+
    i\                     l   R t ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	t	^ RI
t
^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RItR R ltR R ltR tR t]P6                  R]P8                  R	]P:                  R
]P<                  R]P>                  R]P@                  R]PB                  R]PD                  R]PF                  R]PH                  R^R]PJ                  R/t&R t'R:R lt(R:R lt)R t*R;R lt+R;R lt,R t-R t.R t/R t0R t1R t2R  t3R! t4R" t5R# t6R$ t7R<R% lt8R<R& lt9R<R' lt:]Pv                  t< ! R( R)]=4      t>R* t?R+ t@R, tAR- tB]BtCR=R. ltD ! R/ R0]=4      tE ! R1 R2]=4      tF ! R3 R4]=4      tG ! R5 R6]=4      tHR:R7 ltI ! R8 R9]=4      tJ]G! 4       tK ]F! 4       tLR# )>z4
idautils.py - High level utility functions for IDA
Nc                $    V ^8  d   QhR\         /#    flowbool)formats   "@C:\Users\user\Downloads\ida93sp2\portable_win\python\idautils.py__annotate__r
   &   s     & & &    c              #     "   \         P                  ! 4       pV^8X  d   VP                  V 4       Rj  xL
  R# VP                  V 4       Rj  xL
  R#  L! L5i)z
Get a list of code references to 'ea'

:param ea:   Target address
:param flow: Follow normal code flow or not

:returns: list of references (may be empty list)

Example::

    for ref in CodeRefsTo(get_screen_ea(), 1):
        print(ref)
N)ida_xref	xrefblk_tcrefs_to	fcrefs_toear   xrefs   && r	   
CodeRefsTor   &   sH      Dqy==$$$>>"%%% 	%%!   1AAAAAAc                $    V ^8  d   QhR\         /# r   r   )r   s   "r	   r
   r
   ;   s     ( (4 (r   c              #     "   \         P                  ! 4       pV^8X  d   VP                  V 4       Rj  xL
  R# VP                  V 4       Rj  xL
  R#  L! L5i)z
Get a list of code references from 'ea'

:param ea:   Target address
:param flow: Follow normal code flow or not

:returns: list of references (may be empty list)

Example::

    for ref in CodeRefsFrom(get_screen_ea(), 1):
        print(ref)
N)r   r   
crefs_fromfcrefs_fromr   s   && r	   CodeRefsFromr   ;   sJ      Dqy??2&&&##B''' 	''r   c              #  n   "   \         P                  ! 4       pVP                  V 4       Rj  xL
  R#  L5i)z
Get a list of data references to 'ea'

:param ea:   Target address

:returns: list of references (may be empty list)

Example::

    for ref in DataRefsTo(get_screen_ea()):
        print(ref)
N)r   r   drefs_tor   r   s   & r	   
DataRefsTor   O   s'      D}}R      *535c              #  n   "   \         P                  ! 4       pVP                  V 4       Rj  xL
  R#  L5i)z
Get a list of data references from 'ea'

:param ea:   Target address

:returns: list of references (may be empty list)

Example::

    for ref in DataRefsFrom(get_screen_ea()):
        print(ref)
N)r   r   
drefs_fromr   s   & r	   DataRefsFromr"   `   s'      Dr"""r   Data_UnknownData_Offset
Data_Write	Data_Read	Data_TextData_InformationalCode_Far_CallCode_Near_CallCode_Far_JumpCode_Near_Jump	Code_UserOrdinary_Flowc                N    V \         9   g   Q RV ,          4       h\         V ,          # )zb
Convert cross-reference type codes to readable names

:param typecode: cross-reference type code
zunknown reference type %d)
_ref_types)typecodes   &r	   XrefTypeNamer2      s(     z!I#>#II!hr   c                N    \         P                  ! 4       pVP                  W4      # )aL  
Return all references from address 'ea'

:param ea: Reference address
:param flags: one of ida_xref.XREF_ALL (default), ida_xref.XREF_FAR, ida_xref.XREF_DATA

Example::
       for xref in XrefsFrom(here(), 0):
           print(xref.type, XrefTypeName(xref.type),                          'from', hex(xref.frm), 'to', hex(xref.to))
)r   r   	refs_fromr   flagsr   s   && r	   	XrefsFromr7      s!     D>>"$$r   c                N    \         P                  ! 4       pVP                  W4      # )aH  
Return all references to address 'ea'

:param ea: Reference address
:param flags: one of ida_xref.XREF_ALL (default), ida_xref.XREF_FAR, ida_xref.XREF_DATA

Example::
       for xref in XrefsTo(here(), 0):
           print(xref.type, XrefTypeName(xref.type),                          'from', hex(xref.frm), 'to', hex(xref.to))
)r   r   refs_tor5   s   && r	   XrefsTor:      s!     D<<""r   c               #     "   \        ^ \        P                  ! 4       4       F  p \        P                  ! V 4      x  K  	  R# 5i)z.Returns all thread IDs for the current debugeeN)rangeidcget_thread_qtygetn_threadis    r	   ThreadsrB      s.     1c((*+ooa   ,s   AAc              #  t  "   V f   \         P                  ! 4       p Vf   \         P                  ! 4       pT p\        P                  ! \
        P                  ! V4      4      '       g   \
        P                  ! W!4      pW!8  d4   V\        P                  8w  d   Vx  \
        P                  ! W!4      pK7  R# R# 5i)z
Get a list of heads (instructions or data items)

:param start: start address (default: inf.min_ea)
:param end:   end address (default: inf.max_ea)

:returns: list of heads between start and end
N)
ida_idainf_get_min_eainf_get_max_ear=   is_head	ida_bytes	get_flags	next_head
ida_idaapiBADADDR)startendr   s   && r	   HeadsrO      s      }g446e
{G224c	B;;y**2.//  )
(rZ///  ) 0(s   A$B8'AB8c              #  &  "   V f   \         P                  ! 4       p Vf   \         P                  ! 4       p\        P                  ! V 4      pV'       g   \        P
                  ! V 4      pV'       dZ   VP                  V8  dI   VP                  \        P                  ,          ^ 8w  d#   \        P
                  ! VP                  4      pKa  TpV'       d<   VP                  V8  d)   VP                  pVx  \        P                  ! V4      pKA  R# R# 5i)a  
Get a list of functions

:param start: start address (default: inf.min_ea)
:param end:   end address (default: inf.max_ea)

:returns: list of function entrypoints between start and end

NOTE: The last function that starts before 'end' is included even
if it extends beyond 'end'. Any function that has its chunks scattered
in multiple segments will be reported multiple times, once in each segment
as they are listed.
N)
rD   rE   rF   	ida_funcs
get_fchunkget_next_fchunkstart_ear6   	FUNC_TAILget_next_func)rM   rN   chunkfuncstarteas   &&   r	   	FunctionsrZ      s      }g446e
{G224c   'E))%0
ENNS(ekkI<O<O.OTU-U))%..9D
4==3&--&&w/ '$s   ADD1A"D=Dc              #     "   \         P                  ! \         P                  ! V 4      4      pV F  pVP                  VP                  3x  K  	  R# 5i)z
Get a list of function chunks
See also ida_funcs.func_tail_iterator_t

:param start: address of the function

:returns: list of function chunks (tuples of the form (start_ea, end_ea))
         belonging to the function
N)rQ   func_tail_iterator_tget_funcrT   end_ea)rM   	func_iterrW   s   &  r	   Chunksr`      s?      ..	0B0BE0KMI~~u||,, s   AAc               #  ,  "   \         P                  ! 4       p \        P                  ! V 4      pV'       d]   \        P
                  ! V P                  V P                  V P                  V P                  R7      x  \        P                  ! V 4      pKd  R# 5i)zS
Returns a list of module objects with name,size,base and the rebase_to attributes
)namesizebase	rebase_toN)ida_idd	modinfo_tida_dbgget_first_modulerK   object_trb   rc   rd   re   get_next_module)modresults     r	   Modulesrn      si      


C%%c*F
 !!sxxchhSXXY\YfYfgg((- s   3BABc               #     "   \        \        P                  ! 4       4       F4  p \        P                  ! V 4      p\        P                  ! V 4      pW3x  K6  	  R# 5i)z>
Returns a list of names

:returns: List of tuples (ea, name)
N)r<   ida_nameget_nlist_sizeget_nlist_eaget_nlist_name)rA   r   rb   s      r	   Namesrt     sG      8**,-$$Q'&&q)j .s   AAc               #     "   \        \        P                  ! 4       4       F1  p \        P                  ! V 4      pV'       g   K#  VP                  x  K3  	  R# 5i)za
Get list of segments (sections) in the binary image

:returns: List of segment start addresses.
N)r<   ida_segmentget_segm_qtygetnsegrT   )nsegs     r	   Segmentsr{     s>      ;++-.!!!$3,, /s   =AAc               #     "   \         P                  ! 4       p \        ^ V 4       FK  p\         P                  ! V4      p\         P                  ! V4      p\         P
                  ! V4      pWW43x  KM  	  R# 5i)z_
Returns a list of entry points (exports)

:returns: List of tuples (index, ordinal, ea, name)
N)	ida_entryget_entry_qtyr<   get_entry_ordinal	get_entryget_entry_name)ry   rA   ordinalr   rb   s        r	   Entriesr     s`      	!A1a[--a0%%g.**732$$	 s   A3A5c                V    \         P                  ! \         P                  ! V 4      4      # )z
Get a list of function items (instruction or data items inside function boundaries)
See also ida_funcs.func_item_iterator_t

:param start: address of the function

:returns: ea of each item in the function
)rQ   func_item_iterator_tr]   )rM   s   &r	   	FuncItemsr   '  s      )))*<*<U*CDDr   c               #     "   \         P                  ! 4       p \        ^V 4       Fd  p\         P                  ! 4       pVP	                  RV4       VP                  4       '       g   KB  WP                  4       VP                  4       3x  Kf  	  R# 5i)zI
Get a list of structures

:returns: List of tuples (ordinal, sid, name)
N)ida_typeinfget_ordinal_limitr<   tinfo_tget_numbered_typeis_udtget_tidget_type_name)limitr   tifs      r	   Structsr   3  sh      ))+EE?!!#dG,::<<KKM3+<+<+>??	 #s   AB&(Bc              #    "   \         P                  ! 4       pVP                  V 4      '       d   VP                  4       '       g   \	        RV ,          4      h\         P
                  ! 4       pVP                  V4       V FN  pVP                  4       '       d   K  VP                  ^,          VP                  VP                  ^,          3x  KP  	  R# 5i)an  
Get a list of structure members information (or stack vars if given a frame).

:param sid: ID of the structure.

:returns: List of tuples (offset_in_bytes, name, size_in_bytes)

NOTE: If 'sid' does not refer to a valid structure, an exception will be raised.
NOTE: This will not return 'holes' in structures/stack frames; it only returns defined structure members.
zNo structure with ID: 0x%xN)r   r   get_type_by_tidr   	Exceptionudt_type_data_tget_udt_detailsis_gapoffsetrb   rc   )sidr   udtudms   &   r	   StructMembersr   A  s      


Cs##3::<<4s:;;

%
%
'Czz||::q=#((CHHaK88 s   ACAC9Cc                    \         P                  ! 4       p\         P                  ! W4      w  r#V\        P                  8w  d   W3# R# )z
Decode preceding instruction in the execution flow.

:param ea: address to decode
:returns: (None or the decode instruction, farref)
         farref will contain 'true' if followed an xref, false otherwise
)NF)ida_uainsn_tdecode_preceding_insnrK   rL   )r   insn	prev_addrfarrefs   &   r	   DecodePrecedingInstructionr   V  s<     ==?D55d?I&**<*<<D>O-Or   c                    \         P                  ! 4       p\         P                  ! W4      pV\        P                  8w  d   V# R# )z
Decodes the previous instruction and returns an insn_t like class

:param ea: address to decode
:returns: None or a new insn_t instance
N)r   r   decode_prev_insnrK   rL   )r   r   r   s   &  r	   DecodePreviousInstructionr   c  s7     ==?D''1I
 2 224<<r   c                n    \         P                  ! 4       p\         P                  ! W4      pV^ 8  d   V# R# )z
Decodes an instruction and returns an insn_t like class

:param ea: address to decode
:returns: None or a new insn_t instance
N)r   r   decode_insn)r   r   inslens   &  r	   DecodeInstructionr   o  s0     ==?D)FA:4'4'r   c              #  :  "   V^8X  d   \         P                  pMSV^8X  d   \         P                  pM;V^8X  d   \         P                  pM#V^8X  d   \         P                  pM\        R4      hWV,          ,           pT pWT8  d   V! V4      x  WR,          pK  R# 5i)z#
Get data list - INTERNAL USE ONLY
z'Invalid data size! Must be 1, 2, 4 or 8N)rH   get_byteget_word	get_dword	get_qword
ValueError)r   countitemsizegetdataendeacureas   &&&   r	   GetDataListr   {  s      1}$$	Q$$	Q%%	Q%%BCCE!!EE
-en s   BBc                    RpV^8X  d   \         P                  pV^8X  d   \         P                  pV^8X  d   \         P                  pV'       g   Q R4       hV F  pV! W4       W,           p K  	  R# )z#
Put data list - INTERNAL USE ONLY
Nz$Invalid data size! Must be 1, 2 or 4)rH   
patch_byte
patch_wordpatch_dword)r   datalistr   putdatavals   &&&  r	   PutDataListr     sf     G1}&&1}&&1}'':::7] r   c                H    \        V \        V\        WV4      4      V4       R# )z
Map through a list of data words in the database

:param ea:       start address
:param length:   number of words to map
:param func:     mapping function
:param wordsize: size of words to map [default: 1 byte]

:returns: None
N)r   mapr   )r   lengthrX   wordsizes   &&&&r	   MapDataListr     s     Ck"h?@(Kr   c                      a  ] tR tRt o Rt ! R R]4      tR tRR ltR t	]
P                  .^R	RR3R
 ltR tR tR tRtV tR# )Stringsi  aa  
Allows iterating over the string list. The set of strings will not be
modified, unless asked explicitly at setup()-time. This string list also
is used by the "String window" so it may be changed when this window is
updated.

Example:
    s = Strings()

    for i in s:
        print("%x: len=%d type=%d -> '%s'" % (i.ea, i.length, i.strtype, str(i)))

c                   B   a  ] tR tRt o RtR tR tR tR tR t	Rt
V tR	# )
Strings.StringItemi  z&
Class representing each string item.
c                p    VP                   V n          VP                  V n         VP                  V n        R # N)r   typestrtyper   )selfsis   &&r	   __init__Strings.StringItem.__init__  s,    eeDG77DL-))DKr   c                H    \         P                  ! V P                  4      ^8H  #    )ida_naltget_strtype_bpur   r   s   &r	   is_1_byte_encoding%Strings.StringItem.is_1_byte_encoding  s    ++DLL9Q>>r   c                   \         P                  ! V P                  V P                  V P                  4      p\
        P                  P                  ^8  d   V'       d   VP                  RR4      # T# V'       d   \        VRR4      # T# )   zUTF-8replace)
rH   get_strlit_contentsr   r   r   sysversion_infomajordecodeunicode)r   
as_unicodestrbytess   && r	   _toseqStrings.StringItem._toseq  se     44TWWdkk4<<XH%%*>Hxw	:VhV@Jwx)<XPXXr   c                n    T P                  \        P                  P                  ^8  d   R4      # R4      # )r   FT)r   r   r   r   r   s   &r	   __str__Strings.StringItem.__str__  s,    ;;(8(8(>(>(BuMMMMr   c                $    V P                  R 4      # )T)r   r   s   &r	   __unicode__Strings.StringItem.__unicode__  s    ;;t$$r   )r   r   r   N)__name__
__module____qualname____firstlineno____doc__r   r   r   r   r   __static_attributes____classdictcell____classdict__s   @r	   
StringItemr     s*     		 	?	Y	N	% 	%r   r   c                0    \         P                  ! 4        R# )zClears the string list cacheN)ida_strlistclear_strlistr   s   &r	   clear_cacheStrings.clear_cache  s    !!#r   Fc                    ^ V n         V'       d   V P                  4        M\        P                  ! 4        V P	                  4        \        P
                  ! 4       V n        R# )z
Initializes the Strings enumeration helper class

:param default_setup: Set to True to use default setup (C strings, min len 5, ...)
N)rc   setupr   get_strlist_optionsrefreshstring_info_t_si)r   default_setups   &&r	   r   Strings.__init__  s>     	JJL ++-,,.r   c                d    \         P                  ! 4        \         P                  ! 4       V n        R# )zRefreshes the string listN)r   build_strlistget_strlist_qtyrc   r   s   &r	   r   Strings.refresh  s    !!#//1	r   Tc                    \         P                  ! 4       pWn        W&n        W6n        WVn        WFn        V P                  4        R # r   )r   r   strtypesminlen	only_7bitdisplay_only_existing_stringsignore_headsr   )r   r  r	  r
  ignore_instructionsr  ts   &&&&&& r	   r   Strings.setup  s5     ++-
*G',r   c                    \         P                  ! V P                  V4      '       g   R # \        P	                  V P                  4      # r   )r   get_strlist_itemr   r   r   r   indexs   &&r	   	_get_itemStrings._get_item  s1    ++DHHe<<!!$((++r   c                D   a  V 3R  l\        ^ S P                  4       4       # )c              3   F   <"   T F  pSP                  V4      x  K  	  R # 5ir   )r  ).0r  r   s   & r	   	<genexpr>#Strings.__iter__.<locals>.<genexpr>  s     G3F%u%%3Fs   !)r<   rc   r   s   fr	   __iter__Strings.__iter__  s    G5DII3FGGr   c                P    WP                   8  d   \        hV P                  V4      # )zReturns a string item or None)rc   KeyErrorr  r  s   &&r	   __getitem__Strings.__getitem__  s     IIN>>%((r   )r   rc   N)F)r   r   r   r   r   objectr   r   r   r   r   	STRTYPE_Cr   r  r  r  r   r   r   s   @r	   r   r     sY     %V %8$/"2 #,,-$).3 ,H) )r   r   c                     \         P                  P                  \        P                  ! \        P
                  4      4      \         P                  ,           # )zU
Get IDB directory

This function returns directory path of the current IDB database
)ospathdirname
ida_loaderget_pathPATH_TYPE_IDBsep r   r	   	GetIdbDirr,    s1     77??:..z/G/GHIBFFRRr   c                 ,    \         P                  ! 4       # )zReturns the register list)ida_idpph_get_regnamesr+  r   r	   GetRegisterListr0  &  s    ""$$r   c                     \         P                  ! 4        U u. uF  q ^ ,          '       g   K  V ^ ,          NK  	  up # u up i )z<Returns the instruction list of the current processor module)r.  ph_get_instrucr@   s    r	   GetInstructionListr3  +  s3    !002;2QddDAaDD2;;;s   ==c                ,   \        V4      \        .\        \        P                  4      ,           9   d   V.pMTp. pV F  p\
        P                  ! V 4      pV'       g   Ru # V \
        P                  ! VP                  4      ^,          ,
          p\        P                  ! WP                  WTP                  V4      pV'       g   RRV,           3u # V \        V4      ,          p VP                  V4       K  	  \        V4      ^8X  d
   V^ ,          pRV3# )aq  
Assembles one or more lines (does not display an message dialogs)
If line is a list then this function will attempt to assemble all the lines
This function will turn on batch mode temporarily so that no messages are displayed on the screen

:param ea:       start address
:returns: (False, "Error message") or (True, asm_buf) or (True, [asm_buf1, asm_buf2, asm_buf3])
FzAssembler failed: T)FzNo segment at ea)r   byteslistrK   string_typesrv   getsegsel2paraselr.  AssembleLinebitnesslenappend)r   linelinesretrz   ipbufs   &&     r	   AssemblerD  0  s     DzugZ%<%< ==>
C  $..K((1Q67""2wwKKF/$677
c#h

3  3x1}!f#;r   c                T   \        V4      \        8X  d   \        P                  VR/ 4      p\	        V 4       Fm  pVP                  R4      '       d   VP                  R4      '       d   K3  V'       d	   W29   d   KC  \        W4      p\        V4      '       d   Ka  \        WV4       Ko  	  V# )a@  
Copy non private/non callable attributes from a class instance to another
:param src: Source class to copy from
:param dest: If it is a string then it designates the new class type that will be created and copied to.
             Otherwise dest should be an instance of another class
:returns: A new instance or "dest"
__r+  )
r   r5  newclassobjdir
startswithendswithgetattrcallablesetattr)srcdest	skip_listxr  s   &&&  r	   	_copy_objrS  R  s     DzU||D"b)X<<!**T"2"2COA;;  Kr   c                   0   a  ] tR tRt o RtR tR tRtV tR# )_reg_dtyp_til  z
INTERNAL
This class describes a register's number and dtyp.
The equal operator is overloaded so that two instances can be tested for equality
c                    Wn         W n        R # r   regdtype)r   rX  rY  s   &&&r	   r   _reg_dtyp_t.__init__r  s    
r   c                v    V P                   VP                   8H  ;'       d    V P                  VP                  8H  # r   rW  )r   others   &&r	   __eq___reg_dtyp_t.__eq__v  s*    EII%FFDJJ%++,EFr   )rY  rX  N)	r   r   r   r   r   r   r]  r   r   r   s   @r	   rU  rU  l  s     
G Gr   rU  c                   0   a  ] tR tRt o RtR tR tRtV tR# )	_procregsiz  zOUtility class allowing the users to identify registers in a decoded instructionc                    \         P                  ! 4       p\         P                  ! W!4      '       g   \        4       h\	        VP
                  \        P                  ! VP                  4      4      pW0P                  V&   V# r   )
r.  
reg_info_tparse_reg_nameAttributeErrorrU  rX  r   get_dtype_by_sizerc   __dict__)r   attrrirs   &&  r	   __getattr___procregs.__getattr__|  sZ    !%%b// "" 8 8 ABdr   c                    \        V4      hr   )rd  )r   rg  values   &&&r	   __setattr___procregs.__setattr__  s    T""r   r+  N	r   r   r   r   r   rj  rn  r   r   r   s   @r	   r`  r`  z  s     Y# #r   r`  c                   0   a  ] tR tRt o RtR tR tRtV tR# )_cpui  z1Simple wrapper around get_reg_value/set_reg_valuec           	          \         P                  ! V4      #   \         d5   p\        R P	                  T\        T4      P                  T4      4      hRp?ii ; i)z6_cpu: "{}" is not a register; inner exception: [{}] {}N)r=   get_reg_valuer   rd  r   r   r   )r   rb   exs   && r	   rj  _cpu.__getattr__  sW    	G$$T** 	G  "="(&tBx/@/@""EG G	Gs    A/AAc                .    \         P                  ! W!4      # r   )r=   set_reg_value)r   rb   rm  s   &&&r	   rn  _cpu.__setattr__  s      --r   r+  Nrp  r   s   @r	   rr  rr    s     7G. .r   rr  c                   6   a  ] tR tRt o RR ltR tR tRtV tR# )__process_ui_actions_helperi  c                    \        V\        4      '       d   VP                  R4      pM*\        V\        \        34      '       d   TpM\        R4      hW0n        W n        ^ V n        R# )z0Expect a list or a string with a list of actions;z#Must pass a string, list or a tupleN)	
isinstancestrsplitr6  tupler   '_process_ui_actions_helper__action_list!_process_ui_actions_helper__flags_process_ui_actions_helper__idx)r   actionsr6   lsts   &&& r	   r   $__process_ui_actions_helper.__init__  sU    gs##--$C$//CBCC ! 
r   c                ,    \        V P                  4      # r   )r=  r  r   s   &r	   __len__#__process_ui_actions_helper.__len__  s    4%%&&r   c                    V P                   \        V P                  4      8  d   R # \        P                  ! V P                  V P                   ,          V P
                  4       V ;P                   ^,          un         R# )FT)r  r=  r  ida_kernwinprocess_ui_actionr  r   s   &r	   __call__$__process_ui_actions_helper.__call__  sY    ::T//00 	%%""4::.	
 	

a
 r   )__action_list__flags__idxN    )	r   r   r   r   r   r  r  r   r   r   s   @r	   r{  r{    s      ' r   r{  c                j    \        W4      p\        V4      ^8  d   R# \        P                  ! V34      # )z
:param actions: A string containing a list of actions separated by semicolon, a list or a tuple
:param flags: flags to be passed to process_ui_action()
:returns: Boolean. Returns False if the action list was empty or execute_ui_requests() failed.
F)r{  r=  r  execute_ui_requests)r  r6   helpers   && r	   ProcessUiActionsr    s0     )8FK!O5S)H)H&)SSr   c                   F  a  ] tR tRt o RtRt]P                  R,          t]P                  R,          t	]P                  R,          t
]P                  R,          t]P                  R,          t]P                  R,          tR t]! R 4      t ]! R 4      t R tR tR	tV tR
# )	peutils_ti  zT
PE utility class. Retrieves PE information from the database.

Constants from pe.h
z$ PE headerc                    \         P                  ! 4       V n        V P                  P                  \        P
                  4       R # r   )ida_netnodenetnode_peutils_t__penodecreater  PE_NODEr   s   &r	   r   peutils_t.__init__  s*    #++-Y../r   c                T    V P                   P                  \        P                  4      # r   )r  altvalr  PE_ALT_IMAGEBASEr   s   &r	   <lambda>peutils_t.<lambda>  s    dmm&:&:9;U;U&Vr   c                T    V P                   P                  \        P                  4      # r   )r  r  r  PE_ALT_PEHDR_OFFr   s   &r	   r  r    s    $--*>*>y?Y?Y*Zr   c                    V P                   P                   R V P                   P                   R2V P                  V P                  3,          # ).z(imagebase=%x, header=%x))	__class__r   r   	imagebaseheader_offsetr   s   &r	   __repr__peutils_t.__repr__  sV    ..++,Adnn.E.E-FF_`dhdrdrtx  uG  uG  dH  H  	Hr   c                6    V P                   P                  4       # r   )r  valobjr   s   &r	   r  r    s    $--..0r   )__penodeNi)r   r   r   r   r   r  rK   rL   PE_ALT_DBG_FPOSr  r  PE_ALT_NEFLAGSPE_ALT_TDS_LOADEDPE_ALT_PSXDLLr   propertyr  r  r  headerr   r   r   s   @r	   r  r    s     
 G"**R/O"**R/"**R/"**R/N"**R/"**R/M0 VWI0Z[MH 1F[r   r  r  )NNr   r   )Mr   rH   rh   r}   rQ   rD   rK   rf   r.  r  r'  r   rp   r  rv   r   r   r   r   r=   typesr$  r   r   r   r   r"   fl_Udr_Odr_Wdr_Rdr_Tdr_Ifl_CFfl_CNfl_JFfl_JNfl_Fr0   r2   r7   r:   rB   rO   rZ   r`   rn   rt   r{   r   r   r   r   r   r   r   r   r   r   retrieve_input_file_md5GetInputFileMD5r!  r   r,  r0  r3  rD  	_AssemblerS  rU  r`  rr  r{  r  r  cpuprocregsr+  r   r	   <module>r     s                     
  	 
&*((!"#& MM^MM]MM\MM[MM[MM)NN_NN%NN_NN%MMO
 % # !*(0>-.		%	E@9*
P	=	(,(L 22d)f d)NS%
<
< 	4G& G# #.6 .!& !J	T\ \> f
 ;r   