+ hcsRtRtRtRt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIt^RIt^RIHt^RIHtHtHtHt^RIHt^RIt]P4!R]P6!R 44]tRR lt]!R R 7R4tRt R t!Rt"Rt#Rt$Rt%Rt&R t'Rt(^ t)Rt*Rt+Rt,Rt-Rt.Rt/Rt0Rt1^t2Rt3Rt4Rt5Rt6Rt7.ROt8]7!]84t9.ROt:]7!]:4t;.RNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNt<]7!]<4t=.ROt>]7!]>4t?.ROt@]7!]@4tA.RNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNtB]7!]B4tC.ROtD]7!]D4tE.ROtF]7!]F4tG.ROtH]7!]H4tIRtJRtK.ROtL]7!]L4tM.ROtN]7!]N4tO^tP^tQ^tR^tS^tT^tU^tV^tW^ tX^ tY.ROtZ]7!]Z4t[.RNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNERNERNERNERNERNERNERNERNERNER NER NER NER NER NERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNER NER!NER"NER#NER$NER%NER&NER'NER(NER)NER*NER+NER,NER-NER.NER/NER0NER1NER2NER3NER4NER5NER6NER7NER8NER9NER:NER;NERNER?NER@NERANERBNERCNERDNERENERFNERGNERHNERINERJNERKNt\]7!]\4t].ERLNERMNERNNERONERPNERQNERRNERSNERTNERUNERVNERWNERXNERYNERZNER[NER\NER]NER^NER_NER`NERaNERbNERcNERdNEReNERfNERgNERhNERiNERjNERkNERlNERmNERnNERoNERpNERqNERrNERsNERtNERuNERvNERwNERxNERyNERzNER{NER|NER}NER~NERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNt^]7!]^4t_]`!]^4t_]^F-wtatb]b]_9d]_]b,P]a4K']a.]_]b&K/ R tdR!teR"tfR#tgR$th!R%R&]i4tj!R'R(4tk!R)R*]l4tm!R+R,4tnR-^R.^R/^R0^R1^R2^R3^R4^R5^R6^R7^R8^R9^R:^R;^/to]!R R 7R<4tp]!R R=R>7R?4tq!R@RA4tr!RBRC]r4ts]!R R R>7RD4tt!RERF]r4tu!RGRH4tv!RIRJ]v4tw!RKRL]v4tx!RMRN]v4ty!RORP]v4tz!RQRR]v4t{!RSRT]v4t|!RURV]v4t}!RWRX]v4t~!RYRZ]v4t!R[R\]v4t!R]R^]v4t!R_R`]v4t!RaRb]v4t!RcRd]v4t!ReRf]v4t!RgRh]v4t!RiRj]v4t!RkRl]v4t!RmRn]v4t!RoRp]u4t!RqRr4t!RsRt]4t!RuRv]4t!RwRx]4t!RyRz]4t!R{R|]4t!R}R~]4t!RR]4t!RR]4t!RR]4t!RR]4t!RR4t] EP.] EP0,] EP2,R,EP54tRt] EP.] EP0,] EP2,EP54t]!R R 7ERRRll4t!RR4tRt]R8Xd ]!4R#R#(abpefile, Portable Executable reader module All the PE file basic structures are available with their default names as attributes of the instance returned. Processed elements such as the import table are made available with lowercase names, to differentiate them from the upper case basic structure names. pefile has been tested against many edge cases such as corrupted and malformed PEs as well as malware, which often attempts to abuse the format way beyond its standard use. To the best of my knowledge most of the abuse is handled gracefully. Copyright (c) 2005-2024 Ero Carrera z Ero Carreraz 2024.8.26zero.carrera@gmail.comN)Counter)md5sha1sha256sha512)Unionbackslashreplace_backslashreplaceFcsVaaV'g\P!SS4#VV3RlpV#)cs<a\P!SS4!V4o\P!V4V3Rl4pV#)cs<<\P!S!V/VB4#N)copymodcopy)argskwargs cached_funcs*,+/usr/lib/python3.14/site-packages/pefile.pywrapperZ-lru_cache..decorator..wrapper8s<< T .decorator5s<))'59!<   >  >r)rr)rrr rsff& rrr1s& ""7E22 r)rcstVR8dTpV'd'W,'dV\W, 4,#V#))int)valsection_alignmentfile_alignment&&&rcache_adjust_SectionAlignmentrBs56!*S44 C(?$@AA Jrcs$VP^4#)count)data&r count_zeroesr$Rs ::a=r iMZiZMiNEiLEiLXiVZiPEli i csn\VUu.uFq^,V^,3NK upV,4#uupi))dict)Zpairse& r two_way_dictr.s. u-u!A$!u-5 66-s2cs\PVR4p\PV.4F pW#9gK Vu# \PVR.4^,#) *unknown*)LANGgetSUBLANG)Z lang_value sublang_valueZ lang_name sublang_name&& rget_sublang_name_for_langr6sO[1I M26   $  7 ;;}{m 4Q 77rcs^p^pV\V48dWV^,p\V4^8dR#\P!RV4^,pV^, pV^8wd^^V^,u;8:d\V48:d?MM;WW6^,,PR4W!&V^8dR#W6^,, pV^, pKR# \d T^, pL;i;i)r zQQr)rSrR) __name__ __module__ __qualname____firstlineno__rQrWrZ__static_attributes____classdictcell__ __classcell__rU __classdict__@@rrOrOs G RRrrOcs`a]tRtRtoRtRtRtRtRtRt Rt R t R t R t R tR tVtR#)!UnicodeStringWrapperPostProcessorizThis class attempts to help the process of identifying strings that might be plain Unicode or Pascal. A list of strings will be wrapped on it with the hope the overlappings will help make the decision about their type.cs,WnW nRVnR#r)perva_ptrstring)rTrfrgrrrQZ*UnicodeStringWrapperPostProcessor.__init__s  rc VP#)zGet the RVA of the string.)rgrYr#rget_rvaZ)UnicodeStringWrapperPostProcessor.get_rvas ||rc s&VPRR4#)z6Return the escaped UTF-8 representation of the string.utf-8r)r;rYr#r__str__Z)UnicodeStringWrapperPostProcessor.__str__s{{7$788rcs^VP'gR#VPP!V!#)rhr;)rTr s&*rr;Z(UnicodeStringWrapperPostProcessor.decodes#{{{{{!!4((rc s RpR#)z>Make this instance None, to express it's no known string type.NrMrYr#r invalidateZ,UnicodeStringWrapperPostProcessor.invalidatesrcs@VPPVP^,VP4R7VnR# \ dNTPP 4PRPTP^,44R#i;i) max_lengthzCFailed rendering pascal string, attempting to read from RVA 0x{0:x}N) rfget_string_u_at_rvargget_pascal_16_lengthrh PEFormatError get_warningsappendformatrYr#rrender_pascal_16Z2UnicodeStringWrapperPostProcessor.render_pascal_16s} ''55 q T-F-F-H6DK  GG " ) )66&5DKrcsVPPVP4VnR# \dGTPP 4P RPTP44R#i;i)zDFailed rendering unicode string, attempting to read from RVA 0x{0:x}N)rfrsrgrhrurvrwrxrYr#rrender_unicode_16Z3UnicodeStringWrapperPostProcessor.render_unicode_16(s^ ''55dllCDK  GG " ) )66A?)r~rfrgrhN)r[r\r]r^__doc__rQrjrlr;roryrtrzrrr_r`rc@rreresA"  9)  : , rrec0a]tRtRtoRtRtRtRtVtR#)rui2z"Generic PE format error exception.cWnR#rrJ)rTrJrrrQZPEFormatError.__init__5s rcs,\VP4#r)reprrJrYr#rrlZPEFormatError.__str__8sDJJrrN) r[r\r]r^rrQrlr_r`rrrruru2s,  rrucsZa]tRtRtoRtRtR RltR RltR RltRt Rt R t R t Vt R #) Dumpi<z1Convenience class for dumping the PE information.cs.VnR#rtextrYr#rrQZ Dump.__init__?s  rc s:VFpVPW24K R#)zUAdds a list of lines. The list can be indented with the optional argument 'indent'. N)add_line)rTtxtindentline&&& r add_linesZDump.add_linesBs D MM$ 'rc s8VPVR,V4R#)zLAdds a line. The line can be indented with the optional argument 'indent'.  N)rWrTrrrrrZ Dump.add_lineJs tV$rc sjVPPRPRV,V44R#)zlAdds some text, no newline will be appended. The text can be indented with the optional argument 'indent'. z{0}{1} N)rrwrxrrrrWZDump.addQs% vs;Z Dump.get_text..bs: 1u||A s )joinrrYr#rget_textZ Dump.get_text`sww: :::rrNr)r[r\r]r^rrQrrrWrrrr_r`rrrrr<s0;(%=;;;rrxcrZBZhZHr=Ir<ZLrZqZQdsc sl^pTpV^,\P9dx\RPVUu.uFq3\P9gKVNK up44pRPVUu.uFq3\P9gKVNK up4p\V,V,#uupiuupi)r*rn)rhdigitsrrSTRUCT_SIZEOF_TYPES)Ztr!Z_tr& r sizeof_typerxs E Btv}}BGG@1&---?QQ@AB WW=Av}}& r "U **A=sB, B, 0B1 B1T)rr c s Rp.p/p.p^p^pVFpRV9gK VPR^4wrW, pVPR4V PR4p .p V F\p W9d?VU u.uFqR\V 4NK p p V PV 4pRP W4p V PV 4WcV &K^ V\ V4, pVPV 4K \ P!V4pVVVVV3#uup i)<,Nz {0}_{1:d})splitrwr8r!rxrr9Zcalcsize)rx__format_str____unpacked_data_elms____field_offsets____keys____format_length__offsetelmelm_typeelm_nameZ elm_namesZnamesrZ search_listZ occ_counts& r set_formatrs"NH F #:!$3!2 H  &N " ) )$ / s+IE%'?G"Hx!_s8}#5xK"H + 1 1( ;I*11(FH X&.4(+ & k(+ +F OOE "+.7   #Is*Dcsa]tRtRtoRtRRltV3RlRltRtRtR t R t R t R t R t RtRtRtRRltRtRtVtR#) StructureizPrepare structure object to extract members from data. Format is a list containing definitions for the elements of the structure. NcsJRVn.Vn^Vn/Vn.VnV^,p\ V\ 4'g \ V4p\V4wVnVnVnVnVnRVnW0n V'd W n R#V^,Vn R#)rFN) rrrrrrAtupler__all_zeroes____file_offset__name)rTrxr file_offsetr&&&& rrQZStructure.__init__s! !"!#&(# 1I!U##aA qM     '  " M  "$* Iq DIrcs <V^8dQhRS[/#)rpreturn)rBrxrc"r __annotate__ZStructure.__annotate__s###rcrir)rrYr#r__get_format__ZStructure.__get_format__"""rc sJVPVPV,,#)zLReturn the offset within the field for the requested field in the structure.)rrrTZ field_namerrget_field_absolute_offsetZ#Structure.get_field_absolute_offsets##d&<&HCG}}S))!$,> *   g &?{{4..<<r)rrr)rTrr-r__repr__ZStructure.__repr__sB HH499;?;achhqwwy);? @  ?s(A c  s.pVPRPVP44\PUu.uF$q3\P 9gK\ V4NK& ppVPEFpVEFp\W4p\V\\34'dVPR4'dRPV4pMRPV4pVR8XgVR8Xd;VR\P!\P!V44,, pMM\#V4pVPR 4'dAR P%VP'R 4Uu.uFpR PV4NK up4pMPR P%VP'R 4Uu.uF%pW49d \)V4MR PV4NK' up4pVPRVP*V,VP,,VP*V,VR,V3,4EK EK V#uupi \ d TR, pL}i;iuupiuupi)z1Returns a string representation of the structure.z[{0}]Z Signature_z{:<8X}z0x{:<8X} TimeDateStamp dwTimeStampz [%s UTC]z [INVALID TIME] Signaturernz{:02X}z \x{0:02x}z0x%-8X 0x%-3X %-30s %s:)rwrxrrh printableZ whitespaceordrrrArlongrDtimeasctimegmtime ValueError bytearrayrrstripchrrr) rT indentationrr=Zprintable_bytesr@rrZval_strs && rrZStructure.dumps GNN499-.#,, ,q9J9J0JFCF,  MMDd(cC;//~~l33"*//#"6","3"3C"8o- 1E9#{T\\$++cBR5S'SSG2F (nG~~k22"$''9@9PQ9PAX__Q/9PQ##%'' *1)@ *AA%&$8!$A%1%8%8%;!<*A # ,..s3d6J6JJ..s3c  9"N [ " *9#'88G9 Rs)H?H?18I+I ++I# IIc  s/pVPVR&VPFpVFp\W4p\V\\ 34'dEVR8XgVR8Xd6RV\ P!\ P!V443,pMJMIRPRVUu.uF&p\V\4'g \V4MTNK( up44pRVPV,VP,R VPV,R V/W&K K V# \d RT,pL]i;iuupi) z5Returns a dictionary representation of the structure.rrrz0x%-8X [%s UTC]z0x%-8X [INVALID TIME]rnc3s"TF7p\V4\P9d \V4MRV,xK9 R#5i)z\x%02xN)rrhr)rrr-rrZ&Structure.dump_dict..ds5"!WA#&a&F,<,<"<A)a-O!Ws?AZ FileOffsetOffsetZValue)rrrrArrrrrrrrrr)rT dump_dictr@rrrrrrZStructure.dump_dictNs6 !% +MMDd(cC;//o- 1E@"3 # $ T[[-= >7#C2F''"SV!WSVa 1c0B0B#a&"ISV!W"C !$"8"8"=@T@T"Td44S9S" #"0 *@"9C"?C@ "Xs3D!",D;!D87D8)rrrrrrrrNNr)r[r\r]r^rrQrrrrrrrrrrlrrrr_r`rrrrrs\ "8##I2$&# & (* =& 4l!!rrcsaa]tRtRtoRtV3RltRtRtRRltRt Rt R t R t R t R tR tRtRtRtRtRtRtVtV;t#)SectionStructureirz#Convenience section handling class.cs<RV9dVR,VnVRRVnRVnRVnRVn\ SV`!V/VBRVnRVnRVn RVn R#)rfN) rfPointerToRawDataVirtualAddress SizeOfRawDataMisc_VirtualSizerPrQPointerToRawData_adjVirtualAddress_adjsection_min_addrsection_max_addr)rTr r rUs&*,rrQZSectionStructure.__init__usn 6>TlDGt $"! $ $)&)$(!"& $ $rcs@VPfVPexVPPVP4pVPPP R8d(VPVP 8Xd VP pWnVP#)Nr)rrrfadjust_PointerToRawDataOPTIONAL_HEADERSectionAlignmentr)rTZptrdr-rget_PointerToRawData_adjZ)SectionStructure.get_PointerToRawData_adjs~  $ $ ,1F1F1R772243H3HID ww&&77&@((D,?,??..D(, %(((rcs"VPfwVPeiVPPVPVPPP VPPP 4VnVP#r)rrrfadjust_SectionAlignmentrr FileAlignmentrYr#rget_VirtualAddress_adjZ'SectionStructure.get_VirtualAddress_adjsn  " " *"".*.''*I*I''GG++<<GG++99+' &&&rc sVfVP4pM+WP4, VP4,pVe WB,pM#VPeW@P,pMTpV'd%Ve!Ve\WTVP,4pVP eMVPe?WPP VP,8dVP VP,pVP PWE#)aGet data chunk from a section. Allows to query data from the section by passing the addresses where the PE file would be loaded by default. It is then possible to retrieve code and data by their real addresses as they would be if loaded. Note that sections on disk can include padding that would not be loaded to memory. That is the case if `section.SizeOfRawData` is greater than `section.Misc_VirtualSize`, and that means that data past `section.Misc_VirtualSize` is padding. In case you are not interested in this padding, passing `ignore_padding=True` will truncate the result in order not to return the padding (if any). Returns bytes(). )rrrrRrrrf__data__)rTstartr~Zignore_paddingrend&&&& rr|ZSectionStructure.get_datas& =224F3355--/0F  /C    +---CC co&2DcD$9$99:C  ,1C1C1O**T-?-???++d.@.@@ww++rcsTVR8Xd\\R4p\WV4MuRV9do\W4'd^V'd,VPR;;,\V,,uu&M*VPR;;,\V,,uu&W PV&R#)Characteristics IMAGE_SCN_N)rGSECTION_CHARACTERISTICSrLhasattrrH)rTrr section_flagsrr __setattr__ZSectionStructure.__setattr__s{ $ $*+BLQM d / T !gd&9&9 /04KD4QQ0 /04KD4QQ0! drcXWP4, VP4,#r)rrrrrget_rva_from_offsetZ$SectionStructure.get_rva_from_offsets"5577$:U:U:WWWrcrr)rrrTr}rrget_offset_from_rvaZ$SectionStructure.get_offset_from_rvas"0022T5R5R5TTTrc sVPfR#VP4pY!u;8*;'dW P,8#u#)z V V-ADVDV-V V V rc sVPe9VPe+VPTu;8*;'dVP8#u#VP4p\VPP 4VP 4, VP8dVPpM \VPVP4pVPeFVPVP8d+W#,VP8dVPV, pW nW#,VnY!u;8*;'d W#,8#u#)z8Check whether the section contains the address provided.) rrrr8rfrrrrrSnext_section_virtual_addressr)rTr}rsizer5r contains_rvaZSectionStructure.contains_rvas  ,1F1F1R((CGG$2G2GG GG G!88: tww 4#@#@#B BTEWEW W((Dt))4+@+@AD  - - 911D4G4GG")D,M,MM447IID 2 2 9!DD+=+DDDDDrcs$VPV4#r)r rrrcontainsZSectionStructure.containss  %%rc s@VPVP44#)z1Calculate and return the entropy for the section.) entropy_Hr|rYr#r get_entropyZSectionStructure.get_entropys~~dmmo..rc d\e(\VP44P4#R#)z/Get the SHA-1 hex-digest of the section's data.N)rr| hexdigestrYr#r get_hash_sha1ZSectionStructure.get_hash_sha1s)   (224 4 rc r )z1Get the SHA-256 hex-digest of the section's data.N)rr|rrYr#rget_hash_sha256Z SectionStructure.get_hash_sha256)  $--/*446 6 rc r )z1Get the SHA-512 hex-digest of the section's data.N)rr|rrYr#rget_hash_sha512Z SectionStructure.get_hash_sha512"rrc r )z-Get the MD5 hex-digest of the section's data.N)rr|rrYr#r get_hash_md5ZSectionStructure.get_hash_md5(s( ?t}}'113 3 rc sV'gR#\\V44p^pVP4FBp\V4\ V4, pW5\ P !V^4,,pKD V#)z)Calculate the entropy of a chunk of data.g)rrvaluesZfloatr8mathZlog)rTr"Z occurencesZentropyrZp_xs&& rr ZSectionStructure.entropy_H.saYt_- ""$A(SY&C TXXc1-- -G%r) rrrrrrrfrr)NNF)r[r\r]r^rrQrrr|rrrrr r r rrrrr r_r`rarbrdrrrrsb- % )'*,X "XU  $EL&/ 5 7 7 4  rrcsp!RR4p.p/pV!W#4pV^,FpRV9d$VP4VPV4K-VPR^4wrgRV9d \R4hVPR^4wrh\ V4pWdP 48wgWP 48d"VP4VPV4VPWx4K VP4\\V44wrrp .p\V 4FwppW9dVPV4KW?,wp pVUu.uFpV\P,.NK ppVPV4VFpV V^,,V V^,&K K WWW3#uupi)csJa]tRtRtoRtRtRtRtRtRt Rt R t Vt R #) )set_bitfields_format..Accumulatori@csV.VnRVnRVn^VnW nWnR#)~N) _subfields_name_type _bits_left _comp_fields_format)rTfmt comp_fieldsrrrQZ2set_bitfields_format..Accumulator.__init__As+ DODJDJDO + LrcsHVPfR#VPPVPR,VP,4VPVP3VP \ VP4^, &RVnRVn.VnR#)Nrr)rrrwrrrr8rYr#rwrap_upZ1set_bitfields_format..Accumulator.wrap_upKsszz! LL   S 04:: = >8< DOO7TD  c$,,/!3 4DJDJ DOrcsD\V,^,VnWnR#)N)rrr)rTZtprrnew_typeZ2set_bitfields_format..Accumulator.new_typeTs1"59DOJrcsV;PV, unV;PV,unVPPW34R#r)rrrrw)rTrZbitcntrr add_subfieldZ6set_bitfields_format..Accumulator.add_subfieldXs2 JJ$ J OOv %O OO " "D> 2rcrir)rrYr#rget_typeZ2set_bitfields_format..Accumulator.get_type] :: rcrir)rrYr#rget_nameZ2set_bitfields_format..Accumulator.get_name`r%rcrir)rrYr#r get_bits_leftZ7set_bitfields_format..Accumulator.get_bits_leftcs ?? "r)rrrrrrN) r[r\r]r^rQr r"r#r$r&r'r_r`rrr Accumulatorr@s-  !  3    # #rr(rrz3Structures with bitfields do not support unions yet)r rwrZNotImplementedErrorrr$r'r"r#rrrStructureWithBitfields BTF_NAME_IDXextend)rxr(Zold_fmtrZacrrrZelm_bitsZ format_str_Z field_offsetsr@Z format_lengthZ extended_keysrrZsbfrZbf_namesZns& rset_bitfields_formatr->s$#$#LGK W *Bayy c> JJL NN3   YYsA. (?%E &^^C3x= {{} $3C3C3E(E JJL KK ! +'(JJL8B5>8R5J= MdOS  !   % !3FIJcQ-::; --> (data type, [ (subfield name, length in bits)+ ] ) that facilitates bitfield paking and unpacking. With lru_cache() creating only once instance per format string, the memory overhead is negligible. cs\V4wVnVnVnVnVnVn\VP4Uu.uFpRNK upVnRVn W0n VR8wd W n R#V^,Vn R#uupiNF) r-rrrr __keys_ext____compound_fields__rangerrrr)rTrxrrr=rrrQZStructureWithBitfields.__init__s ! (    "  " M    $6;4;Q;Q5R&S5Rt5R&S##* DLD fQi 'Ts BcsF<\SV`V4VP4R#r)rPr_unpack_bitfield_attributesrTr"rUrXrrZ!StructureWithBitfields.__unpack__s 4  ((*rcs<VP4\SV` 4pVP4V# TP4i;ir)_pack_bitfield_attributesrPrr2r3& rrZStructureWithBitfields.__pack__sB &&( /7#%D  , , .   , , .s 3Acs<VPpVPVn\SV` V4pW nV# Y ni;ir)rr/rPr)rTrtkretrUs&& rrZStructureWithBitfields.dumps? ]]))  ',{+CM Ms7?cs<VPpVPVn\SV` 4pWnV# Yni;ir)rr/rPr)rTr6r7rUs& rrZ StructureWithBitfields.dump_dicts> ]]))  '#%CM Ms6>c sVPP4FpVPV,^,p\W4p\ W4^pVPV,\ P ,F|p^V\ P,,^, pWd,p\VV\ P,W6,V, 4WE\ P,, pK~ K R#)zQReplace compound attributes corresponding to bitfields with separate sub-fields. N) r0r@rrZdelattrr) CF_SUBFLD_IDXBTF_BITCNT_IDXrr*)rTr=cf_nameZcvaloffstsfmasks& rr2Z2StructureWithBitfields._unpack_bitfield_attributess))..0AmmA&q)G4)D D "E..q12H2V2VWWR 6 E EFF!K-::;[U* 2AABBX 1rc sVPP4FpVPV,^,p^^rCVPV,\P,F{p^V\P ,,^, p\ W\P,4V,pWGV,,pW5\P ,, pK} \WV4K R#)z(Pack attributes into a compound bitfieldN) r0r@rr)r8r9rr*r)rTr=r:r;Zacc_valr<r=Z field_val& rr4Z0StructureWithBitfields._pack_bitfield_attributess))..0AmmA&q)G7..q12H2V2VWWR 6 E EFF!KD%;%H%H"IJTQ--2AABB X D7 +1r) rr0rrrrrr/rrrr)r[r\r]r^rr*r9Z CF_TYPE_IDXr8rQrrrrr2r4r_r`rarbrdrr)r)sI(LNKM8 + C& , ,rr)cs6aa]tRtRtoRtV3RltRtVtV;t#) DataContainerizGeneric data container.c s^<\SV`pVP4F wr4V!W44K R#r)rPritems)rTr Z bare_setattrrrJrUs&, rrQZDataContainer.__init__s'w*  ,,.JC  $)rrM) r[r\r]r^rrQr_r`rarbrdrr?r?s!%%rr?c]tRtRtRtRtR#)ImportDescDataizHolds import descriptor information. dll: name of the imported DLL imports: list of imported symbols (ImportData instances) struct: IMAGE_IMPORT_DESCRIPTOR structure rMNr[r\r]r^rr_rMrrrBrBrrBc*a]tRtRtoRtRtRtVtR#) ImportDataizHolds imported symbol's information. ordinal: Ordinal of the symbol name: Name of the symbol bound: If the symbol is bound, this contains the address. cs\VR4'Ed\VR4'Ed\VR4'EdVR8XdVPP\8Xd\pM%VPP\ 8Xd\ pXVR,,VPnVPPVPn VPPVPn VPPVPn EMVR8XdVPeW Pn VPPVPn VPPVPn VPPVPn EMFVR8XdW Pn VPPVPnVPPVPn VPPVPn MVR8XdVP'dVPPVP4pVPPVP ^V,4\#V4\#VP$48d \'R4hVPP)VPV4W P*V&R#)ordinalboundrNaddress9The export name provided is longer than the existing one.)rrfPE_TYPEOPTIONAL_HEADER_MAGIC_PEIMAGE_ORDINAL_FLAGOPTIONAL_HEADER_MAGIC_PE_PLUSIMAGE_ORDINAL_FLAG64 struct_tableOrdinal AddressOfDataFunctionForwarderString struct_iat name_offsetrset_dword_at_offsetordinal_offsetr8rruset_bytes_at_offsetrH)rTrr ordinal_flagZname_rvarKrrZImportData.__setattr__s% D) $ $g&&f%%y 77??&>>#5LWW__(EE#7L-9C&L,I!!)262C2C2K2K!!/-1->->-F-F!!*484E4E4M4M!!1??.47OO148OO4Q4QDOO1/3/L/LDOO,6:oo6S6SDOO3"25!!/,0,=,=,K,K!!)-1->->-L-L!!*484E4E4S4S!!1####ww::4;K;KLHGG//++g-A 3x#dii.0+WGG//0@0@#F! drrMNr[r\r]r^rrr_r`rrrrFrFs2"2"rrFcrA) ExportDirDataiLzHolds export directory information. struct: IMAGE_EXPORT_DIRECTORY structure symbols: list of exported symbols (ExportData instances)rMNrCrMrrr]r]LsCrr]crE) ExportDataiSaDHolds exported symbols' information. ordinal: ordinal of the symbol address: address of the symbol name: name of the symbol (None if the symbol is exported by ordinal only) forwarder: if the symbol is forwarded it will contain the name of the target symbol, None otherwise. cs\VR4'EdM\VR4'Ed:\VR4'Ed'\VR4'EdVR8Xd(VPPVPV4MVR8Xd(VPP VP V4MVR8XdV\ V4\ VP48d \R4hVPPVPV4M[VR8XdU\ V4\ VP48d \R4hVPPVPV4W PV&R#)rGrJ forwarderrrKz+>D"++D,?,?Es8c$))n,'S++D,<,  t9t & <<1 !2;c$BVBV>WW W W^ && 1n OO & &too6L6L6N1N'O P*11$//BE}03t7K7Kb7P3QQQ ::4??DQL--/,>H   "-($$r)   NB  &J    # #E *  ! ! !T%;%;%;#5D  " " "#2D   4 ' $$ $[;Ns;S-ST $( rc sF<VPR8wd\VP\R,, VPVP&VPP VP.4\ SV`V4pVPR8wdVPP4TP RRP\Uu.uF&p\Y^,4'gKT^,NK( up4,4TP RRPTPUu.uF%qDP4'gK\T4NK' up4,4T# TPR8wdTPP4ii;iuupiuupi)NrFlags: , zUnwind codes: z; )rrrrr/rwrPrpoprunwind_info_flagsrris_validrB)rTrrrrrUs&& rrZUnwindInfo.dumpsT   4 '"5c"::  " "4#7#7 8    $ $d&:&:%; < (7< ,D##t+!!%%' ii'8P'8!GDA$ ))**, ,J #   4 ' D'$0D0D"EF "5c"::T__  rcrir)rrYr#rget_chained_function_entryZ%UnwindInfo.get_chained_function_entryrrcsJVPR8wd \R4hWnR#)Nz(Chained function entry cannot be changed)rru)rTentryrrset_chained_function_entryZ%UnwindInfo.set_chained_function_entrys"   $ & JK K#r)rrrrrrr)r[r\r]r^rrQrrrrrrrrr_r`rarbrdrr{r{2s= )0:x6 "$#$$rr{c<a]tRtRtoRtRtRtRtRtRt Vt R#) PrologEpilogOpizMeant as an abstract class representing a generic unwind code. There is a subclass of PrologEpilogOp for each member of UNWIND_OP_CODES enum. cs~\VPV4VR7VnVPPV4R#)r}N)r) _get_formatr9r)rTunw_coder"unw_infors&&&&&rrZPrologEpilogOp.initializes2,   X &K   t$rc s^#)zComputes how many UNWIND_CODE structures UNWIND_CODE occupies. May be called before initialize() and, for that reason, should not rely on the values of intance attributes. rMrTrrrrrZ(PrologEpilogOp.length_in_code_structuress rcsR#)TrMrYr#rrZPrologEpilogOp.is_validsrcR#)rr~rMrTrrrrZPrologEpilogOp._get_formatsNNrr9N) r[r\r]r^rrrrrr_r`rrrrrs%% OOrrcr)PrologEpilogOpPushRegiUWOP_PUSH_NONVOLcr)UNWIND_CODE_PUSH_NONVOL)r)rrB:4,RegrMrrrrZ!PrologEpilogOpPushReg._get_formatsWWrcsRR\VPP,,#)z .PUSHREG ) REGISTERSr9RegrYr#rrlZPrologEpilogOpPushReg.__str__sYt{{777rrMN) r[r\r]r^rrrlr_r`rrrrrsX88rrcr) PrologEpilogOpAllocLargeiUWOP_ALLOC_LARGEcs<RRRRVP^8XdR33#R33#)ZUNWIND_CODE_ALLOC_LARGErrrzH,AllocSizeInQwordsz I,AllocSizeOpInforrrrZ$PrologEpilogOpAllocLarge._get_formatsB %)1A)=%    DQ    rcs,VP^8Xd^#^#rrrrrrZ2PrologEpilogOpAllocLarge.length_in_code_structures sOOq(q/a/rcsVPP^8XdVPP^,#VPP#r)r9rZAllocSizeInQwordsZ AllocSizerYr#rget_alloc_sizeZ'PrologEpilogOpAllocLarge.get_alloc_sizesC{{!!Q& KK ) )A - && rcBR\VP44,#z .ALLOCSTACK rrrYr#rrlZ PrologEpilogOpAllocLarge.__str__D$7$7$9 :::rrMN) r[r\r]r^rrrrrlr_r`rrrrrs!  0 ;;rrcs6a]tRtRtoRtRtRtRtRtVt R#)PrologEpilogOpAllocSmalliUWOP_ALLOC_SMALLcr)UNWIND_CODE_ALLOC_SMALL)r)rrzB:4,AllocSizeInQwordsMinus8rMrrrrZ$PrologEpilogOpAllocSmall._get_format   rcsJVPP^,^,#r!)r9ZAllocSizeInQwordsMinus8rYr#rrZ'PrologEpilogOpAllocSmall.get_alloc_size$s{{22Q6::rcrrrrYr#rrlZ PrologEpilogOpAllocSmall.__str__'rrrMN) r[r\r]r^rrrrlr_r`rrrrrs ;;;rrcs<aa]tRtRtoRtV3RltRtRtVtV;t #)PrologEpilogOpSetFPi+UWOP_SET_FPREGcsz<\SV`WW44VPVnVP^,VnR#)N)rPrZ FrameRegister_frame_registerZ FrameOffset _frame_offsetrTrr"rrrU&&&&&rrZPrologEpilogOpSetFP.initialize.s3 88A'55%11B6rcsR\VP,,R,\VP4,#)z .SETFRAME r)rrrrrYr#rrlZPrologEpilogOpSetFP.__str__3s: ,,- . $$$% & r)rr) r[r\r]r^rrrlr_r`rarbrdrrr+s7   rrcr) PrologEpilogOpSaveRegi<UWOP_SAVE_NONVOLc^#rprM)rTunwcoderrrrZ/PrologEpilogOpSaveReg.length_in_code_structures?rcs<VPP^,#r)r9ZOffsetInQwordsrYr#r get_offsetZ PrologEpilogOpSaveReg.get_offsetBs{{))A--rcr)UNWIND_CODE_SAVE_NONVOL)r)rrrzH,OffsetInQwordsrMrrrrZ!PrologEpilogOpSaveReg._get_formatErrcsR\VPP,,R,\VP 44,#z .SAVEREG r)rr9rrrrYr#rrlZPrologEpilogOpSaveReg.__str__Ks0Yt{{77$>T__EVAWWWrrMN r[r\r]r^rrrrrlr_r`rrrrr<s#. XXrrcr) PrologEpilogOpSaveRegFariOUWOP_SAVE_NONVOL_FARc^#rMrrrrZ2PrologEpilogOpSaveRegFar.length_in_code_structuresRrrc.VPP#rr9rrYr#rrZ#PrologEpilogOpSaveRegFar.get_offsetU{{!!!rcr)UNWIND_CODE_SAVE_NONVOL_FAR)rrrrzI,OffsetrMrrrrZ$PrologEpilogOpSaveRegFar._get_formatXrrcsR\VPP,,R,\VPP4,#r)rr9rrrrYr#rrlZ PrologEpilogOpSaveRegFar.__str__^s3Yt{{77$>T[[EWEWAXXXrrMNrrrrrrOs#" YYrrcr) PrologEpilogOpSaveXMMibUWOP_SAVE_XMM128cr)UNWIND_CODE_SAVE_XMM128)r)rrrzH,OffsetIn2QwordsrMrrrrZ!PrologEpilogOpSaveXMM._get_formaterrcrrrMrrrrZ/PrologEpilogOpSaveXMM.length_in_code_structureskrrcs<VPP^,#)r)r9ZOffsetIn2QwordsrYr#rrZ PrologEpilogOpSaveXMM.get_offsetns{{**R//rcsR\VPP4,R,\VP 44,#z.SAVEXMM128 XMMr)rBr9rrrrYr#rrlZPrologEpilogOpSaveXMM.__str__qs0 3t{{#77$>T__EVAWWWrrMN r[r\r]r^rrrrrlr_r`rrrrrbs# 0XXrrcr) PrologEpilogOpSaveXMMFariuUWOP_SAVE_XMM128_FARcr)UNWIND_CODE_SAVE_XMM128_FAR)rrrMrrrrZ$PrologEpilogOpSaveXMMFar._get_formatxrrcrrrMrrrrZ2PrologEpilogOpSaveXMMFar.length_in_code_structures~rrcrrrrYr#rrZ#PrologEpilogOpSaveXMMFar.get_offsetrrcsR\VPP4,R,\VPP4,#r)rBr9rrrrYr#rrlZ PrologEpilogOpSaveXMMFar.__str__s3 3t{{#77$>T[[EWEWAXXXrrMNrrrrrrus# "YYrrcrE)PrologEpilogOpPushFrameiUWOP_PUSH_MACHFRAMEcs\RVPP'd R,#R,#)z .PUSHFRAMEz rn)r9rrYr#rrlZPrologEpilogOpPushFrame.__str__s$DKK,>,>,>yGGBGGrrMN)r[r\r]r^rrlr_r`rrrrrsHHrrcsTaa]tRtRtoRtV3RltRtRtRtRt Rt R t Vt V;t #) PrologEpilogOpEpilogMarkeri UWOP_EPILOGcs <RVn\VR4'*Vn\SV`WW44VP'd=\ VRVP P4VP^,^8HVnVPVn R#)T SizeOfEpilogN) _long_offstr_firstrPrrr9Sizerr _epilog_sizerrrrZ%PrologEpilogOpEpilogMarker.initializesn!(N;;  88A ;;; Hndkk.>.> ?'2a7D $11rcshVP'd RVP^,^8XdR3#R3#R#)UNWIND_CODE_EPILOG)zB,OffsetLow,Sizer B:4,Flags)zB,Sizerr B,OffsetLowz B:4,UnusedB:4,OffsetHigh)r)rrr)rrrrrrZ&PrologEpilogOpEpilogMarker._get_formatsJ ;;;$??Q&!+B     rcs^\VR4'gVP^,^8Xd^#^#)r)rrrrrrZ4PrologEpilogOpEpilogMarker.length_in_code_structuress68^44(//A:MRS9S   rcsVPPVP'd$VPP^,,#^,#r)r9Z OffsetLowrZ OffsetHighrYr#rrZ%PrologEpilogOpEpilogMarker.get_offsetsC{{$$+/+;+;+;DKK " "a '  AB  rcs(VP4^8#r)rrYr#rrZ#PrologEpilogOpEpilogMarker.is_valids 1$$rcsVP4^8dBR\VP4,R,\VP44,#R#)r z EPILOG: size=z, offset from the end=-rn)rrrrYr#rrlZ"PrologEpilogOpEpilogMarker.__str__sX 1$ $##$ %' ($//#$ %   r)rrr)r[r\r]r^rrrrrrrlr_r`rarbrdrrrs+2.  %   rrcs`a]tRtRtoRt]]]]] ] ] ] ] ]]]]]]]]]]]/ t]R4tRtVtR#)rizBA factory for creating unwind codes based on the value of UnwindOpcsVPpV\P9d\PV,!4#R#r)ZUnwindOpr _class_dict)rZcoder-rrZPrologEpilogOpsFactory.creates@-999 # . .t 4 6  rrMN)r[r\r]r^rrrrrrrrrrrrrrrrrrrrrrZ staticmethodrr_r`rrrrrsaL /22+/6/64/ K  rrz!#$%&'()-@^_`{}~+,.;=[]:csaVe"\V\\\34'gR#\R,o\ ;QJd(V3Rl\ V44F 'dK R# R#!V3Rl\ V444#)NFs\/c3s,<"TF qS9xK R#5irrM)rrallowedr5rrZ(is_valid_dos_filename..s,VG|VsT)rArBrCrallowed_filenameallset)rrs&@ris_valid_dos_filenamersYy 1sE9&=>>'G 3,SV,33,3,3,SV, ,,rcshV^8dQhR\\\\3,R\R\/#)rprrelax_allowed_charactersr)rrBrCrZboolrs"rrr s0   S% "# ?C   rcsaRoV'dRoVRJ;'dp\V\\\34;'dM\;QJd(V3Rl\ V44F 'dK R# R#!V3Rl\ V444#)s ._?@$()<>s!"#$%&'()*+,-./:<>?[\]^_`{|}~@Nc3sN<"TFq\9;'gVS9xK R#5ir)allowed_function_name)rr allowed_extrar5rrZ)is_valid_function_name.. s%SFq++AAqM/AAFs%%FT)rArBrCrrr)rrrs&&@ris_valid_function_namer s!M;    T T q3y1 2 T T CSCPQFSCC  SCPQFS SrcsJa]tRtRtoRtRatRbtRctRdtRet Rft Rgt Rht Rit RjtRktRltRmtRntRotRptRqtRrtRstRttRutRvtRwtRxtRytRztR{tR|t R}t!R~t"Rt#Rt$Rt%Rt&Rt'Rt(Rt)Rt*Rt+Rt,Rt-Rt.Rt/RRR]0^x3Rlt1Rt2Rt3Rt4Rt5R t6R t7R t8R t9R t:Rt;RtRRlt?Rt@RtARtBRtCRtDRtERtFRRltGRtHRtIRtJRRltKRtLR tMR!tNRR"ltOR#tPR$tQR%tRRR&ltSR'tTR(tURR)ltVRR*ltWRR+ltXRR,ltYR-tZRR.lt[R/t\R0t]]^3R1lt_R2t`R3taRR4ltbR5tcR6tdR7teR8tfR9tgRR:lthRR;ltiR<tjR=tkR>tlR?tmR@tnRAtoRBtpRCtqRDtrREtsRFttRGtuRHtvRItwRJtxRKtyRLtzRMt{RNt|ROt}RPt~RQtV3RRlRSltRTtRUtRVtRWtRXtRYtRZtR[tR\tR]tR^tR_tR`tVtR#)PEi aA Portable Executable representation. This class provides access to most of the information in a PE file. It expects to be supplied the name of the file to load or PE data to process and an optional argument 'fast_load' (False by default) which controls whether to load all the directories information, which can be quite time consuming. pe = pefile.PE('module.dll') pe = pefile.PE(name='module.dll') would load 'module.dll' and process it. If the data is already available in a buffer the same can be achieved with: pe = pefile.PE(data=module_dll_data) The "fast_load" can be set to a default by setting its value in the module itself by means, for instance, of a "pefile.fast_load = True". That will make all the subsequent instances not to load the whole PE structure. The "full_load" method can be used to parse the missing data at a later stage. Basic headers information will be available in the attributes: DOS_HEADER NT_HEADERS FILE_HEADER OPTIONAL_HEADER All of them will contain among their attributes the members of the corresponding structures as defined in WINNT.H The raw data corresponding to the header (from the beginning of the file up to the start of the first section) will be available in the instance's attribute 'header' as a string. The sections will be available as a list in the 'sections' attribute. Each entry will contain as attributes all the structure's members. Directory entries will be available as attributes (if they exist): (no other entries are processed at this point) DIRECTORY_ENTRY_IMPORT (list of ImportDescData instances) DIRECTORY_ENTRY_EXPORT (ExportDirData instance) DIRECTORY_ENTRY_RESOURCE (ResourceDirData instance) DIRECTORY_ENTRY_DEBUG (list of DebugData instances) DIRECTORY_ENTRY_BASERELOC (list of BaseRelocationData instances) DIRECTORY_ENTRY_TLS DIRECTORY_ENTRY_BOUND_IMPORT (list of BoundImportData instances) The following dictionary attributes provide ways of mapping different constants. They will accept the numeric value and return the string representation and the opposite, feed in the string and get the numeric constant: DIRECTORY_ENTRY IMAGE_CHARACTERISTICS SECTION_CHARACTERISTICS DEBUG_TYPE SUBSYSTEM_TYPE MACHINE_TYPE RELOCATION_TYPE RESOURCE_TYPE LANG SUBLANG NcsW@nWPnRVn.Vn.VnRVnVfVf \ R4h.VnRVnRVn RVn ^Vn ^Vn ^Vn ^\P^\P ^\P"/VnVeTM\'4R,pVP)WV4R# TP+4h;i)NzMust supply either name or dataF fast_load)max_symbol_exportsmax_repeated_symbol_get_section_by_rva_last_usedsections _PE__warningsrLr__structures___PE__from_fileFileAlignment_WarningSectionAlignment_Warning!_PE__total_resource_entries_count_PE__total_resource_bytes_PE__total_import_symbolsr;__IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION_format__:__IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION_format__6__IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION_format__#dynamic_relocation_format_by_symbolZglobals __parse__close)rTrr"rrrs&&&&&&rrQZ PE.__init__L s#5#6 -1*  ? ? !&+"(-%/0+'(#&'# rMM rLL rHH4 0 "+!6IGIkpTPP RP T^,Y544Rp?R#Rp?ii;iziApply structure format to raw data. Returns an unpacked structure object if successful, None otherwise. r}z7Corrupt header "{0}" at file offset {1}. Exception: {2}N)rrrurrwrxrrTrxr"r structureZerrrr__unpack_data__ZPE.__unpack_data__ s} f>     & ""9-  OO " "IPP1I{    < B2A??Bc rr)r)rrurrwrxrrrr__unpack_data_with_bitfields__Z!PE.__unpack_data_with_bitfields__ s} +6K     & ""9-  OO " "IPP1I{    rc  sVe\P!V4pVP^8Xd \R4hRp\ VR4pVP 4Vn\ \R4'd7\P!VP ^\P4Vn M6\P!VP ^\PR7Vn RVn TeTP4MVeW n R Vn \!VP4VnR VnV'g\'\)VP44P+4FwrV^8Xd"V \!VP4, R 8g-V^8wgK6V \!VP4, R 8gKYVP,P/R PVRV ,\!VP4, 44K VPR,p \!V 4^@8wd \R4hVP1VP2V ^R7VnVP4P6\88Xd \R4hVP4'd VP4P6\:8wd \R4hVP4P<\!VP48d \R4hVP4P<p VP1VP>VPW^,V R7Vn VP@'dVP@PB'g \R4hRVP@PB,\D8Xd \R4hRVP@PB,\F8Xd \R4hRVP@PB,\H8Xd \R4hRVP@PB,\J8Xd \R4hVP@PB\L8wd \R4hVP1VPNVPV ^,V ^,^ ,V ^,R7Vn(\S\TR4p VPP'g \R4h\WVPPVPPPXV 4V ^,VPPP[4,p WPPP\,pVP1VP^VPWR,V R7Vn0^EpVP`fl\!VPWR,4V8dI^pVPWR,R V,,pVP1VP^VV R7Vn0VP`EeVP`Pb\d8Xd \dVn3MVP`Pb\h8Xd\hVn3VP1VPjVPWR,V R7Vn0^IpVP`fl\!VPWR,4V8dI^pVPWR,R V,,pVP1VPjVV R7Vn0VPP'g \R4hVP`f \R!4hVPff?VP,P/R"PVP`Pb44\S\lR#4p\WVP`VP`PnV4.VP`n8WP`P[4,pVPPVP@n(VP`VP@n0VP`PrVP`Pt8dVP,P/R$4VP`Pv^8d7VP,P/R%VP`Pv,4Rp\y\{R&VP`Pv,44EFp\!VP4V, ^8XdM\!VP4V, ^8dVPVRR),pMVPVVV,pVP1VP|VVR7pVfM\~V,Vn@TTP[4, pTP`PpP/T4TYP`P[4,^,8gEKM VPV4pVPUu.uF1pVP^8gKVPVP4NK3 pp\!V4^8d \V4pMRpV'dVV8dVPRVVnHMVPRVVnHVPVP`Pr4ewVPVP`Pr4pV\!VP48d7VP,P/R'VP`Pr,4M6VP,P/R(VP`Pr,4V'gVP4R#R# \dDpRPT4pT;'d RT,p\R PY44hRp?ii;i TeTP4ii;i \\3dEKi;iuupi)*zParse a Portable Executable file. Loads a PE file, parsing all its structures and making them available through the instance's attributes. NzThe file is emptyZrb MAP_PRIVATE)ZaccessTrz: %szUnable to access file '{0}'{1}Fg?g333333?zeByte 0x{0:02x} makes up {1:.4f}% of the file's contents. This may indicate truncation / malformation.gY@:N@Nz9Unable to read the DOS Header, possibly a truncated file.r}z)Probably a ZM Executable (not a PE file).zDOS Header magic not found.z.Invalid e_lfanew value, probably not a PE filezNT Headers not found.rIz0Invalid NT Headers signature. Probably a NE filez0Invalid NT Headers signature. Probably a LE filez0Invalid NT Headers signature. Probably a LX filez0Invalid NT Headers signature. Probably a TE filezInvalid NT Headers signature. IMAGE_FILE_zFile Header missingr'rz5No Optional Header found, invalid PE32 or PE32+ file.z*Invalid type 0x{0:04x} in Optional Header.IMAGE_DLLCHARACTERISTICS_zXSizeOfHeaders is smaller than AddressOfEntryPoint: this file cannot run under Windows 8.zsSuspicious NumberOfRvaAndSizes in the Optional Header. Normal values are never larger than 0x10, the value is: 0x%xz[Possibly corrupt file. AddressOfEntryPoint lies outside the file. AddressOfEntryPoint: 0x%xzTAddressOfEntryPoint lies outside the sections' boundaries. AddressOfEntryPoint: 0x%xs)LosstatZst_sizeruopenfilenorrrrZ ACCESS_READrZIOErrorrx Exceptionr r8$_PE__resource_size_limit_upperbounds _PE__resource_size_limit_reachedrrr@rrwr__IMAGE_DOS_HEADER_format__ DOS_HEADERZe_magicIMAGE_DOSZM_SIGNATUREIMAGE_DOS_SIGNATUREZe_lfanew__IMAGE_NT_HEADERS_format__ NT_HEADERSrIMAGE_NE_SIGNATUREIMAGE_LE_SIGNATUREIMAGE_LX_SIGNATUREIMAGE_TE_SIGNATUREIMAGE_NT_SIGNATURE__IMAGE_FILE_HEADER_format__ FILE_HEADERrGIMAGE_CHARACTERISTICSrLrrSizeOfOptionalHeader __IMAGE_OPTIONAL_HEADER_format__rZMagicrMrLrO"__IMAGE_OPTIONAL_HEADER64_format__DLL_CHARACTERISTICSDllCharacteristicsDATA_DIRECTORYZAddressOfEntryPointZ SizeOfHeadersZNumberOfRvaAndSizesr1r__IMAGE_DATA_DIRECTORY_format__DIRECTORY_ENTRYrKeyErrorZAttributeErrorparse_sectionsrrrrRheaderget_section_by_rvar full_load)rTZfnamer"rrZfdexcpZ exception_msgZbyteZ byte_countZdos_header_dataZnt_headers_offset image_flagsZoptional_header_offsetZsections_offsetZ&MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZEpadding_lengthZ padded_datadll_characteristics_flagsrZ)MAX_ASSUMED_VALID_NUMBER_OF_RVA_AND_SIZESr= dir_entryrZrawDataPointersZlowest_section_offsetZ ep_offsets&&&& rrZ PE.__parse__ s|   775>D||q #$788B %& iik 4//$(IIdkk1d>N>N$ODM%)IIdkk1TEUEU$VDM#' >HHJ   M$D 25T]]1C.-2*$+Idmm,D$E$K$K$M  AI*s4==/A"AC"GAI*s4==/A"AD"HOO**L &uz'9C > ?? # #c$--&8 8 PQ Q OO44..  , , MM+!.C D)/ doo&?&?&? 78 8 T__.. .3E E RS S T__.. .3E E RS S T__.. .3E E RS S T__.. .3E E RS S ?? $ $(: : ?@ @//  - - MM+a/2Ca2G"2L M)A-0  %%:MJ  56 6 $""D$4$4$D$DkR!2Q!69I9I9P9P9R!R13C3C3X3XX#33  1 1 MM0C3O P. 4  24.  ( 4PU7UV66!N--&%)G')K$(#7#7552$8$D     +##))-EE7 %%++/LL< '+';';;;MM.%1O!7 (<($:@6((0 2e5S > >&)N"&--.%1O#/#1K,0+?+???#$:,@,D(  56 6    ' WX X <<  OO " "<CC((..  %3 !<% !    3 3 % /1+'*>*>*E*E*GG&*&6&6#*.*>*>'  4 4""00 1 OO " ".     3 3d : OO " "O&&::;  5:1s:(<(<(P(PPQRA4==!F*a/4==!F*Q.}}VW- 9}}V&OO,,44d-I  !0!3  i&&( (F  / / 6 6y A&)=)=)D)D)FFOSSV$$_5]] "!!A% =D ( ();); <"   ! #$'$8 !$( !$(=(F--0DK--(>)>?DK  # #D$8$8$L$L M  00$$88I3t}}--&&7**>>? OO " ",.2.B.B.V.VW   NN M   % T 2 - J J6M3I 4;;EQ >HHJ"tn-  : sBB*o$p.qq p>p  ppp+.qqc  srRpRpVPPR^VPP44pVR8XdR#VP^V^,pVR^\ V4^,,p\ \ P!RP\ V4^,4V44pW%9dR#\ P!RYUPT4^,,4pRT/pTRTPR4pYR&R p \4p \T4F?wrT PT !T 4T !Yk\ T4,,4, 4KA \T 4TR &\ P#TR 4p T^,T , T8wg+T^,T 8wgT^,T 8wgT^,T 8wdTP$PR 4YR &.pYR&TR,p\'\ T4^,4FpT^T,,T8Xd;T^T,^,,T 8wdTP$PR4T#Y^T,,T , T^T,^,,T , ., pK T# \dR#i;i)zParses the rich header see https://www.ntcore.com/files/richsign.htm for more information Structure: 00 DanS ^ checksum, checksum, checksum, checksum 10 Symbol RVA ^ checksum, Symbol size ^ checksum... ... XX Rich, checksum, 0, 0,... iDanSiRichsRichNz<{0}IZ&PE.parse_rich_header..O sz!S'9'9Q@q@r clear_dataZlittlez:Rich Header is not in Microsoft format, possibly malformedchecksumr:NNzRich Header is malformed)rfindrrr8listr9r:rxrurZindexrrrwrCrZ from_bytesrr1)rTZDANSZRICHZ rich_indexZ rich_datar"rZresultrFZord_rHrrrIZ headervaluesr=s& rparse_rich_headerZPE.parse_rich_header# sr]]'' T4//??A     dZ!^I gnnS^q5H&I9UVD kk$ZZ%5%9 :;6y~~g67%z@[ !(+HC   d3i$sS>/B*CC D,$Z0|>>#x0 Gh $ &Aw("Aw("Aw(" OO " "L &z 'xBxs4yA~&AAE{d"A ?h.OO**+EF   !a%[83T!a%!)_x5OP PL' c  sA7J'' J65J6c ri)zReturn the list of warnings. Non-critical problems found when parsing the PE file are appended to a list of warnings. This method returns the full list. )rrYr#rrvZPE.get_warningsx src sDVPFp\RV4K R#)zPrint the list of warnings. Non-critical problems found when parsing the PE file are appended to a list of warnings. This method prints the full list to standard output. Z>N)rprint)rTwarningr-r show_warningsZPE.show_warnings sG #w 'rc sVP4!RR4pVP4pV'dV!4VnVPRR4VPnVPRR4VPnVPRR4VPnVPRR4VPnVPRR4VPnR#RVnR#) zProcess the data directories. This method will load the data directories which might not have been loaded if the "fast_load" option was used. It also parses the rich header, which may or may not present. cs]tRtRtRtR#) PE.full_load..RichHeaderi rMN)r[r\r]r^r_rMrr RichHeaderrR s rrSrINrrrFrH) parse_data_directoriesrN RICH_HEADERr1rIrrrFrH)rTrSZ rich_header& rr?Z PE.full_load s ##%  ,,. )|D (3 D(ID   %&1ooh&ED   ##.??5$#?D   (3 D(ID   %*5//,*MD   '#D rc  sV\VP4pVPF?p\VP44pVP 4pWBWU\ V4,%KA \ VR4'Edd\ VR4'EdQVPEF?pVEF4p\ VR4'gKVPEF p\VPP44FwrVPV ,p VPV ,p \ V4V ^,8d\VPR4PR4p V RV ^,^,VV ^,V ^,V ^,^,,%KVPR4PR4p V VV ^,V ^,\ V 4,%K EK EK7 EKB TpV'gV#\!VR4;_uu_4pVP#V4RRR4R# +'giR#;i)aMWrite the PE file. This function will process all headers and components of the PE file and include all changes made (by just assigning to attributes in the PE objects) and write the changes back to a file whose name is provided as an argument. The filename is optional, if not provided the data will be returned as a 'str' object. VS_VERSIONINFOFileInfo StringTablerkr7Nzwb+)rrrrrr8rrXrYrMentriesr@entries_offsetsentries_lengthsr;encoder write)rTZfilenameZ file_datarZ struct_datarfinforst_entryroffsetsZlengthsr<Z encoded_dataZ new_file_datars&& rr^ZPE.write sdmm, ,,I#I$6$6$89K..0F,1LL,A,H,H,T-..> Q,?)2,3AJgajSTn9T)*8=||G7L7S7S,68* -9)2,3AJc,FW9W)*#3Q->"'+2"  (E " "a GGM "# " " "s ;H H( c s .Vn^p\VPP4EF0pV\8dGVP P RPVPP\44EM^p\VPVR7pV'gEMWP4V,,pVPV4VPWfVP4,p\V4VP48Xd#VP P RV R24EM+V'g#VP P RV R24EMVPV4VPP V4VP VP",\%VP48d)V^, pVP P RV R24VP'VP"4\%VP48d)V^, pVP P RV R24VP(R 8d)V^, pVP P R V R 24VP+VP,VP.P0VP.P24R 8d)V^, pVP P R V R 24VP.P2^8wdUVP"VP.P2,^8wd)V^, pVP P RV R 24WB8dVP P R4M\5\6R4p\9WUP:V4VP<P?RR4'dyVP<P?RR4'dWVP@PCR4R8XdVPE4'dMVP P RV R24VPP V4EK3 VPPGRR7\IVP4FXwrV \%VP4^, 8Xd RVn%K/VPV ^,,P,Vn%KZ VPP^8dUVP'dCWP^,P4VPP,,#V#)aFetch the PE file sections. The sections will be readily available in the "sections" attribute. Its attributes will contain all the section information plus "data" a buffer containing the section's data. The "Characteristics" member will be processed and attributes representing the section characteristics (with the 'IMAGE_SCN_' string trimmed from the constant's names) will be added to the section instance. Refer to the SectionStructure class for additional info. zToo many sections {0} (>={1}))rfzInvalid section z. Contents are null-bytes.z8. No data in the file (is this corkami's virtsectblXP?).zError parsing section z$. SizeOfRawData is larger than file.z5. PointerToRawData points beyond the end of the file.z'Suspicious value found parsing section z*. VirtualSize is extremely large > 256MiB.z&. VirtualAddress is beyond 0x10000000.z. PointerToRawData should normally be a multiple of FileAlignment, this might imply the file is trying to confuse tools which parse this incorrectly.z,Too many warnings parsing section. Aborting.rIMAGE_SCN_MEM_WRITEFIMAGE_SCN_MEM_EXECUTErsPAGEz!Suspicious flags set for section zf. Both IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE are set. This might indicate a packed executable.crir)r)Zar#rrGZ#PE.parse_sections..Ws )9)9r)rN)&rr1r1ZNumberOfSections MAX_SECTIONSrrwrxr__IMAGE_SECTION_HEADER_format__rrrr$rrrrr8rrrrrrrrGrrLrrHr1Namer is_driversortrr) rTrZMAX_SIMULTANEOUS_ERRORSr=Zsimultaneous_errorssectionZsection_offsetZ section_datarr && rr<ZPE.parse_sections s "#t''889AL &&3::((99< "# &t'K'KPTUG#nn&6&::N  # #N 3=='..2B!BLL)W^^-==&&)9!FF<<&&w/7:t~~?O?OOO**;A3?CC MM  )O:X 9:%dmm4LCc$--(1,,7;47;}}!G8 .4 5    , ,q 0T]]]q)002T5E5E5V5VVV Mrc  sRVP3RVP3RVP3RVP3RVP3RVP 3RVP 3RVP3R VP3R VP33 pVe \V\\34'gV.pVEFWp\V^,,pVPPV,pTeYa9dR pTP"'dT'd6T^,R8Xd(T^,!TP"TP$R R 7pMbT'd6T^,R8Xd(T^,!TP"TP$R R7pM%T^,!TP"TP$4pT'd\-Y^,R,T4TfEK\T\4'gEK5T^,T9gEKFTP/T4EKZ R # \ dR #i;i \&d3p TP(P+RT^, RT 24R p ? LR p ? ii;i)aParse and process the PE file's data directories. If the optional argument 'directories' is given, only the directories at the specified indexes will be parsed. Such functionality allows parsing of areas of interest without the burden of having to parse all others. The directories can then be specified as: For export / import only: directories = [ 0, 1 ] or (more verbosely): directories = [ DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'], DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'] ] If 'directories' is a list, the ones that are processed will be removed, leaving only the ones that are not present in the image. If `forwarded_exports_only` is True, the IMAGE_DIRECTORY_ENTRY_EXPORT attribute will only contain exports that are forwarded to another DLL. If `import_dllnames_only` is True, symbols will not be parsed from the import table and the entries in the IMAGE_DIRECTORY_ENTRY_IMPORT attribute will not have a `symbols` attribute. IMAGE_DIRECTORY_ENTRY_IMPORTIMAGE_DIRECTORY_ENTRY_EXPORTIMAGE_DIRECTORY_ENTRY_RESOURCEIMAGE_DIRECTORY_ENTRY_DEBUGIMAGE_DIRECTORY_ENTRY_BASERELOCIMAGE_DIRECTORY_ENTRY_TLS!IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORTIMAGE_DIRECTORY_ENTRY_EXCEPTIONNT)forwarded_only) dllnames_onlyzFailed to process directory "z": :NN)parse_import_directoryparse_export_directoryparse_resources_directoryparse_debug_directoryparse_relocations_directoryparse_directory_tlsparse_directory_load_configparse_delay_import_directoryparse_directory_bound_importsparse_exceptions_directoryrArrMr:rr8 IndexErrorrrrurrwrZremove) rT directoriesZforwarded_exports_onlyZimport_dllnames_onlyZdirectory_parsingrZdirectory_indexrDrJr@ &&&& rrTZPE.parse_data_directoriesgs#@,T-H-H I +T-H-H I -t/M/M N *D,F,F G .0P0P Q ($*B*B C 0$2R2R S 143T3T U 143U3U V .0O0O P    "kE4=99*m &E "1%("; 00??P "o&D+++.!!H(FF %a%44%NN+/! -!!H(FF %a%44innTX! $)!HY-E-Ey~~$VE AhrlE:({D111X,""?3['  : - OO22"?azTF Ss*/1H9$H HH I&(IIc sVPP\R,8wd)VPP\R,8wdR#\VP4pVP 4p/p.p/p\ W$,4EFpVPVPVPW4VPV4R7pVfEMRp VP^,^8XEd-VPV9dWsP,p M3\VPVP4R7p WVP&V PVPVPV P 444p V R8wdVPPV 4MV PVPVPV P 444p V R8wdVPPV 4MSVPPV 4\!W9R7p VPV 4WVP"&W, pEK VFpVP$fK\'VP$R4'gK1VP$P(V9d;VPPRVP*P-4R R 24KVP$P/WSP$P(,4K V# \0dGp TPPR TP*P-4R R T 24Rp ? EKRp ? ii;i) zParses exception directory All the code related to handling exception directories is documented in https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details IMAGE_FILE_MACHINE_AMD64IMAGE_FILE_MACHINE_IA64Nr})r9 unwindinforz FunctionEntry of UNWIND_INFO at rz' points to an entry that does not existz/Failed parsing FunctionEntry of UNWIND_INFO at z: )r1Machine MACHINE_TYPEr__RUNTIME_FUNCTION_format__rr1rr|rZ UnwindDatar{rrrwrrzZ BeginAddressrrrr9rrru) rTr}rrfZrf_sizeZrva2rtZrt_funcsZ rva2infosr,ZuiZwsrr@s &&& rrZPE.parse_exceptions_directorys    $ $ 5O(P P  ((L9R,SS t77 8))+ t'A%%00 c+ 44S9&B zB #) MMY."==1B#0H0H0WXB/1bmm,((r}}biik)RS:OO**2.((r}}biik)RS:OO**2.##**2.*"DE OOE "&+2?? # NCQ(VB}}$ 2==/::}}**&8&&6ryy7P7P7RST6U=>  88==667!4! &&Eyy00215Rv?  s5L M& :M!!M&c  s\VP4pVP4pTp.pVPVPVPWV,VR7pVfVP P R4R#VP4'dV#WP4, pVPV4pVPV4pVf\VP4V, p VPU u.uF"p V PV8gKV PNK$ p p V 'd4\V 4p VPV 4pVeVPV, p M1VP\VP44,V, p V'g-VP P RPV44R#.p \!\VP"\%V ^, 444EFpVPVP&VPWV,VR7pV'g \)R4hWP4, pW_P*,pVP-^VPVV\.,4pV'dU\1V4Uu.uF%p\3V4\4P69gK#VNK' pp\V4R8g V'dM!V P \9VVR74EK WSP*,pVP-^VPVV\.,4pV'dV\1V4Uu.uF%p\3V4\4P69gK#VNK' pp\V4R8g V'dV#V'gV#VP \;VVV R74EKuup iuupiuupi) rnr}Nz7The Bound Imports directory exists but can't be parsed.zHRVA of IMAGE_BOUND_IMPORT_DESCRIPTOR points to an invalid address: {0:x}z(IMAGE_BOUND_FORWARDER_REF cannot be readr)r9r)r9rrZ)r(__IMAGE_BOUND_IMPORT_DESCRIPTOR_format__rrrrrwrget_section_by_offsetrr8rrrRr|rxr1ZNumberOfModuleForwarderRefsr$__IMAGE_BOUND_FORWARDER_REF_format__ruZOffsetModuleNameget_string_from_dataMAX_STRING_LENGTHrrrhrryrw)rTr}rZ bnd_descrZbnd_descr_sizerZ bound_importsrjrsafety_boundaryrZsections_after_offsetZfirst_section_after_offsetZforwarder_refsr,Z bnd_frwd_refrZname_strrZ invalid_chars&&& rrZ PE.parse_directory_bound_imports sdKKL "))+ ,,== c.$89-I  &&M##%%vs ##% %C005G2237K"%dmm"4{"B"]])*))K7'A&&*&) )255J1K."889STG**1*B*B[*P,,s73C3C3E/FFT &&7fSk  NI993QR?R;ST $33==MM#n(<= # 4  $'(RSS**,,!>!>>44t}}Vf7H.HI#,X#6%#6a#a&HXHX:X#6"%8}s*m%%&lJAH777F004==&3D*DEH(2!2!c!fFDTDT6TAA2!x=3&-  #$8^ [)j% !s$<OO' O O OOc  sVPpVP\8Xd VPpVP VVP V\ V4P44VPV4R7pV'gR#\VR7# \d(TPPRT,4RpLGi;i)rnr}z5Invalid TLS information. Can't read data at RVA: 0x%xNr) __IMAGE_TLS_DIRECTORY_format__rLrO __IMAGE_TLS_DIRECTORY64_format__rr|rrrrurrwrv)rTr}rrxZ tls_structrKrr~ZPE.parse_directory_tlss 44 <<8 8::F -- c9V#4#;#;#=> 44S9.Jj))  OO " "JSP J  sA B/CCc  sZVP\8XdVPV4pVPpMPVP\8XdVPV4pVP pMVP PR4R#^p^pV^,F>pV^, pV\VPR4^,,, pWc8XgK>M V^,V^,RV3pRpVPVVPV\V4P44VPV4R7pV'gR#Rp V^#8d'VP!VP"VP$4p \'WR7# \d&TP PRT,4Lti;i)rnzGDon't know how to parse LOAD_CONFIG information for non-PE32/PE32+ fileNrr}z=Invalid LOAD_CONFIG information. Can't read data at RVA: 0x%x)r9dynamic_relocations)rLrMget_dword_at_rva&__IMAGE_LOAD_CONFIG_DIRECTORY_format__rO(__IMAGE_LOAD_CONFIG_DIRECTORY64_format__rrwrrrr|rrrruparse_dynamic_relocationsZDynamicValueRelocTableOffsetZDynamicValueRelocTableSectionrx) rTr}rZload_config_dir_szrxZfields_counterZ cumulative_szZfieldZload_config_structr &&& rrZPE.parse_directory_load_configs <<3 3!%!6!6s!; @@F \\: :!%!6!6s!; BBF OO " "  AYYE a N 0S1A!1DE EM2  )VAY78! !%!5!5 c9V#4#;#;#=> 44S9"6" "" B "&"@"@"??"@@#  %    OO " "RUXX  s+A E::-F*)F*c sV'gR#V'gR#V\VP48dR#VPV^, ,pVPV,pRp\VP4P 4pVP VPVPWF4VPV4R7pTP^8wd/TPPRTP,4R#YF, pYEP,p.pYG8EdpTPp TP\ 8Xd TP"p \T 4P 4p TP T TPYJ4TPT4R7p T 'gT#YJ, pT P$p T P&p ^T u;8:d^8:dDMM@TP)YMTP*T ,4pTP\-YTR74MnT ^8Xd4TP/T4wppTP\1T T TTR74M4T ^8d.TP)YM4pTP\-YTR74YM, pEKvT# \d'TPPRT,4R#i;i \d)TPPRT,4Rp EL^i;i)Nr}zPInvalid IMAGE_DYNAMIC_RELOCATION_TABLE information. Can't read data at RVA: 0x%xzDNo parsing available for IMAGE_DYNAMIC_RELOCATION_TABLE.Version = %d> c4 44S90D0 , , 3 3q 8 OO " "V2::;  999 i==F||<<CC (//1H #"22MM#0 $ 8 8 =3 J#"G OC ''F,,DFa"CCtGGO $**)*{ 1*.*K*KC*P' Z#**(*%#-$/ !"CCCN #**)*{ KC""[  OO " "$&)*   @! #&&(*-.#  #s$Invalid function override header. Can't read data at RVA: 0x%xz((-I &&(*-.#.. 9V$++- -CM9,,12$$V]]4sA9N%OPQ%RSq3??,,K ** *C   5$&22"/ +  //''  MM#y0779 :  $ $S )   OO " "CcI * * y ''))x''1,-AAAF,, c9V#4#;#;#=>((-I &&(*-.#.. 9V$++- -C   6iH I."&&rc s$VPW4#rm)r)rTr}rrrr}ZPE.parse_relocations_directorys44S??rcs \VP4P4pW,p.pW8EdVPVPVP W4VP V4R7pV'gV#VPVPP8d0VPPRVP,4V#VPVPP8d0VPPRVP,4V#Vf6VPW,VPVPV, 4pM5VPW,VPVPV, V4pVP\WxR74VP'gV#WP, pEKV# \ d)TPPRT,4RpELi;i)r}rNzEInvalid relocation information. VirtualAddress outside of Image: 0x%xz9Invalid relocation information. SizeOfBlock too large: %dr9rZ)r __IMAGE_BASE_RELOCATION_format__rrr|rrurrwrr SizeOfImageZ SizeOfBlockparse_relocationsparse_relocations_with_formatro) rTr}rrrrrZrlcZ reloc_entriess &&&& rrZ#PE.parse_image_base_relocation_listsTBBCJJLj i **99MM#0 $ 8 8 =+D?!!D$8$8$D$DD&&&(+(:(:;4-!5!5!A!AA&& __-"{ $ 6 6NC$6$6(8R! !% B BNC$6$6(8RTW!    1T U??? ?? "CU! &&(*-.  s )K7):G  OO " "%CHQ<#P QI s"D00,EEc  sVPW4pVPV4p\ T4P 4p.p\4p \\T4T,4Fp TPTYZT,T ^,T,TR7p T 'gT#T Pp Y9d,TPP RY,,4T#T PT 4TP \YY,R74Yg, pK T# \d%TPP RTR 24.u#i;i)rnrrr}r)r9rtr})r|rrurrwr)rrr1r8rZPageRelativeOffsetrWrp) rTrr}rrxr"rZ entry_sizerZrarrrs &&&&& rrZ PE.parse_relocations_with_formatsI ==0D228?'8E  !33L&&&#&2&8: KK % NNe|?QR   %K-20?  OO " "%CHQ<#P QI s"D,E  E c  s\VP4P4p.p\\ W#, 44EFpVP WV,,V4pTPTPTTPYT,,4R7pT'gR#RpTP^8XdEMITP^8XEdTPp TPp TPYT ,p T R,R8XEd9R.RO.p T \T 4P4, p T ^8d(T ^,PRPT 44TPYT 4pTe\ P"!RR TP$,4^,Tn\)\*P,!TP.TP0TP2TP4TP6TP&3R 74P9R R4P;4TP<R ,TnEMT R,R 8XdgR.RO.pT \T4P4, p T ^8d(T^,PRPT 44TPYT 4pEMMTP^8XdTPp TPp TPYT ,p R.RO.pTPYT 4pT'drTP@R9daT \T4P4, pT^8d(T^,PRPT44TPYT 4pM}TP^8XdmTPp TPp TPYT ,p RR..pTPTT T 4p\C\DR4p\GTTPHT4TP\KYxR74EK V# \ d(TPPRT,4R#i;i)rnz7Invalid debug information. Can't read data at RVA: 0x%xNr}:NrJNsRSDSZ CV_INFO_PDB70z{0}s,PdbFileNamez>Q)Zfields-XsNB10Z CV_INFO_PDB20ZIMAGE_DEBUG_MISCz {0}s,DataZ!IMAGE_DEBUG_EX_DLLCHARACTERISTICSzI,ExDllCharacteristicsIMAGE_DLLCHARACTERISTICS_EX_)r9r)z4s,CvSignaturezI,Signature_Data1zH,Signature_Data2zH,Signature_Data3zB,Signature_Data4zB,Signature_Data5z6s,Signature_Data6I,Age)zI,CvHeaderSignaturezI,CvHeaderOffset I,Signaturer)z I,DataTypezI,Lengthz B,Unicodez B,Reserved1 H,Reserved2r r*)&r __IMAGE_DEBUG_DIRECTORY_format__rr1rr|rurrwrrTyperZ SizeOfDatarrxr9r:ZSignature_Data6ZSignature_Data6_valuerBuuidZUUIDZSignature_Data1ZSignature_Data2ZSignature_Data3ZSignature_Data4ZSignature_Data5replaceZupperZAgeZSignature_StringZUnicoderGEX_DLL_CHARACTERISTICSrLZExDllCharacteristicsrh)rTr}rZdbg_sizeZdebugrr"dbgZdbg_typeZdbg_type_offsetZ dbg_type_sizeZ dbg_type_dataZ__CV_INFO_PDB70_format__ZpdbFileName_sizeZ__CV_INFO_PDB20_format__Z___IMAGE_DEBUG_MISC_format__Zdbg_type_partialZ data_sizeZ-___IMAGE_DEBUG_EX_DLLCHARACTERISTICS_format__ex_dll_characteristics_flagsrrr|ZPE.parse_debug_directory7sLTBBCJJLT_-.C }}Sc>%98D&&55 44Sc>5IJ'C  Hxx1}Q"%"6"6 # $ # &E! !$/(  0,& 2J(K(R(R(TT%(!+03::.556FG $330 H +9? 'H,D,D"D::6 $ (0(@(@(0(@(@(0(@(@(0(@(@(0(@(@(0(F(F ,& !" %WS"-"UW!)a 02!1$#2&'1(0,& 2J(K(R(R(TT% (!+03::.556FG $330 HQ"%"6"6 # $ # &E! ' 0,$(#7#70$ $'//69)'(DELLNO"%q=8;BB + 2 29 =$(#7#78$R"%"6"6 # $ # &E! 80A=  //A!# 0>*,J0,110 LL#> ?/B }! &&PSVV  sP))-QQc  sJVfV.pVfTpV\8d+VPPRV\3,4R#VPV\ VP 4P 44pTPTP TTPT4R7pTf%TPPRT,4R#.pYP 4, pTPTP,p Rp Y8d&TPPRY3,4R#T;PT , un TP\8d5TPPRTP\3,4R#.p Rp \T 4EFp TP'g[TP TP"8d@R TnTPPR TP TP"3,4TP%T4pTf'TPPR Y3,4EMGRpRpTP&R ,^, pT'gTP&pMY>P(,p\+TT4pT;P TP-4, unT 'dRT ^,T8dDT ^,T8d6T P/4TPPR T,4EMuTTTP-4,3p T PT4TP0'EdY>P2,T9dEMTP5Y>P2,Y!T, , TT^,YSTP2,.,R7pT'gEMRpT\6R,8XEd8/pTP8EF$p\;TR4'gK/pTP<P8FpTeC\;TR4'd1TP>P@PBeTPDfKKTP>P@PFpTP>P@PBpTPDpTPTT4p\IT\KT4^, ^,T4TPMT4K TTP<n'EK' TP\QTTTTR74MTPSY>P2,4pT'drT;P TPB, un\UTTP&R,TP&^ , R7pTP\QYTTR74MMT^8XdTPV\6R,8Xd}T'd TR,pXP<P8^,P<P8pTF3p Rp!T P>P@p!T!fK"TPYT!4K5 YP 4, pEK T U"u.uFp"T"P[4NK p#p"T#P]4\_T 4Fwp p"T"Pa4K \cYxR7p$T$# \d'TPPRT,4R#i;i \d'TPPRT,4ELi;i \d(TPPRTR RT 24EKii;i EL:;i EL';iuup"i)aXParse the resources directory. Given the RVA of the resources directory, it will process all its entries. The root will have the corresponding member of its structure, IMAGE_RESOURCE_DIRECTORY plus 'entries', a list of all the entries in the directory. Those entries will have, correspondingly, all the structure's members (IMAGE_RESOURCE_DIRECTORY_ENTRY) and an additional one, "directory", pointing to the IMAGE_RESOURCE_DIRECTORY structure representing upper layers of the tree. This one will also have an 'entries' attribute, pointing to the 3rd, and last, level. Another directory with more entries. Those last entries will have a new attribute (both 'leaf' or 'data_entry' can be used to access it). This structure finally points to the resource data. All the members of this structure, IMAGE_RESOURCE_DATA_ENTRY, are available as its attributes. NzNError parsing the resources directory. Excessively nested table depth %d (>%s)zCInvalid resources directory. Can't read directory data at RVA: 0x%xr}zDInvalid resources directory. Can't parse directory data at RVA: 0x%xrzNError parsing the resources directory. The directory contains %d entries (>%s)zRError parsing the resources directory. The file contains at least %d entries (>%d)TzGResource size 0x%x exceeds file size 0x%x, overlapping resources found.zHError parsing the resources directory, Entry %d is invalid, RVA = 0x%x. r)z^Error parsing the resources directory, attempting to read entry name. Entry names overlap 0x%xznError parsing the resources directory, attempting to read entry name. Can't read unicode string at offset 0x%x)rtleveldirs RT_STRING directoryr"z2Error parsing resource of type RT_STRING at RVA 0xrz with size )r9ridri)r9langsublang)r9rrr" RT_VERSIONrrK)2MAX_RESOURCE_DEPTHrrwr|r#__IMAGE_RESOURCE_DIRECTORY_format__rrurrZNumberOfNamedEntriesZNumberOfIdEntriesrMAX_RESOURCE_ENTRIESr1r$rr#parse_resource_entryrg NameOffsetrertrDataIsDirectoryOffsetToDirectoryr{ RESOURCE_TYPErZrrr"r9rr OffsetToDatar?rupdatestringsrfparse_resource_data_entryrgIdparse_version_informationrjrirryrd)%rTr}rrtrrr"Z resource_dirZ dir_entriesZnumber_of_entriesZMAX_ALLOWED_ENTRIESZstrings_to_postprocessZlast_name_begin_endrZresZ entry_nameZentry_idZname_is_string ustr_offsetZentry_directoryr resource_idZresource_strings resource_langZstring_entry_rvaZstring_entry_sizeZstring_entry_idZstring_entry_datar9Z entry_dataZ last_entryZversion_entriesZ version_entryZrt_version_structrZ string_rvasZresource_directory_datas%&&&&&& rr{ZPE.parse_resources_directorys@, <5D  H % % OO " ":=BDV668LMN  !# #*+C666//$2X2XX592&&'33>>++C0C{&&8;>*EJH!hh3:N!88&7  !B4!UJ//:3R3R3TT/++A.</2kA/224..7:EG $#j&E&E&GG+' +11*="""333t;"&"@"@444(N+%!)C,A,A!A BB #A#'}[99 G'6'>'> "; </!6%CHHu,R9EdiTP@^8XEdWTP3T TP4,^\#T4^,,,TP4p.Tn!TPTPDTTRTT,R7pT'gEM?TPT,TP4,pTP!T4pTTn#/Tn$/Tn%/Tn&TPBP T4TP3TTP4,^\#T4^,,,TP4pTTTPN,8EdTPTPPTTRTT,R7pT'gEMtTPT,TP4,pTP!T4pTPT4pTP3^\#T4^,,T,TP4,TP4pTPT,pTP!TTP@R7pTPT4pTPN^8XdTTPN,pM-TP3TPNT,TP4pTTPHT&TT3TPJT&\#T4\#T43TPLT&EKTP3TPNT,TP4pTT8XdEMTpTTPN8gEKEMrEMpT'EdhTP=R4'EdPTpRTn)TP>R9Ed5TP@^8XEd#TP3T TP4,^\#T4^,,,TP4p.Tn*TPTPVTTRTT,R7pT'gEMTPT,TP4,pTP!T4pTfEMYTPTP T4TP3^\#T4^,,T,TP4,TP4pTp TT TP@,8dTPYTTT^,^4p!TPYTT^,T^,^4p"T^, p\[T!\\4'gKx\[T"\\4'gKTRT!T"3,/Tn/KTP3TTPN,TP4pTTTPN,8:gEKTP3TPNT ,TP4p TPN^8XgYPN8gEKTP8P T4R# \d9TPP RP TP44R#i;i \d'TPP RT,4E Li;i \d/TPP RP T44Ki;i \d0TPP RP T44EK^i;i \d0TPP RP T44EK[i;i \d%TPP RTR 24EKi;i \d0TPP RP T44EK i;i)aParse version information structure. The date will be made available in three attributes of the PE object. VS_VERSIONINFO will contain the first three fields of the main structure: 'Length', 'ValueLength', and 'Type' VS_FIXEDFILEINFO will hold the rest of the fields, accessible as sub-attributes: 'Signature', 'StrucVersion', 'FileVersionMS', 'FileVersionLS', 'ProductVersionMS', 'ProductVersionLS', 'FileFlagsMask', 'FileFlags', 'FileOS', 'FileType', 'FileSubtype', 'FileDateMS', 'FileDateLS' FileInfo is a list of all StringFileInfo and VarFileInfo structures. StringFileInfo structures will have a list as an attribute named 'StringTable' containing all the StringTable structures. Each of those structures contains a dictionary 'entries' with all the key / value version information string pairs. VarFileInfo structures will have a list as an attribute named 'Var' containing all Var structures. Each Var structure will have a dictionary as an attribute named 'entry' which will contain the name and value of the Var. zWError parsing the version information, attempting to read OffsetToData with RVA: 0x{:x}Nr}asciiencodingzzError parsing the version information, attempting to read VS_VERSION_INFO string. Can't read unicode string at offset 0x%xz"Invalid VS_VERSION_INFO block: {0}sVS_VERSION_INFO:NNz\uz({0} ... ({1} bytes, too long to display)Zz\00rWrnVS_FIXEDFILEINFOrXz/Error parsing StringFileInfo/VarFileInfo structz|Error parsing the version information, attempting to read StringFileInfo string. Can't read unicode string at offset 0x{0:x}sStringFileInfozyError parsing the version information, attempting to read StringTable string. Can't read unicode string at offset 0x{0:x}z}Error parsing the version information, attempting to read StringTable Key string. Can't read unicode string at offset 0x{0:x}rqzzError parsing the version information, attempting to read StringTable Value string. Can't read unicode string at offset 0xrs VarFileInfoZ VarFileInfoz}Error parsing the version information, attempting to read VarFileInfo Var string. Can't read unicode string at offset 0x{0:x}z 0x%04x 0x%04xr)0rrrurrwrxrrr__VS_VERSIONINFO_format__rr>rrSrrrsr8r;Zrfindr]rrrWZKey dword_align__VS_FIXEDFILEINFO_format__rrX__StringFileInfo_format__rDrZ ValueLengthrY__StringTable_format__LangIDrZr[r\ZLength__String_format__rVar__Var_format__get_word_from_datarArr)#rTZversion_structZ start_offsetrFZversioninfo_structrrjZ section_endZversioninfo_stringZexcerptZvinfoZfixedfileinfo_offsetZfixedfileinfo_structZstringfileinfo_offsetr_Zstringfileinfo_structZstringfileinfo_stringZstringtable_offsetZstringtable_structZstringtable_stringZ entry_offsetZ string_structrZ key_offsetZ value_offsetrJZnew_stringtable_offsetZvarfileinfo_structZ var_offsetZ var_structZ var_stringZvarword_offsetZorig_varword_offsetZword1Zword2s#&& rrZPE.parse_version_informationhs 4 33N4O4OPL==~?R?R0RS"11  * *H2   % $114F4M4M4OO ))+6 !003%%w'?'?4K"  "%)%=%='&>&"&*%=%= ";!AG&>&"  % OO " "4;;>ufM  t-.."$D #'  ""5)  %!# #//  % % '!s3E/F/J*K K  ' '  $33  , , * +$; 4  $ t/00$&D ! $$%9: !% 0 0 #>#>#@ @  ' '!  tZ((DM$($8$8../0(@%9% ! %,&&E++'($++-.   (,(@(@(M%)> ! % LL. /%$)>)I)I!***..&8-99Q>)-)9)9-/6689s#89A=>?'33 *&9;)5-1-A-A 77$%7%89(47I(I.B.* 2!+77010779:$ "151I1I+1V.5G*157*2=?*:=?*:-99@@AST'+'7'7.0779:3'9#:Q#>?@+77 ( )03E3L3LLM-1,@,@ $ 6 6 ( 7,8<,G-A-M $1 %!/ ; ;".!/"/"6"6"8!9( &&*&>&>{&K-1-E-Ek-R ,0+;+; !SX\ 2".!/"/"6"6"8!9!/ ; ; ,L+9*E*E *TK &(,(@(@$/M>sC !$C #E G.>>sC 261A1A.558JJ*772.25GG!-C*-1F1M1MM!'&+@+K+K,,&;"*7"''++v5*66!;!%!1!1-,3356s#89A=>?'33 "J.0&*%)%9%9 //$Z[1(4z(A&:& *!+77()(//12$ ")-)A)A+)NJ&-!*..55jA)-)9)9Z1!45()(//12+77 * /=++1J4J4JJK%)$;$; (.1:L Mq%E%)$;$; (!);nq>P QST%E+a/N)%55*UC:P:P$.5%.0P4" 0&*%5%5&):)::Nk9 "l6.m3$n%?jj -j:9j:=5k65k695l32l365m0/m03*n"!n"%5ooc saSPSPSPV\SP4P 44SP V4R7pT'gR#T3RlpSPTP\T!TP4TP^,44pSPTP\T!TP4TP^,44pSPTP\T!TP4TP^,44p.p ^ p SPTP4p \!SP"4p T 'd<T P$\!T P44,TP, p \&P(!\*4p Rp\-\TP\+T ^, 444EF!pSP/Y4pTe+T^,\!T48dSP1TT4pMR#TeT^8XdKSTT8d2TY,8d%SP3T4pSP T4pMT'dKRpRpSP1Yo4pTfT ^,p T ^8:dRpEMcSP3T\44p\7TRR7'gRpEM5SP T4pT TT3;;,^, uu&T TT3,^ 8d&SPPRT R TR R 24M\!T 4SP88d7SPPR P;SP844MT P\=STP>T,SP TP^T,,4TSP TP^T,,4TTTTR 7 4EK$ T'g*SPPRTPR 24T Uu0uFpTP@kK pp^ p SPTP4p \!SP"4p T 'd<T P$\!T P44,TP, p \&P(!\*4p Rp\-\TP\+T ^, 444EFWpTTP>,T9gKSP1TT4pTfT ^,p T ^8:dRpEMT^8XdKSTe'TT8d TY,8dSP3T4pMRpT T;;,^, uu&T T,SPB8d8SPPRP;SPBT44My\!T 4SP88d,SPPRSP8 R24M4T P\=TP>T,TRTR74EKZ T'g,SPPRTPR 24R#T 'gTPE4'dR#\GTT SP3TPH4R7# \ d'SPPRT,4R#i;i \ d'SPPRT,4R#i;i \ dEKi;i \ dZT ^,p T ^8:dRpEKSP T4pEL \ dT ^,p T ^8:d RpEKEKi;ii;iuupi \ dRpELi;i)zParse the export directory. Given the RVA of the export directory, it will process all its entries. The exports will be made available as a list of ExportData instances in the 'IMAGE_DIRECTORY_ENTRY_EXPORT' PE attribute. r}z+Error parsing export directory at RVA: 0x%xNcsZ<\SP4SPV4, #r)r8rr)r}rTrVrlength_until_eofZ3PE.parse_export_directory..length_until_eof2s"t}}%(@(@(EE ErTF)rz9Export directory contains more than 10 repeated entries (rz#02xz). Assuming corrupt.zHExport directory contains more than {} symbol entries. Assuming corrupt.) rfrGrYrJrarrWr_rbzIRVA AddressOfNames in the export directory points to an invalid address: rz[Export directory contains more than {} repeated ordinal entries (0x{:x}). Assuming corrupt.z$Export directory contains more than z# ordinal entries. Assuming corrupt.)rGrJrr_zMRVA AddressOfFunctions in the export directory points to an invalid address: )r9symbolsr)%r!__IMAGE_EXPORT_DIRECTORY_format__r|rrrrurrwZAddressOfNamesrRZ NumberOfNamesZAddressOfNameOrdinalsZAddressOfFunctionsZNumberOfFunctionsr>r8rr collectionsZ defaultdictrr1rget_dword_from_dataget_string_at_rvaMAX_SYMBOL_NAME_LENGTHrrrxr^ZBaserGrrr]rg)rTr}rrvZ export_dirrZaddress_of_namesZaddress_of_name_ordinalsZaddress_of_functionsexportsZ#max_failed_entries_before_giving_uprjrZ symbol_countsZ&export_parsing_loop_completed_normallyr=Zsymbol_ordinalZsymbol_addressZ forwarder_strrbZsymbol_name_addressZ symbol_nameZsymbol_name_offsetexpZordinalsrsf&&& rrzZPE.parse_export_directorys --66 4#I#IJQQS!44S9 .J   F #}}))$Z%>%>?,,q0  (,}}00$Z%E%EF,,q0( $$(==--$Z%B%BC0014$ .0+))**C*CDdmm, &&g&&()*++,  $//4 15.s:33S19L5MNOA!445MQN)nq.@3$D/"&!9!9(." %1)< $#*)D $ 6 6~ F '+'?'?'O$" $ #' "&":":;K"O "*3q836!;=B:00#%;K*+PTUU9>6 %)%=%=>Q%R"$ ;7 8A = 8k>:;b@&&#}B~d&;;OQ]#d&=&==&&((.t/F/F(G NN&OOn<#'#;#;"881q5@$+#'#;#;"55N8JJ$% 2+%5 [P~6 OO " "&55a8:  ,337CCKK73.0+))**G*GHdmm, &&g&&()*//0  $//4 15.Z993QR?R;STUCZ__$H4*%)%=%=>RTW%XN")71<7:a?AF>!Q&#.&#-&3$($:$:>$JM$(M n-2- 043K3KKOO**FFLf 44nG '$*A*AAOO**>2233VX *# 5 .!"/ ]Vn6 OO " "&99!<>  :0022'' 8  a  OO " "=E    J  OO " "=E    Z%.! 3q836!;=B:)-)A)ABU)V&$71<7:a?AF>  n4(%*%)N*sA\2C]]9;^ $_3_8-]]-]65]69 ^ ^  _0/__, _0&_0+_,,_08 ` ` csJW,^,R,VR,, #)rlrM)rTrZbaserrrZPE.dword_aligns"j0TJ5FGGrcsVPPpVPPVPP,pY!u;8:dV8d MV#W,pV#r)r ImageBaser)rTZvaZbegin_of_imageZ end_of_imager5rnormalize_import_vaZPE.normalize_import_vasV--77++558L8L8X8XX   ., .   B rc s.p^pVPV\VP4P44pTPT4pTPTPTTR7pT'dTP4'dT#RpTP^8XdTPP\R,8XdTPTP4TnTPTP 4TnTPTP"4TnTPTP$4TnTPTP$4TnTPTP(4TnRpYP4, p\+TP,4T, p YP"8gYP 8d-\/YP", YP , 4p .p TP1TP"TP RT T4p T^8d.TP P RP3T44T#T 'g T^, pEKrTP6\88d6TP P R TP6\83,4T#TP;TP(\<4p \?T 4'gR p T 'gEKT FRp T P@eK\BPD!T PG4T PH4pT'gKLYn KT TP \KYzT R 74EKq \d'TP P RT,4T#i;i \d@p TP P RP3YP444Rp ? ELRp ? ii;i) z*Walk and parse the delay import directory.Tz5Error parsing the Delay import directory at RVA: 0x%xr}FIMAGE_FILE_MACHINE_I386NzSError parsing the Delay import directory. Invalid import data at RVA: 0x{0:x} ({1})zWToo many errors parsing the Delay import directory. Invalid import data at RVA: 0x{0:x}z)Error, too many imported symbols %d (>%s) *invalid*r9importsdll)&r|r(__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__rrurrwrrrZgrAttrsr1rrrZ pBoundIATZpIATZpINTZ pUnloadIATZphmodZszNamer8rrS parse_importsrxrJrMAX_IMPORT_SYMBOLSrMAX_DLL_LENGTHrr ordlookup ordLookuplowerrGrB)rTr}r import_descsr>r"r import_desccontains_addressesmax_len import_datar@rrfuncnames&&& rrZPE.parse_delay_import_directory*s   }}dKKLSSU2237K..=='/K+"8"8":":^]"' ##q($$,, =V0WW(,(@(@AVAV(W %#'#;#;KP>P%Q "%)" %%' 'C $--(;6G%%%/?/?)?c$4$44c>@ @ ( "$**556@@B B ( "$**556@@B B=>>rc  s.p.R Op\VR4'gR#VPEFp\VP\4'd*VPP 4P 4pMVPP 4pVPR^4p\V4^8dV^,V9d V^,pVPP 4pVPFpRpVP'gR\P!WgPRR7pV'g'\RVP RVPR 24hM VPpV'gK~\V\4'dVP 4pVPVP 4: RVP 4: 24K EK \!R P#V4P%44P'4#) aReturn the imphash of the PE file. Creates a hash based on imported symbol names and their specific order within the executable: https://www.mandiant.com/resources/blog/tracking-malware-import-hashing Returns: the hexdigest of the MD5 hash of the exported symbols. DIRECTORY_ENTRY_IMPORTrn.NT)Z make_namezUnable to look up ordinal rZ04xr)Zocxsysr)rrrArrCr;rZrsplitr8rrrrrGrurwrrr]r) rTZimpstrsZextsrZlibnameZpartsZentry_dll_lowerimpr s & r get_imphashZPE.get_imphashs$t56600E%))U++))**,224))//+NN3*E5zA~%(d"2(#iioo/O}}xxx(22' H$+8 1S[[QTDUV$ #xxHh..'0H'--/8>>;KLM%%1>388G$++-.88::rc s\VR4'gR#\VPR4'gR#VPPUu.uFEpV'gK VPfKVPP 4P 4NKG pp\ V4^8XdR#\RPV4P44P4#uupi)zReturn the exphash of the PE file. Similar to imphash, but based on exported symbol names and their specific order. Returns: the hexdigest of the SHA256 hash of the exported symbols. DIRECTORY_ENTRY_EXPORTrnrr) rrrrr;rr8rrr]r)rTr,Z export_listrVr get_exphashZPE.get_exphashst566t22I>>0088 8 $VV $AFFMMO ! ! #8  { q 388K(//12<<>> s C  C *,C c sD.p^p\VP4P4pVPW4pTPT4pTPTPYxR7p T 'dT P4'dEMYP4, p\TP4T, p YP8gYP8d-\YP, YP, 4p .p T'gpTPT PT PT P T R7p T^8d!TP P R TR 24MT 'g T^, pEKXTP%T P&\(4p \+T 4'gR p T 'gEKT FRpTP,eK\.P0!T P34TP44pT'gKLYnKT TP \7YT R 74EK T'gR R 0p^p^pTFpTP8FpTFpT'dTP,'gKTP,p\;TP,4\<8XdTP,P?R4pTPAT4'gK}T^, pM T^, pK K T\T48Xd#T^8dTP P R4T# \d%TP P RTR 24EK#i;i \d9p TP P RTR RT P" R24Rp ? ELURp ? ii;i)z$Walk and parse the import directory.z-Error parsing the import directory at RVA: 0xrr}rqzBError parsing the import directory. Invalid Import data at RVA: 0xz ()NzLToo many errors parsing the import directory. Invalid import data at RVA: 0xrrZ LoadLibraryZGetProcAddressrkz?Imported symbols contain entries typical of packed executables.)!r"__IMAGE_IMPORT_DESCRIPTOR_format__rr|rurrwrrrr8rZOriginalFirstThunkZ FirstThunkrSrZForwarderChainrJrrgrrrrrrrGrBrrqrCr;rD)rTr}rrwrr>Zimage_import_descriptor_sizer"rr r r r,rrr Zsuspicious_importsZsuspicious_imports_countZ total_symbolsZimp_dllZsuspicious_symbolrs&&&& rryZPE.parse_import_directorysH  '0  3 3( &( % }}SG2237K..77/K +"8"8":": %%' 'C $--(;6G333s=S=S7S888#@V@V:VK  "&"4"4#66#..#22#* #5#K?OO**99JC(--"s)F{{*#,#6#6syy{FNN#S#8*2K * ##"+PST"/1A!B '( $M'%ooF-?)%V[[[$%{{ ,5#);;#5#5g#>D??+<==494!.@"Q&M.()C0B,CC!B&&&Uw! &&CC7K  F%OO**99V'd\V4^8Xd&VPPRVR RVR 24.#Rp V'dTp M V'dTp MR#^p Rp VP\ 8Xd\ p M&VP\8Xd \p ^p Rp M\ p ^p \V 4EFwrRpRpRpRpRpRpVP'dVPV ,'dRpVPR ,pRpRpMRpVPV ,pVPV^4pVPV^4pVPVP^,\4p\V4'gR pVP!VP^,4pVP%4pVP'V4pW P(P*,W,,pRpV'dKV'dCW~,PW,P8wdW,PpW,pMRpVfVf \#R 4hVR 8Xd%V R 8dW8Xd \#R 4hV ^, p EKV'g V'gEKVP\/VVVVVVP%4VVVVVVXXR74EK V# \"dEL>i;i \,dRpLi;i)zParse the imported symbols. It will fill a list, which will be available as the dictionary attribute "imports". Its keys will be the DLL names and the values of all the symbols imported from that object. z\Damaged Import Table information. ILT and/or IAT appear to be broken. OriginalFirstThunk: 0xrz FirstThunk: 0xNrlFTrIrz"Invalid entries, aborting parsing.iz)Too many invalid names, aborting parsing.)rfrQrVimport_by_ordinalrGrYhintrrWrHrJhint_name_table_rva thunk_offset thunk_rva)get_import_tabler8rrwrLrMrNrOrPrrSr|rrMAX_IMPORT_NAME_LENGTHrrrurrrrrrF)rTZoriginal_first_thunkZ first_thunkZforwarder_chainrrr Zimported_symbolsZiltZiattableZ imp_offsetZ address_maskr[Z num_invalidrZ tbl_entryZimp_ordZimp_hintZimp_namerWrrr"rrZ imp_addressrVZ imp_bounds&&&&&& rrZPE.parse_importsYs4## .@ ##K=OPs3x1}sc#h!m OO " "))=a(@A!!,Q1  I E E ! <<3 3-L \\: :/LJ-L .L '.NCGHHK"&  % &&&**\99(,%'55>G#H"&K(-%.7.E.E .T+#}}-@!D#'#:#:4#C#'#9#9%33a79O$ 6h??'3H&*&>&>%33a7'  )88:  44\B 22<<%s)FTz9Error parsing the import table. Invalid data at RVA: 0x%xr}z\Error parsing the import table. AddressOfData overlaps with THUNK_DATA for THUNK at RVA 0x%xrrI)rLrMrN__IMAGE_THUNK_DATA_format__rOrP__IMAGE_THUNK_DATA64_format__rrrOrrwrrrZr|rur8rrrrSrUrTrRrWr)rTr}rrr rr[rxZ expected_sizeZMAX_ADDRESS_SPREADZADDR_4GBZMAX_REPEATED_ADDRESSESZrepeated_addressZaddresses_of_data_set_64Zaddresses_of_data_set_32Z start_rvaZfailedr"Z thunk_dataZ addr_of_dataZthe_sets&&&& rrZPE.get_import_tables] <<3 3-L55F \\: :/L77F .L55F!&)002 (!##-< #-<  c%#Z1G*G&&OB **-??&&:224FGHt q  ' '1 , ' 9 (,,.1CC ',,.1CC F }}S8Tm3&&RUXX--$*B*B3*G.J "+/+C+C,,, (.2-E-E... *'+&>&>z?R?R&S #%)%=%=j>P>P%Q ",, 9,,3&&(+.0 > ;j666)77 ,..$j069! :$x/":":#w.(A-(KK -!6!6!8!8  :$$& &C LL $ M!  s0M88 N N c sVeVPpVPV4VPpVPEF<pVP^8XdVP ^8XdK(VP pVP VP4pVPVPVPPVPP4pV\VP48gAV\VP48g'Wg,\VP48gW8dKV\V4, p V ^8dVRV ,, pM V ^8dVRV pWEP4, pEK? VeXVnV#)aDReturns the data corresponding to the memory layout of the PE file. The data includes the PE header and the sections loaded at offsets corresponding to their relative virtual addresses. (the VirtualAddress section header member). Any offset in this data corresponds to the absolute memory address ImageBase+offset. The optional argument 'max_virtual_address' provides with means of limiting which sections are processed. Any section with their VirtualAddress beyond this value will be skipped. Normally, sections with values beyond this range are just there to confuse tools. It's a common trick to see in packed executables. If the 'ImageBase' optional argument is supplied, the file's relocations will be applied to the image by calling the 'relocate_image()' method. Beware that the relocation information is applied permanently. Nr)rrelocate_imager=rrrrrrrrrrr8r|) rTZmax_virtual_addressrZ original_dataZ mapped_datarjZsrdZprdrrBrrget_memory_mapped_imageZPE.get_memory_mapped_imagezsV,  !MMM    *kk }}G''1,1F1F!1K''C..w/G/GHC!%!=!=&&$$55$$22" c$--((T]]++9s4==11%</#k2BBN!u~55 !#)/>: ++- -K;%B  )DMrc s.p\VR4'dVPPFp\VR4'gKVPPFp\VR4'gK\VPR4'gK5VPP'gKS\ VPPP 44FpVPV4K K K V#)zReturns a list of all the strings found within the resources (if any). This method will scan all entries in the resources directory of the PE, if there is one, and will return a [] with the strings. An empty list will be returned otherwise. DIRECTORY_ENTRY_RESOURCErr)rr&rZrrrMrrw)rTZresources_stringsres_typer res_string& rget_resources_stringsZPE.get_resources_stringss 43 4 4 99AA8[11'/'9'9'A'A "; << ' (=(=y I I$/$9$9$A$A$A26$/$9$9$A$A$H$H$J3"J%6$<$r8r=rrur|)rTr}r~rrrKrr|Z PE.get_datas  # #C ( >C,CS%%{{3++S''}}S-- OP Pzz#&&rc  slVPV4pV'gVP'ds\VPUu.uFHpVPVPVP P VP P4NKJ up4pW8dV#R#V#VPV4#uupi)z.Get the RVA corresponding to this file offset.N) rrrRrrrrrr)rTrrZ lowest_rvar5rrZPE.get_rva_from_offsets  & &v .}}} "&  "/A 44,, 00AA 00>> "/   &"M $$V,,-sAB1c sVPV4pV'g-V\VP48dV#\RVR R24hVP V4#)zGet the file offset corresponding to this RVA. Given a RVA , this method will find the section where the data lies and return the offset within the file. zdata at RVA 0xrz can't be fetched)r>r8rrur)rTr}rrFrrZPE.get_offset_from_rvasW  # #C ( S'' .Q7H IJ J$$S))rc sVfR#VPV4pV'g&VP^VPWV,4#VP^VPWR74#)z1Get an ASCII string located at the given address.N)r~)r>rrr|)rTr}rrrrrrZPE.get_string_at_rva/s^ ;  # #C (,,Q c*DT0UV V((AJJsJ,NOOrc stV\V48dR#W!Rp\V\4'd \V4#V#)rrN)r8rArrC)rTrr"rrrget_bytes_from_dataZPE.get_bytes_from_data:s5 CI  M a # #8Orc sbVPW4pVPR4pV^8dVRVpV#)zGet an ASCII string from data.rN)r+rL)rTrr"rrrKrrZPE.get_string_from_dataCs6  $ $V 2ffUm !8$3Arc sV^8XdR#VPV^4pV^,p\VR4pVPW4pR pVPRV^,4pVR 8Xd\\V4pWu8gWr8Xd\V4^, pMKW@PW,W', 4, pV^, pTpK|V^,^8XgKV^,p\P !RP V4VRV^,4pRP\\V44p V'dV PVR4#V PRR4#) z3Get an Unicode string located at the given address.rrrz<{:d}HNrnrrkrK) r|rRrLr8r9r:rxrZmaprr]) rTr}rrrr"Z requestedZ null_indexZ data_lengthZuchrsrrrrsZPE.get_string_u_at_rvaKs2 ?}}S!$ q  C( }}S, ; Q?JR!$i *k.G!$TaJ c&79QRR&] & a1$q  hooj94@P*q.;QR GGCUO $ 88H&9: :xx!455rc sbVPFpVPV4'gKVu# R#)z1Get the section containing the given file offset.N)rr)rTrrjrFrrZPE.get_section_by_offsetvs-}}G&&v..%rc sVPe.VPPV4'd VP#VPF$pVPV4'gKW nVu# R#)z-Get the section containing the given address.N)rr r)rTr}rjrFrr>ZPE.get_section_by_rvasb  - - 911>>sCC999}}G##C((5<2% rcs"VP4#r) dump_inforYr#rrlZ PE.__str__s~~rc s\VR4#)z.Checks if the PE file has relocation directoryDIRECTORY_ENTRY_BASERELOC)rrYr#r has_relocsZ PE.has_relocsst899rcsf\VR4'dVPP'dR#R#)DIRECTORY_ENTRY_LOAD_CONFIGTF)rr/rrYr#rhas_dynamic_relocsZPE.has_dynamic_relocss( 46 7 7//CCCrc s<\VPVR74R#)z=Print all the PE header information in a human readable from.rN)rOr,)rTrrr print_infoZ PE.print_infos dnnhn/0rc  s(3Vf \4pVP4pV'd<VPR4VF$pVPV4VP 4K& VPR4VP VP P44VP 4VPR4VP VPP44VP 4VPR4VP VPP44\\R4pVPR4.p\V4F@p\VPV^,4'gK(VPV^,4KB VPRP!V44VP 4\#VR4'dIVP$e;VPR4VP VP$P44\\&R 4pVPR 4.p\V4F@p\VP$V^,4'gK(VPV^,4KB VPRP!V44\\(R 4p V 'd.p\#VR 4'dVP*eVP*Fzp V P,P.\0R ,8XgK+\V 4F@p\V P2V^,4'gK(VPV^,4KB K| V'd2VPR4VPRP!V44VP 4VPR4\\4R4p VP6EFp VP V P44VPR4.p\V 4F5p\W^,4'gKVPV^,4K7 VPRP!V44VPRP9V P;444\<e/VPRP9V P?444\@e'VPRV PC4,4\De'VPRV PG4,4\He'VPRV PK4,4VP 4EK \#VR4'd\#VP$R4'ddVPR4VP$PLF(p V fK VP V P44K* VP 4\#VR4'Ed\OVPP4EFwr\SVPP4^8dVPRV^, 24MVPR4Ve VP VP44VP 4\#VR4'dAVP VPTV,P44VP 4\#VR4'gK\SVPV4V8gEKVPVV,EFqpVP VP44VP 4\#VR4'Ed*VPXEFpVP4Uu.uFpVPRV,4NK pVPRP9VPZP]VR 444VP 4\\_VP`Pc444FRpVPR!P9V^,P]VR 4V^,P]VR 444KT EK VP 4EKo\#VR"4'gEKVPdFp\#VR#4'gKVP4Uu.uFpVPRV,4NK pVPR!P9\_VP2Pg44^,P]R$R 4\_VP2Pi44^,44K VP 4EKt EK \#VR%4'EdlVPR&4VP VPjP,P44VP 4VPR':R( R)R*:R( RR+: 24VPjPlFpVPnfKR,pVPp'd VPppVPR-VPrVPnVP]V43,4VPt'd=VPR.P9VPtP]VR 444KVP 4K VP 4\#VR/4'EdkVPR04VPvEFHpVP VP,P44VPx'gdVPR1P9VP{VP,P|4P]VR 444VP 4VP 4VPxEFupVP~R2JdVPpe`VPR3P9VPP]R$4VPpP]R$4VPr44MVPR4P9VPP]R$4VPr44M`VPR5P9VPP]VR 4VPpP]VR 4VP44VP'd.VPR6P9VP44EKeVP 4EKx VP 4EKK \#VR74'Ed!VPR84VPFpVP VP,P44VPR9P9VPpP]VR 444VP 4VP`FxpVP VP,P4^4VPR9P9VPpP]VR 44^4VP 4Kz EK \#VR:4'EdVPR;4VPEFfpVP VP,P44VP 4VPxEFpVP~R2JdGVPR4'EdVPR?4VP VPP,P44VPP`EFpVPpe4VPpP]VR 4pVPR@V RA2^4MX\PVP,PRB4pVPRCVP,PRD REV RF2^4VP VP,P4^4\#VRG4'Ed3VP VPP,P4^4VPP`EFpVPpe4VPpP]R$R 4pVPR@V RA2^4M+VPRCVP,PRD RA2^4VP VP,P4^4\#VRG4'gKVP VPP,P4^4VPP`EFp\#VRH4'gKVPRIVPPVPP\PVPPRJ4\VPPVPP43,^4VP VP,P4^ 4VP VPP,P4^ 4EK \#VPRK4'gEK1VPP'gEKPVPRL^ 4\_\VPPPc444FGwppVPRMP9VVPRNRO4P]RP44^ 4KI EK VP 4EK VP 4\#VRQ4'dVP'dqVPP,'dUVPRR4VP VPP,P44VP 4\#VRS4'dVP'dqVPP,'dUVPRT4VP VPP,P44VP 4\#VR 4'dVPRU4VP*Fp VP V P,P44VPRV\0V P,P.,,4VP 4V P2'gKVP V P2P4^4VP 4K VP4'dVPRX4VPFp!VP V!P,P44V!P`FEp"VPRYV"P\V"P,RZ,3,^4KG VP 4K \#VR\4'd\SVP4^8dVPR]4VPFzp#VP V#P,P44\#V#R^4'gK@V#PfKPVP V#PP4^4K| VP4#uupiuupi \d9TPRWP9T P,P.44ELMi;i \d5TPR[T"PT"P3,^4EKi;i)_z>Dump all the PE header information into human readable string.Parsing Warningsr&r*r1rrrrrzDllCharacteristics: rDIRECTORY_ENTRY_DEBUG&IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICSzExDllCharacteristics: PE Sectionsrz!Entropy: {0:f} (Min=0.0, Max=8.0)zMD5 hash: {0}zSHA-1 hash: %szSHA-256 hash: %szSHA-512 hash: %sr8 DirectoriesrWzVersion Information Version InformationrrXrYz z LangID: {0}rz {0}: {1}rrrkrExported symbolsrRZ10z RVArgsNonez%-10d 0x%08X %sz forwarder: {0}rImported symbolsz Name -> {0}Tz*{0}.{1} Ordinal[{2}] (Imported by Ordinal)z&{0} Ordinal[{1}] (Imported by Ordinal)z{0}.{1} Hint[{2:d}]z Bound: 0x{0:08X}DIRECTORY_ENTRY_BOUND_IMPORT Bound importszDLL: {0}DIRECTORY_ENTRY_DELAY_IMPORTDelay Imported symbolsz({0} Ordinal[{1:d}] (Imported by Ordinal)z{0}.{1} Hint[{2}]r&Resource directoryzName: [Z]rzId: [0xrz] (rrr"z\--- LANG [%d,%d][%s,%s]r/rz [STRINGS]z {0:6d}: {1}unicode-escaperrDIRECTORY_ENTRY_TLSTLSr/ LOAD_CONFIGDebug informationzType: zType: 0x{0:x}(Unknown)Base relocationsz%08Xh %srNNz0x%08X 0x%x(Unknown)DIRECTORY_ENTRY_EXCEPTIONz"Unwind data for exception handlingr)\rrvrrrrr&rr*r1rGr2rWZsortedrrwrrrr6rr3r9r DEBUG_TYPErrrrxr rrrrrrrrr8rrWr8rrXrYrr;rMrZr@rr@rrrrJrrGr_rrrrgrrrrHr;r=r&rr1rrr"rrr0r6rr]rAr/r;r.r-r}RELOCATION_TYPErqrGrr)$rTrrwarningsrPrArIrErCrZ debug_entryrrjrrZ vinfo_entryrr`r str_entry var_entryexportrmodulerbound_imp_desc bound_imp_refr'Z res_type_idrrr(r base_relocrelocrs$&&& rr,Z PE.dump_infosQ <6D$$&  OO. /# g&  "$  % t++-.   % t++-.   & t'',,./$%:MJ  ;'Dt''a11 T!W%( dii&'  4* + +0D0D0P OO- . NN4//446 7$2 !<% ! '(45Dt++T!W55 T!W%6 dii&''5 "$B( $ (E566..:#'#=#=K#**//%&NOP%++G$HD&{'8'8$q'BB % T!W 5%I $>12 dii./   &&'> M }}G NN7<<> * HHY E}-7G,,LLa). MM$))E* + MM3::7;N;N;PQ  1889M9M9OPQ 073H3H3JJK! 073J3J3LLM! 073J3J3LLM    '%* 4* + +  "21 1  OOM *!11@@ (NN9>>#34A     4) * *$-d.A.A$B t**+a/OO&:37)$DEOO$9:*NN;#3#3#56  "4!344NN4#8#8#=#B#B#DE$$&4,,T]]1Cc1I!%s!3!3uzz|4((*"5-88,1,=,=HP  Xtd{!; X $ $3$:$:(0(>(>,46I)*%&!"!% 0 0 217X=M=M=S=S=U8V1WI$(MM(6(=(=,5aL,?,?08:M-.-6aL,?,?08:M-. )* %&2X->.!,,.$UE22-2YY #*9g#>#>5>NN4D%&4DD)- dTk(B4D%&%)MM(6(=(=,01E1E1G,H,K,R,R079L-.-11G1G1I,J1,M )*%& .7!,,.]"4%C| 41 2 2 OO. / NN466==BBD E     MME6J K55==>>-"D{{{%{{HH,!>>6>>4;;x;PQR''' -44 & 0 0 7 7BU V ((*!>$     41 2 2 OO. /55v}}1134~~~HH'.. 226==3E3EFMM (*=$$&  "$nnF//47!;;2 HH L S S$*JJ$5$5g$>$*KK$6$6w$?$*NN!"!HH H O O$*JJ$5$5g$>!" 188 & 1 1(BMM")))..55h@ST  $$&&<#D& 47 8 8 OO4 5;;v}}1134  "$nnF//47FMM & 1 1('>'@!D"; << NN;+@+@+G+G+L+L+NPQR1<1F1F1N1N #*=&#A#A$(MM(C,9,>,>,C,C,9,>,>,F,F,0HH0=0B0B0G0G-.-F0=0B0B0G0G0=0B0B0J0J-. +* )*)*%&%)NN=3G3G3L3L3NPR$S$(NN=3E3E3L3L3Q3Q3SUW$X%2O(!( (=(=y I I$/$9$9$A$A$A $ k2 >7;$*;+@+@+H+H+N+N+P$Q8"OC%)MM(5(<(<,/,6,=,=0@BT-..4fWo )* )+%&8"O(Bh  "OBR     D/ 0 0(((((/// OOE " NN433::??A B     D7 8 800000777 OOM * NN4;;BBGGI J     40 1 1 OO/ 011szz01TMM(Z -H"HI  "999NN399>>#3Q7$$&2 ??   OO. /"<< z005578'//E &%))_UZZ5PQT5U)VV0  "= D5 6 6D223a7 OO@ A44ryy~~/02|,,1JNN2==#5#5#7;5 }}Y !Y6%&` TMM":"A"A#**//"RST"$ 2eii5LLas? !Ad !Ad [ 7Ad _AAed ?AeeAee:AffAfc  sN /pVP4pV'dW!R&VPP4VR&VPP4VR&VPP4VR&\ \ R4p.VR&VFGp\VPV^,4'gK(VR,PV^,4KI \VR4'd,VPeVPP4VR&\ \R4p.VR &VFGp\VPV^,4'gK(VR ,PV^,4KI .VR &\ \R 4pVPFpVP4pVR ,PV4.VR&VF<p\Wt^,4'gKVR,PV^,4K> VP4VR &\eVP!4VR &\"eVP%4VR&\&eVP)4VR&\*fKVP-4VR&K \VR4'dv\VPR4'dZ.VR&\/VPP04F1wrV fK VR,PV P44K3 \VR4'Ed.VR&\/VP24EFdwr.p V PV P44\VR4'd1V PVP4V ,P44\VR4'Ed\7VP84V 8Ed.p V PV 4VP8V ,EFpV PVP44\VR4'd/pVP:FnpV P=VP44VP>VR&\AVPBPE44FpV^,VV^,&K Kp V PV4K\VR4'gKVPFFp/p\VR4'gKV P=VP44\AVPHPK44^,V\AVPHPM44^,&V PV4K EK VR,PV 4EKg \VR4'd.VR&VR,PVPNPPP44VPNPRFp/pVPTeWVPWRVPXRVPTRVPZ/4VP\'dVP\VR &VR,PV4K \VR!4'd.VR"&VP^Fp.pVR",PV4VPVPPP44VP`Fp/pVPbR#Jd VPdVR$&VPXVR&M-VPdVR$&VPZVR&VPfVR%&VPh'dVPhVR&&VPV4K K \VR'4'd.VR(&VPjFp/pVR(,PV4VPWVPPP44VPZVR$&VPBF=p/pVPWVPPP44VPZVR$&K? K \VR)4'd.VR*&VPlFp.pVR*,PV4VPVPPP44VP`Fp/pVPbR#Jd VPdVR$&VPXVR&M-VPdVR$&VPZVR&VPfVR%&VPh'dVPhVR&&VPV4K K \VR+4'Ed-.VR,&VR,,PVPnPPP44VPnPBEFp/p VPZeVPZV R&MCVPPPp\rPuVPPPpR-43V R.&V PWVPPP44VR,,PV 4\VR/4'gK.p!V!PVPvPPP44VR,,PV!4VPvPBEFp"/p#V"PZeV"PZV#R&MV"PPPpV#R.&V#PWV"PPP44V!PV#4\V"R/4'gK.p$V$PV"PvPPP44V!PV$4V"PvPBEFp%\V%R04'gK/p&V%PxPzV&R1&V%PxP|V&R2&\~PuV%PxPzR34V&R4&\V%PxPzV%PxP|4V&R5&V&PWV%PPP44V&PWV%PxPPP44V$PV&4EK \V"PvR64'gEK(V"PvP'gEKG\AV"PvPPE44F6wp p'V$PV'PR7R84PR944K8 EK EK \VR:4'dVVP'dDVPPP'd(VPPPP4VR;&\VR<4'dVVP'dDVPPP'd(VPPPP4VR=&\VR>4'd.VR?&VPFp(/p)VR?,PV)4V)PWV(PPP44\PuV(PPPV(PPP4V)R@&K VP4'd.VRA&VPFp*.p+VRA,PV+4V+PV*PPP44V*PBFGp,/p-V+PV-4V,PV-R&\V,P,RB,V-R@&KI K V# \dT,PT-R@&Kni;i)Cz5Dump all the PE header information into a dictionary.r2r&r*r1rrrrr7r5rZEntropyZMD5ZSHA1ZSHA256ZSHA512r8r6rWr7rrXrYrrrrr8rRr9rgr_rr:TZDLLZHintZBoundr;r<r=r>r&r?rrrr"r0r2r/Z LANG_NAMEZ SUBLANG_NAMErr@rrrArBr/rCr3rDrrErF)Orvr&rr*r1rGr2rrwrrr6rrr rrrrrrrrrr8rWrr8rXrYr+rrMrZr@rrrr@rr9rrJrrGrr_rrrrrrHr;r=r&rrr1rr"rrr0r6rr]r;rAr/r3rHrr.r-r}rIrqr;).rTrrJrArErCrrjZ section_dictrrZvs_vinfoZversion_info_listZ fileinfo_listrZstringtable_dictr`rKrLZvar_dictrMZ export_dictrNZ import_listrZ symbol_dictrOZbound_imp_desc_dictrPZbound_imp_ref_dictZ module_listr'Zresource_type_dictZdirectory_listrZresource_id_dictZresource_id_listrZresource_lang_dictr(rZdbg_dictrQZbase_reloc_listrRZ reloc_dicts.& rrZ PE.dump_dictMs  $$& ,4( )"&//";";"= ,"&//";";"= ,#'#3#3#=#=#? - $%:MJ  'Dt''a11'"))$q'2  4* + +0D0D0P+/+?+?+I+I+KI' ($2 !<% !+- &'-Dt++T!W55./66tAw?.$& - &'> M }}G",,.L m $ + +L 9$&L !%7G,, )00a9&'.&9&9&;L #&-&:&:&< U#'.'<'<'> V$!)0)@)@)B X&!)0)@)@)B X&!%$ 4* + +  "21 1 (*Im $"+D,@,@,O,O"P(m,33I4G4G4IJ#Q 4) * */1I+ ,!*4+>+>!? $&!!((););)=>4!344%,,T-B-B3-G-Q-Q-ST4,,T]]1Cc1I$&M%,,];!%s!3!3%,,U__->?"5-88/1,,1,=,= - 4 4X5G5G5I J=E__ 0 :15h6F6F6L6L6N1OIENq\$4Yq\$B2P-> *001AB$UE22-2YY +-#*9g#>#>$1$8$89L9L9N$OPT(1(>(>(@Q&&'Q)HT)//2F2F2H-I!-L$M%2$8$8$B.7"4,/0778IJA"@D 41 2 2,.I( ) ( ) 0 0++22<<> 55== >>-&&%v~~!6>>"FKK'''393C3C K0,-44[A> 41 2 2,.I( )55 ,-44[A""6==#:#:#<=$nnF"$K//47-3ZZ E*17 I.-3ZZ E*.4kk F+.4kk F+|||/5|| G,&&{3- 6$ 47 8 8)+Io &"&"C"C&(#/*112EF#**>+@+@+J+J+LM-;-@-@#E*%3%;%;M)+&&--m.B.B.L.L.NO0=0B0B&u-&<#D 47 8 824I. /;; 23::;G""6==#:#:#<=$nnF"$K//47-3ZZ E*17 I.-3ZZ E*.4kk F+.4kk F+|||/5|| G,&&{3- <& 43 4 4.0I* + * + 2 2--44>>@ !99AA%'"==,19&v.!**%))(//*<*J'/'9'9'A'A +-(&++77B7G7G,V45@5G5G5J5J,T2(// 0B0B0L0L0NO&--.>?"; <)6(:(:(B(B%7(1%&GKhh(5(:(:(?(?G&$6{$C )B(5(:(:(?(?(5(:(:(B(B)&%7(6%& %7$=$=(5(<(<(F(F(H%&%7$=$=(5(:(:(A(A(K(K(M%&%5$;$;P)**0&/%&8"[(B'BT D/ 0 0(((((///#77>>HHJIe  D7 8 8000007770077AAC   40 1 1-/I) *11-.55h? 4 4 67#->>#**//3::??#S 2 ??  ,.I( )"<< "$,-44_E&&z'8'8'B'B'DE'//E!#J#**:6(- Ju%8-\P!RVR,4#)zMReturn a four byte string representing the double word value (little endian).rEr9r)rTdwordrrget_data_from_dwordZPE.get_data_from_dword|s{{4!344rc sV^,^,\V48dR#\P!RW^,V^,^,4^,#)zConvert four bytes of data to a double word (little endian) 'offset' is assumed to index into a dword array. So setting it to N will return a dword out of the data starting at offset N*4. Returns None if the data can't be turned into a double word. Nrr8r9r:rTr"rrrrZPE.get_dword_from_dataD QJ! c$i '}}T4 fqjA5E#FGJJrc slVPVPV^4^4# \dR#i;i)zReturn the double word value at the given RVA. Returns None if the value can't be read, i.e. the RVA can't be mapped to a file offset. N)rr|rurrrrZPE.get_dword_at_rvas7 ++DMM#q,A1E E  s !$ 33c sV^,\VP48dR#VPVPW^,^4#)zFReturn the double word value at the given file offset. (little endian)N)r8rrrrrget_dword_from_offsetZPE.get_dword_from_offset< A:DMM* *'' fz(JANNrc BVPWPV44#)zLSet the double word value at the file offset corresponding to the given RVA.)set_bytes_at_rvarW)rTr}rVrrset_dword_at_rvaZPE.set_dword_at_rva$$S*B*B5*IJJrc r])z3Set the double word value at the given file offset.)rZrW)rTrrVrrrXZPE.set_dword_at_offset''0H0H0OPPrc 0\P!RV4#)zFReturn a two byte string representing the word value. (little endian).r{rUrTrurrget_data_from_wordZPE.get_data_from_word{{4&&rc sV^,^,\V48dR#\P!RW^,V^,^,4^,#)zConvert two bytes of data to a word (little endian) 'offset' is assumed to index into a word array. So setting it to N will return a dword out of the data starting at offset N*2. Returns None if the data can't be turned into a word. Nr{rXrYrrrZPE.get_word_from_datarZrc xVPVPV4R,^4# \dR#i;i)zReturn the word value at the given RVA. Returns None if the value can't be read, i.e. the RVA can't be mapped to a file offset. :NrpNN)rr|rurrrget_word_at_rvaZPE.get_word_at_rvas: **4==+=b+A1E E   '* 99c sV^,\VP48dR#VPVPW^,^4#)z?Return the word value at the given file offset. (little endian)N)r8rrrrrget_word_from_offsetZPE.get_word_from_offsets< A:DMM* *&&t}}Vqj'I1MMrc r])zESet the word value at the file offset corresponding to the given RVA.)r^rd)rTr}rurrset_word_at_rvaZPE.set_word_at_rvas$$S*A*A$*GHHrc r])z,Set the word value at the given file offset.)rZrd)rTrrurrr`ZPE.set_word_at_offsets''0G0G0MNNrc rb)zMReturn an eight byte string representing the quad-word value (little endian).r,BAF F  rhc sV^,\VP48dR#VPVPW^,^4#)zDReturn the quad-word value at the given file offset. (little endian)N)r8rrmrrrget_qword_from_offsetZPE.get_qword_from_offsetr\rc r])zJSet the quad-word value at the file offset corresponding to the given RVA.)r^rl)rTr}qwordrrset_qword_at_rvaZPE.set_qword_at_rvar`rc r])z1Set the quad-word value at the given file offset.)rZrl)rTrrprrset_qword_at_offsetZPE.set_qword_at_offset rarc s\V\4'g \R4hVPV4pV'gR#VP W24#)zOverwrite, with the given string, the bytes at the file offset corresponding to the given RVA. Return True if successful, False otherwise. It can fail if the offset is outside the file's boundaries. data should be of type: bytesF)rArC TypeErrorrSrZ)rTr}r"rrrr^ZPE.set_bytes_at_rvasD$&&;< <))#.''55rc s\V\4'g \R4h^Tu;8:d\VP48dMR#VP W4R#R#)zOverwrite the bytes at the given file offset with the given string. Return True if successful, False otherwise. It can fail if the offset is outside the file's boundaries. rsFT)rArCrtr8rset_data_bytes)rTrr"rrrZZPE.set_bytes_at_offset#sR$&&;< <  +T]]+ +    -rcs&<V^8dQhRS[RS[/#)rprr")rrCrrrrZPE.__annotate__4s::S::rcs\VP\4'g,\VP4pVP4W0nW PW\ V4,%R#r)rArrrr8)rTrr"new_datarrruZPE.set_data_bytes4sG$--33 /H    $M59 fD 12rc s4VPFpVPVP4pW!P,pV\ VP 48gKLV\ VP 48gKhVP W!P44K R#)zUUpdate the PE image content with any individual section data that has been modified. N)rrrrr8rrur|)rTrjZsection_data_startZsection_data_endrrmerge_modified_section_dataZPE.merge_modified_section_data<sz }}G!%!=!=g>V>V!W 14I4II !C $66;Kc O<##$68H8H8JK %rc sJWPP, p\VPP4^8E dVPP^,P'E d\ VR4'gVP \R,.R7\ VR4'gVPPR4EMVPEFp^pV\VP48gK"VPV,pV^, pVP\R,8XdKVVP\R,8XdMVPVPVP!VP4V,^, R,4KVP\R,8XdGVPVPVP!VP4V,R,4EK VP\R ,8Xd@VP#VPVP%VP4V,4EK{VP\R ,8XdV\VP48XdEKVPV,pV^, pVPVPVP!VP4^,VP,V,R ,^, 4EK5VP\R ,8XgEKTVP'VPVP)VP4V,4EK WPn\ VR 4'd@VP*F/pVP,FpV;P.V, unK K1 \ VR4'dVP0P2;P4V, unVP0P2;P6V, unVP0P2;P8V, unVP0P2;P:V, un\ VR4'EdpVP<P2p \ V R4'd,V P>'dV ;P>V, un\ V R4'd,V P@'dV ;P@V, un \ V R4'd,V PB'dV ;PBV, un!\ V R4'd,V PD'dV ;PDV, un"\ V R4'd,V PF'dV ;PFV, un#\ V R4'd,V PH'dV ;PHV, un$\ V R4'd,V PJ'dV ;PJV, un%\ V R4'd,V PL'dV ;PLV, un&\ V R4'd,V PN'dV ;PNV, un'\ V R4'd,V PP'dV ;PPV, un(VPR\T8Xd>\ V R4'd,V PV'dV ;PVV, un+\ V R4'd,V PX'dV ;PXV, un,\ V R4'd,V PZ'dV ;P\V, un.\ V R4'd,V P\'dV ;P\V, un.\ V R4'd,V P^'dV ;P^V, un/\ V R4'd,V P`'dV ;P`V, un0\ V R 4'd,V Pb'dV ;PbV, un1\ V R!4'd,V Pd'dV ;PdV, un2\ V R"4'd,V Pf'dV ;PfV, un3\ V R#4'd,V Ph'dV ;PhV, un4\ V R$4'd,V Pj'dV ;PjV, un5\ V R%4'd0V Pl'dV ;PlV, un6R&#R&#R&#R&#R&#R&#)'aApply the relocation information to the image using the provided image base. This method will apply the relocation information to the image. Given the new base, all the relocations will be processed and both the raw data and the section's data will be fixed accordingly. The resulting image can be retrieved as well through the method: get_memory_mapped_image() In order to get something that would more closely match what could be found in memory once the Windows loader finished its work. r-rprzZRelocating image but PE does not have (or pefile cannot parse) a DIRECTORY_ENTRY_BASERELOCIMAGE_REL_BASED_ABSOLUTEIMAGE_REL_BASED_HIGHrIIMAGE_REL_BASED_LOWIMAGE_REL_BASED_HIGHLOWIMAGE_REL_BASED_HIGHADJrIMAGE_REL_BASED_DIR64rrAr/LockPrefixTableEditListSecurityCookieSEHandlerTableGuardCFCheckFunctionPointerGuardCFDispatchFunctionPointerGuardCFFunctionTableGuardAddressTakenIatEntryTableGuardLongJumpTargetTableDynamicValueRelocTableCHPEMetadataPointerGuardRFFailureRoutine$GuardRFFailureRoutineFunctionPointer(GuardRFVerifyStackPointerFunctionPointerEnclaveConfigurationPointerVolatileMetadataPointerGuardEHContinuationTableGuardXFGCheckFunctionPointerGuardXFGDispatchFunctionPointer$GuardXFGTableDispatchFunctionPointer CastGuardOsDeterminedFailureModeGuardMemcpyFunctionPointerN)7rrr8r8rrrTr:rrwr-rZrqrIrjr}rgr_rrqrnrrrJrAr9ZStartAddressOfRawDataZEndAddressOfRawDataZAddressOfIndexZAddressOfCallBacksr/rrrrrrrrrrrLrOrrrrrrrrrrrr) rTZ new_ImageBaseZrelocation_differencerRZ entry_idxrZ next_entryrZfuncZ load_configrkrr$ZPE.relocate_imageIs!.0D0D0N0N N $$33 4 9$$33A6;;;4!<==++!01R!S T,4!<==&&9 ";;E !"I#c%--&88 % i 8!Q  ::9S)TT "ZZ?;Q+RR !00 % $($8$8$C&;%<')%*#) !)#ZZ?;P+QQ !00 % $($8$8$C&;%<#) !)#ZZ?;T+UU !11 % $ 5 5eii @"7!8 #ZZ?;T+UU )C ,>> %).y)AJ%NI 00 % %)%9%9%))%D%J&0nn%5&;%<'1%1 $& !& #ZZ?;R+SS!11 % $ 5 5eii @"7!8m>BWW>((//BB)Bt:;;">>EE K):;;#333//3HH/; 33 8L8L8L((,AA(K)9::#222..2GG.K)9::#222..2GG.K)FGG#???;;?TT;K)IJJ#BBB>>BWW>K)?@@#888448MM4K)IJJ#BBB>>BWW>K)CDD#<<<88>>::>SS:?GerrZPE.generate_checksumOsr::<  ..>>@4G &* t}}%!i-IN)KLx1}%Aq((1uQ'I q1uw/5A M3JK c4==QQ+KLQO  H5 $z1h"nE&v%(b.9R0f$#dmm,,,rc s\R,pVP4'g:VP4'g$WPP,V8XdR#R#)zCheck whether the file is a standard executable. This will return true only if the file has the IMAGE_FILE_EXECUTABLE_IMAGE flag set and the IMAGE_FILE_DLL not set and the file does not appear to be a driver either. IMAGE_FILE_EXECUTABLE_IMAGETF)r2is_dllrhr1r)rTZEXE_flagr-ris_exeZ PE.is_exesF))FG^^%%,,<<<Irc sf\R,pWPP,V8XdR#R#)ztCheck whether the file is a standard DLL. This will return true only if the image has the IMAGE_FILE_DLL flag set. IMAGE_FILE_DLLTF)r2r1r)rTZDLL_flagr-rrZ PE.is_dlls, ))9: ''77 7H Drc s^\VR4'gVP\R,.R7\VR4'gR#0R mpTPVPUu0uFq"P P 4kK up4'dR#RR0pTPVPUu0uF+qDPP 4PR4kK- up4'd6VPP\R ,\R ,39dR#R#uupiuupi) zCheck whether the file is a Windows driver. This will return true only if there are reliable indicators of the image being a driver. rrlrxFTspagespagedrIMAGE_SUBSYSTEM_NATIVEIMAGE_SUBSYSTEM_NATIVE_WINDOWS>shal.dllsndis.syss kdcom.dlls bootvid.dlls ntoskrnl.exe) rrTr:Z intersectionrrrrrgrrZ SubsystemSUBSYSTEM_TYPE)rTZ system_DLLsrZdriver_like_section_namesrjr)rrhZ PE.is_drivers,t566  ' ',-KLM (  t566    # #(,(C(C D(CWW]]_(C D  %,h$7! $ 1 1AE Og\\   ! ( ( 1 O    * *78?@  ! E Ps ""D%01D*c saRo\VP43V3Rllp\VR4'd7V!VPP 4VP P 34oVPF!pV!VPVP34oK# \R,.p\VPP4F;wrEWC9dK V!VPVP4VP34oK= \VP4\#S48d \#S4#R# \ dK}i;i)zgGet the offset of data appended to the file and not contained within the area described in the headers.csV<\S4\V4u;8d V8:dV#S#S#r)sum)Zoffset_and_sizeZ file_sizelargest_offset_and_sizerXr'update_if_sum_is_larger_and_within_fileZQPE.get_overlay_data_start_offset..update_if_sum_is_larger_and_within_files5*+c/.BOiO&&P* ** *rrIMAGE_DIRECTORY_ENTRY_SECURITYN)r r )r8rrrrr1r3rrrr:rr8rrrrur)rTrrjZskip_directoriesrrrs& @rget_overlay_data_start_offsetZ PE.get_overlay_data_start_offsets/#)(+4=='9 + 4* + +&M((88:$$99' #}}G&M))7+@+@A' #% ,,LMN'(<(<(K(KLNC& *Q--i.F.FGX+' M t}} $; < <./ / !  s-D55 EEc sLVP4pVeVPVR#R#)z]Get the data appended to the file and not contained within the area described in the headers.NrrrTZoverlay_data_offsetr-r get_overlayZPE.get_overlay s/#@@B  *==!4!56 6rc snVP4pVeVPRV#VPR,#)zKReturn the just data defined by the PE headers, removing any overlaid data.N:NNNrrr-rtrimZPE.trims;#@@B  *==!5"56 6}}Qrcs6VPP\8dsVPRJdc\ VPP4'g>VP P RVPP,4RVnVR,#)Fz=If FileAlignment > 0x200 it should be a power of 2. Value: %xTi)rrMIN_VALID_FILE_ALIGNMENTrrNrrw)rTrrrrZPE.adjust_PointerToRawData%s    - -1I I))U2<$$22<<&&S++99;.2*V|rcsVR8dBW28wd<VPRJd,VPPRVR RVR R24RVn\WV4#)rFzIf SectionAlignment(0xrz+) < 0x1000 it should equal FileAlignment(0xrT)rrrwr)rTrrrr rrZPE.adjust_SectionAlignment:sj v %311U:&&,->q,AB--;A,>aA15-,S^TTr)r&r1rrXr*rrLrUrrrWrZ __from_fileZ__resource_size_limit_reachedZ!__resource_size_limit_upperboundsrZ__total_import_symbolsZ__total_resource_bytesZ__total_resource_entries_countZ __warningsrrr!r=rrr)ZIMAGE_DOS_HEADER)z H,e_magiczH,e_cblpzH,e_cpzH,e_crlcz H,e_cparhdrz H,e_minallocz H,e_maxalloczH,e_sszH,e_spzH,e_csumzH,e_ipzH,e_csz H,e_lfarlczH,e_ovnoz8s,e_resz H,e_oemidz H,e_oeminfoz 20s,e_res2z I,e_lfanew)ZIMAGE_FILE_HEADER)z H,MachinezH,NumberOfSectionsI,TimeDateStampzI,PointerToSymbolTablezI,NumberOfSymbolszH,SizeOfOptionalHeaderzH,Characteristics)ZIMAGE_DATA_DIRECTORY)I,VirtualAddressI,Size)ZIMAGE_OPTIONAL_HEADER)H,MagicB,MajorLinkerVersionB,MinorLinkerVersion I,SizeOfCodeI,SizeOfInitializedDataI,SizeOfUninitializedDataI,AddressOfEntryPoint I,BaseOfCodez I,BaseOfDataz I,ImageBaseI,SectionAlignmentI,FileAlignmentH,MajorOperatingSystemVersionH,MinorOperatingSystemVersionH,MajorImageVersionH,MinorImageVersionH,MajorSubsystemVersionH,MinorSubsystemVersion I,Reserved1 I,SizeOfImageI,SizeOfHeaders I,CheckSum H,SubsystemH,DllCharacteristicszI,SizeOfStackReservezI,SizeOfStackCommitzI,SizeOfHeapReservezI,SizeOfHeapCommit I,LoaderFlagsI,NumberOfRvaAndSizes)ZIMAGE_OPTIONAL_HEADER64)rrrrrrrrz Q,ImageBaserrrrrrrrrrrrrrzQ,SizeOfStackReservezQ,SizeOfStackCommitzQ,SizeOfHeapReservezQ,SizeOfHeapCommitrr)ZIMAGE_NT_HEADERS)r)ZIMAGE_SECTION_HEADER) z8s,Namez,I,Misc,Misc_PhysicalAddress,Misc_VirtualSizerzI,SizeOfRawDataI,PointerToRawDatazI,PointerToRelocationszI,PointerToLinenumberszH,NumberOfRelocationszH,NumberOfLinenumbersI,Characteristics)ZIMAGE_DELAY_IMPORT_DESCRIPTOR)z I,grAttrszI,szNamezI,phmodzI,pIATzI,pINTz I,pBoundIATz I,pUnloadIATz I,dwTimeStamp)ZIMAGE_IMPORT_DESCRIPTOR)z$I,OriginalFirstThunk,CharacteristicsrzI,ForwarderChainI,Namez I,FirstThunk)ZIMAGE_EXPORT_DIRECTORY) rrH,MajorVersionH,MinorVersionrzI,BasezI,NumberOfFunctionszI,NumberOfNameszI,AddressOfFunctionszI,AddressOfNameszI,AddressOfNameOrdinals)ZIMAGE_RESOURCE_DIRECTORY)rrrrzH,NumberOfNamedEntrieszH,NumberOfIdEntries)ZIMAGE_RESOURCE_DIRECTORY_ENTRY)rI,OffsetToData)ZIMAGE_RESOURCE_DATA_ENTRY)rrz I,CodePagez I,Reserved)rWzH,Lengthz H,ValueLengthzH,Type)r) rzI,StrucVersionzI,FileVersionMSzI,FileVersionLSzI,ProductVersionMSzI,ProductVersionLSzI,FileFlagsMaskz I,FileFlagszI,FileOSz I,FileTypez I,FileSubtypez I,FileDateMSz I,FileDateLS)ZStringFileInfor)rYr)ZStringr)rr)IMAGE_THUNK_DATA)z0I,ForwarderString,Function,Ordinal,AddressOfData)r)z0Q,ForwarderString,Function,Ordinal,AddressOfData)ZIMAGE_DEBUG_DIRECTORY)rrrrzI,Typez I,SizeOfDatazI,AddressOfRawDatar)ZIMAGE_BASE_RELOCATION)rz I,SizeOfBlock)ZIMAGE_BASE_RELOCATION_ENTRY)zH,Data)Z0IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION)zI:12,PageRelativeOffsetzI:1,IndirectCallz I:19,IATIndex)Z/IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION)H:12,PageRelativeOffsetzH:1,IndirectCallzH:1,RexWPrefixz H:1,CfgCheckz H:1,Reserved)Z+IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION)rzH:4,RegisterNumber)ZIMAGE_FUNCTION_OVERRIDE_HEADER)zI,FuncOverrideSize)Z*IMAGE_FUNCTION_OVERRIDE_DYNAMIC_RELOCATION)z I,OriginalRvaz I,BDDOffsetz I,RvaSizeI,BaseRelocSize)ZIMAGE_BDD_INFO) I,Versionz I,BDDSize)ZIMAGE_BDD_DYNAMIC_RELOCATION)zH,LeftzH,RightzI,Value)IMAGE_TLS_DIRECTORY)zI,StartAddressOfRawDatazI,EndAddressOfRawDatazI,AddressOfIndexzI,AddressOfCallBacksI,SizeOfZeroFillr)r)zQ,StartAddressOfRawDatazQ,EndAddressOfRawDatazQ,AddressOfIndexzQ,AddressOfCallBacksrr)IMAGE_LOAD_CONFIG_DIRECTORY)4rrrrI,GlobalFlagsClearI,GlobalFlagsSetI,CriticalSectionDefaultTimeoutzI,DeCommitFreeBlockThresholdzI,DeCommitTotalFreeThresholdzI,LockPrefixTablezI,MaximumAllocationSizezI,VirtualMemoryThresholdI,ProcessHeapFlagszI,ProcessAffinityMask H,CSDVersionH,DependentLoadFlagsz I,EditListzI,SecurityCookiezI,SEHandlerTablezI,SEHandlerCountzI,GuardCFCheckFunctionPointerz I,GuardCFDispatchFunctionPointerzI,GuardCFFunctionTablezI,GuardCFFunctionCount I,GuardFlagsH,CodeIntegrityFlagsH,CodeIntegrityCatalogI,CodeIntegrityCatalogOffsetI,CodeIntegrityReservedz I,GuardAddressTakenIatEntryTablez I,GuardAddressTakenIatEntryCountzI,GuardLongJumpTargetTablezI,GuardLongJumpTargetCountzI,DynamicValueRelocTablezI,CHPEMetadataPointerzI,GuardRFFailureRoutinez&I,GuardRFFailureRoutineFunctionPointerI,DynamicValueRelocTableOffsetH,DynamicValueRelocTableSectionrz*I,GuardRFVerifyStackPointerFunctionPointerI,HotPatchTableOffset I,Reserved3zI,EnclaveConfigurationPointerzI,VolatileMetadataPointerzI,GuardEHContinuationTablezI,GuardEHContinuationCountzI,GuardXFGCheckFunctionPointerz!I,GuardXFGDispatchFunctionPointerz&I,GuardXFGTableDispatchFunctionPointerz"I,CastGuardOsDeterminedFailureModezI,GuardMemcpyFunctionPointer)r)4rrrrrrrzQ,DeCommitFreeBlockThresholdzQ,DeCommitTotalFreeThresholdzQ,LockPrefixTablezQ,MaximumAllocationSizezQ,VirtualMemoryThresholdzQ,ProcessAffinityMaskrrrz Q,EditListzQ,SecurityCookiezQ,SEHandlerTablezQ,SEHandlerCountzQ,GuardCFCheckFunctionPointerz Q,GuardCFDispatchFunctionPointerzQ,GuardCFFunctionTablezQ,GuardCFFunctionCountrrrrrz Q,GuardAddressTakenIatEntryTablez Q,GuardAddressTakenIatEntryCountzQ,GuardLongJumpTargetTablezQ,GuardLongJumpTargetCountzQ,DynamicValueRelocTablezQ,CHPEMetadataPointerzQ,GuardRFFailureRoutinez&Q,GuardRFFailureRoutineFunctionPointerrrrz*Q,GuardRFVerifyStackPointerFunctionPointerrrzQ,EnclaveConfigurationPointerzQ,VolatileMetadataPointerzQ,GuardEHContinuationTablezQ,GuardEHContinuationCountzQ,GuardXFGCheckFunctionPointerz!Q,GuardXFGDispatchFunctionPointerz&Q,GuardXFGTableDispatchFunctionPointerz"Q,CastGuardOsDeterminedFailureModezQ,GuardMemcpyFunctionPointer)ZIMAGE_DYNAMIC_RELOCATION_TABLE)rr)ZIMAGE_DYNAMIC_RELOCATION)I,Symbolr)ZIMAGE_DYNAMIC_RELOCATION64)Q,Symbolr)ZIMAGE_DYNAMIC_RELOCATION_V2) I,HeaderSizeI,FixupInfoSizer I,SymbolGroupI,Flags)ZIMAGE_DYNAMIC_RELOCATION64_V2)rrrrr)ZIMAGE_BOUND_IMPORT_DESCRIPTOR)rH,OffsetModuleNamezH,NumberOfModuleForwarderRefs)ZIMAGE_BOUND_FORWARDER_REF)rrz H,Reserved)ZRUNTIME_FUNCTION)zI,BeginAddressz I,EndAddressz I,UnwindDatar)NFF)r Nr NF)rr.)rbN)r N)N)rk)Nr)r[r\r]r^rr%r0r9r4r5r)rfrrrrrrrrrrrrr"r#rrrrrrrrrrrrrrrrrZ&__IMAGE_DYNAMIC_RELOCATION_V2_format__Z(__IMAGE_DYNAMIC_RELOCATION64_V2_format__rrrMAX_SYMBOL_EXPORT_COUNTrQr r rr rrrrNrvrQr?r^r<rTrrr~rrrr}rrrr|r{rrrrzrrrrrrryrrr%r*r|rrrrr+rrsrr>rlr.r0r1r,rrSrWrrr[r_rXrdrrgrirjr`rlrmrnrorqrrr^rZrurwr$rrrrrhrrrrrr_r`rrrrr sBP#2 $ '# "($H!*&F#I'# 0, *&)%" +'1- ,( ! #&! VKEN# %! ($($ .* C? B>>: 1- =9! /+ &" ($8.*t80,t1- +' -) .* 0, 0, ,( # 2 3j ,,]~ Sj  $22#hKZ]4~Xtun*83 jd#LU'n@ 9v)V%NGRo'b 0>j$X F PH kZ ?.;`?2hT\ |AFCJ!6 'D->*(1B P)6V  :1jX bH 5 K OKQ' K NIO' K OKQ6"":: LATFI0-d& ;z*X  *UUrrcs\^RIpRpVPR,'g\V4R#VP^,R8XdVPR,'gVPR4\ VP^,4pVP P FRp\\VPPVP,4VPVP4KT R#\\ VP^,4P44R#)r Nz1pefile.py pefile.py exports :r*NNr:rpNNzerror: required)rZargvrOZexitrrrrrrrJrrGr,)rZusagerfrs rmainrKs E 88B<< e ! !xx|| HH1 2  _,,44C B&&003;;>?3;; 5 b!o'')*rZ__main__)rFF))rmr )rlr*)rnrp)rur)rrJ)rp)rorx)ZIMAGE_DIRECTORY_ENTRY_COPYRIGHT)ZIMAGE_DIRECTORY_ENTRY_GLOBALPTRr!)rq )rr )rt )ZIMAGE_DIRECTORY_ENTRY_IAT )rs )Z$IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR)ZIMAGE_DIRECTORY_ENTRY_RESERVED))ZIMAGE_FILE_RELOCS_STRIPPEDr*)rrp)ZIMAGE_FILE_LINE_NUMS_STRIPPEDrJ)ZIMAGE_FILE_LOCAL_SYMS_STRIPPEDr!)ZIMAGE_FILE_AGGRESIVE_WS_TRIMr)ZIMAGE_FILE_LARGE_ADDRESS_AWARE )ZIMAGE_FILE_16BIT_MACHINEr)ZIMAGE_FILE_BYTES_REVERSED_LOr)ZIMAGE_FILE_32BIT_MACHINEr)ZIMAGE_FILE_DEBUG_STRIPPEDr')Z"IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP)ZIMAGE_FILE_NET_RUN_FROM_SWAPr)ZIMAGE_FILE_SYSTEMr)rr&)ZIMAGE_FILE_UP_SYSTEM_ONLY@)ZIMAGE_FILE_BYTES_REVERSED_HIr()ZIMAGE_SCN_TYPE_REGr )ZIMAGE_SCN_TYPE_DSECTr*)ZIMAGE_SCN_TYPE_NOLOADrp)ZIMAGE_SCN_TYPE_GROUPrJ)ZIMAGE_SCN_TYPE_NO_PADr!)ZIMAGE_SCN_TYPE_COPYr)ZIMAGE_SCN_CNT_CODEr)ZIMAGE_SCN_CNT_INITIALIZED_DATAr)Z IMAGE_SCN_CNT_UNINITIALIZED_DATAr)ZIMAGE_SCN_LNK_OTHERr)ZIMAGE_SCN_LNK_INFOr')ZIMAGE_SCN_LNK_OVERr)ZIMAGE_SCN_LNK_REMOVEr)ZIMAGE_SCN_LNK_COMDATr)ZIMAGE_SCN_MEM_PROTECTEDr)ZIMAGE_SCN_NO_DEFER_SPEC_EXCr)ZIMAGE_SCN_GPRELr()ZIMAGE_SCN_MEM_FARDATAr()ZIMAGE_SCN_MEM_SYSHEAPr)ZIMAGE_SCN_MEM_PURGEABLE)ZIMAGE_SCN_MEM_16BITr)ZIMAGE_SCN_MEM_LOCKEDi)ZIMAGE_SCN_MEM_PRELOADi)ZIMAGE_SCN_ALIGN_1BYTESr%)ZIMAGE_SCN_ALIGN_2BYTESi )ZIMAGE_SCN_ALIGN_4BYTESi0)ZIMAGE_SCN_ALIGN_8BYTESi@)ZIMAGE_SCN_ALIGN_16BYTESiP)ZIMAGE_SCN_ALIGN_32BYTESi`)ZIMAGE_SCN_ALIGN_64BYTESip)ZIMAGE_SCN_ALIGN_128BYTESi)ZIMAGE_SCN_ALIGN_256BYTESi)ZIMAGE_SCN_ALIGN_512BYTESi)ZIMAGE_SCN_ALIGN_1024BYTESi)ZIMAGE_SCN_ALIGN_2048BYTESi)ZIMAGE_SCN_ALIGN_4096BYTESi)ZIMAGE_SCN_ALIGN_8192BYTESi)ZIMAGE_SCN_ALIGN_MASKi)ZIMAGE_SCN_LNK_NRELOC_OVFLi)ZIMAGE_SCN_MEM_DISCARDABLEi)ZIMAGE_SCN_MEM_NOT_CACHEDi)ZIMAGE_SCN_MEM_NOT_PAGEDr )ZIMAGE_SCN_MEM_SHAREDrb)rdi )ZIMAGE_SCN_MEM_READi@)rcr)))ZIMAGE_DEBUG_TYPE_UNKNOWNr )ZIMAGE_DEBUG_TYPE_COFFr*)ZIMAGE_DEBUG_TYPE_CODEVIEWrp)ZIMAGE_DEBUG_TYPE_FPOr)ZIMAGE_DEBUG_TYPE_MISCrJ)ZIMAGE_DEBUG_TYPE_EXCEPTIONr)ZIMAGE_DEBUG_TYPE_FIXUPrx)ZIMAGE_DEBUG_TYPE_OMAP_TO_SRCr)ZIMAGE_DEBUG_TYPE_OMAP_FROM_SRCr!)ZIMAGE_DEBUG_TYPE_BORLANDr)ZIMAGE_DEBUG_TYPE_RESERVED10r)ZIMAGE_DEBUG_TYPE_CLSIDr)ZIMAGE_DEBUG_TYPE_VC_FEATUREr)ZIMAGE_DEBUG_TYPE_POGOr)ZIMAGE_DEBUG_TYPE_ILTCGr)ZIMAGE_DEBUG_TYPE_MPXr)ZIMAGE_DEBUG_TYPE_REPROr)r4))ZIMAGE_SUBSYSTEM_UNKNOWNr )rr*)ZIMAGE_SUBSYSTEM_WINDOWS_GUIrp)ZIMAGE_SUBSYSTEM_WINDOWS_CUIr)ZIMAGE_SUBSYSTEM_OS2_CUIr)ZIMAGE_SUBSYSTEM_POSIX_CUIr)rr!)ZIMAGE_SUBSYSTEM_WINDOWS_CE_GUIr)ZIMAGE_SUBSYSTEM_EFI_APPLICATIONr)Z'IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVERr)Z"IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVERr)ZIMAGE_SUBSYSTEM_EFI_ROMr)ZIMAGE_SUBSYSTEM_XBOXr)Z(IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATIONr)ZIMAGE_FILE_MACHINE_UNKNOWNr )riL)ZIMAGE_FILE_MACHINE_R3000ib)ZIMAGE_FILE_MACHINE_R4000if)ZIMAGE_FILE_MACHINE_R10000ih)ZIMAGE_FILE_MACHINE_WCEMIPSV2ii)ZIMAGE_FILE_MACHINE_ALPHAi)ZIMAGE_FILE_MACHINE_SH3i)ZIMAGE_FILE_MACHINE_SH3DSPi)ZIMAGE_FILE_MACHINE_SH3Ei)ZIMAGE_FILE_MACHINE_SH4i)ZIMAGE_FILE_MACHINE_SH5i)ZIMAGE_FILE_MACHINE_ARMi)ZIMAGE_FILE_MACHINE_THUMBi)ZIMAGE_FILE_MACHINE_ARMNTi)ZIMAGE_FILE_MACHINE_AM33i)ZIMAGE_FILE_MACHINE_POWERPCi)ZIMAGE_FILE_MACHINE_POWERPCFPi)rr')ZIMAGE_FILE_MACHINE_MIPS16if)ZIMAGE_FILE_MACHINE_ALPHA64)ZIMAGE_FILE_MACHINE_AXP64r)ZIMAGE_FILE_MACHINE_MIPSFPUif)ZIMAGE_FILE_MACHINE_MIPSFPU16if)ZIMAGE_FILE_MACHINE_TRICOREi )ZIMAGE_FILE_MACHINE_CEFi )ZIMAGE_FILE_MACHINE_EBCi)ZIMAGE_FILE_MACHINE_RISCV32i2P)ZIMAGE_FILE_MACHINE_RISCV64idP)ZIMAGE_FILE_MACHINE_RISCV128i(Q)ZIMAGE_FILE_MACHINE_LOONGARCH32i2b)ZIMAGE_FILE_MACHINE_LOONGARCH64idb)rid)ZIMAGE_FILE_MACHINE_M32RiA)ZIMAGE_FILE_MACHINE_ARM64id)ZIMAGE_FILE_MACHINE_CEEi) )ryr )rzr*)r{rp)r|r)r}rJ)ZIMAGE_REL_BASED_MIPS_JMPADDRr)ZIMAGE_REL_BASED_SECTIONrx)ZIMAGE_REL_BASED_RELr)ZIMAGE_REL_BASED_MIPS_JMPADDR16r)ZIMAGE_REL_BASED_IA64_IMM64r)r~r)ZIMAGE_REL_BASED_HIGH3ADJr))ZIMAGE_LIBRARY_PROCESS_INITr*)ZIMAGE_LIBRARY_PROCESS_TERMrp)ZIMAGE_LIBRARY_THREAD_INITrJ)ZIMAGE_LIBRARY_THREAD_TERMr!)Z(IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VAr)Z%IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASEr)Z(IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITYr)Z"IMAGE_DLLCHARACTERISTICS_NX_COMPATr)Z%IMAGE_DLLCHARACTERISTICS_NO_ISOLATIONr')ZIMAGE_DLLCHARACTERISTICS_NO_SEHr)Z IMAGE_DLLCHARACTERISTICS_NO_BINDr)Z%IMAGE_DLLCHARACTERISTICS_APPCONTAINERr)Z#IMAGE_DLLCHARACTERISTICS_WDM_DRIVERr&)Z!IMAGE_DLLCHARACTERISTICS_GUARD_CFr)Z.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWAREr())Z&IMAGE_DLLCHARACTERISTICS_EX_CET_COMPATr*)Z2IMAGE_DLLCHARACTERISTICS_EX_CET_COMPAT_STRICT_MODErp)ZFIMAGE_DLLCHARACTERISTICS_EX_CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODErJ)Z:IMAGE_DLLCHARACTERISTICS_EX_CET_DYNAMIC_APIS_ALLOW_IN_PROCr!)Z*IMAGE_DLLCHARACTERISTICS_EX_CET_RESERVED_1r)Z*IMAGE_DLLCHARACTERISTICS_EX_CET_RESERVED_2r))rr*)rrp)rrJ))ZRAXr )ZRCXr*)ZRDXrp)ZRBXr)ZRSPrJ)ZRBPr)ZRSIrx)ZRDIr)ZR8r!)ZR9r)ZR10r)ZR11r)ZR12r)ZR13r)ZR14r)ZR15r))Z RT_CURSORr*)Z RT_BITMAPrp)ZRT_ICONr)ZRT_MENUrJ)Z RT_DIALOGr)rrx)Z RT_FONTDIRr)ZRT_FONTr!)ZRT_ACCELERATORr)Z RT_RCDATAr)ZRT_MESSAGETABLEr)ZRT_GROUP_CURSORr)Z RT_GROUP_ICONr)rr)Z RT_DLGINCLUDE)Z RT_PLUGPLAY)ZRT_VXDr)Z RT_ANICURSOR)Z RT_ANIICON)ZRT_HTML)Z RT_MANIFEST)Z LANG_NEUTRALr )ZLANG_INVARIANTi)ZLANG_AFRIKAANSi6)Z LANG_ALBANIANi)Z LANG_ARABICr*)Z LANG_ARMENIANi+)Z LANG_ASSAMESEiM)Z LANG_AZERIi,)Z LANG_BASQUEi-)ZLANG_BELARUSIANi#)Z LANG_BENGALIiE)ZLANG_BULGARIANrp)Z LANG_CATALANr)Z LANG_CHINESErJ)Z LANG_CROATIAN)Z LANG_CZECHr)Z LANG_DANISHrx)Z LANG_DIVEHIie)Z LANG_DUTCHr)Z LANG_ENGLISHr)Z LANG_ESTONIANi%)Z LANG_FAEROESEi8)Z LANG_FARSIi))Z LANG_FINNISHr)Z LANG_FRENCHr)Z LANG_GALICIANiV)Z LANG_GEORGIANi7)Z LANG_GERMANr)Z LANG_GREEKr!)Z LANG_GUJARATIiG)Z LANG_HEBREWr)Z LANG_HINDIi9)ZLANG_HUNGARIANr)ZLANG_ICELANDICr)ZLANG_INDONESIANi!)Z LANG_ITALIANr)Z LANG_JAPANESEr)Z LANG_KANNADAiK)Z LANG_KASHMIRIi`)Z LANG_KAZAKi?)Z LANG_KONKANIiW)Z LANG_KOREAN)Z LANG_KYRGYZr)Z LANG_LATVIANi&)ZLANG_LITHUANIANi')ZLANG_MACEDONIANi/)Z LANG_MALAYi>)ZLANG_MALAYALAMiL)Z LANG_MANIPURIiX)Z LANG_MARATHIiN)ZLANG_MONGOLIANiP)Z LANG_NEPALIia)ZLANG_NORWEGIANr)Z LANG_ORIYAiH)Z LANG_POLISHr)ZLANG_PORTUGUESEr)Z LANG_PUNJABIiF)Z LANG_ROMANIANr)Z LANG_RUSSIANi)Z LANG_SANSKRITiO)Z LANG_SERBIANr)Z LANG_SINDHIiY)Z LANG_SLOVAKi)ZLANG_SLOVENIANi$)Z LANG_SPANISHr)Z LANG_SWAHILIiA)Z LANG_SWEDISHi)Z LANG_SYRIACiZ)Z LANG_TAMILiI)Z LANG_TATARiD)Z LANG_TELUGUiJ)Z LANG_THAIi)Z LANG_TURKISHi)ZLANG_UKRAINIANi")Z LANG_URDUr)Z LANG_UZBEKiC)ZLANG_VIETNAMESEi*)Z LANG_GAELICi<)Z LANG_MALTESEi:)Z LANG_MAORIi()ZLANG_RHAETO_ROMANCEr)Z LANG_SAAMIi;)Z LANG_SORBIANi.)Z LANG_SUTUi0)Z LANG_TSONGAi1)Z LANG_TSWANAi2)Z LANG_VENDAi3)Z LANG_XHOSAi4)Z LANG_ZULUi5)ZLANG_ESPERANTOi)Z LANG_WALONi)Z LANG_CORNISHi)Z LANG_WELSHi)Z LANG_BRETONi)ZSUBLANG_NEUTRALr )ZSUBLANG_DEFAULTr*)ZSUBLANG_SYS_DEFAULTrp)ZSUBLANG_ARABIC_SAUDI_ARABIAr*)ZSUBLANG_ARABIC_IRAQrp)ZSUBLANG_ARABIC_EGYPTr)ZSUBLANG_ARABIC_LIBYArJ)ZSUBLANG_ARABIC_ALGERIAr)ZSUBLANG_ARABIC_MOROCCOrx)ZSUBLANG_ARABIC_TUNISIAr)ZSUBLANG_ARABIC_OMANr!)ZSUBLANG_ARABIC_YEMENr)ZSUBLANG_ARABIC_SYRIAr)ZSUBLANG_ARABIC_JORDANr)ZSUBLANG_ARABIC_LEBANONr)ZSUBLANG_ARABIC_KUWAITr)ZSUBLANG_ARABIC_UAEr)ZSUBLANG_ARABIC_BAHRAINr)ZSUBLANG_ARABIC_QATARr)ZSUBLANG_AZERI_LATINr*)ZSUBLANG_AZERI_CYRILLICrp)ZSUBLANG_CHINESE_TRADITIONALr*)ZSUBLANG_CHINESE_SIMPLIFIEDrp)ZSUBLANG_CHINESE_HONGKONGr)ZSUBLANG_CHINESE_SINGAPORErJ)ZSUBLANG_CHINESE_MACAUr)Z SUBLANG_DUTCHr*)ZSUBLANG_DUTCH_BELGIANrp)ZSUBLANG_ENGLISH_USr*)ZSUBLANG_ENGLISH_UKrp)ZSUBLANG_ENGLISH_AUSr)ZSUBLANG_ENGLISH_CANrJ)ZSUBLANG_ENGLISH_NZr)ZSUBLANG_ENGLISH_EIRErx)ZSUBLANG_ENGLISH_SOUTH_AFRICAr)ZSUBLANG_ENGLISH_JAMAICAr!)ZSUBLANG_ENGLISH_CARIBBEANr)ZSUBLANG_ENGLISH_BELIZEr)ZSUBLANG_ENGLISH_TRINIDADr)ZSUBLANG_ENGLISH_ZIMBABWEr)ZSUBLANG_ENGLISH_PHILIPPINESr)ZSUBLANG_FRENCHr*)ZSUBLANG_FRENCH_BELGIANrp)ZSUBLANG_FRENCH_CANADIANr)ZSUBLANG_FRENCH_SWISSrJ)ZSUBLANG_FRENCH_LUXEMBOURGr)ZSUBLANG_FRENCH_MONACOrx)ZSUBLANG_GERMANr*)ZSUBLANG_GERMAN_SWISSrp)ZSUBLANG_GERMAN_AUSTRIANr)ZSUBLANG_GERMAN_LUXEMBOURGrJ)ZSUBLANG_GERMAN_LIECHTENSTEINr)ZSUBLANG_ITALIANr*)ZSUBLANG_ITALIAN_SWISSrp)ZSUBLANG_KASHMIRI_SASIArp)ZSUBLANG_KASHMIRI_INDIArp)ZSUBLANG_KOREANr*)ZSUBLANG_LITHUANIANr*)ZSUBLANG_MALAY_MALAYSIAr*)ZSUBLANG_MALAY_BRUNEI_DARUSSALAMrp)ZSUBLANG_NEPALI_INDIArp)ZSUBLANG_NORWEGIAN_BOKMALr*)ZSUBLANG_NORWEGIAN_NYNORSKrp)ZSUBLANG_PORTUGUESErp)ZSUBLANG_PORTUGUESE_BRAZILIANr*)ZSUBLANG_SERBIAN_LATINrp)ZSUBLANG_SERBIAN_CYRILLICr)ZSUBLANG_SPANISHr*)ZSUBLANG_SPANISH_MEXICANrp)ZSUBLANG_SPANISH_MODERNr)ZSUBLANG_SPANISH_GUATEMALArJ)ZSUBLANG_SPANISH_COSTA_RICAr)ZSUBLANG_SPANISH_PANAMArx)Z"SUBLANG_SPANISH_DOMINICAN_REPUBLICr)ZSUBLANG_SPANISH_VENEZUELAr!)ZSUBLANG_SPANISH_COLOMBIAr)ZSUBLANG_SPANISH_PERUr)ZSUBLANG_SPANISH_ARGENTINAr)ZSUBLANG_SPANISH_ECUADORr)ZSUBLANG_SPANISH_CHILEr)ZSUBLANG_SPANISH_URUGUAYr)ZSUBLANG_SPANISH_PARAGUAYr)ZSUBLANG_SPANISH_BOLIVIAr)ZSUBLANG_SPANISH_EL_SALVADORr)ZSUBLANG_SPANISH_HONDURASr)ZSUBLANG_SPANISH_NICARAGUAr)ZSUBLANG_SPANISH_PUERTO_RICOr)ZSUBLANG_SWEDISHr*)ZSUBLANG_SWEDISH_FINLANDrp)ZSUBLANG_URDU_PAKISTANr*)ZSUBLANG_URDU_INDIArp)ZSUBLANG_UZBEK_LATINr*)ZSUBLANG_UZBEK_CYRILLICrp)ZSUBLANG_DUTCH_SURINAMr)ZSUBLANG_ROMANIANr*)ZSUBLANG_ROMANIAN_MOLDAVIArp)ZSUBLANG_RUSSIANr*)ZSUBLANG_RUSSIAN_MOLDAVIArp)ZSUBLANG_CROATIANr*)ZSUBLANG_LITHUANIAN_CLASSICrp)ZSUBLANG_GAELICr*)ZSUBLANG_GAELIC_SCOTTISHrp)ZSUBLANG_GAELIC_MANXrr)rZ __author__Z __version__Z __contact__Zcodecsrr r rrrrrrhr9rrrZhashlibrrrrZtypingrrZregister_errorZ lookup_errorrrrrr$rrrrrrrerrrr(r'r+r,r-r.r/Z IMAGE_NUMBEROF_DIRECTORY_ENTRIESrNrPrMrOr.Zdirectory_entry_typesr:Zimage_characteristicsr2Zsection_characteristicsrZ debug_typesrHZsubsystem_typesrZ machine_typesrZrelocation_typesrIZdll_characteristicsr6Zex_dll_characteristicsrrZ SECTOR_SIZErrZ registersrrrrrrrrrrrZ resource_typerrr0rr2r+r4r3rwr6r?rGrLrNrrOrer"rurrrrrrr-r)r?rBrFr]r^rdrfrgrhrirjrlrmrorprvrwrxryrzr{rrrrrrrrrrrrZascii_lowercaseZascii_uppercaserr]rrrrrrr[rMrrrs   %  --)6+>+>?Q+RS " 4     !#% )  %7(45&%%:;/&/(/*/) / * / ( /'/3/5/(/'/'/)/)/,/ 0!/"$#/$*%/&*'/(,)/*(+/,)-/.*//0+1/2+3/4+5/6+7/8,9/:,;/<,=/>-?/@-A/B-C/D.E/F.G/H.I/J.K/L)M/N.O/P.Q/R-S/T,U/V)W/X*Y/Z'[/\(]/b''>? *+ & "o.%'%'%)%) % * % - %)%'%*%(%'%'%'%)%)% (!%"+#%$-%%&('%(*)%*++%,)-%.+/%0-1%2+3%4'5%6'7%8+9%:+;%<,=%>/?%@/A%B)C%D(E%F)G%H'I% NM*  /0$##67&&<=   !!23  &  #   0]+ ____ _  _  __________ !_"#_$%_&'_()_*+_,-_./_01_23_45_67_89_:;_<=_>?_@A_BC_DE_FG_HI_JK_LM_NO_PQ_RS_TU_VW_XY_Z[_\]_^__`a_bc_de_fg_hi_jk_lm_no_pq_rs_tu_vw_xy_z{_|}_~_@A_BC_DE_FG_HI_JK_LM_NO_PQ_RS_TU_VW_XY_Z[_\]_^__`a_b"c_de_fg_hi_jk_lm_no_pq_rs_tu_vw_xy_z{_|}_BDh h h "h * h  " h  # h #h %h %h %h "h #h #h $h %h  $!h "!#h $%%h &#'h (")h *%+h ,*-h .)/h 0'1h 2(3h 4$5h 67h 8$9h :!;h <!=h >"?h @"Ah B!Ch D#Eh F+Gh H&Ih J(Kh L%Mh N'Oh P'Qh R*Sh TUh V%Wh X&Yh Z#[h \(]h ^$_h `ah b#ch d&eh f(gh h+ih jkh l$mh n%oh p%qh rsh t!uh v%wh x.yh z#{h |'}h ~(h @!Ah B+Ch D$Eh F'Gh HIh J&Kh L%Mh N(Oh P)Qh R%Sh T1Uh V(Wh X'Yh Z#[h \(]h ^&_h `$ah b&ch d'eh f&gh h*ih j'kh l(mh n*oh pqh r&sh t$uh v!wh x"yh z%{h |$}h ~h @(Ah BCh D'Eh FGh H)Ih JKh L&Mh N"Oh T w  w-#*L- %%l3".  $+8*  '/ R RHHV I &;&;T& 4++ 4d#'$'TAAHIyIX 4e$NX%NXbi,Yi,X%%];";"|CMC,","^m=*M M=M}"]"@m-&]]g$'g$TOO28N8;~;8 ;~ ;  . "XNX&Y~Y&XNX&Y~Y&HnH; ; |  F   mm!! &( - V333fmmC&(  4  pXUpXUfq+* zFr