i'm trying to use pefile to script check a list of binaries and determine which
are packed.
Unfortunately, i have some problem withe some files that provoke a crash of my
script and
pefile.
here is my script :
import peutils
import pefile
import glob
sig = peutils.SignatureDatabase('peid_userdb.txt')
dir = glob.glob('path/to/bin/directory/*')
for file in dir:
ispe = "Yes"
try:
pe = pefile.PE(file)
except pefile.PEFormatError:
print "Not a PE"
ispe = "No"
if ispe != "No"
mathes = sig.math_all(pe, ep_only = True)
print matches
for most of my file i get "Not a PE" or the packer listed. But i have some
files that crash the script
before the except and i still get this error :
""Traceback (most recent call last):
File "./script_peid.py", line 19, in <module>
pe = pefile.PE(file)
File "/pefile-1.2.10-56/pefile.py", line 1302, in __init__
self.__parse__(name, data, fast_load)
File "/pefile-1.2.10-56/pefile.py", line 1591, in __parse__
self.parse_data_directories()
File "/pefile-1.2.10-56/pefile.py", line 1858, in parse_data_directories
value = entry[1](dir_entry.VirtualAddress, dir_entry.Size)
File "/pefile-1.2.10-56/pefile.py", line 2801, in parse_import_directory
import_desc.ForwarderChain)
File "/pefile-1.2.10-56/pefile.py", line 2895, in parse_imports
if iat and ilt and ilt[idx].AddressOfData != iat[idx].AddressOfData:
IndexError: list index out of range
""
i don't really understand what happening, so i someone can help me ...
i'm running un Ubuntu 8.04 with Python 2.5.2
i also try the new version of pefile-1.2.10-60 but still have the same error.
I leave here a example of file that crash my script. According to Kaspersky, it
is packed with UPX
Original issue reported on code.google.com by wadie.gu...@gmail.com on 25 Feb 2009 at 12:36
Original issue reported on code.google.com by
wadie.gu...@gmail.com
on 25 Feb 2009 at 12:36Attachments: