pe_parse.py 文件源码

def get_DataDirectory(self):
        # This won't work if we load a PE32 in a 64bit process
        # PE32 .NET...
        # return self.get_OptionalHeader().DataDirectory
        DataDirectory_type = IMAGE_DATA_DIRECTORY * IMAGE_NUMBEROF_DIRECTORY_ENTRIES
        SizeOfOptionalHeader = self.get_NT_HEADER().FileHeader.SizeOfOptionalHeader
        if self.target is None:
            opt_header_addr = ctypes.addressof(self.get_NT_HEADER().OptionalHeader)
        else:
            opt_header_addr = self.get_NT_HEADER().OptionalHeader._base_addr
        DataDirectory_addr = opt_header_addr + SizeOfOptionalHeader - ctypes.sizeof(DataDirectory_type)
        return self.transformers.create_structure_at(DataDirectory_type, DataDirectory_addr)