From cd59e48ccb823c249769d9c3502e92155c2edadd Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 2 Jul 2024 08:43:20 +0100 Subject: [PATCH] Replace list comprehension with set comprehension Amends function is_driver to take intersection between two sets, rather than a set and a list. --- pefile.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pefile.py b/pefile.py index cd8cc6e..5923818 100644 --- a/pefile.py +++ b/pefile.py @@ -7780,7 +7780,7 @@ def is_driver(self): # Checking that the ImageBase field of the OptionalHeader is above or # equal to 0x80000000 (that is, whether it lies in the upper 2GB of # the address space, normally belonging to the kernel) is not a - # reliable enough indicator. For instance, PEs that play the invalid + # reliable enough indicator. For instance, PEs that play the invalid # ImageBase trick to get relocated could be incorrectly assumed to be # drivers. @@ -7805,18 +7805,17 @@ def is_driver(self): # self.DIRECTORY_ENTRY_IMPORT will now exist, although it may be empty. # If it imports from "ntoskrnl.exe" or other kernel components it should # be a driver - # system_DLLs = { b"ntoskrnl.exe", b"hal.dll", b"ndis.sys", b"bootvid.dll", b"kdcom.dll" } if system_DLLs.intersection( - [imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT] + {imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT} ): return True driver_like_section_names = {b"page", b"paged"} if driver_like_section_names.intersection( - [section.Name.lower().rstrip(b"\x00") for section in self.sections] + {section.Name.lower().rstrip(b"\x00") for section in self.sections} ) and ( self.OPTIONAL_HEADER.Subsystem in (