Created
October 22, 2020 20:26
-
-
Save islem-esi/99d733cf2591aa77c7a841414e934755 to your computer and use it in GitHub Desktop.
get main code section
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#the function takes two arguments, both are fetched from the exe file using | |
#pefile. the first one is the list of all sections. The second one is the | |
#address of the first instruction in the program | |
def get_main_code_section(sections, base_of_code): | |
addresses = [] | |
#get addresses of all sections | |
for section in sections: | |
addresses.append(section.VirtualAddress) | |
#if the address of section corresponds to the first instruction then | |
#this section should be the main code section | |
if base_of_code in addresses: | |
return sections[addresses.index(base_of_code)] | |
#otherwise, sort addresses and look for the interval to which the base of code | |
#belongs | |
else: | |
addresses.append(base_of_code) | |
addresses.sort() | |
if addresses.index(base_of_code)!= 0: | |
return sections[addresses.index(base_of_code)-1] | |
else: | |
#this means we failed to locate it | |
return None |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment