diff options
| -rw-r--r-- | example/loader/build_pe.py | 33 | ||||
| -rw-r--r-- | example/loader/test_pe.py | 31 | ||||
| -rwxr-xr-x | test/test_all.py | 2 |
3 files changed, 34 insertions, 32 deletions
diff --git a/example/loader/build_pe.py b/example/loader/build_pe.py new file mode 100644 index 00000000..6baeb645 --- /dev/null +++ b/example/loader/build_pe.py @@ -0,0 +1,33 @@ +#! /usr/bin/env python + +from miasm.loader.pe_init import PE + +# Build an empty PE object +pe_object = PE() + +# Add a section with a just a "RET" +payload = b"\xc3" +s_text = pe_object.SHList.add_section( + name="text", addr=0x1000, rawsize=0x1000, data=payload +) + +# Set the entry point on this instruction +pe_object.Opthdr.AddressOfEntryPoint = s_text.addr + +# Add some imports +new_dll = [ + ({"name": "kernel32.dll", + "firstthunk": s_text.addr + 0x100}, + ["CreateFileA", "SetFilePointer", "WriteFile", "CloseHandle"] + ), + ({"name": "USER32.dll", + "firstthunk": None}, + ["SetDlgItemInt", "GetMenu", "HideCaret"] + ) +] +pe_object.DirImport.add_dlldesc(new_dll) +s_myimp = pe_object.SHList.add_section(name="myimp", rawsize=0x1000) +pe_object.DirImport.set_rva(s_myimp.addr) + +# Rebuild the PE and dump it to a file +open('fresh_pe.exe', 'wb').write(bytes(pe_object)) diff --git a/example/loader/test_pe.py b/example/loader/test_pe.py deleted file mode 100644 index 543cbea5..00000000 --- a/example/loader/test_pe.py +++ /dev/null @@ -1,31 +0,0 @@ -#! /usr/bin/env python - -import miasm.loader.pe as pe -from miasm.loader.pe_init import PE -import rlcompleter -import readline -import pdb -import sys -from pprint import pprint as pp -readline.parse_and_bind("tab: complete") - - -e_ = PE() -mysh = b"\xc3" -s_text = e_.SHList.add_section( - name="text", addr=0x1000, rawsize=0x1000, data=mysh) -e_.Opthdr.AddressOfEntryPoint = s_text.addr -new_dll = [({"name": "kernel32.dll", - "firstthunk": s_text.addr + 0x100}, - ["CreateFileA", "SetFilePointer", "WriteFile", "CloseHandle"] - ), - ({"name": "USER32.dll", - "firstthunk": None}, - ["SetDlgItemInt", "GetMenu", "HideCaret"] - ) - ] -e_.DirImport.add_dlldesc(new_dll) - -s_myimp = e_.SHList.add_section(name="myimp", rawsize=0x1000) -e_.DirImport.set_rva(s_myimp.addr) -open('uu.bin', 'wb').write(bytes(e_)) diff --git a/test/test_all.py b/test/test_all.py index 445d2b16..1f729a71 100755 --- a/test/test_all.py +++ b/test/test_all.py @@ -704,7 +704,7 @@ class ExampleLoader(Example): example_dir = "loader" -testset += ExampleLoader(["test_pe.py"], products=["uu.bin"]) +testset += ExampleLoader(["build_pe.py"], products=["fresh_pe.exe"]) # A sample is required, so "minidump_to_pe.py" is disabled for now |