Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

__generate_signature uses ord()? #301

Open
markste-in opened this issue Nov 21, 2020 · 0 comments
Open

__generate_signature uses ord()? #301

markste-in opened this issue Nov 21, 2020 · 0 comments

Comments

@markste-in
Copy link

markste-in commented Nov 21, 2020

I was trying to generate some signatures but I often got errors stating that ord() wants a single string character and not an integer.

In peutils.py there is the following code:

 def __generate_signature(self, pe, offset, name, ep_only=False,
            section_start_only=False, sig_length=512):

        data = pe.__data__[offset:offset+sig_length]

        signature_bytes = ' '.join(['%02x' % ord(c) for c in data])

In my opinion the last line should change to (remove the ord):
signature_bytes = ' '.join(['%02x' % c for c in data])
since data is already binary and looks something like that
b'SVWUH\x8d5:\x96\xff\xffH\x8d\xbe\xdb\x7f\xfe\xffW1\xdb1\xc9H\x83\xcd\xff\xe8P\x00\x00\x00\x01\xdbt\x02\xf3\xc3\x8b\x1eH\x83\xee\xfc\x11\xdb\x8a\x16\xf3\xc3H\x8d\x04/\x83\xf9\x05\x8a\x10v!H\x83\xfd'

In accordance the matching function:

 def __match_signature_tree(self, signature_tree, data, depth = 0):

        matched_names = list ()
        match = signature_tree

        for idx, byte in enumerate ( [b if isinstance(b, int) else ord(b) for b in data] ):

should change to (ord(b) -> hex(b)) since data comes from the database text file
for idx, byte in enumerate ( [b if isinstance(b, int) else hex(b) for b in data] ):

Those two small changes make the generate_signature function work for me and also match the generated data.

But maybe I'm missing something crucial and it should be indeed the way it is?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant