forked from rootm0s/Protectors
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
91 changed files
with
10,709 additions
and
0 deletions.
There are no files selected for viewing
24 changes: 24 additions & 0 deletions
24
Polychaos/contrib/portable-executable-library/pe_lib/Makefile
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,24 @@ | ||
OBJS = entropy.o file_version_info.o message_table.o pe_base.o pe_bound_import.o pe_checksum.o pe_debug.o pe_directory.o pe_dotnet.o pe_exception_directory.o pe_exports.o pe_imports.o pe_load_config.o pe_properties.o pe_properties_generic.o pe_relocations.o pe_factory.o pe_resources.o pe_resource_manager.o pe_resource_viewer.o pe_rich_data.o pe_section.o pe_tls.o utils.o version_info_editor.o version_info_viewer.o pe_exception.o resource_message_list_reader.o resource_string_table_reader.o resource_version_info_reader.o resource_version_info_writer.o resource_cursor_icon_reader.o resource_cursor_icon_writer.o resource_bitmap_writer.o resource_bitmap_reader.o resource_data_info.o pe_rebuilder.o | ||
LIBNAME = pebliss | ||
LIBPATH = ../lib | ||
CXXFLAGS = -O2 -Wall -fPIC -DPIC -I. | ||
|
||
ifdef PE_DEBUG | ||
CXXFLAGS += -g -O0 | ||
endif | ||
|
||
all: $(LIBPATH)/lib$(LIBNAME).a | ||
|
||
clean: | ||
rm -f $(OBJS) lib$(LIBNAME).a | ||
rm -rf ../lib | ||
|
||
lib$(LIBNAME).a: $(OBJS) | ||
ar -cvr lib$(LIBNAME).a $(OBJS) | ||
ranlib lib$(LIBNAME).a | ||
|
||
$(LIBPATH): | ||
mkdir -p ../lib | ||
|
||
$(LIBPATH)/lib$(LIBNAME).a: lib$(LIBNAME).a $(LIBPATH) | ||
cp -d lib$(LIBNAME).a ../lib |
Binary file added
BIN
+112 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/entropy.obj
Binary file not shown.
Binary file added
BIN
+70.9 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/file_version_info.obj
Binary file not shown.
Binary file added
BIN
+299 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/message_table.obj
Binary file not shown.
Binary file added
BIN
+971 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_base.obj
Binary file not shown.
Binary file added
BIN
+1.32 MB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.idb
Binary file not shown.
Binary file added
BIN
+1.81 MB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.pdb
Binary file not shown.
Binary file added
BIN
+37.6 KB
...os/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.tlog/CL.command.1.tlog
Binary file not shown.
Binary file added
BIN
+777 KB
...chaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.tlog/CL.read.1.tlog
Binary file not shown.
Binary file added
BIN
+41.6 KB
...haos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.tlog/CL.write.1.tlog
Binary file not shown.
Binary file added
BIN
+21.7 KB
...contrib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.tlog/Lib-link.read.1.tlog
Binary file not shown.
Binary file added
BIN
+11 KB
...ontrib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.tlog/Lib-link.write.1.tlog
Binary file not shown.
Binary file added
BIN
+13.3 KB
...s/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.tlog/Lib.command.1.tlog
Binary file not shown.
2 changes: 2 additions & 0 deletions
2
...trib/portable-executable-library/pe_lib/Win32/Debug/pe_bliss.tlog/pe_bliss.lastbuildstate
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,2 @@ | ||
#TargetFrameworkVersion=v4.0:PlatformToolSet=v141:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.15063.0 | ||
Debug|Win32|C:\Users\rmt01\Dropbox\WindowsBox\Kodning\Fusk\Mutation\Polychaos-master\| |
Binary file added
BIN
+491 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_bound_import.obj
Binary file not shown.
Binary file added
BIN
+55.1 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_checksum.obj
Binary file not shown.
Binary file added
BIN
+705 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_debug.obj
Binary file not shown.
Binary file added
BIN
+7.7 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_directory.obj
Binary file not shown.
Binary file added
BIN
+88.8 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_dotnet.obj
Binary file not shown.
Binary file added
BIN
+37 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_exception.obj
Binary file not shown.
Binary file added
BIN
+203 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_exception_directory.obj
Binary file not shown.
Binary file added
BIN
+1.13 MB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_exports.obj
Binary file not shown.
Binary file added
BIN
+108 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_factory.obj
Binary file not shown.
Binary file added
BIN
+588 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_imports.obj
Binary file not shown.
41 changes: 41 additions & 0 deletions
41
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_lib.log
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,41 @@ | ||
version_info_viewer.cpp | ||
version_info_editor.cpp | ||
utils.cpp | ||
resource_version_info_writer.cpp | ||
resource_version_info_reader.cpp | ||
resource_string_table_reader.cpp | ||
resource_message_list_reader.cpp | ||
resource_cursor_icon_reader.cpp | ||
resource_data_info.cpp | ||
resource_cursor_icon_writer.cpp | ||
resource_bitmap_writer.cpp | ||
resource_bitmap_reader.cpp | ||
pe_rich_data.cpp | ||
pe_resources.cpp | ||
pe_relocations.cpp | ||
pe_resource_manager.cpp | ||
pe_factory.cpp | ||
pe_exception.cpp | ||
pe_base.cpp | ||
pe_imports.cpp | ||
Generating Code... | ||
Compiling... | ||
pe_exports.cpp | ||
pe_exception_directory.cpp | ||
pe_dotnet.cpp | ||
pe_debug.cpp | ||
pe_tls.cpp | ||
pe_section.cpp | ||
pe_resource_viewer.cpp | ||
pe_rebuilder.cpp | ||
pe_properties_generic.cpp | ||
pe_properties.cpp | ||
pe_load_config.cpp | ||
pe_directory.cpp | ||
pe_checksum.cpp | ||
pe_bound_import.cpp | ||
message_table.cpp | ||
file_version_info.cpp | ||
entropy.cpp | ||
Generating Code... | ||
pe_lib.vcxproj -> C:\Users\rmt01\Dropbox\WindowsBox\Kodning\Fusk\Mutation\Polychaos-master\build\Win32\Debug\pe_bliss.lib |
Binary file added
BIN
+403 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_load_config.obj
Binary file not shown.
Binary file added
BIN
+46.4 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_properties.obj
Binary file not shown.
Binary file added
BIN
+241 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_properties_generic.obj
Binary file not shown.
Binary file added
BIN
+137 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_rebuilder.obj
Binary file not shown.
Binary file added
BIN
+450 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_relocations.obj
Binary file not shown.
Binary file added
BIN
+409 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_resource_manager.obj
Binary file not shown.
Binary file added
BIN
+470 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_resource_viewer.obj
Binary file not shown.
Binary file added
BIN
+801 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_resources.obj
Binary file not shown.
Binary file added
BIN
+181 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_rich_data.obj
Binary file not shown.
Binary file added
BIN
+176 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_section.obj
Binary file not shown.
Binary file added
BIN
+479 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/pe_tls.obj
Binary file not shown.
Binary file added
BIN
+182 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_bitmap_reader.obj
Binary file not shown.
Binary file added
BIN
+182 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_bitmap_writer.obj
Binary file not shown.
Binary file added
BIN
+431 KB
...os/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_cursor_icon_reader.obj
Binary file not shown.
Binary file added
BIN
+477 KB
...os/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_cursor_icon_writer.obj
Binary file not shown.
Binary file added
BIN
+146 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_data_info.obj
Binary file not shown.
Binary file added
BIN
+521 KB
...s/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_message_list_reader.obj
Binary file not shown.
Binary file added
BIN
+552 KB
...s/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_string_table_reader.obj
Binary file not shown.
Binary file added
BIN
+1.21 MB
...s/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_version_info_reader.obj
Binary file not shown.
Binary file added
BIN
+394 KB
...s/contrib/portable-executable-library/pe_lib/Win32/Debug/resource_version_info_writer.obj
Binary file not shown.
Binary file added
BIN
+45.4 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/utils.obj
Binary file not shown.
Binary file added
BIN
+1.56 MB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/version_info_editor.obj
Binary file not shown.
Binary file added
BIN
+726 KB
Polychaos/contrib/portable-executable-library/pe_lib/Win32/Debug/version_info_viewer.obj
Binary file not shown.
90 changes: 90 additions & 0 deletions
90
Polychaos/contrib/portable-executable-library/pe_lib/entropy.cpp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,90 @@ | ||
#include <cmath> | ||
#include "entropy.h" | ||
#include "utils.h" | ||
|
||
namespace pe_bliss | ||
{ | ||
//Calculates entropy for PE image section | ||
double entropy_calculator::calculate_entropy(const section& s) | ||
{ | ||
if(s.get_raw_data().empty()) //Don't count entropy for empty sections | ||
throw pe_exception("Section is empty", pe_exception::section_is_empty); | ||
|
||
return calculate_entropy(s.get_raw_data().data(), s.get_raw_data().length()); | ||
} | ||
|
||
//Calculates entropy for istream (from current position of stream) | ||
double entropy_calculator::calculate_entropy(std::istream& file) | ||
{ | ||
uint32_t byte_count[256] = {0}; //Byte count for each of 255 bytes | ||
|
||
if(file.bad()) | ||
throw pe_exception("Stream is bad", pe_exception::stream_is_bad); | ||
|
||
std::streamoff pos = file.tellg(); | ||
|
||
std::streamoff length = pe_utils::get_file_size(file); | ||
length -= file.tellg(); | ||
|
||
if(!length) //Don't calculate entropy for empty buffers | ||
throw pe_exception("Data length is zero", pe_exception::data_is_empty); | ||
|
||
//Count bytes | ||
for(std::streamoff i = 0; i != length; ++i) | ||
++byte_count[static_cast<unsigned char>(file.get())]; | ||
|
||
file.seekg(pos); | ||
|
||
return calculate_entropy(byte_count, length); | ||
} | ||
|
||
//Calculates entropy for data block | ||
double entropy_calculator::calculate_entropy(const char* data, size_t length) | ||
{ | ||
uint32_t byte_count[256] = {0}; //Byte count for each of 255 bytes | ||
|
||
if(!length) //Don't calculate entropy for empty buffers | ||
throw pe_exception("Data length is zero", pe_exception::data_is_empty); | ||
|
||
//Count bytes | ||
for(size_t i = 0; i != length; ++i) | ||
++byte_count[static_cast<unsigned char>(data[i])]; | ||
|
||
return calculate_entropy(byte_count, length); | ||
} | ||
|
||
//Calculates entropy for this PE file (only section data) | ||
double entropy_calculator::calculate_entropy(const pe_base& pe) | ||
{ | ||
uint32_t byte_count[256] = {0}; //Byte count for each of 255 bytes | ||
|
||
size_t total_data_length = 0; | ||
|
||
//Count bytes for each section | ||
for(section_list::const_iterator it = pe.get_image_sections().begin(); it != pe.get_image_sections().end(); ++it) | ||
{ | ||
const std::string& data = (*it).get_raw_data(); | ||
size_t length = data.length(); | ||
total_data_length += length; | ||
for(size_t i = 0; i != length; ++i) | ||
++byte_count[static_cast<unsigned char>(data[i])]; | ||
} | ||
|
||
return calculate_entropy(byte_count, total_data_length); | ||
} | ||
|
||
//Calculates entropy from bytes count | ||
double entropy_calculator::calculate_entropy(const uint32_t byte_count[256], std::streamoff total_length) | ||
{ | ||
double entropy = 0.; //Entropy result value | ||
//Calculate entropy | ||
for(uint32_t i = 0; i < 256; ++i) | ||
{ | ||
double temp = static_cast<double>(byte_count[i]) / total_length; | ||
if(temp > 0.) | ||
entropy += std::abs(temp * (std::log(temp) * pe_utils::log_2)); | ||
} | ||
|
||
return entropy; | ||
} | ||
} |
30 changes: 30 additions & 0 deletions
30
Polychaos/contrib/portable-executable-library/pe_lib/entropy.h
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,30 @@ | ||
#pragma once | ||
#include <istream> | ||
#include "pe_base.h" | ||
|
||
namespace pe_bliss | ||
{ | ||
class entropy_calculator | ||
{ | ||
public: | ||
//Calculates entropy for PE image section | ||
static double calculate_entropy(const section& s); | ||
|
||
//Calculates entropy for istream (from current position of stream) | ||
static double calculate_entropy(std::istream& file); | ||
|
||
//Calculates entropy for data block | ||
static double calculate_entropy(const char* data, size_t length); | ||
|
||
//Calculates entropy for this PE file (only section data) | ||
static double calculate_entropy(const pe_base& pe); | ||
|
||
private: | ||
entropy_calculator(); | ||
entropy_calculator(const entropy_calculator&); | ||
entropy_calculator& operator=(const entropy_calculator&); | ||
|
||
//Calculates entropy from bytes count | ||
static double calculate_entropy(const uint32_t byte_count[256], std::streamoff total_length); | ||
}; | ||
} |
Oops, something went wrong.