
    W:Jj8!                        d Z ddlmZ ddlZddlZddlZddlmZ dZdZ	ddZ
ddZdd	Zdd
ZddZddZddZddZddZddZedk(  r e        yy)z?Summarize PE imports and simple IAT references for Hwanse2.exe.    )annotationsN)Path   l        c                r    | j                  d|      }|dk  rt        |       }| || j                  dd      S )N    r   asciireplaceerrors)findlendecode)dataoffsetends      2/home/exedev/hwanse/tools/summarize_exe_imports.pyc_stringr      s?    
))GV
$C
Qw$is""79"==    c           	        | d d dk7  rt        d      t        j                  d| d      d   }| ||dz    dk7  rt        d	      |dz   }t        j                  d
| |dz         d   }t        j                  d
| |dz         d   }|dz   }t        j                  d
| |      d   }|dk7  rt        d      t        j                  d| |dz         d   }t        j                  d| |dz   t        dz  z         \  }}	g }
||z   }t	        |      D ]l  }||dz  z   }| ||dz    j                  dd      d   j                  dd      }t        j                  d| |dz         \  }}}}|
j                  |||||d       n |||
fS )N   s   MZznot an MZ executable<I<   r      s   PE  znot a PE executable<H      i  zonly PE32 is supported   z<II`      (   r   r   r   r	   r
   z<IIII)namevirtualAddressvirtualSizerawSize
rawPointer)
ValueErrorstructunpack_fromIMAGE_DIRECTORY_ENTRY_IMPORTrangesplitr   append)r   	pe_offsetfile_headersection_countoptional_sizeoptionalmagic
image_base
import_rvaimport_sizesectionssection_tableindexr   r!   virtual_sizevirtual_addressraw_sizeraw_ptrs                      r   
pe_headersr=      s   BQx5/00""4t4Q7IIi!m$5.//a-K&&tT;?CAFM&&tT;3CDQGMRHtT84Q7E~122##D$2>qAJ$00hmNjmnNn>noJH},M}% 
+F6A:&,,Wa8;BB7S\B];A;M;MgW[]cfg]g;h8ox"1+#%	
	
 z8++r   c                    |D ]7  }|d   }t        |d   |d         }|| cxk  r	||z   k  s)n ,|d   | |z
  z   c S  t        d| dd      )Nr"   r#   r$   r%   zRVA 0x08xz is outside known sections)maxr&   )rvar6   sectionstartsizes        r   rva_to_offsetrE   9   sp     9()7=)79+=>C&%$,&<(C%K88	9
 vc#Y&@A
BBr   c                "    |d   }| |||d   z    S )Nr%   r$    )r   rB   rC   s      r   section_bytesrH   B   s#    L!Eegi0011r   c                R   t        j                  d||z         }g }|D ]  }|d   dvrt        | |      }|j                  |      }|dk\  s.|dk\  r||dz
  | dk(  r|dz
  n|}	|j	                  |d   |d   |	z   ||d   z   |	z   d       |j                  ||d	z         }|dk\  rY |S )
Nr   r!   >   .data.rdata.textr   r   s   %r"   rB   rA   var   )r'   packrH   r   r,   )
r   r6   r3   iat_rvaneedlerefsrB   bodyr8   	ref_indexs
             r   find_iat_refsrU   G   s    [[zG34FD 16?">>T7+		&!qj%*aZD54I[4X	^cIKK&v"#34y@$w/?'@@9L IIfeai0E qj1 Kr   c           
     F   g }|D ]  }|d   dk7  rt        | |      }t        dt        dt        |      dz
              D ]]  }||   dk7  rt	        j
                  d||dz         d   }||d   z   |z   }	|	d	z   |z   |k(  s@|j                  |d   |d   |z   |	d
       _  |S )Nr!   rL   r   r      z<ir   r"      rM   )rH   r*   r@   r   r'   r(   r,   )
r   r6   r3   	target_varR   rB   rS   r8   rel	source_vas
             r   find_relative_callsr\   \   s    D 6?g%T7+1c!SY]34 	EE{d"$$T4;A>C"W-=%>>FI1}s"i/#*6?&'785@'		" Kr   c                    |t         z  rd|dz  iS t        ||      }t        j                  d| |      d   }|t	        | |dz         dS )Nordinali  r   r   r   )hintr!   )IMAGE_ORDINAL_FLAG32rE   r'   r(   r   )r   r6   thunk_valuename_offsetr_   s        r   read_import_namerc   r   sV    ));/00X6KdD+6q9D(4q"ABBr   c                   | j                         }t        |      \  }}}t        ||      }g }|}	 t        j                  d||      \  }}	}
}}t        |||g      snt        |t        ||            }|xs |}t        ||      }g }d}	 t        j                  d|||dz  z         d   }|dk(  rnxt        |||      }||dz  z   }||d<   ||z   |d<   t        ||||      |d<   |d   D cg c]  }t        ||||d         D ]  }|  c}}|d	<   |j                  |       |d
z  }|j                  ||d       |dz  }t        |       ||dS c c}}w )Nz<IIIIIr   r   r   iatRvaiatVarR   rN   callRefsr   )dll	functionsr   )exe	imageBaseimports)
read_bytesr=   rE   r'   r(   anyr   rc   rU   r\   r,   str)pathr   r3   r4   r6   import_offsetdllsdescriptor_offsetoriginal_first_thunk_time
_forwardername_rvafirst_thunkdll_name	thunk_rvathunk_offsetri   r8   ra   importedrP   refcall_refs                          r   parse_importsr   z   s   ??D'1$'7$J
H!*h7MD%
IOI[I[J
FeZ;
 ((K@AD-("CD(7K	$Y9	 ,,T4PQ	9QRSTUKa'hDH!EAI-G!(HX *W 4HW,T8ZQHV $F+$ 3D(JPSTXPY Z$  $$HZ 
 X&QJE   	H9=>R= B 4y $s   +Ec                X   ddd| d    dd| d   dddd	dd
dg	}| d   D ]  }|d   D cg c]&  }|j                  dd|j                  d             ( }}dj                  |d d       }t        |      dkD  r|dt        |      dz
   dz  }|j                  d|d    dt        |       d| d        |j	                  g d       | d   D ]2  }|d   j                         dvr|j	                  d|d    dddg       |d   D ]  }dj                  d |d   d d  D              }t        |d         d kD  r|dt        |d         d z
   dz  }dj                  d! |d"   d d D              }t        |d"         dkD  r|dt        |d"         dz
   dz  }|j                  d|j                  ddt        |j                  d            z          d#|d$   dd%|xs d& d|xs d& d	        |j                  d       5 d'j                  |      j                         d'z   S c c}w )(Nz# EXE Imports zExecutable: `rj   `zImage base: `0xrk   r?   z## Imported DLLsz%| DLL | functions | notable imports |z| --- | ---: | --- |rl   ri   r!   zordinal:r^   z,    z, ... (+)z| rh   z | z |)r   z## DirectX Importsr   >   	DDRAW.DLL
DINPUT.DLL
DSOUND.DLLz### z,| import | IAT VA | thunk refs | call refs |z| --- | --- | --- | --- |c              3  8   K   | ]  }|d     d|d   d  ywrB   z:0xrN   r?   NrG   .0r}   s     r   	<genexpr>zmarkdown.<locals>.<genexpr>   s&     _sI/s3t9S/B_   rR   r   c              3  8   K   | ]  }|d     d|d   d  ywr   rG   r   s     r   r   zmarkdown.<locals>.<genexpr>   s&     !iCS^$4CD	#"G!ir   rg   z | `0xrf   z` | -
)getjoinr   r,   extendupperro   rstrip)summarylinesrh   itemnamesnotablerR   	call_refss           r   markdownr      s   

'q)
'+.s315

/
E y! EPST_P`a&HTXXi-@,A"BCaa))E#2J'u:?#e*r/!2!44Gr#e*SUCyCDE 
LL/0y! u:%NNSZL)2/]_z{|$ 
	D99_dSYl[]\]N^__D4< 1$(3tF|#4q#8"9;;		!iSWXbScdgegSh!iiI4
#$r)xD,<(=(B'C1EE	LLTXXfj3txx	7J3K&KLM N7mC(T[SMY=M#<NbR
	 	R" 99U""$t++1 bs   +H'c                    t        j                  t              } | j                  dt        t	        d             | j                  dt        t	        d             | j                  ddd	t        d 
       | j                         }t        |j                        }|j                  j                  j                  dd       |j                  j                  t        j                  |dd      dz   d       |j                  r&|j                  j                  t        |      d       t!        d|j                          y )N)descriptionz--exezHwanse2.exe)typedefaultz
--json-outzout/exe_imports.jsonz--md-outz--outmd_out)destr   r   T)parentsexist_okFr   )ensure_asciiindentr   zutf-8)encodingzwrote EXE import summary -> )argparseArgumentParser__doc__add_argumentr   
parse_argsr   rj   json_outparentmkdir
write_textjsondumpsr   r   print)parserargsr   s      r   mainr      s    $$9F
dD4GH
4>T9UV

G(tTDDHH%GMMtd;MMTZZeANQUU`gh{{x07C	(
89r   __main__)r   bytesr   intreturnro   )r   r   r   ztuple[int, int, list[dict]])rA   r   r6   
list[dict]r   r   )r   r   rB   dictr   r   )
r   r   r6   r   r3   r   rP   r   r   r   )
r   r   r6   r   r3   r   rY   r   r   r   )r   r   r6   r   ra   r   r   r   )rp   r   r   r   )r   r   r   ro   )r   None)r   
__future__r   r   r   r'   pathlibr   r)   r`   r   r=   rE   rH   rU   r\   rc   r   r   r   __name__rG   r   r   <module>r      sp    E "      ! ! > ,FC2
*,C+\%,P: zF r   