diff options
Diffstat (limited to 'example/elfesteem')
| -rw-r--r-- | example/elfesteem/minidump_to_pe.py | 48 | ||||
| -rw-r--r-- | example/elfesteem/test_pe.py | 31 |
2 files changed, 0 insertions, 79 deletions
diff --git a/example/elfesteem/minidump_to_pe.py b/example/elfesteem/minidump_to_pe.py deleted file mode 100644 index 30a95325..00000000 --- a/example/elfesteem/minidump_to_pe.py +++ /dev/null @@ -1,48 +0,0 @@ -#! /usr/bin/env python -"""Minidump to PE example""" - -import sys - -from future.utils import viewvalues - -from miasm.loader.minidump_init import Minidump -from miasm.loader.pe_init import PE - -minidump = Minidump(open(sys.argv[1], 'rb').read()) - -pe = PE() -for i, memory in enumerate(sorted(viewvalues(minidump.memory), - key=lambda x:x.address)): - # Get section name - name = str(memory.name) - if not name: - name = "s_%02d" % i - else: - name = name.split('\\')[-1] - - # Get section protection - protect = memory.pretty_protect - protect_mask = 0x20 - if protect == "UNKNOWN": - protect_mask |= 0xe0000000 - else: - if "EXECUTE" in protect: - protect_mask |= 1 << 29 - if "READ" in protect: - protect_mask |= 1 << 30 - if "WRITE" in protect: - protect_mask |= 1 << 31 - - # Add the section - pe.SHList.add_section(name=name, addr=memory.address, rawsize=memory.size, - data=memory.content, flags=protect_mask) - -# Find entry point -try: - entry_point = minidump.threads.Threads[0].ThreadContext.Eip[0] -except AttributeError: - entry_point = minidump.threads.Threads[0].ThreadContext.Rip[0] - -pe.Opthdr.AddressOfEntryPoint = entry_point - -open("out_pe.bin", "wb").write(bytes(pe)) diff --git a/example/elfesteem/test_pe.py b/example/elfesteem/test_pe.py deleted file mode 100644 index 543cbea5..00000000 --- a/example/elfesteem/test_pe.py +++ /dev/null @@ -1,31 +0,0 @@ -#! /usr/bin/env python - -import miasm.loader.pe as pe -from miasm.loader.pe_init import PE -import rlcompleter -import readline -import pdb -import sys -from pprint import pprint as pp -readline.parse_and_bind("tab: complete") - - -e_ = PE() -mysh = b"\xc3" -s_text = e_.SHList.add_section( - name="text", addr=0x1000, rawsize=0x1000, data=mysh) -e_.Opthdr.AddressOfEntryPoint = s_text.addr -new_dll = [({"name": "kernel32.dll", - "firstthunk": s_text.addr + 0x100}, - ["CreateFileA", "SetFilePointer", "WriteFile", "CloseHandle"] - ), - ({"name": "USER32.dll", - "firstthunk": None}, - ["SetDlgItemInt", "GetMenu", "HideCaret"] - ) - ] -e_.DirImport.add_dlldesc(new_dll) - -s_myimp = e_.SHList.add_section(name="myimp", rawsize=0x1000) -e_.DirImport.set_rva(s_myimp.addr) -open('uu.bin', 'wb').write(bytes(e_)) |