unpacker.py
ofrak.core.pe.unpacker
PeUnpacker (Unpacker)
unpack(self, resource, config=None)
async
Unpack a PE file using the pefile library for the parsing itself, then create the appropriate OFRAK child resources for the PE file.
Source code in ofrak/core/pe/unpacker.py
async def unpack(self, resource: Resource, config=None):
"""
Unpack a PE file using the pefile library for the parsing itself, then
create the appropriate OFRAK child resources for the PE file.
"""
pe = pefile.PE(data=await resource.get_data())
# MS-DOS header
ms_dos_header = self.ms_dos_header_from_pefile(pe.DOS_HEADER)
await resource.create_child_from_view(
ms_dos_header,
data_range=Range.from_size(pe.DOS_HEADER.get_file_offset(), pe.DOS_HEADER.sizeof()),
)
# File header
file_header = self.file_header_from_pefile(pe.FILE_HEADER)
await resource.create_child_from_view(
file_header,
data_range=Range.from_size(pe.FILE_HEADER.get_file_offset(), pe.FILE_HEADER.sizeof()),
)
# Optional header
if pe.OPTIONAL_HEADER is not None:
optional_header = self.optional_header_from_pefile(pe.OPTIONAL_HEADER)
await resource.create_child_from_view(
optional_header,
data_range=Range.from_size(
pe.OPTIONAL_HEADER.get_file_offset(), pe.OPTIONAL_HEADER.sizeof()
),
)
# Data directories
for pe_data_directory in pe.OPTIONAL_HEADER.DATA_DIRECTORY:
data_directory = self.data_directory_from_pefile(pe_data_directory)
await resource.create_child_from_view(
data_directory,
data_range=Range.from_size(
pe_data_directory.get_file_offset(), pe_data_directory.sizeof()
),
)
# Sections
for index, pe_section in enumerate(pe.sections):
# Section header
section_header = self.section_header_from_pefile(pe_section, index)
await resource.create_child_from_view(
section_header,
data_range=Range.from_size(pe_section.get_file_offset(), pe_section.sizeof()),
)
# The section itself
section = PeSection(
section_index=index,
name=section_header.name,
virtual_address=section_header.m_virtual_address,
size=section_header.m_virtual_size,
)
if pe_section.SizeOfRawData > 0:
section_range = Range.from_size(
pe_section.PointerToRawData, pe_section.SizeOfRawData
)
else:
section_range = None
section_r = await resource.create_child_from_view(
section,
data_range=section_range,
)
if section_header.has_flag(PeSectionFlag.IMAGE_SCN_CNT_CODE):
section_r.add_tag(CodeRegion)
![](../../../../assets/square_04.png)