Skip to content

Draft: Read script data from overlay #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nazywam wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Draft: Read script data from overlay #30

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 29 additions & 13 deletions autoit_ripper/autoit_unpack.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,28 @@ def parse_all(stream: ByteStream, version: AutoItVersion) -> List[Tuple[str, byt
raise Exception("Unsupported autoit version %s", version)


def get_script_data(pe: pefile.PE) -> Optional[bytes]:
pe.parse_data_directories()
if not hasattr(pe, "DIRECTORY_ENTRY_RESOURCE") or not pe.DIRECTORY_ENTRY_RESOURCE:
log.error("The input file has no resources")
return None

script_resource = get_script_resource(pe)
if script_resource is None:
log.error("Couldn't find the script resource")
return None

data_rva = script_resource.OffsetToData
data_size = script_resource.Size
script_data = pe.get_memory_mapped_image()[data_rva: data_rva + data_size]

return script_data


def get_overlay_data(pe: pefile.PE) -> Optional[bytes]:
return pe.get_overlay()


def unpack_ea05(binary_data: bytes) -> Optional[List[Tuple[str, bytes]]]:
if EA05_MAGIC not in binary_data:
log.error("Couldn't find the location chunk in binary")
Expand Down Expand Up @@ -179,19 +201,13 @@ def unpack_ea06(binary_data: bytes) -> Optional[List[Tuple[str, bytes]]]:
log.error("Failed to parse the input file")
return None

pe.parse_data_directories()
if not hasattr(pe, "DIRECTORY_ENTRY_RESOURCE") or not pe.DIRECTORY_ENTRY_RESOURCE:
log.error("The input file has no resources")
return None

script_resource = get_script_resource(pe)
if script_resource is None:
log.error("Couldn't find the script resource")
return None

data_rva = script_resource.OffsetToData
data_size = script_resource.Size
script_data = pe.get_memory_mapped_image()[data_rva: data_rva + data_size]
script_data = get_script_data(pe)
if not script_data:
log.warning("Couldn't get data from script resource, trying layover")
script_data = get_overlay_data(pe)
if not script_data:
log.error("No data in overlay either")
return None

stream = ByteStream(bytes(script_data)[0x18:])
parsed_data = parse_all(stream, AutoItVersion.EA06)
Expand Down