diff --git a/pefile.py b/pefile.py index 8763ab3..456bc8c 100644 --- a/pefile.py +++ b/pefile.py @@ -3967,7 +3967,7 @@ def parse_delay_import_directory(self, rva, size): if error_count > 5: self.__warnings.append( - 'Too may errors parsing the Delay import directory. ' + 'Too many errors parsing the Delay import directory. ' 'Invalid import data at RVA: 0x{0:x}'.format(rva) ) break @@ -4084,7 +4084,7 @@ def parse_import_directory(self, rva, size, dllnames_only=False): if error_count > 5: self.__warnings.append( - 'Too may errors parsing the import directory. ' + 'Too many errors parsing the import directory. ' 'Invalid import data at RVA: 0x{0:x}'.format(rva) ) break @@ -5743,11 +5743,11 @@ def is_driver(self): system_DLLs = set((b'ntoskrnl.exe', b'hal.dll', b'ndis.sys', b'bootvid.dll', b'kdcom.dll')) if system_DLLs.intersection( - [imp.dll.decode('utf-8', 'ignore').lower() for imp in self.DIRECTORY_ENTRY_IMPORT]): + [imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT]): return True driver_like_section_names = set( - ('page', 'paged')) + (b'page', b'paged')) if driver_like_section_names.intersection( [section.Name.lower().rstrip(b'\x00') for section in self.sections]) and ( self.OPTIONAL_HEADER.Subsystem in ( diff --git a/setup.py b/setup.py index 7fc8f8a..81c48bf 100755 --- a/setup.py +++ b/setup.py @@ -86,6 +86,7 @@ def run(self): long_description = "\n".join(_read_doc().split('\n')), cmdclass={"test": TestCommand}, py_modules = ['pefile', 'peutils'], + python_requires=">=3.6.0", packages = ['ordlookup'], install_requires=[ 'future', diff --git a/tests/pefile_test.py b/tests/pefile_test.py index 2b43114..c37b832 100644 --- a/tests/pefile_test.py +++ b/tests/pefile_test.py @@ -477,6 +477,12 @@ def test_driver_check(self): # Ensure the rebased image is the same as the pre-generated one. self.assertEqual(pe_fast.is_driver(), pe_full.is_driver()) + control_file_pe = os.path.join( + REGRESSION_TESTS_DIR, 'issue_322_plaso_test_driver.sys') + + pe = pefile.PE(control_file_pe, fast_load=False) + self.assertEqual(pe.is_driver(), True) + def test_rebased_image(self): """Test correctness of rebased images"""