diff options
| author | Ajax <commial@gmail.com> | 2019-05-09 10:40:26 +0200 |
|---|---|---|
| committer | Ajax <commial@gmail.com> | 2019-05-09 10:40:26 +0200 |
| commit | 639abbe623a5d04d173495f29aff698e80577d8a (patch) | |
| tree | 34983d32c30aa54e3e918fe2c0602682dc609940 /example/elfesteem/minidump_to_pe.py | |
| parent | 82ec0ab9b24553c894540bb1f560df2cf062679b (diff) | |
| download | miasm-639abbe623a5d04d173495f29aff698e80577d8a.tar.gz miasm-639abbe623a5d04d173495f29aff698e80577d8a.zip | |
Example: rename elfesteem -> loader
Diffstat (limited to 'example/elfesteem/minidump_to_pe.py')
| -rw-r--r-- | example/elfesteem/minidump_to_pe.py | 48 |
1 files changed, 0 insertions, 48 deletions
diff --git a/example/elfesteem/minidump_to_pe.py b/example/elfesteem/minidump_to_pe.py deleted file mode 100644 index 30a95325..00000000 --- a/example/elfesteem/minidump_to_pe.py +++ /dev/null @@ -1,48 +0,0 @@ -#! /usr/bin/env python -"""Minidump to PE example""" - -import sys - -from future.utils import viewvalues - -from miasm.loader.minidump_init import Minidump -from miasm.loader.pe_init import PE - -minidump = Minidump(open(sys.argv[1], 'rb').read()) - -pe = PE() -for i, memory in enumerate(sorted(viewvalues(minidump.memory), - key=lambda x:x.address)): - # Get section name - name = str(memory.name) - if not name: - name = "s_%02d" % i - else: - name = name.split('\\')[-1] - - # Get section protection - protect = memory.pretty_protect - protect_mask = 0x20 - if protect == "UNKNOWN": - protect_mask |= 0xe0000000 - else: - if "EXECUTE" in protect: - protect_mask |= 1 << 29 - if "READ" in protect: - protect_mask |= 1 << 30 - if "WRITE" in protect: - protect_mask |= 1 << 31 - - # Add the section - pe.SHList.add_section(name=name, addr=memory.address, rawsize=memory.size, - data=memory.content, flags=protect_mask) - -# Find entry point -try: - entry_point = minidump.threads.Threads[0].ThreadContext.Eip[0] -except AttributeError: - entry_point = minidump.threads.Threads[0].ThreadContext.Rip[0] - -pe.Opthdr.AddressOfEntryPoint = entry_point - -open("out_pe.bin", "wb").write(bytes(pe)) |