Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace list comprehension with set comprehension #415

Merged
merged 1 commit into from
Aug 26, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions pefile.py
Original file line number Diff line number Diff line change
Expand Up @@ -7780,7 +7780,7 @@ def is_driver(self):
# Checking that the ImageBase field of the OptionalHeader is above or
# equal to 0x80000000 (that is, whether it lies in the upper 2GB of
# the address space, normally belonging to the kernel) is not a
# reliable enough indicator. For instance, PEs that play the invalid
# reliable enough indicator. For instance, PEs that play the invalid
# ImageBase trick to get relocated could be incorrectly assumed to be
# drivers.

Expand All @@ -7805,18 +7805,17 @@ def is_driver(self):
# self.DIRECTORY_ENTRY_IMPORT will now exist, although it may be empty.
# If it imports from "ntoskrnl.exe" or other kernel components it should
# be a driver
#
system_DLLs = {
b"ntoskrnl.exe", b"hal.dll", b"ndis.sys", b"bootvid.dll", b"kdcom.dll"
}
if system_DLLs.intersection(
[imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT]
{imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT}
):
return True

driver_like_section_names = {b"page", b"paged"}
if driver_like_section_names.intersection(
[section.Name.lower().rstrip(b"\x00") for section in self.sections]
{section.Name.lower().rstrip(b"\x00") for section in self.sections}
) and (
self.OPTIONAL_HEADER.Subsystem
in (
Expand Down
Loading