Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
'code': pe.OPTIONAL_HEADER.BaseOfCode,
'entry_point': pe.OPTIONAL_HEADER.AddressOfEntryPoint,
'image': pe.OPTIONAL_HEADER.ImageBase,
},
'alignment': {
'file': pe.OPTIONAL_HEADER.FileAlignment,
'section': pe.OPTIONAL_HEADER.SectionAlignment,
},
'characteristics': {
'dll': [],
'image': [],
},
'checksum': pe.OPTIONAL_HEADER.CheckSum,
'machine': {
'id': pe.FILE_HEADER.Machine,
'type': pefile.MACHINE_TYPE.get(pe.FILE_HEADER.Machine).replace('IMAGE_FILE_MACHINE_', ''),
},
'magic': {
'dos': MAGIC_DOS.get(pe.DOS_HEADER.e_magic, ''),
'image': MAGIC_IMAGE.get(pe.OPTIONAL_HEADER.Magic, ''),
},
'size': {
'code': pe.OPTIONAL_HEADER.SizeOfCode,
'data': {
'initialized': pe.OPTIONAL_HEADER.SizeOfInitializedData,
'uninitialized': pe.OPTIONAL_HEADER.SizeOfUninitializedData,
},
'headers': pe.OPTIONAL_HEADER.SizeOfHeaders,
'heap': {
'reserve': pe.OPTIONAL_HEADER.SizeOfHeapReserve,
'commit': pe.OPTIONAL_HEADER.SizeOfHeapCommit,
},
def scan(self, file_object, options):
self.metadata["total"] = {"sections": 0}
try:
pe = pefile.PE(data=file_object.data)
pe_dictionary = pe.dump_dict()
self.metadata["total"]["sections"] = pe.FILE_HEADER.NumberOfSections
self.metadata["warnings"] = pe.get_warnings()
self.metadata["timestamp"] = datetime.utcfromtimestamp(pe.FILE_HEADER.TimeDateStamp).isoformat(timespec="seconds")
machine = pe.FILE_HEADER.Machine
self.metadata["machine"] = {"id": machine, "type": pefile.MACHINE_TYPE.get(machine)}
# Reference: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339%28v=vs.85%29.aspx
self.metadata["imageMagic"] = IMAGE_MAGIC_LOOKUP.get(pe.OPTIONAL_HEADER.Magic, "Unknown")
subsystem = pe.OPTIONAL_HEADER.Subsystem
self.metadata["subsystem"] = pefile.SUBSYSTEM_TYPE.get(subsystem)
self.metadata["stackReserveSize"] = pe.OPTIONAL_HEADER.SizeOfStackReserve
self.metadata["stackCommitSize"] = pe.OPTIONAL_HEADER.SizeOfStackCommit
self.metadata["heapReserveSize"] = pe.OPTIONAL_HEADER.SizeOfHeapReserve
self.metadata["heapCommitSize"] = pe.OPTIONAL_HEADER.SizeOfHeapCommit
self.metadata["entryPoint"] = pe.OPTIONAL_HEADER.AddressOfEntryPoint
self.metadata["imageBase"] = pe.OPTIONAL_HEADER.ImageBase
self.metadata["entryPoint"] = pe.OPTIONAL_HEADER.AddressOfEntryPoint
self.metadata["entryPoint"] = pe.OPTIONAL_HEADER.AddressOfEntryPoint
image_characteristics = pe_dictionary.get("Flags")
if image_characteristics is not None:
self.metadata["imageCharacteristics"] = image_characteristics
logging.debug('Unable to identify imphash')
imgChars = dump_dict.get('Flags', [])
scanObject.addMetadata(
self.module_name, 'Image Characteristics', imgChars)
# Make a pretty date format
date = datetime.fromtimestamp(pe.FILE_HEADER.TimeDateStamp)
isoDate = date.isoformat()
scanObject.addMetadata(self.module_name, 'Date', isoDate)
scanObject.addMetadata(
self.module_name, 'Timestamp', pe.FILE_HEADER.TimeDateStamp)
machine = pe.FILE_HEADER.Machine
machineData = {
'Id': machine,
'Type': pefile.MACHINE_TYPE.get(machine)
}
scanObject.addMetadata(
self.module_name, 'Machine Type', machineData)
# Reference: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339%28v=vs.85%29.aspx
scanObject.addMetadata(
self.module_name,
'Image Magic',
IMAGE_MAGIC_LOOKUP.get(pe.OPTIONAL_HEADER.Magic, 'Unknown'))
dllChars = dump_dict.get('DllCharacteristics', [])
scanObject.addMetadata(
self.module_name, 'DLL Characteristics', dllChars)
subsystem = pe.OPTIONAL_HEADER.Subsystem
subName = pefile.SUBSYSTEM_TYPE.get(subsystem)