE) ########################### 64 BIT Types ########################### Elf64_Addr = c_ulonglong Elf64_Off = c_ulonglong Elf64_Half = c_ushort Elf64_Word = c_uint Elf64_Sword = c_int Elf64_Xword = c_ulonglong Elf64_Sxword = c_longlong uchar = c_ubyte ########################### LSB 64 BIT Structures ########################### LSB_64_R_SYM = lambda i: i >> 32 LSB_64_R_TYPE = lambda i: i & 0xffffffff class LSB_64_EHDR(LittleEndianStructure): _fields_ = [('e_ident', uchar * 16), ('e_type', Elf64_Half), ('e_machine', Elf64_Half), ('e_version', Elf64_Word), ('e_entry', Elf64_Addr), ('e_phoff', Elf64_Off), ('e_shoff', Elf64_Off), ('e_flags', Elf64_Word), ('e_ehsize', Elf64_Half), ('e_phentsize', Elf64_Half), ('e_phnum', Elf64_Half), ('e_shentsize', Elf64_Half), ('e_shnum', Elf64_Half), ('e_shstrndx', Elf64_Half) ] class LSB_64_SHDR(LittleEndianStructure): _fields_ = [('sh_name', Elf64_Word), ('sh_type', Elf64_Word), ('sh_flags', Elf64_Xword), ('sh_addr', Elf64_Addr), ('sh_offset', Elf64_Off), ('sh_size', Elf64_Xword), ('sh_link', Elf64_Word), ('sh_info', Elf64_Word), ('sh_addralign', Elf64_Xword), ('sh_entsize', Elf64_Xword) ] class LSB_64_SYM(LittleEndianStructure): _fields_ = [('st_name', Elf64_Word), ('st_info', uchar), ('st_other', uchar), ('st_shndx', Elf64_Half), ('st_value', Elf64_Addr), ('st_size', Elf64_Xword) ] class LSB_64_REL(LittleEndianStructure): _fields_ = [('r_offset', Elf64_Addr), ('r_info', Elf64_Xword)] class LSB_64_RELA(LittleEndianStructure): _fields_ = [('r_offset', Elf64_Addr), ('r_info', Elf64_Xword), ('r_addend', Elf64_Sxword) ] class LSB_64_PHDR(LittleEndianStructure): _fields_ = [('p_type', Elf64_Word), ('p_flags', Elf64_Word), ('p_offset', Elf64_Off), ('p_vaddr', Elf64_Addr), ('p_paddr', Elf64_Addr), ('p_filesz', Elf64_Xword), ('p_memsz', Elf64_Xword), ('p_align', Elf64_Xword) ] class LSB_64_DYN(LittleEndianStructure): _fields_ = [('d_tag', Elf64_Xword), ('d_un', Elf64_Xword) ] class LSB_64(): PHDR = LSB_64_PHDR EHDR = LSB_64_EHDR SHDR = LSB_64_SHDR REL = LSB_64_REL RELA = LSB_64_RELA SYM = LSB_64_SYM DYN = LSB_64_DYN R_SYM = staticmethod(LSB_64_R_SYM) R_TYPE = staticmethod(LSB_64_R_TYPE) ########################### MSB 64 BIT Structures ########################### MSB_64_R_SYM = lambda i: i >> 32 MSB_64_R_TYPE = lambda i: i & 0xffffffff class MSB_64_EHDR(BigEndianStructure): _fields_ = [('e_ident', uchar * 16), ('e_type', Elf64_Half), ('e_machine', Elf64_Half), ('e_version', Elf64_Word), ('e_entry', Elf64_Addr), ('e_phoff', Elf64_Off), ('e_shoff', Elf64_Off), ('e_flags', Elf64_Word), ('e_ehsize', Elf64_Half), ('e_phentsize', Elf64_Half), ('e_phnum', Elf64_Half), ('e_shentsize', Elf64_Half), ('e_shnum', Elf64_Half), ('e_shstrndx', Elf64_Half) ] class MSB_64_SHDR(BigEndianStructure): _fields_ = [('sh_name', Elf64_Word), ('sh_type', Elf64_Word), ('sh_flags', Elf64_Xword), ('sh_addr', Elf64_Addr), ('sh_offset', Elf64_Off), ('sh_size', Elf64_Xword), ('sh_link', Elf64_Word), ('sh_info', Elf64_Word), ('sh_addralign', Elf64_Xword), ('sh_entsize', Elf64_Xword) ] class MSB_64_SYM(BigEndianStructure): _fields_ = [('st_name', Elf64_Word), ('st_info', uchar), ('st_other', uchar), ('st_shndx', Elf64_Half), ('st_value', Elf64_Addr), ('st_size', Elf64_Xword) ] class MSB_64_REL(BigEndianStructure): _fields_ = [('r_offset', Elf64_Addr), ('r_info', Elf64_Xword)] class MSB_64_RELA(BigEndianStructure): _fields_ = [('r_offset', Elf64_Addr), ('r_info', Elf64_Xword), ('r_addend', Elf64_Sxword) ] class MSB_64_PHDR(BigEndianStructure): _fields_ = [('p_type', Elf64_Word), ('p_flags', Elf64_Word), ('p_offset', Elf64_Off), ('p_vaddr', Elf64_Addr), ('p_paddr', Elf64_Addr), ('p_filesz', Elf64_Xword), ('p_memsz', Elf64_Xword), ('p_align', Elf64_Xword) ] class MSB_64_DYN(BigEndianStructure): _fields_ = [('d_tag', Elf64_Xword), ('d_un', Elf64_Xword) ] class MSB_64(): PHDR = MSB_64_PHDR EHDR = MSB_64_EHDR SHDR = MSB_64_SHDR REL = MSB_64_REL RELA = MSB_64_RELA SYM = MSB_64_SYM DYN = MSB_64_DYN R_SYM = staticmethod(MSB_64_R_SYM) R_TYPE = staticmethod(MSB_64_R_TYPE) ################################ ELF File Implementation ######################################### class EhdrData(Container): """ header = SectionHeader """ class ShdrData(Container): """ header = SectionHeader name = string (section name) bytes = bytearray (section bytes) raw = c_ubyte_array .dynamic content = List of DYN entries .rel & .rela relocations = list of REL or RELA .dynsym & .symtab symbols = list of SYM entries """ class PhdrData(Container): """ type = Programm Header Type header = ProgrammHeader bytes = bytearray (section bytes) raw = c_ubyte_array vaddr = virtual address (int) offset = offset """ class SymbolData(Container): """ header = Symbol name = string type = int bind = bind """ class RelocationData(Container): """ header = RelocationStruct symbol = SymbolData type = type of relocation """ class DynamicData(Container): """ header = DYN tag = value of class DT """ ##################### ELF Class ############################## class ELF(Binary): def __init__(self, fileName, fileContent=None): super(ELF, self).__init__(fileName, fileContent) self.__classes = self._getSuitableClasses(self._bytes) if not self.__classes: raise BinaryError('Bad architecture') self.__elfHeader = self._parseElfHeader(self._bytes) self.__segments = self._parseSegments(self._bytes, self.elfHeader) self.__sections = self._parseSections(self._bytes, self.elfHeader) self._parseSymbols(self.sections) self._parseDynamic(self.sections) self._parseRelocations(self.sections) @property def _classes(self): return self.__classes @property def elfHeader(self): return self.__elfHeader @property def sections(self): return list(self.__sections) @property def segments(self): return list(self.__segments) @property def programHeaders(self): return list(self.__segments) @property def entryPoint(self): return self.elfHeader.header.e_entry @property def imageBase(self): return self.segments[0].header.p_vaddr - self.segments[0].header.p_offset if len(self.segments) > 0 else 0 def _getSuitableClasses(self, data): """Returns the class which holds the suitable classes for the loaded file""" classes = None if data[EI.CLASS] == ELFCLASS.BITS_32: if data[EI.DATA] == ELFDATA.LSB: classes = LSB_32 elif data[EI.DATA] == ELFDATA.MSB: classes = MSB_32 elif data[EI.CLASS] == ELFCLASS.BITS_64: if data[EI.DATA] == ELFDATA.LSB: classes = LSB_64 elif data[EI.DATA] == ELFDATA.MSB: classes = MSB_64 return classes def _parseElfHeader(self, data): """Returns the elf header""" ehdr = self.__classes.EHDR.from_buffer(data) return EhdrData(header=ehdr) def _parseSegments(self, data, elfHeader): """Return a list of segments""" offset = elfHeader.header.e_phoff segments = [] for i in range(elfHeader.header.e_phnum): phdr = self.__classes.PHDR.from_buffer(data, offset) segment_bytes = (c_ubyte * phdr.p_filesz).from_buffer(data, phdr.p_offset) phdrData = PhdrData(header=phdr, raw=segment_bytes, bytes=bytearray(segment_bytes), type=PT[phdr.p_type], vaddr=phdr.p_vaddr, offset=phdr.p_offset) segments.append(phdrData) offset += elfHeader.header.e_phentsize return segments def _parseSections(self, data, elfHeader): """Returns a list of sections""" offset = elfHeader.header.e_shoff shdrs = [] for i in range(elfHeader.header.e_shnum): shdr = self.__classes.SHDR.from_buffer(data, offset) section_bytes = None ba_section_bytes = None if shdr.sh_type != SHT.NOBITS: section_bytes = (c_ubyte * shdr.sh_size).from_buffer(data, shdr.sh_offset) ba_section_bytes = bytearray(section_bytes) shdrs.append(ShdrData(name=None,header=shdr, raw=section_bytes, bytes=ba_section_bytes)) offset += elfHeader.header.e_shentsize if elfHeader.header.e_shstrndx != SHN.UNDEF: strtab = shdrs[elfHeader.header.e_shstrndx] strtab_offset = strtab.header.sh_offset for section in shdrs: section.name = get_str(strtab.raw, section.header.sh_name) return shdrs def _parseSymbols(self, sections): """Sets a list of symbols in each DYNSYM and SYMTAB section""" for section in sections: strtab = sections[section.header.sh_link] if section.header.sh_type in (int(SHT.DYNSYM), int(SHT.SYMTAB)): section.symbols = self.__parseSymbolEntriesForSection(section, strtab) def __parseSymbolEntriesForSection(self, section, strtab): entries = [] offset = 0 bytes_p = cast(pointer(section.raw), c_void_p) sym_size = sizeof(self.__classes.SYM) for i in range(int(section.header.sh_size / sym_size)): entry = self.__classes.SYM.from_buffer(section.raw, offset) name = get_str(strtab.raw, entry.st_name) sym_data = SymbolData(header=entry, name=name, type=entry.st_info & 0xf, bind=entry.st_info >> 4) entries.append(sym_data) offset += sym_size return entries def _parseRelocations(self, sections): """Parses the relocations and add those to the section""" for section in sections: if section.header.sh_link != SHN.UNDEF and section.header.sh_type in (SHT.REL, SHT.RELA): symbols = sections[section.header.sh_link].symbols relocations = self.__parseRelocationEntries(section, symbols) section.relocations = relocations def __parseRelocationEntries(self, section, symbols): struct = self.__classes.REL if section.header.sh_type == SHT.REL else self.__classes.RELA struct_size = sizeof(struct) offset = 0 entries = [] for i in range(int(section.header.sh_size / struct_size)): entry = struct.from_buffer(section.raw, offset) sym = symbols[self.__classes.R_SYM(entry.r_info)] reloc_entry = RelocationData(header=entry, symbol=sym, type=self.__classes.R_TYPE(entry.r_info)) entries.append(reloc_entry) offset += sizeof(struct) return entries def _parseDynamic(self, sections): dyn_size = sizeof(self._classes.DYN) for section in sections: offset = 0 dyns = [] if section.header.sh_type == SHT.DYNAMIC: for i in range(int(len(section.bytes) / dyn_size)): dyn = self._classes.DYN.from_buffer(section.raw, offset) dyns.append(DynamicData(header=dyn, tag=DT[dyn.d_tag])) if dyn.d_tag == DT.NULL: break offset += dyn_size section.content = dyns self._parseDynamicTags(dyns, sections) def _parseDynamicTags(self, dyns, sections): for dyn in dyns: if dyn.header.d_tag == DT.NEEDED: self.__parseDynamicTagNeeded(dyn, dyns, sections) def __parseDynamicTagNeeded(self, dyn, dyns, sections): dyn_strtab = None for d in dyns: if d.header.d_tag == DT.STRTAB: dyn_strtab = d if not dyn_strtab: return for section in sections: if section.header.sh_addr == dyn_strtab.header.d_un: dyn.val = get_str(section.raw, dyn.header.d_un) break @classmethod def isSupportedContent(cls, fileContent): """Returns if the files are valid for this filetype""" return bytearray(fileContent)[:4] == b'\x7fELF' ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1554495171.0 filebytes-0.10.2/filebytes/enum.py0000644000175000017500000001666100000000000017015 0ustar00sashsash00000000000000# coding=utf-8 # Copyright 2018 Sascha Schirra # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of the copyright holder nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" A ND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. from re import match from sys import version_info import types if version_info.major > 2: long = int class EnumError(BaseException): def __init__(self, msg): super(EnumError, self).__init__(msg) class EnumElement(object): def __init__(self, name, value, enum): super(EnumElement, self).__init__() self.__name = name self.__value = value self.__enum = enum @property def name(self): return self.__name @property def value(self): return self.__value @property def _enum(self): return self.__enum def __str__(self): return self.__name def __index__(self): return self.__value def __hash__(self): return hash((self,)) @property def value(self): return self.__value @property def name(self): return self.__name class IntEnumElement(EnumElement): def __hash__(self): return hash(self.value) def __cmp__(self, other): if isinstance(other, EnumElement): return self.value - other.value elif isinstance(other, int) or isinstance(other, long): return self.value - other else: return 1 def __lt__(self, other): return self.__cmp__(other) < 0 def __le__(self, other): return self.__cmp__(other) <= 0 def __eq__(self, other): return self.__cmp__(other) == 0 def __ge__(self, other): return self.__cmp__(other) >= 0 def __gt__(self, other): return self.__cmp__(other) > 0 def __and__(self, other): if isinstance(other, int) or isinstance(other, long): return self.value & other elif isinstance(other, EnumElement): return self.value & other.value raise TypeError('This operation is not supported for type ' % type(other)) def __rand__(self, other): if isinstance(other, int) or isinstance(other, long): return self.value & other elif isinstance(other, EnumElement): return self.value & other.value raise TypeError('This operation is not supported for type ' % type(other)) def __or__(self, other): if isinstance(other, int) or isinstance(other, long): return self.value | other elif isinstance(other, EnumElement) : return self.value | other.value raise TypeError('This operation is not supported for type ' % type(other)) def __ror__(self, other): if isinstance(other, int) or isinstance(other, long): return self.value | other elif isinstance(other, EnumElement): return self.value | other.value raise TypeError('This operation is not supported for type ' % type(other)) def __invert__(self): return ~self.value def __int__(self): return self.value class EnumIterator(object): def __init__(self, enumData): self.__enumData = enumData self.__index = 0 def next(self): if self.__index < len(self.__enumData): data = self.__enumData[self.__index] self.__index += 1 return data raise StopIteration class EnumMeta(type): def __new__(cls, name, bases, dct): def update(key, value): if value in values: raise EnumError('No aliases allowed: '+key+' and '+str(revData[value])) if isinstance(value, types.FunctionType): dct[key] = classmethod(value) return values.append(value) if isinstance(value, int) or isinstance(value, long): element = IntEnumElement(key, value, name) else: element = EnumElement(key, value, name) revData[value] = element valueData.append(element) dct[key] = element revData = {} valueData = [] values = [] for key, value in dct.items(): if not key.startswith('_'): update(key, value) count = 0 if '_enum_' in dct: enuminit = None if isinstance(dct['_enum_'], str): enuminit = dct['_enum_'].split(' ') elif isinstance(dct['_enum_'], tuple) or isinstance(dct['_enum_'], list): enuminit = dct['_enum_'] for key in enuminit: if count in revData: raise EnumError('The predefined elements have to have bigger value numbers') update(key, count) count += 1 dct['_revData'] = revData dct['_enumData'] = sorted(valueData, key=lambda x: x.value) return super(EnumMeta, cls).__new__(cls, name, bases, dct) def __call__(cls, name, args): if isinstance(args, list): args = ' '.join(args) return type(name, (cls,), {'_enum_':args}) def __iter__(cls): return EnumIterator(cls._enumData) def __str__(cls): toReturn = '<' for elem in cls._enumData: toReturn += str(elem) + '|' toReturn = toReturn[:-1] + '>' return cls.__name__ + '='+toReturn def __contains__(cls, item): return item in cls._revData def __getitem__(cls, key): if isinstance(key, str): return cls.__search(key) elif isinstance(key, EnumElement): return cls.__search(str(key)) elif isinstance(key, int) or isinstance(key, long): if key in cls._revData: return cls._revData[key] return 'Unkown' raise TypeError('key has to be an instance of int/long or str:' + key.__class__.__name__) def __search(self, key): for elem in self._enumData: if str(elem) == key: return elem; def __instancecheck__(self, instance): return isinstance(instance, EnumElement) and instance._enum == self.__name__ # For compatibility reason (python2 & python3) Enum = EnumMeta('Enum', (), {}) ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1581116104.0 filebytes-0.10.2/filebytes/mach_o.py0000644000175000017500000004127100000000000017272 0ustar00sashsash00000000000000# coding=utf-8 # Copyright 2018 Sascha Schirra # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of the copyright holder nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" A ND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. from struct import pack as p from .enum import Enum from .binary import * from binascii import hexlify ############# MachO General ###################### class MH(Enum): OBJECT = 0x1 EXECUTE = 0x2 FVMLIB = 0x3 CORE = 0x4 PRELOAD = 0x5 DYLIB = 0x6 DYLINKER = 0x7 BUNDLE = 0x8 DYLIB_STUB = 0x9 DSYM = 0xa KEXT_BUNDLE = 0xb class VM_PROT(Enum): READ = 0x1 WRITE = 0x2 EXEC = 0x4 def shortString(self, perm): toReturn = '' toReturn += 'R' if perm & int(self.READ) > 0 else ' ' toReturn += 'W' if perm & int(self.WRITE) > 0 else ' ' toReturn += 'E' if perm & int(self.EXEC) > 0 else ' ' return toReturn class TypeFlags(Enum): MASK = 0xff000000 ABI64 = 0x01000000 class CpuType(Enum): ANY = -1 I386 = 7 X86_64 = I386 | TypeFlags.ABI64 MIPS = 8 ARM = 12 ARM64 = ARM | TypeFlags.ABI64 SPARC = 14 POWERPC = 18 POWERPC64 = POWERPC | TypeFlags.ABI64 LC_SEGMENT = 1 LC_SEMGENT_64 = 0x19 S_ATTR_SOME_INSTRUCTIONS = 0x400 S_ATTR_PURE_INSTRUCTIONS = 0x80000000 class CpuSubTypeARM(Enum): ALL = 0 V4T = 5 V6 = 6 V5 = 7 XSCALE = 8 V7 = 9 V7S = 11 V7K = 12 V6M = 14 V7M = 15 V7EM = 16 class CpuSubTypeARM64(Enum): ALL = 0 V8 = 1 E = 2 class SubTypeFlags(Enum): MASK = 0xff000000 LIB64 = 0x80000000 class CPU_SUBTYPE_X86(Enum): X86 = 3 X86_64 = X86 | SubTypeFlags.LIB64 X86_64_H = 8 I486 = 4 I486SX = 0x84 I586 = 5 PENTPRO = 0x16 PENTII_M3 = 0x36 PENTII_M5 = 0x56 CELERON = 0x67 CELERON_MOBILE = 0x77 PENTIUM_3_M = 0x18 PENTIUM_3_XEON = 0x28 PENTIUM_M = 0x09 PENTIUM_4 = 0x0a PENTIUM_4_M = 0x1a ITANIUM = 0x0b ITANIUM_2 = 0x1b XEON = 0x0c XEON_MP = 0x1c class LC(Enum): SEGMENT = 0x00000001 SYMTAB = 0x00000002 SYMSEG = 0x00000003 THREAD = 0x00000004 UNIXTHREAD = 0x00000005 LOADFVMLIB = 0x00000006 IDFVMLIB = 0x00000007 IDENT = 0x00000008 FVMFILE = 0x00000009 PREPAGE = 0x0000000A DYSYMTAB = 0x0000000B LOAD_DYLIB = 0x0000000C ID_DYLIB = 0x0000000D LOAD_DYLINKER = 0x0000000E ID_DYLINKER = 0x0000000F PREBOUND_DYLIB = 0x00000010 ROUTINES = 0x00000011 SUB_FRAMEWORK = 0x00000012 SUB_UMBRELLA = 0x00000013 SUB_CLIENT = 0x00000014 SUB_LIBRARY = 0x00000015 TWOLEVEL_HINTS = 0x00000016 PREBIND_CKSUM = 0x00000017 LOAD_WEAK_DYLIB = 0x80000018 SEGMENT_64 = 0x00000019 ROUTINES_64 = 0x0000001A UUID = 0x0000001B RPATH = 0x8000001C CODE_SIGNATURE = 0x0000001D SEGMENT_SPLIT_INFO = 0x0000001E REEXPORT_DYLIB = 0x8000001F LAZY_LOAD_DYLIB = 0x00000020 ENCRYPTION_INFO = 0x00000021 DYLD_INFO = 0x00000022 DYLD_INFO_ONLY = 0x80000022 LOAD_UPWARD_DYLIB = 0x80000023 VERSION_MIN_MACOSX = 0x00000024 VERSION_MIN_IPHONEOS = 0x00000025 FUNCTION_STARTS = 0x00000026 DYLD_ENVIRONMENT = 0x00000027 MAIN = 0x80000028 DATA_IN_CODE = 0x00000029 SOURCE_VERSION = 0x0000002A DYLIB_CODE_SIGN_DRS = 0x0000002B ENCRYPTION_INFO_64 = 0x0000002C LINKER_OPTIONS = 0x0000002D LINKER_OPTIMIZATION_HINT = 0x0000002E class S_ATTR(Enum): SOME_INSTRUCTIONS = 0x00000400 PURE_INSTRUCTIONS = 0x80000000 class LcStr(Union): _pack_ = 4 _fields_ = [('offset', c_uint)] class LoadCommand(LittleEndianStructure): _pack_ = 4 _fields_ = [('cmd', c_uint), ('cmdsize', c_uint)] class UuidCommand(LittleEndianStructure): _pack_ = 4 _fields_ = [('cmd', c_uint), ('cmdsize', c_uint), ('uuid', c_ubyte * 16)] class TwoLevelHintsCommand(LittleEndianStructure): _pack_ = 4 _fields_ = [('cmd', c_uint), ('cmdsize', c_uint), ('offset', c_uint), ('nhints', c_uint)] class TwoLevelHint(LittleEndianStructure): _pack_ = 4 _fields_ = [('isub_image', c_uint), ('itoc', c_uint)] class Dylib(LittleEndianStructure): _pack_ = 4 _fields_ = [('name', LcStr), ('timestamp', c_uint), ('current_version', c_uint), ('compatibility_version', c_uint), ] class DylibCommand(LittleEndianStructure): _pack_ = 4 _fields_ = [('cmd', c_uint), ('cmdsize', c_uint), ('dylib', Dylib), ] class DylinkerCommand(LittleEndianStructure): _pack_ = 4 _fields_ = [('cmd', c_uint), ('cmdsize', c_uint), ('name', LcStr) ] ########################### 32 BIT Structures ########################### class LSB_32_MachHeader(LittleEndianStructure): _pack_ = 4 _fields_ = [('magic', c_uint), ('cputype', c_uint), ('cpusubtype', c_uint), ('filetype', c_uint), ('ncmds', c_uint), ('sizeofcmds', c_uint), ('flags', c_uint) ] class LSB_32_SegmentCommand(LittleEndianStructure): _pack_ = 4 _fields_ = [('cmd', c_uint), ('cmdsize', c_uint), ('segname', c_char * 16), ('vmaddr', c_uint), ('vmsize', c_uint), ('fileoff', c_uint), ('filesize', c_uint), ('maxprot', c_uint), ('initprot', c_uint), ('nsects', c_uint), ('flags', c_uint)] class LSB_32_Section(LittleEndianStructure): _pack_ = 4 _fields_ = [('sectname', c_char * 16), ('segname', c_char * 16), ('addr', c_uint), ('size', c_uint), ('offset', c_uint), ('align', c_uint), ('reloff', c_uint), ('nreloc', c_uint), ('flags', c_uint), ('reserved1', c_uint), ('reserved2', c_uint) ] class LSB_32(object): Section = LSB_32_Section SegmentCommand = LSB_32_SegmentCommand MachHeader = LSB_32_MachHeader ########################### 64 BIT Structures ########################### class LSB_64_MachHeader(LittleEndianStructure): _pack_ = 8 _fields_ = [('magic', c_uint), ('cputype', c_uint), ('cpusubtype', c_uint), ('filetype', c_uint), ('ncmds', c_uint), ('sizeofcmds', c_uint), ('flags', c_uint), ('reserved', c_uint), ] class LSB_64_SegmentCommand(LittleEndianStructure): _pack_ = 8 _fields_ = [('cmd', c_uint), ('cmdsize', c_uint), ('segname', c_char * 16), ('vmaddr', c_ulonglong), ('vmsize', c_ulonglong), ('fileoff', c_ulonglong), ('filesize', c_ulonglong), ('maxprot', c_uint), ('initprot', c_uint), ('nsects', c_uint), ('flags', c_uint)] class LSB_64_Section(LittleEndianStructure): _pack_ = 8 _fields_ = [('sectname', c_char * 16), ('segname', c_char * 16), ('addr', c_ulonglong), ('size', c_ulonglong), ('offset', c_uint), ('align', c_uint), ('reloff', c_uint), ('nreloc', c_uint), ('flags', c_uint), ('reserved1', c_uint), ('reserved2', c_uint) ] class LSB_64(object): Section = LSB_64_Section SegmentCommand = LSB_64_SegmentCommand MachHeader = LSB_64_MachHeader ############################# Fat/Universal ########################### class FatHeader(BigEndianStructure): _pack_ = 4 _fields_ = [('magic', c_uint), ('nfat_arch', c_uint) ] class FatArch(BigEndianStructure): _pack_ = 4 _fields_ = [('cputype', c_uint), ('cpusubtype', c_uint), ('offset', c_uint), ('size', c_uint), ('align', c_uint) ] ############################### Container ############################# class MachHeaderData(Container): """ header = MachHeader """ class LoadCommandData(Container): """ header = LoaderCommand bytes = bytes of the command bytearray raw = bytes of the command c_ubyte_array SegmentCommand sections = list of SectionData UuidCommand uuid = uuid (str) TwoLevelHintsCommand twoLevelHints = list of TwoLevelHintData DylibCommand name = name of dylib (str) DylinkerCommand name = name of dynamic linker """ class SectionData(Container): """ header = Section """ class TwoLevelHintData(Container): """ header = TwoLevelHint """ class MachO(Binary): def __init__(self, fileName, fileContent=None): super(MachO, self).__init__(fileName, fileContent) self.__fatArches = self._tryParseFat(self._bytes) if self.__fatArches: return self.__classes = self._getSuitableClasses(self._bytes) if not self.__classes: raise BinaryError('Bad architecture') self.__machHeader = self._parseMachHeader(self._bytes) self.__loadCommands = self._parseLoadCommands(self._bytes, self.machHeader) @property def _classes(self): return self.__classes @property def machHeader(self): assert not self.__fatArches return self.__machHeader @property def isFat(self): return self.__fatArches is not None @property def fatArches(self): assert self.__fatArches return self.__fatArches @property def loadCommands(self): assert not self.__fatArches return self.__loadCommands @property def entryPoint(self): return 0x0 @property def imageBase(self): for loadCommand in self.loadCommands: if loadCommand.header.cmd == LC.SEGMENT or loadCommand.header.cmd == LC.SEGMENT_64: for section in loadCommand.sections: if section.header.flags & S_ATTR.SOME_INSTRUCTIONS or section.header.flags & S_ATTR.PURE_INSTRUCTIONS: return section.header.addr - section.header.offset return 0x0 @property def type(self): return 'MachO' def _getSuitableClasses(self, data): classes = None if data[7] == 0: classes = LSB_32 elif data[7] == 1: classes = LSB_64 return classes def _tryParseFat(self, data): header = FatHeader.from_buffer(data) if header.magic != 0xcafebabe: return None offset = sizeof(FatHeader) arches = [] for i in range(header.nfat_arch): arch = FatArch.from_buffer(bytearray(data[offset:])) cputype = CpuType[arch.cputype] thin_data = bytearray(data[arch.offset : arch.offset+arch.size]) thin = MachO('{}.{}'.format(self.fileName, cputype), thin_data) arches.append(thin) offset += sizeof(FatArch) return arches def _parseMachHeader(self, data): header = self._classes.MachHeader.from_buffer(data) if header.magic not in (0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe): raise BinaryError('No valid MachO file') return MachHeaderData(header=header) def _parseLoadCommands(self, data, machHeader): offset = sizeof(self._classes.MachHeader) load_commands = [] for i in range(machHeader.header.ncmds): command = LoadCommand.from_buffer(data, offset) raw = (c_ubyte * command.cmdsize).from_buffer(data, offset) if command.cmd == LC.SEGMENT or command.cmd == LC.SEGMENT_64: command = self.__parseSegmentCommand(data, offset, raw) elif command.cmd == LC.UUID: command = self.__parseUuidCommand(data, offset, raw) elif command.cmd == LC.TWOLEVEL_HINTS: command = self.__parseTwoLevelHintCommand(data, offset, raw) elif command.cmd in (LC.ID_DYLIB, LC.LOAD_DYLIB, LC.LOAD_WEAK_DYLIB): command = self.__parseDylibCommand(data, offset, raw) elif command.cmd in (LC.ID_DYLINKER, LC.LOAD_DYLINKER): command = self.__parseDylibCommand(data, offset, raw) else: command = LoadCommandData(header=command) load_commands.append(command) offset += command.header.cmdsize return load_commands def __parseSegmentCommand(self, data, offset, raw): sc = self._classes.SegmentCommand.from_buffer(data, offset) sections = self.__parseSections(data, sc, offset+sizeof(self._classes.SegmentCommand)) return LoadCommandData(header=sc, name=sc.segname.decode('ASCII'), sections=sections, bytes=bytearray(raw), raw=raw) def __parseUuidCommand(self, data, offset, raw): uc = UuidCommand.from_buffer(data, offset) return LoadCommandData(header=uc, uuid=hexlify(uc.uuid), bytes=bytearray(raw), raw=raw) def __parseTwoLevelHintCommand(self, data, offset, raw): tlhc = TwoLevelHintsCommand.from_buffer(data, offset) hints = self.__parseTwoLevelHints(data, tlhc) return LoadCommandData(header=tlhc, twoLevelHints=hints, bytes=bytearray(raw), raw=raw) def __parseTwoLevelHints(self, data, twoLevelHintCommand): offset = twoLevelHintCommand.offset hints = [] for i in twoLevelHintCommand.nhints: tlh = TwoLevelHint.from_buffer(data, offset) hints.append(TwoLevelHintData(header=tlh)) return hints def __parseDylibCommand(self, data, offset, raw): dc = DylibCommand.from_buffer(data, offset) name = get_str(raw, dc.dylib.name.offset) return LoadCommandData(header=dc, bytes=bytearray(raw), raw=raw, name=name) def __parseDylinkerCommand(self, data, offset, raw): dc = DylinkerCommand.from_buffer(data, offset) name = get_str(raw, dc.name.offset) return LoadCommandData(header=dc, bytes=bytearray(raw), raw=raw, name=name) def __parseSections(self, data, segment, offset): sections = [] for i in range(segment.nsects): sec = self._classes.Section.from_buffer(data, offset) if self._classes.Section == LSB_64_Section: offset += 80 else: offset += sizeof(self._classes.Section) if self.machHeader.header.filetype != MH.DSYM or segment.segname == b"__DWARF": raw = (c_ubyte * sec.size).from_buffer(data, sec.offset) bytes = bytearray(raw) else: raw = None bytes = None sections.append(SectionData(header=sec, name=sec.sectname.decode('ASCII'), bytes=bytes, raw=raw)) return sections @classmethod def isSupportedContent(cls, fileContent): """Returns if the files are valid for this filetype""" magic = bytearray(fileContent)[:4] magics = ( p('>I', 0xfeedface), p('>I', 0xfeedfacf), p('>I', 0xcafebabe), p(' 0: class_offsets = (c_uint*dex_file.classDefsSize).from_buffer(data, offset) oat_classes = self._parseOatClasses(data, class_offsets) offset += dex_file.classDefsSize*4 oat_dex_files.append((OatDexFileHeaderData(header=odfh, classOffsets=class_offsets, name=odfh.dexFileLocation.decode('ASCII'), dexHeader=dex_file, dexRaw=dex_raw, dexBytes=bytearray(dex_raw), oatClasses=oat_classes))) return oat_dex_files def _parseOatClasses(self, data, classOffsets): oat_classes = [] for class_offset in classOffsets: oat_class = OatClass.from_buffer(data, class_offset) if oat_class.type != OatClassType.kOatClassNoneCompiled: if oat_class.type == OatClassType.kOatClassSomeCompiled: oat_class_with_bitmap_struct = create_oat_class_with_bitmap_class(oat_class.methodsPointer) oat_class = oat_class_with_bitmap_struct.from_buffer(data, class_offset) oat_classes.append(oat_class) return oat_classes ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1581116104.0 filebytes-0.10.2/filebytes/pe.py0000644000175000017500000006476600000000000016466 0ustar00sashsash00000000000000# coding=utf-8 # Copyright 2018 Sascha Schirra # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, this # list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of the copyright holder nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" A ND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. from .enum import Enum from .binary import * ###################### PE General ################# class IMAGE_FILE_MACHINE(Enum): UKNOWN = 0 AM33 = 0x1d3 AMD64 = 0x8664 ARM = 0x1c0 ARMV = 0x1c4 EBC = 0xebc I386 = 0x14c IA64 = 0x200 M32R = 0x9041 MIPS16 = 0x266 MIPSFPU = 0x366 MIPSFPU16 = 0x466 POWERPC = 0x1f0 POWERPCFP = 0x1f1 THUMB = 0x1c2 WCEMIPSV2 = 0x169 ARM64 = 0xaa64 class IMAGE_SCN(Enum): TYPE_NO_PAD = 0x00000008 CNT_CODE = 0x00000020 CNT_INITIALIZED_DATA = 0x00000040 CNT_UNINITIALIZED_DATA = 0x00000080 LNK_OTHER = 0x00000100 LNK_INFO = 0x00000200 LNK_REMOVE = 0x00000800 LNK_COMDAT = 0x00001000 GPREL = 0x00008000 MEM_PURGEABLE = 0x00020000 MEM_LOCKED = 0x00040000 MEM_PRELOAD = 0x00080000 ALIGN_1BYTES = 0x00100000 ALIGN_2BYTES = 0x00200000 ALIGN_4BYTES = 0x00300000 ALIGN_8BYTES = 0x00400000 ALIGN_16BYTES = 0x00500000 ALIGN_32BYTES = 0x00600000 ALIGN_64BYTES = 0x00700000 ALIGN_128BYTES = 0x00800000 ALIGN_256BYTES = 0x00900000 ALIGN_512BYTES = 0x00A00000 ALIGN_1024BYTES = 0x00B00000 ALIGN_2048BYTES = 0x00C00000 ALIGN_4096BYTES = 0x00D00000 ALIGN_8192BYTES = 0x00E00000 LNK_NRELOC_OVFL = 0x01000000 MEM_WRITE = 0x80000000 MEM_READ = 0x4000000 class ImageDllCharacteristics(Enum): DYNAMIC_BASE = 0x0040 FORCE_INTEGRITY = 0x0080 NX_COMPAT = 0x0100 NO_ISOLATION = 0x0200 NO_SEH = 0x0400 NO_BIND = 0x0800 APP_CONTAINER = 0x1000 WDM_DRIVER = 0x2000 CONTROL_FLOW_GUARD = 0x4000 TERMINAL_SERVER_AWARE = 0x8000 class ImageDirectoryEntry(Enum): EXPORT = 0 IMPORT = 1 RESOURCE = 2 EXCEPTION = 3 SECURITY = 4 BASERELOC = 5 DEBUG = 6 COPYRIGHT = 7 GLOBALPTR = 8 TLS = 9 LOAD_CONFIG = 10 BOUND_IMPORT = 11 IAT = 12 DELAY_IMPORT = 13 COM_DESCRIPTOR = 14 NUMBER_OF_DIRECTORY_ENTRIES = 16 class IMAGE_DOS_HEADER(Structure): _fields_ = [('e_magic', c_char * 2), ('e_cblp', c_ushort), ('e_cp', c_ushort), ('e_crlc', c_ushort), ('e_cparhdr', c_ushort), ('e_minalloc', c_ushort), ('e_maxalloc', c_ushort), ('e_ss', c_ushort), ('e_sp', c_ushort), ('e_csum', c_ushort), ('e_ip', c_ushort), ('e_cs', c_ushort), ('e_lfarlc', c_ushort), ('e_ovno', c_ushort), ('e_res', c_ushort * 4), ('e_oemid', c_ushort), ('e_oeminfo', c_ushort), ('e_res2', c_ushort * 10), ('e_lfanew', c_uint)] # Offset zum PE-Header class IMAGE_FILE_HEADER(Structure): _fields_ = [('Machine', c_ushort), ('NumberOfSections', c_ushort), ('TimeDateStamp', c_uint), ('PointerToSymbolTable', c_uint), ('NumberOfSymbols', c_uint), ('SizeOfOptionalHeader', c_ushort), ('Characteristics', c_ushort) ] class IMAGE_DATA_DIRECTORY(Structure): _fields_ = [('VirtualAddress', c_uint), ('Size', c_uint)] class IMAGE_SECTION_HEADER(Structure): _fields_ = [('Name', c_char * 8), ('PhysicalAddress_or_VirtualSize', c_uint), ('VirtualAddress', c_uint), ('SizeOfRawData', c_uint), ('PointerToRawData', c_uint), ('PointerToRelocations', c_uint), ('PointerToLinenumbers', c_uint), ('NumberOfRelocations', c_ushort), ('NumberOfLinenumbers', c_ushort), ('Characteristics', c_uint)] class IMAGE_IMPORT_BY_NAME(Structure): _fields_ = [('Hint', c_ushort), ('Name', c_char)] class IMAGE_THUNK_DATA(Union): _fields_ = [('ForwarderString', c_uint), ('Function', c_uint), ('Ordinal', c_uint), ('AddressOfData', c_uint)] class IMAGE_IMPORT_DESCRIPTOR(Structure): _fields_ = [('OriginalFirstThunk', c_uint), ('TimeDateStamp', c_uint), ('ForwarderChain', c_uint), ('Name', c_uint), ('FirstThunk', c_uint)] class IMAGE_EXPORT_DIRECTORY(Structure): _fields_ = [('Characteristics',c_uint), ('TimeDateStamp',c_uint), ('MajorVersion', c_ushort), ('MinorVersion', c_ushort), ('Name',c_uint), ('Base',c_uint), ('NumberOfFunctions',c_uint), ('NumberOfNames',c_uint), ('AddressOfFunctions',c_uint), ('AddressOfNames',c_uint), ('AddressOfNameOrdinals',c_uint) ] class GUARD_CFF_ENTRY(Structure): _fields_ = [('rva',c_uint), ('flag', c_byte)] ##################### PE32 ######################## class IMAGE_OPTIONAL_HEADER(Structure): _fields_ = [('Magic', c_ushort), ('MajorLinkerVersion', c_byte), ('MinorLinkerVersion', c_byte), ('SizeOfCode', c_uint), ('SizeOfInitializedData', c_uint), ('SizeOfUninitializedData', c_uint), ('AddressOfEntryPoint', c_uint), ('BaseOfCode', c_uint), ('BaseOfData', c_uint), ('ImageBase', c_uint), ('SectionAlignment', c_uint), ('FileAlignment', c_uint), ('MajorOperatingSystemVersion', c_ushort), ('MinorOperatingSystemVersion', c_ushort), ('MajorImageVersion', c_ushort), ('MinorImageVersion', c_ushort), ('MajorSubsystemVersion', c_ushort), ('MinorSubsystemVersion', c_ushort), ('Win32VersionValue', c_uint), ('SizeOfImage', c_uint), ('SizeOfHeaders', c_uint), ('CheckSum', c_uint), ('Subsystem', c_ushort), ('DllCharacteristics', c_ushort), ('SizeOfStackReserve', c_uint), ('SizeOfStackCommit', c_uint), ('SizeOfHeapReserve', c_uint), ('SizeOfHeapCommit', c_uint), ('LoaderFlags', c_uint), ('NumberOfRvaAndSizes', c_uint), ('DataDirectory', IMAGE_DATA_DIRECTORY * 16)] class PE32_IMAGE_NT_HEADERS(Structure): _fields_ = [('Signature', c_char * 4), ('FileHeader', IMAGE_FILE_HEADER), ('OptionalHeader', IMAGE_OPTIONAL_HEADER)] class PE32(object): IMAGE_NT_HEADERS = PE32_IMAGE_NT_HEADERS class IMAGE_LOAD_CONFIG_DIRECTORY32(Structure): _fields_ = [('Size', c_uint), ('TimeDateStamp', c_uint), ('MajorVersion', c_ushort), ('MinorVersion', c_ushort), ('GlobalFlagsClear', c_uint), ('GlobalFlagsSet', c_uint), ('CriticalSectionDefaultTimeout', c_uint), ('DeCommitFreeBLockThreshold', c_uint), ('DeCommitTotalFreeThreshold', c_uint), ('LockPrefixTable', c_uint), ('MaximumAllocationSize', c_uint), ('VirtualMemoryThreshold', c_uint), ('ProcessHeapFlags', c_uint), ('ProcessAffinityMask', c_uint), ('CSDVersion', c_ushort), ('Reserved1', c_ushort), ('EditList', c_uint), ('SecurityCookie', c_uint), ('SEHandlerTable', c_uint), ('SEHandlerCount', c_uint), ('GuardCFCheckFunctionPointer', c_uint), ('Reserved2', c_uint), ('GuardCFFunctionTable', c_uint), ('GuardCFFunctionCount', c_uint), ('GuardFlags', c_uint)] ######################### PE64 ######################## class IMAGE_OPTIONAL_HEADER_PE32_PLUS(Structure): _fields_ = [('Magic', c_ushort), ('MajorLinkerVersion', c_ubyte), ('MinorLinkerVersion', c_ubyte), ('SizeOfCode', c_uint), ('SizeOfInitializedData', c_uint), ('SizeOfUninitializedData', c_uint), ('AddressOfEntryPoint', c_uint), ('BaseOfCode', c_uint), ('ImageBase', c_ulonglong), ('SectionAlignment', c_uint), ('FileAlignment', c_uint), ('MajorOperatingSystemVersion', c_ushort), ('MinorOperatingSystemVersion', c_ushort), ('MajorImageVersion', c_ushort), ('MinorImageVersion', c_ushort), ('MajorSubsystemVersion', c_ushort), ('MinorSubsystemVersion', c_ushort), ('Win32VersionValue', c_uint), ('SizeOfImage', c_uint), ('SizeOfHeaders', c_uint), ('CheckSum', c_uint), ('Subsystem', c_ushort), ('DllCharacteristics', c_ushort), ('SizeOfStackReserve', c_ulonglong), ('SizeOfStackCommit', c_ulonglong), ('SizeOfHeapReserve', c_ulonglong), ('SizeOfHeapCommit', c_ulonglong), ('LoaderFlags', c_uint), ('NumberOfRvaAndSizes', c_uint), ('DataDirectory', IMAGE_DATA_DIRECTORY * 16)] class PE64_IMAGE_NT_HEADERS(Structure): _fields_ = [('Signature', c_char * 4), ('FileHeader', IMAGE_FILE_HEADER), ('OptionalHeader', IMAGE_OPTIONAL_HEADER_PE32_PLUS)] class PE64(object): IMAGE_NT_HEADERS = PE64_IMAGE_NT_HEADERS class IMAGE_LOAD_CONFIG_DIRECTORY64(Structure): _fields_ = [('Size', c_uint), ('TimeDateStamp', c_uint), ('MajorVersion', c_ushort), ('MinorVersion', c_ushort), ('GlobalFlagsClear', c_uint), ('GlobalFlagsSet', c_uint), ('CriticalSectionDefaultTimeout', c_uint), ('DeCommitFreeBLockThreshold', c_ulonglong), ('DeCommitTotalFreeThreshold', c_ulonglong), ('LockPrefixTable', c_ulonglong), ('MaximumAllocationSize', c_ulonglong), ('VirtualMemoryThreshold', c_ulonglong), ('ProcessAffinityMask', c_ulonglong), ('ProcessHeapFlags', c_uint), ('CSDVersion', c_ushort), ('Reserved1', c_ushort), ('EditList', c_ulonglong), ('SecurityCookie', c_ulonglong), ('SEHandlerTable', c_ulonglong), ('SEHandlerCount', c_ulonglong), ('GuardCFCheckFunctionPointer', c_ulonglong), ('Reserved2', c_ulonglong), ('GuardCFFunctionTable', c_ulonglong), ('GuardCFFunctionCount', c_ulonglong), ('GuardFlags', c_uint)] ##################### Container ################### def to_offset(addr, section): return addr - section.header.VirtualAddress def to_raw_address(addr, section): """Converts the addr from a rva to a pointer to raw data in the file""" return addr - section.header.VirtualAddress + section.header.PointerToRawData class ImageDosHeaderData(Container): """ header = IMAGE_DOS_HEADER """ class ImageNtHeaderData(Container): """ header = IMAGE_NT_HEADERS """ class SectionData(Container): """ header = IMAGE_SECTION_HEADER name = name of the section (str) bytes = bytes of section (bytearray) raw = bytes of section (c_ubyte_array) """ class DataDirectoryData(Container): """ header = IMAGE_DATA_DIRECTORY """ class ImportDescriptorData(Container): """ header = IMAGE_IMPORT_DESCRIPTOR dllName = name of dll (str) importNameTable = list of IMAGE_THUNK_DATA importAddressTable = list of IMAGE_THUNK_DATA """ class ImportByNameData(Container): """ header = IMAGE_IMPORT_BY_NAME name = name of function (str) """ class ThunkData(Container): """ header = IMAGE_THUNK_DATA rva = relative virtual address of thunk ordinal = None | Ordinal importByName = None| ImportByNameData """ class ExportDirectoryData(Container): """ header = IMAGE_EXPORT_DIRECTORY name = name of dll (str) functions = list of FunctionData """ class LoadConfigData(Container): """" header = IMAGE_LOAD_CONFIG_DIRECTORY32/IMAGE_LOAD_CONFIG_DIRECTORY64 cfGuardedFunctions = list of relative virtual addresses (RVA) of cfg allowed call/jmp targets. Empty if CFG not supported """ class FunctionData(Container): """ name = name of the function (str) ordinal = ordinal (int) rva = relative virtual address of function (int) """ def checkOffset(offset, section): size = len(section.raw) if offset < 0 or offset > size: raise BinaryError('Invalid offset: {} (data size: {})'.format(offset, size)) class PE(Binary): def __init__(self, fileName, fileContent=None, parse_header_only=False): super(PE, self).__init__(fileName, fileContent) self.__imageDosHeader = self._parseImageDosHeader(self._bytes) self.__classes = self._getSuitableClasses(self._bytes, self.imageDosHeader) if not self.__classes: raise BinaryError('Bad architecture') self.__imageNtHeaders = self._parseImageNtHeaders(self._bytes, self.imageDosHeader) self.__sections = self._parseSections(self._bytes, self.imageDosHeader, self.imageNtHeaders, parse_header_only=parse_header_only) if parse_header_only: self.__dataDirectory = None else: self.__dataDirectory = self._parseDataDirectory(self._bytes, self.sections, self.imageNtHeaders) @property def _classes(self): return self.__classes @property def imageDosHeader(self): return self.__imageDosHeader @property def imageNtHeaders(self): return self.__imageNtHeaders @property def sections(self): return self.__sections @property def dataDirectory(self): return self.__dataDirectory @property def entryPoint(self): return self.imageNtHeaders.header.OptionalHeader.ImageBase + self.imageNtHeaders.header.OptionalHeader.AddressOfEntryPoint @property def imageBase(self): return self.imageNtHeaders.header.OptionalHeader.ImageBase @property def type(self): return 'PE' def _getSuitableClasses(self, data, imageDosHeader): """Returns the class which holds the suitable classes for the loaded file""" classes = None machine = IMAGE_FILE_MACHINE[c_ushort.from_buffer(data,imageDosHeader.header.e_lfanew+4).value] if machine == IMAGE_FILE_MACHINE.I386: classes = PE32 elif machine == IMAGE_FILE_MACHINE.AMD64: classes = PE64 return classes def _parseImageDosHeader(self, data): """Returns the ImageDosHeader""" ioh = IMAGE_DOS_HEADER.from_buffer(data) if ioh.e_magic != b'MZ': raise BinaryError('No valid PE/COFF file') return ImageDosHeaderData(header=ioh) def _parseImageNtHeaders(self, data, imageDosHeader): """Returns the ImageNtHeaders""" inth = self._classes.IMAGE_NT_HEADERS.from_buffer(data, imageDosHeader.header.e_lfanew) if inth.Signature != b'PE': raise BinaryError('No valid PE/COFF file') return ImageNtHeaderData(header=inth) def _parseSections(self, data, imageDosHeader, imageNtHeaders, parse_header_only=False): """Parses the sections in the memory and returns a list of them""" sections = [] optional_header_offset = imageDosHeader.header.e_lfanew + 4 + sizeof(IMAGE_FILE_HEADER) offset = optional_header_offset + imageNtHeaders.header.FileHeader.SizeOfOptionalHeader # start reading behind the dos- and ntheaders image_section_header_size = sizeof(IMAGE_SECTION_HEADER) IMAGE_SIZEOF_SYMBOL = 18 strtable_offset = imageNtHeaders.header.FileHeader.PointerToSymbolTable + IMAGE_SIZEOF_SYMBOL * imageNtHeaders.header.FileHeader.NumberOfSymbols for sectionNo in range(imageNtHeaders.header.FileHeader.NumberOfSections): ishdr = IMAGE_SECTION_HEADER.from_buffer(data, offset) if parse_header_only: raw = None bytes_ = bytearray() else: size = ishdr.SizeOfRawData raw = (c_ubyte * size).from_buffer(data, ishdr.PointerToRawData) bytes_ = bytearray(raw) secname = ishdr.Name.decode('ASCII', errors='ignore') if secname.startswith('/'): name_offset = int(secname[1:]) + strtable_offset s = bytearray() while self._bytes[name_offset] != 0: s.append(self._bytes[name_offset]) name_offset += 1 secname = bytes(s).decode('ASCII', errors='ignore') sections.append(SectionData(header=ishdr, name=secname, bytes=bytes_, raw=raw)) offset += image_section_header_size return sections def _getSectionForDataDirectoryEntry(self, data_directory_entry, sections): """Returns the section which contains the data of DataDirectory""" for section in sections: if data_directory_entry.VirtualAddress >= section.header.VirtualAddress and \ data_directory_entry.VirtualAddress < section.header.VirtualAddress + section.header.SizeOfRawData : return section def _parseDataDirectory(self, data, sections, imageNtHeaders): """Parses the entries of the DataDirectory and returns a list of the content""" data_directory_data_list = [None for i in range(15)] # parse DataDirectory[Export] export_data_directory = imageNtHeaders.header.OptionalHeader.DataDirectory[ImageDirectoryEntry.EXPORT] export_section = self._getSectionForDataDirectoryEntry(export_data_directory, sections) export_data_directory_data = self._parseDataDirectoryExport(data, export_data_directory, export_section) data_directory_data_list[ImageDirectoryEntry.EXPORT] = export_data_directory_data # parse DataDirectory[Import] import_data_directory = imageNtHeaders.header.OptionalHeader.DataDirectory[ImageDirectoryEntry.IMPORT] import_section = self._getSectionForDataDirectoryEntry(import_data_directory, sections) import_data_directory_data = self._parseDataDirectoryImport(import_data_directory, import_section) data_directory_data_list[ImageDirectoryEntry.IMPORT] = import_data_directory_data # parse DataDirectory[LOAD_CONFIG] loadconfig_data_directory = imageNtHeaders.header.OptionalHeader.DataDirectory[ImageDirectoryEntry.LOAD_CONFIG] loadconfig_section = self._getSectionForDataDirectoryEntry(loadconfig_data_directory, sections) loadconfig_data = self._parseLoadConfig(loadconfig_data_directory, loadconfig_section) data_directory_data_list[ImageDirectoryEntry.LOAD_CONFIG] = loadconfig_data return data_directory_data_list def _parseDataDirectoryExport(self, data, dataDirectoryEntry, exportSection): """Parses the EmportDataDirectory and returns an instance of ExportDirectoryData""" if not exportSection: return functions = [] export_directory = IMAGE_EXPORT_DIRECTORY.from_buffer(exportSection.raw, to_offset(dataDirectoryEntry.VirtualAddress, exportSection)) offset = to_offset(export_directory.Name, exportSection) checkOffset(offset, exportSection) name = get_str(exportSection.raw, offset) offsetOfNames = to_offset(export_directory.AddressOfNames, exportSection) offsetOfAddress = to_offset(export_directory.AddressOfFunctions, exportSection) offsetOfNameOrdinals = to_offset(export_directory.AddressOfNameOrdinals, exportSection) for i in range(export_directory.NumberOfNames): name_address = c_uint.from_buffer(exportSection.raw, offsetOfNames).value name_offset = to_offset(name_address, exportSection) checkOffset(name_offset, exportSection) func_name = get_str(exportSection.raw, name_offset) ordinal = c_ushort.from_buffer(exportSection.raw, offsetOfNameOrdinals).value func_addr = c_uint.from_buffer(exportSection.raw, offsetOfAddress).value offsetOfNames += 4 offsetOfAddress += 4 offsetOfNameOrdinals += 2 functions.append(FunctionData(name=func_name, rva=func_addr, ordinal=ordinal)) return ExportDirectoryData(header=export_directory, name=name, functions=functions) def _parseDataDirectoryImport(self, dataDirectoryEntry, importSection): """Parses the ImportDataDirectory and returns a list of ImportDescriptorData""" if not importSection: return raw_bytes = (c_ubyte * dataDirectoryEntry.Size).from_buffer(importSection.raw, to_offset(dataDirectoryEntry.VirtualAddress, importSection)) offset = 0 import_descriptors = [] while True: import_descriptor = IMAGE_IMPORT_DESCRIPTOR.from_buffer(raw_bytes, offset) if import_descriptor.OriginalFirstThunk == 0: break else: nameOffset = to_offset(import_descriptor.Name, importSection) checkOffset(nameOffset, importSection) dllName = get_str(importSection.raw, nameOffset) import_name_table = self.__parseThunks(import_descriptor.OriginalFirstThunk, importSection) import_address_table = self.__parseThunks(import_descriptor.FirstThunk, importSection) import_descriptors.append(ImportDescriptorData(header=import_descriptor, dllName=dllName, importNameTable=import_name_table, importAddressTable=import_address_table)) offset += sizeof(IMAGE_IMPORT_DESCRIPTOR) return import_descriptors def _getSectionByRVA(self, va): for section in self.sections: address = section.header.VirtualAddress SizeOfRawData = section.header.SizeOfRawData if address <= va and va < (address + SizeOfRawData): return section return def _parseLoadConfig(self, loadConfigEntry, loadconfigSection): if not loadconfigSection: return if self._classes == PE64: load_config_directory = IMAGE_LOAD_CONFIG_DIRECTORY64.from_buffer( loadconfigSection.raw, to_offset(loadConfigEntry.VirtualAddress, loadconfigSection)) pass elif self._classes == PE32: load_config_directory = IMAGE_LOAD_CONFIG_DIRECTORY32.from_buffer( loadconfigSection.raw, to_offset(loadConfigEntry.VirtualAddress, loadconfigSection)) pass else: pass guardCFTableRVA = load_config_directory.GuardCFFunctionTable - self.imageBase section = self._getSectionByRVA(guardCFTableRVA) CfGuardedFunctions = set() if section: sectionOffset = guardCFTableRVA - section.header.VirtualAddress # loop through the ControlFlow Guard Function table for i in range(0, load_config_directory.GuardCFFunctionCount): cffEntry = GUARD_CFF_ENTRY.from_buffer(section.raw, sectionOffset) CfGuardedFunctions.add(cffEntry.rva) sectionOffset += 5 return LoadConfigData(header=load_config_directory, cfGuardedFunctions=CfGuardedFunctions ) def __parseThunks(self, thunkRVA, importSection): """Parses the thunks and returns a list""" offset = to_offset(thunkRVA, importSection) table_offset = 0 thunks = [] while True: thunk = IMAGE_THUNK_DATA.from_buffer(importSection.raw, offset) offset += sizeof(IMAGE_THUNK_DATA) if thunk.Ordinal == 0: break thunkData = ThunkData(header=thunk, rva=table_offset+thunkRVA,ordinal=None, importByName=None) if to_offset(thunk.AddressOfData, importSection) > 0 and to_offset(thunk.AddressOfData, importSection) < len(self._bytes): self.__parseThunkData(thunkData, importSection) thunks.append(thunkData) table_offset += 4 return thunks def __parseThunkData(self, thunk,importSection): """Parses the data of a thunk and sets the data""" offset = to_offset(thunk.header.AddressOfData, importSection) if 0xf0000000 & thunk.header.AddressOfData == 0x80000000: thunk.ordinal = thunk.header.AddressOfData & 0x0fffffff else: ibn = IMAGE_IMPORT_BY_NAME.from_buffer(importSection.raw, offset) checkOffset(offset+2, importSection) name = get_str(importSection.raw, offset+2) thunk.importByName = ImportByNameData(header=ibn, hint=ibn.Hint, name=name) @classmethod def isSupportedContent(cls, fileContent): """Returns if the files are valid for this filetype""" return bytearray(fileContent)[:2] == b'MZ' ././@PaxHeader0000000000000000000000000000003400000000000011452 xustar000000000000000028 mtime=1581287915.7058043 filebytes-0.10.2/filebytes.egg-info/0000755000175000017500000000000000000000000017157 5ustar00sashsash00000000000000././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1581287915.0 filebytes-0.10.2/filebytes.egg-info/PKG-INFO0000644000175000017500000000116100000000000020253 0ustar00sashsash00000000000000Metadata-Version: 1.1 Name: filebytes Version: 0.10.2 Summary: Scripts to parse the following file formats - Executable and Linking Format (ELF), Portable Executable (PE), Mach-O and OAT (Android Runtime). Home-page: https://scoding.de/filebytes-introduction/ Author: Sascha Schirra Author-email: sashs@scoding.de License: BSD-3-Clause Description: UNKNOWN Platform: UNKNOWN Classifier: Topic :: Security Classifier: Environment :: Console Classifier: Operating System :: OS Independent Classifier: License :: OSI Approved :: BSD License Classifier: Programming Language :: Python Classifier: Intended Audience :: Developers ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1581287915.0 filebytes-0.10.2/filebytes.egg-info/SOURCES.txt0000644000175000017500000000050500000000000021043 0ustar00sashsash00000000000000COPYING README.md setup.cfg setup.py filebytes/__init__.py filebytes/binary.py filebytes/ctypes_helper.py filebytes/elf.py filebytes/enum.py filebytes/mach_o.py filebytes/oat.py filebytes/pe.py filebytes.egg-info/PKG-INFO filebytes.egg-info/SOURCES.txt filebytes.egg-info/dependency_links.txt filebytes.egg-info/top_level.txt././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1581287915.0 filebytes-0.10.2/filebytes.egg-info/dependency_links.txt0000644000175000017500000000000100000000000023225 0ustar00sashsash00000000000000 ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1581287915.0 filebytes-0.10.2/filebytes.egg-info/top_level.txt0000644000175000017500000000001200000000000021702 0ustar00sashsash00000000000000filebytes ././@PaxHeader0000000000000000000000000000003400000000000011452 xustar000000000000000028 mtime=1581287915.7058043 filebytes-0.10.2/setup.cfg0000644000175000017500000000113600000000000015321 0ustar00sashsash00000000000000[metadata] name = filebytes author = Sascha Schirra author_email = sashs@scoding.de license = BSD-3-Clause license_file = COPYING description = Scripts to parse the following file formats - Executable and Linking Format (ELF), Portable Executable (PE), Mach-O and OAT (Android Runtime). url = https://scoding.de/filebytes-introduction/ classifiers = Topic :: Security Environment :: Console Operating System :: OS Independent License :: OSI Approved :: BSD License Programming Language :: Python Intended Audience :: Developers [options] packages = filebytes [egg_info] tag_build = tag_date = 0 ././@PaxHeader0000000000000000000000000000002600000000000011453 xustar000000000000000022 mtime=1570182215.0 filebytes-0.10.2/setup.py0000644000175000017500000000103300000000000015206 0ustar00sashsash00000000000000from setuptools import setup import ast import os currentDir = os.path.dirname(os.path.abspath(__file__)) #currentDir = Path(__file__).parent def extractMetaInfo(src): info = {} a=ast.parse(src) for e in a.body: if isinstance(e, ast.Assign) and isinstance(e.value, ast.Str): info[e.targets[0].id] = e.value.s return info text = '' with open(currentDir +os.path.sep+"filebytes"+ os.path.sep+"__init__.py") as f: text = f.read() version = extractMetaInfo(text)["VERSION"] setup(version=version)