parameters: (self, offset)
docstring: Fetch the PE file sections.
          
          The sections will be readily available in the "sections" attribute.
          Its attributes will contain all the section information plus "data"
          a buffer containing the section's data.
          
          The "Characteristics" member will be processed and attributes 
          representing the section characteristics (with the 'IMAGE_SCN_'
          string trimmed from the constant's names) will be added to the
          section instance.
          
          Refer to the SectionStructure class for additional info.
docstring_summary: Fetch the PE file sections.
          
          The sections will be readily available in the "sections" attribute.
          Its attributes will contain all the section information plus "data"
          a buffer containing the section's data.
          
          The "Characteristics" member will be processed and attributes 
          representing the section characteristics (with the 'IMAGE_SCN_'
          string trimmed from the constant's names) will be added to the
          section instance.
          
          Refer to the SectionStructure class for additional info.
docstring_tokens: Fetch the PE file sections . The sections will be readily available in the sections attribute . Its attributes will contain all the section information plus data a buffer containing the section s data . The Characteristics member will be processed and attributes representing the section characteristics ( with the IMAGE_SCN_ string trimmed from the constant s names ) will be added to the section instance . Refer to the SectionStructure class for additional info .
function: def parse_sections(self, offset):
          """Fetch the PE file sections.
          
          The sections will be readily available in the "sections" attribute.
          Its attributes will contain all the section information plus "data"
          a buffer containing the section's data.
          
          The "Characteristics" member will be processed and attributes 
          representing the section characteristics (with the 'IMAGE_SCN_'
          string trimmed from the constant's names) will be added to the
          section instance.
          
          Refer to the SectionStructure class for additional info.
          """
          
          self.sections = []
          
          for i in xrange(self.FILE_HEADER.NumberOfSections):
              section = SectionStructure(self.__IMAGE_SECTION_HEADER_format__)
              if not section:
                  break
              section_offset = offset + section.sizeof() * i
              section.set_file_offset(section_offset)
              section.__unpack__(self.__data__[section_offset:])
              self.__structures__.append(section)
                          
              if section.SizeOfRawData > len(self.__data__):
                  self.__warnings.append(
                      ('Error parsing section %d. ' % i) +
                      'SizeOfRawData is larger than file.')
  
              if section.PointerToRawData > len(self.__data__):
                  self.__warnings.append(
                      ('Error parsing section %d. ' % i) +
                      'PointerToRawData points beyond the end of the file.')
  
              if section.Misc_VirtualSize > 0x10000000:
                  self.__warnings.append(
                      ('Suspicious value found parsing section %d. ' % i) +
                      'VirtualSize is extremely large > 256MiB.')
  
              if section.VirtualAddress > 0x10000000:
                  self.__warnings.append(
                      ('Suspicious value found parsing section %d. ' % i) +
                      'VirtualAddress is beyond 0x10000000.')
  
              #
              # Some packer used a non-aligned PointerToRawData in the sections,
              # which causes several common tools not to load the section data
              # properly as they blindly read from the indicated offset.
              # It seems that Windows will round the offset down to the largest
              # offset multiple of FileAlignment which is smaller than
              # PointerToRawData. The following code will do the same.
              #
              
              #alignment = self.OPTIONAL_HEADER.FileAlignment
              section_data_start = section.PointerToRawData
              
              if ( self.OPTIONAL_HEADER.FileAlignment != 0 and 
                  (section.PointerToRawData % self.OPTIONAL_HEADER.FileAlignment) != 0):
                  self.__warnings.append(
                      ('Error parsing section %d. ' % i) +
                      'Suspicious value for FileAlignment in the Optional Header. ' +
                      'Normally the PointerToRawData entry of the sections\' structures ' +
                      'is a multiple of FileAlignment, this might imply the file ' +
                      'is trying to confuse tools which parse this incorrectly')
              
              section_data_end = section_data_start+section.SizeOfRawData
              section.set_data(self.__data__[section_data_start:section_data_end])
              
              section_flags = self.retrieve_flags(SECTION_CHARACTERISTICS, 'IMAGE_SCN_')
              
              # Set the section's flags according the the Characteristics member
              self.set_flags(section, section.Characteristics, section_flags)
  
              if ( section.__dict__.get('IMAGE_SCN_MEM_WRITE', False)  and 
                  section.__dict__.get('IMAGE_SCN_MEM_EXECUTE', False) ):
                  
                  self.__warnings.append(
                      ('Suspicious flags set for section %d. ' % i) +
                      'Both IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE are set.' +
                      'This might indicate a packed executable.')
  
              self.sections.append(section)
              
          if self.FILE_HEADER.NumberOfSections > 0 and self.sections:
              return offset + self.sections[0].sizeof()*self.FILE_HEADER.NumberOfSections
          else:
              return offset
function_tokens: def parse_sections ( self , offset ) : self . sections = [ ] for i in xrange ( self . FILE_HEADER . NumberOfSections ) : section = SectionStructure ( self . __IMAGE_SECTION_HEADER_format__ ) if not section : break section_offset = offset + section . sizeof ( ) * i section . set_file_offset ( section_offset ) section . __unpack__ ( self . __data__ [ section_offset : ] ) self . __structures__ . append ( section ) if section . SizeOfRawData > len ( self . __data__ ) : self . __warnings . append ( ( 'Error parsing section %d. ' % i ) + 'SizeOfRawData is larger than file.' ) if section . PointerToRawData > len ( self . __data__ ) : self . __warnings . append ( ( 'Error parsing section %d. ' % i ) + 'PointerToRawData points beyond the end of the file.' ) if section . Misc_VirtualSize > 0x10000000 : self . __warnings . append ( ( 'Suspicious value found parsing section %d. ' % i ) + 'VirtualSize is extremely large > 256MiB.' ) if section . VirtualAddress > 0x10000000 : self . __warnings . append ( ( 'Suspicious value found parsing section %d. ' % i ) + 'VirtualAddress is beyond 0x10000000.' ) # # Some packer used a non-aligned PointerToRawData in the sections, # which causes several common tools not to load the section data # properly as they blindly read from the indicated offset. # It seems that Windows will round the offset down to the largest # offset multiple of FileAlignment which is smaller than # PointerToRawData. The following code will do the same. # #alignment = self.OPTIONAL_HEADER.FileAlignment section_data_start = section . PointerToRawData if ( self . OPTIONAL_HEADER . FileAlignment != 0 and ( section . PointerToRawData % self . OPTIONAL_HEADER . FileAlignment ) != 0 ) : self . __warnings . append ( ( 'Error parsing section %d. ' % i ) + 'Suspicious value for FileAlignment in the Optional Header. ' + 'Normally the PointerToRawData entry of the sections\' structures ' + 'is a multiple of FileAlignment, this might imply the file ' + 'is trying to confuse tools which parse this incorrectly' ) section_data_end = section_data_start + section . SizeOfRawData section . set_data ( self . __data__ [ section_data_start : section_data_end ] ) section_flags = self . retrieve_flags ( SECTION_CHARACTERISTICS , 'IMAGE_SCN_' ) # Set the section's flags according the the Characteristics member self . set_flags ( section , section . Characteristics , section_flags ) if ( section . __dict__ . get ( 'IMAGE_SCN_MEM_WRITE' , False ) and section . __dict__ . get ( 'IMAGE_SCN_MEM_EXECUTE' , False ) ) : self . __warnings . append ( ( 'Suspicious flags set for section %d. ' % i ) + 'Both IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE are set.' + 'This might indicate a packed executable.' ) self . sections . append ( section ) if self . FILE_HEADER . NumberOfSections > 0 and self . sections : return offset + self . sections [ 0 ] . sizeof ( ) * self . FILE_HEADER . NumberOfSections else : return offset