Initial directory structure.

git-svn-id: http://pefile.googlecode.com/svn/trunk@1 8842bc4e-7134-0410-8230-5dc5194fb5c1
Initial import

git-svn-id: http://pefile.googlecode.com/svn/trunk@2 8842bc4e-7134-0410-8230-5dc5194fb5c1
Added changes prior to moving to Google Code

git-svn-id: http://pefile.googlecode.com/svn/trunk@3 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Version bumped to 1.2.7
-Added additional IMAGE_SUBSYSTEM_* flags
-Added processing of the Optional Header's DllCharacteristics
-Time/date fileds are now reported as UTC times
-Added warning message for suspicious entry point addresses
-Several minor parsing bugs fixed
-The URLs in the setup.py file now point to the Google Core project website



git-svn-id: http://pefile.googlecode.com/svn/trunk@27 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Bumped version number to 1.2.8
-Faster entropy calculation by Gergely Erdelyi
-Added some intelligence handling unicode strings in the resources information. Strings in the resources seem to always be Pascal style, added support for those
-Changed some loops iterating using range() to use xrange() instead. It will make the code more robust/faster whenever invalid large numbers of elements are specified in different arrays
-As per c1de0x suggestion, added set_data() method to SectionStructure
-Added get_entropy() method to SectionStructure. Now it's only calculated on demand or when doing a dump_info()
-c1de0x pointed out a redundant length check in __unpack_data__ and __unpack__. Now the exception raised by the latter is caught by the former and a warning added if a structure can't be parsed because of missing data
-Fixed bug parsing export directory. Warning messages are added if it's found to be invalid
-Fixed bug parsing the IAT. Some broken samples could crash pefile. The invalid IAT is now reported in the warnings
-New method: relocate_image(new_ImageBase) will apply the relocation information, if any, to the image
-get_memory_mapped_image() now supports and additional keyword argument, "ImageBase". By specifying an address it will return a data relocated (if the PE contains relocation information) as if it had been relocated to the new ImageBase
-Added full family of bytes/word/dword/qword manipulation methods (used by the relocation functionality): 
-get_data_from_dword(dword), get_dword_from_data(data, offset), get_dword_at_rva(rva), get_dword_from_offset(offset), set_dword_at_rva(rva, dword), set_dword_at_offset(offset, dword)
-get_data_from_word(word), get_word_from_data(data, offset), get_word_at_rva(rva), get_word_from_offset(offset), set_word_at_rva(rva, word), set_word_at_offset(offset, word)
-get_data_from_qword(qword), get_qword_from_data(data, offset), get_qword_at_rva(rva), get_qword_from_offset(offset), set_qword_at_rva(rva, qword), set_qword_at_offset(offset, qword)
-set_bytes_at_rva(rva, data), set_bytes_at_offset(offset, data)



git-svn-id: http://pefile.googlecode.com/svn/trunk@34 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Changed defaults in ep_only keyword argument so it will do entry point only checks by default. Those are the fastest and more reliable ones, so it makes sense for them to be the default.



git-svn-id: http://pefile.googlecode.com/svn/trunk@35 8842bc4e-7134-0410-8230-5dc5194fb5c1
Added computation of MD5, SHA-1, SHA-256 and SHA-512 on a per-section basis. The results are always reported when invoking the dump_info() method in the PE instance.
SHA-256 and SHA-512 are calculated only in Python 2.5 onwards which includes them in the hashlib module.
The SectionStructure instances now sport the following methods: get_hash_sha1(), get_hash_sha256(), get_hash_sha512(), get_hash_md5()



git-svn-id: http://pefile.googlecode.com/svn/trunk@39 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Bumped version to 1.2.9a
-Added missing information when parsing import directory entries. Now the RVA of the Hint/Name entries is reported as an attribute named "hint_name_table_rva"; as well the hint, if present, will be exposed as the atribute "hint"
-Fixed a minor bug retrieving the relative virtual address of the Hint/Name entries. Only the lower 16 bits where being fetched as opposed to the 31 that had to be read. It seldom was the case that the entries where farther then 64KiB, but it could have happened. Thanks to Halvar for spotting this one.



git-svn-id: http://pefile.googlecode.com/svn/trunk@42 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Added __str__() and __repr__() methods to pefile's structures. Now it's possible to navigate through the contents much more comfortably from an interactive Python command line. Just typing the name of a structure or doing a print on it will return all the fields and their contents.
-Bugs fixed when parsing the resource information
-Improved parsing of imported symbols. Import by ordinal and name is much more clear now. The ImportData instances have a new attribute, 'import_by_ordinal', indicating whether a symbol is imported by name, in that case the 'ordinal' attributes will contain the ordinal. Otherwise the attribute 'name' will contain the name of the imported symbol.
-Added CheckSum verification and generation methods. verify_checksum() will return True/False indicating whether the value in the file's OptionalHeader CheckSum field contains the real CheckSum of the file. generate_checksum() will calculate the checksum over the file's data. If one modifies fields and writes the changes to disk it's possible to update the checksum by reloading the modified field and setting the CheckSum field to generate_checksum()'s result.
-Other minor fixes



git-svn-id: http://pefile.googlecode.com/svn/trunk@44 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Added support for setuptools



git-svn-id: http://pefile.googlecode.com/svn/trunk@45 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Version bumped up to: 1.2.9
-Now it's possible to modify the version information by directly assigning new values to the keys, for instance
pe.FileInfo[0].StringTable[0].entries['OriginalFilename'] = 'NewName.exe'
The other common keys are: LegalCopyright, InternalName, FileVersion, CompanyName, ProductName, ProductVersion, FileDescription, OriginalFilename



git-svn-id: http://pefile.googlecode.com/svn/trunk@46 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Fixed parsing problem on files specifying a FileAligment of zero
-Fixed problem parsing the Bound Imports directory when it contained invalid data. In some instances pefile would get caught up trying to make sense of arbitrary data. Now when empty strings are found as module names in the Bound Import structures, the parsing is aborted



git-svn-id: http://pefile.googlecode.com/svn/trunk@48 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Whitespace clean-up
-Version number set to 1.2.9.2
-get_memory_mapped_image() can now properly return rebased images. The rebased image data is temporary and will be discarded (won't be saved in the instance). To achieve this one should call relocate_image() which will make the changes permanent
-Improved parsing of import table for PEI-format DLLs (http://www.google.com/codesearch?q=show:Wtes7TbvpLo:co7CX9I5Z0E:YjjyzLSVues)
-Added methods to handle the updating of the section's data upon modification of values in the image's data. (Section's and image's data are kept separately)
-generate_checksum() now makes sure it processes the image with all modifications made to it
-The write() method now only returns the file data if no filename is provided, which is a more intuitive behavior
-'parse_data_directories()' now supports an optional argument to specify with directories to parse. For instance:

# 'fast_load' makes pefile to not load any directory
#
pe = pefile.PE(filepath, fast_load=True)

# the following line will tell pefile to only process the
# resource directory, where the version information is located
#
pe.parse_data_directories( directories=[ DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_RESOURCE'] ] )


git-svn-id: http://pefile.googlecode.com/svn/trunk@50 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Upped version to 1.2.9.3
-Improved the redering when dumping the file's contents in textual form. The performance of the operation has greatly improved
-get_data() calls now use a fixed size argument when possible. Improves the speed of those calls in large files. Fix suggested by Paul, barnabas79 (http://groups.google.com/group/pefile/browse_thread/thread/4b289227042d3f14?hl=en)

git-svn-id: http://pefile.googlecode.com/svn/trunk@52 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Started using the subversion revision keyword

git-svn-id: http://pefile.googlecode.com/svn/trunk@53 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Started using the subversion revision keyword

git-svn-id: http://pefile.googlecode.com/svn/trunk@54 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Fixed bug in contains_offset(). The end of the section's data on disk was being calculated as VirtualAddress + SizeOfRawData instead of the correct: PointerToRawData + SizeOfRawData

git-svn-id: http://pefile.googlecode.com/svn/trunk@55 8842bc4e-7134-0410-8230-5dc5194fb5c1
Updated copyright string and set version to 1.2.10-REVISION#

git-svn-id: http://pefile.googlecode.com/svn/trunk@56 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Added processing of the LOAD_CONFIG data directory
-Improved error handling of parsing errors when handling the TLS data directory, a warning is now added to the warnings list if it can't be parsed
-Improved setup script to avoid bundling OSX's resource forks

git-svn-id: http://pefile.googlecode.com/svn/trunk@59 8842bc4e-7134-0410-8230-5dc5194fb5c1
-Some improvements made to unicode string processing. When random data was added where unicode strings should be in a standard PE file, the data wasn't being re-assembled correctly

git-svn-id: http://pefile.googlecode.com/svn/trunk@60 8842bc4e-7134-0410-8230-5dc5194fb5c1