Lines Matching refs:rva
499 """Get the RVA of the string."""
533 """The next RVA is taken to be the one immediately following this one.
535 Such RVA could indicate the natural end of the string and will be checked
553 def __get_word_value_at_rva(self, rva):
571 """The next RVA is taken to be the one immediately following this one.
573 Such RVA could indicate the natural end of the string and will be checked
838 def get_offset_from_rva(self, rva):
839 return (rva - self.VirtualAddress) + self.PointerToRawData
852 def contains_rva(self, rva):
866 return self.VirtualAddress <= rva < self.VirtualAddress + size
868 def contains(self, rva):
870 return self.contains_rva(rva)
1034 rva: RVA of the relocation
1837 def parse_directory_bound_imports(self, rva, size):
1842 start = rva
1849 self.__data__[rva:rva+bnd_descr_size],
1850 file_offset = rva)
1864 rva += bnd_descr.sizeof()
1872 self.__data__[rva:rva+bnd_descr_size],
1873 file_offset = rva)
1878 rva += bnd_frwd_ref.sizeof()
1903 def parse_directory_tls(self, rva, size):
1914 self.get_data(rva),
1915 file_offset = self.get_offset_from_rva(rva))
1923 def parse_relocations_directory(self, rva, size):
1928 end = rva+size
1931 while rva<end:
1934 # Malware that has bad rva entries will cause an error.
1940 self.get_data(rva, rlc_size),
1941 file_offset = self.get_offset_from_rva(rva) )
1945 'data at RVA: 0x%x' % rva)
1952 rva+rlc_size, rlc.VirtualAddress, rlc.SizeOfBlock-rlc_size)
1961 rva += rlc.SizeOfBlock
1966 def parse_relocations(self, data_rva, rva, size):
1979 rva = reloc_offset+rva))
1984 def parse_debug_directory(self, rva, size):
1993 data = self.get_data(rva+dbg_size*idx, dbg_size)
1997 'data at RVA: 0x%x' % rva)
2002 data, file_offset = self.get_offset_from_rva(rva+dbg_size*idx))
2014 def parse_resources_directory(self, rva, size=0, base_rva = None, level = 0):
2017 Given the rva of the resources directory, it will process all
2037 original_rva = rva
2040 base_rva = rva
2042 resources_section = self.get_section_by_rva(rva)
2045 # If the RVA is invalid all would blow up. Some EXEs seem to be
2046 # specially nasty and have an invalid RVA.
2047 data = self.get_data(rva)
2051 'directory data at RVA: 0x%x' % rva)
2059 file_offset = self.get_offset_from_rva(rva) )
2066 'directory data at RVA: 0x%x' % rva)
2071 # Advance the rva to the positon immediately following the directory
2074 rva += resource_dir.sizeof()
2084 res = self.parse_resource_entry(rva)
2088 'Entry %d is invalid, RVA = 0x%x. ' %
2089 (idx, rva) )
2122 # If the original RVA given to this function is equal to
2185 rva += res.sizeof()
2202 def parse_resource_data_entry(self, rva):
2206 # If the RVA is invalid all would blow up. Some EXEs seem to be
2207 # specially nasty and have an invalid RVA.
2208 data = self.get_data(rva)
2212 'the RVA is invalid: 0x%x' % ( rva ) )
2217 file_offset = self.get_offset_from_rva(rva) )
2222 def parse_resource_entry(self, rva):
2226 self.__IMAGE_RESOURCE_DIRECTORY_ENTRY_format__, self.get_data(rva),
2227 file_offset = self.get_offset_from_rva(rva) )
2576 def parse_export_directory(self, rva, size):
2579 Given the rva of the export directory, it will process all
2597 self.__IMAGE_EXPORT_DIRECTORY_format__, self.get_data(rva),
2598 file_offset = self.get_offset_from_rva(rva) )
2601 'Error parsing export directory at RVA: 0x%x' % ( rva ) )
2616 'Error parsing export directory at RVA: 0x%x' % ( rva ) )
2639 # If the funcion's rva points within the export directory
2643 if symbol_address>=rva and symbol_address<rva+size:
2668 if symbol_address>=rva and symbol_address<rva+size:
2691 def parse_delay_import_directory(self, rva, size):
2697 # If the RVA is invalid all would blow up. Some PEs seem to be
2698 # specially nasty and have an invalid RVA.
2699 data = self.get_data(rva)
2702 'Error parsing the Delay import directory at RVA: 0x%x' % ( rva ) )
2707 data, file_offset = self.get_offset_from_rva(rva) )
2715 rva += import_desc.sizeof()
2725 'Invalid import data at RVA: 0x%x' % ( rva ) )
2744 def parse_import_directory(self, rva, size):
2750 # If the RVA is invalid all would blow up. Some EXEs seem to be
2751 # specially nasty and have an invalid RVA.
2752 data = self.get_data(rva)
2755 'Error parsing the Import directory at RVA: 0x%x' % ( rva ) )
2760 data, file_offset = self.get_offset_from_rva(rva) )
2766 rva += import_desc.sizeof()
2776 'Invalid Import data at RVA: 0x%x' % ( rva ) )
2888 def get_import_table(self, rva):
2892 while True and rva:
2894 data = self.get_data(rva)
2898 'Invalid data at RVA: 0x%x' % ( rva ) )
2907 format, data, file_offset=self.get_offset_from_rva(rva) )
2912 rva += thunk_data.sizeof()
2970 def get_data(self, rva, length=None):
2973 Given a rva and the size of the chunk to retrieve, this method
2977 s = self.get_section_by_rva(rva)
2980 if rva<len(self.header):
2982 end = rva+length
2985 return self.header[rva:end]
2987 raise PEFormatError, 'data at RVA can\'t be fetched. Corrupt header?'
2989 return s.get_data(rva, length)
2993 """Get the rva corresponding to this file offset. """
3000 def get_offset_from_rva(self, rva):
3001 """Get the file offset corresponding to this rva.
3003 Given a rva , this method will find the section where the
3007 s = self.get_section_by_rva(rva)
3010 raise PEFormatError, 'data at RVA can\'t be fetched. Corrupt header?'
3012 return s.get_offset_from_rva(rva)
3015 def get_string_at_rva(self, rva):
3018 s = self.get_section_by_rva(rva)
3020 if rva<len(self.header):
3021 return self.get_string_from_data(rva, self.header)
3024 return self.get_string_from_data(rva-s.VirtualAddress, s.data)
3050 def get_string_u_at_rva(self, rva, max_length = 2**16):
3054 # If the RVA is invalid all would blow up. Some EXEs seem to be
3055 # specially nasty and have an invalid RVA.
3056 data = self.get_data(rva, 2)
3065 uchr = struct.unpack('<H', self.get_data(rva+2*idx, 2))[0]
3087 def get_section_by_rva(self, rva):
3090 sections = [s for s in self.sections if s.contains_rva(rva)]
3231 dump.add_line('%-10s %-10s %s' % ('Ordinal', 'RVA', 'Name'))
3371 reloc.rva, RELOCATION_TYPE[reloc.type][16:]), 4)
3374 reloc.rva, reloc.type), 4)
3381 def get_physical_by_rva(self, rva):
3382 """Gets the physical address in the PE file from an RVA value."""
3384 return self.get_offset_from_rva(rva)
3413 def get_dword_at_rva(self, rva):
3414 """Return the double word value at the given RVA.
3416 Returns None if the value can't be read, i.e. the RVA can't be mapped
3421 return self.get_dword_from_data(self.get_data(rva)[:4], 0)
3435 def set_dword_at_rva(self, rva, dword):
3436 """Set the double word value at the file offset corresponding to the given RVA."""
3437 return self.set_bytes_at_rva(rva, self.get_data_from_dword(dword))
3470 def get_word_at_rva(self, rva):
3471 """Return the word value at the given RVA.
3473 Returns None if the value can't be read, i.e. the RVA can't be mapped
3478 return self.get_word_from_data(self.get_data(rva)[:2], 0)
3492 def set_word_at_rva(self, rva, word):
3493 """Set the word value at the file offset corresponding to the given RVA."""
3494 return self.set_bytes_at_rva(rva, self.get_data_from_word(word))
3526 def get_qword_at_rva(self, rva):
3527 """Return the quad-word value at the given RVA.
3529 Returns None if the value can't be read, i.e. the RVA can't be mapped
3534 return self.get_qword_from_data(self.get_data(rva)[:8], 0)
3548 def set_qword_at_rva(self, rva, qword):
3549 """Set the quad-word value at the file offset corresponding to the given RVA."""
3550 return self.set_bytes_at_rva(rva, self.get_data_from_qword(qword))
3564 def set_bytes_at_rva(self, rva, data):
3565 """Overwrite, with the given string, the bytes at the file offset corresponding to the given RVA.
3571 offset = self.get_physical_by_rva(rva)
3646 # 16bit value at RVA=entry.rva
3649 entry.rva,
3650 ( self.get_word_at_rva(entry.rva) + relocation_difference>>16)&0xffff )
3656 # at RVA=entry.rva
3659 entry.rva,
3660 ( self.get_word_at_rva(entry.rva) + relocation_difference)&0xffff)
3665 # Add relocation_difference to the value at RVA=entry.rva
3668 entry.rva,
3669 self.get_dword_at_rva(entry.rva)+relocation_difference)
3675 # composed from the (16bit value at RVA=entry.rva)<<16 plus
3687 self.set_word_at_rva( entry.rva,
3688 ((self.get_word_at_rva(entry.rva)<<16) + next_entry.rva +
3693 # RVA=entry.rva
3696 entry.rva,
3697 self.get_qword_at_rva(entry.rva) + relocation_difference)
