How to use the pefile.RelocationData function in pefile

To help you get started, we’ve selected a few pefile examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github intezer / MemoryPatchDetector / windows_memory_patches.py View on Github external
entries = []
        for idx in xrange( len(data) / 2 ):

            entry = pe.__unpack_data__(
                pe.__IMAGE_BASE_RELOCATION_ENTRY_format__,
                data[idx*2:(idx+1)*2],
                file_offset = file_offset )

            if not entry:
                break
            word = entry.Data

            reloc_type = (word>>12)
            reloc_offset = (word & 0x0fff)
            relocationData = pefile.RelocationData(
                    struct = entry,
                    type = reloc_type,
                    base_rva = rva,
                    rva = reloc_offset+rva)

            if relocationData.struct.Data > 0 and \
               (relocationData.type == pefile.RELOCATION_TYPE['IMAGE_REL_BASED_HIGHLOW'] or \
                relocationData.type == pefile.RELOCATION_TYPE['IMAGE_REL_BASED_DIR64']):
                entries.append(relocationData)
            file_offset += entry.sizeof()

        return entries
github erocarrera / pefile / pefile.py View on Github external
def parse_relocations(self, data_rva, rva, size):
        """"""
        
        data = self.get_data(data_rva, size)
        
        entries = []
        for idx in range(len(data)/2):
            word = struct.unpack('>12)
            reloc_offset = (word&0x0fff)
            entries.append(
                RelocationData(
                    type = reloc_type,
                    rva = reloc_offset+rva))
            
        return entries