23 lines
790 B
Python
23 lines
790 B
Python
|
import pefile # type: ignore
|
||
|
|
|
||
|
|
|
||
|
|
class PEFile:
|
||
|
|
def __init__(self, data: bytes) -> None:
|
||
|
|
self.__pe = pefile.PE(data=data, fast_load=True)
|
||
|
|
|
||
|
|
def virtual_to_physical(self, offset: int) -> int:
|
||
|
|
for section in self.__pe.sections:
|
||
|
|
start = section.VirtualAddress + self.__pe.OPTIONAL_HEADER.ImageBase
|
||
|
|
end = start + section.SizeOfRawData
|
||
|
|
|
||
|
|
if offset >= start and offset < end:
|
||
|
|
return (offset - start) + section.PointerToRawData
|
||
|
|
|
||
|
|
raise Exception(f"Couldn't find physical offset for virtual offset 0x{offset:08x}")
|
||
|
|
|
||
|
|
def is_virtual(self, offset: int) -> bool:
|
||
|
|
return offset >= self.__pe.OPTIONAL_HEADER.ImageBase
|
||
|
|
|
||
|
|
def is_64bit(self) -> bool:
|
||
|
|
return hex(self.__pe.FILE_HEADER.Machine) == '0x8664'
|