class TurboRex::PEFile::PE

Attributes

data_sections[R]
executable_sections[R]
image_path[RW]

Public Class Methods

new(isource) click to toggle source
Calls superclass method
# File lib/turborex/pefile/pe.rb, line 12
def initialize(isource)
  super(isource)

  get_data_sections
  get_executable_sections
end

Public Instance Methods

data_section_names() click to toggle source
# File lib/turborex/pefile/pe.rb, line 19
def data_section_names
  unless @data_sections.empty?
    names = []
    @data_sections.each do |section|
      names << section.name
    end

    return names
  end

  nil
end

Private Instance Methods

get_data_sections() click to toggle source
# File lib/turborex/pefile/pe.rb, line 34
def get_data_sections
  @data_sections = []
  self.all_sections.each do |section|
    next if section.flags.nil?
    if section.flags & 0x20000000 != 0 #IMAGE_SCN_MEM_EXECUTE
      next
    end

    unless section.flags & 0x40000000 != 0 #IMAGE_SCN_MEM_READ
      next
    end

    @data_sections << section
  end
end
get_executable_sections() click to toggle source
# File lib/turborex/pefile/pe.rb, line 50
def get_executable_sections
  @executable_sections = []
  self.all_sections.each do |section|
    next if section.flags.nil?
    if section.flags & 0x20000000 != 0 #IMAGE_SCN_MEM_EXECUTE
      @executable_sections << section
    end
  end
end