Module: PEdump::IMAGE_OPTIONAL_HEADER::ClassMethods

Defined in:
lib/pedump.rb

Instance Method Summary collapse

Instance Method Details

#read(file, size = nil) ⇒ Object 



131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
 
# File 'lib/pedump.rb', line 131

def read file, size = nil
  usual_size = self.const_get('USUAL_SIZE')
  cSIZE   = self.const_get 'SIZE'
  cFORMAT = self.const_get 'FORMAT'
  size ||= cSIZE
  PEdump.logger.warn "[?] unusual size of IMAGE_OPTIONAL_HEADER = #{size} (must be #{usual_size})" if size != usual_size
  PEdump.logger.warn "[?] #{size-usual_size} spare bytes after IMAGE_OPTIONAL_HEADER" if size > usual_size
  new(*file.read([size,cSIZE].min).to_s.unpack(cFORMAT)).tap do |ioh|
    ioh.DataDirectory = []

    # check if "...this address is outside the memory mapped file and is zeroed by the OS"
    # see http://www.phreedom.org/solar/code/tinype/, section "Removing the data directories"
    ioh.each_pair{ |k,v| ioh[k] = 0 if v.nil? }

    # http://opcode0x90.wordpress.com/2007/04/22/windows-loader-does-it-differently/
    # maximum of 0x10 entries, even if bigger
    [0x10,ioh.NumberOfRvaAndSizes].min.times do |idx|
      ioh.DataDirectory << IMAGE_DATA_DIRECTORY.read(file)
      ioh.DataDirectory.last.type = IMAGE_DATA_DIRECTORY::TYPES[idx]
    end
    #ioh.DataDirectory.pop while ioh.DataDirectory.last.empty?

    # skip spare bytes, if any. XXX may contain suspicious data
    file.seek(size-usual_size, IO::SEEK_CUR) if size > usual_size
  end
end