Skip to content

Commit

Permalink
Ran black
Browse files Browse the repository at this point in the history
  • Loading branch information
erocarrera committed Aug 26, 2024
1 parent bacbdad commit 33e5c75
Showing 1 changed file with 15 additions and 4 deletions.
19 changes: 15 additions & 4 deletions pefile.py
Original file line number Diff line number Diff line change
Expand Up @@ -3414,10 +3414,17 @@ def parse_rich_header(self):

# PE files are stored in little-endian order, the same byte order as an x86
# https://wiki.osdev.org/PE
checksum = int.from_bytes(key, 'little')
checksum = int.from_bytes(key, "little")
# the checksum should be present 3 times after the DanS signature
if data[0] ^ checksum != DANS or data[1] != checksum or data[2] != checksum or data[3] != checksum:
self.__warnings.append("Rich Header is not in Microsoft format, possibly malformed")
if (
data[0] ^ checksum != DANS
or data[1] != checksum
or data[2] != checksum
or data[3] != checksum
):
self.__warnings.append(
"Rich Header is not in Microsoft format, possibly malformed"
)

result["checksum"] = checksum
headervalues = []
Expand Down Expand Up @@ -7868,7 +7875,11 @@ def is_driver(self):
# If it imports from "ntoskrnl.exe" or other kernel components it should
# be a driver
system_DLLs = {
b"ntoskrnl.exe", b"hal.dll", b"ndis.sys", b"bootvid.dll", b"kdcom.dll"
b"ntoskrnl.exe",
b"hal.dll",
b"ndis.sys",
b"bootvid.dll",
b"kdcom.dll",
}
if system_DLLs.intersection(
{imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT}
Expand Down

0 comments on commit 33e5c75

Please sign in to comment.