Skip to content

Commit

Permalink
Fixes for issue #322, #321, and #318
Browse files Browse the repository at this point in the history
* Fixed is_driver(), I was comparing bytes to decoded strings.
* Add test for is_driver() check
* Fixed some types in warning messages
* Made Python >=3.6 a requirement
  • Loading branch information
erocarrera committed May 24, 2021
1 parent 9dea8ee commit de77a93
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 4 deletions.
8 changes: 4 additions & 4 deletions pefile.py
Original file line number Diff line number Diff line change
Expand Up @@ -3967,7 +3967,7 @@ def parse_delay_import_directory(self, rva, size):

if error_count > 5:
self.__warnings.append(
'Too may errors parsing the Delay import directory. '
'Too many errors parsing the Delay import directory. '
'Invalid import data at RVA: 0x{0:x}'.format(rva) )
break

Expand Down Expand Up @@ -4084,7 +4084,7 @@ def parse_import_directory(self, rva, size, dllnames_only=False):

if error_count > 5:
self.__warnings.append(
'Too may errors parsing the import directory. '
'Too many errors parsing the import directory. '
'Invalid import data at RVA: 0x{0:x}'.format(rva) )
break

Expand Down Expand Up @@ -5743,11 +5743,11 @@ def is_driver(self):
system_DLLs = set((b'ntoskrnl.exe', b'hal.dll', b'ndis.sys',
b'bootvid.dll', b'kdcom.dll'))
if system_DLLs.intersection(
[imp.dll.decode('utf-8', 'ignore').lower() for imp in self.DIRECTORY_ENTRY_IMPORT]):
[imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT]):
return True

driver_like_section_names = set(
('page', 'paged'))
(b'page', b'paged'))
if driver_like_section_names.intersection(
[section.Name.lower().rstrip(b'\x00') for section in self.sections]) and (
self.OPTIONAL_HEADER.Subsystem in (
Expand Down
1 change: 1 addition & 0 deletions setup.py
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ def run(self):
long_description = "\n".join(_read_doc().split('\n')),
cmdclass={"test": TestCommand},
py_modules = ['pefile', 'peutils'],
python_requires=">=3.6.0",
packages = ['ordlookup'],
install_requires=[
'future',
Expand Down
6 changes: 6 additions & 0 deletions tests/pefile_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -477,6 +477,12 @@ def test_driver_check(self):
# Ensure the rebased image is the same as the pre-generated one.
self.assertEqual(pe_fast.is_driver(), pe_full.is_driver())

control_file_pe = os.path.join(
REGRESSION_TESTS_DIR, 'issue_322_plaso_test_driver.sys')

pe = pefile.PE(control_file_pe, fast_load=False)
self.assertEqual(pe.is_driver(), True)


def test_rebased_image(self):
"""Test correctness of rebased images"""
Expand Down

0 comments on commit de77a93

Please sign in to comment.