revealpe.py 文件源码

def doExtractPE(deccontent, pos, n):
    if pos>0x100: pos-=0x100
    else: pos=0
    pe = None
    if pos+n>len(deccontent):n=len(deccontent)-pos
    for i in range(pos, pos+n-2):
        if deccontent[i]=='M' and deccontent[i+1]=='Z':
            try:
                pe = pefile.PE(data = deccontent[i:])
                pe = deccontent[i:i+pe.sections[-1].PointerToRawData+pe.sections[-1].SizeOfRawData]
                break
            except:
                pass
    return pe

####################################################################