:py:mod:`dissect.executable.pe.directory.resource` ================================================== .. py:module:: dissect.executable.pe.directory.resource Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.executable.pe.directory.resource.ResourceDirectory dissect.executable.pe.directory.resource.Resource dissect.executable.pe.directory.resource.ResourceEntry dissect.executable.pe.directory.resource.ResourceDataEntry dissect.executable.pe.directory.resource.ResourceDirectoryEntry .. py:class:: ResourceDirectory(pe: dissect.executable.pe.pe.PE, address: int, size: int) Bases: :py:obj:`dissect.executable.pe.directory.base.DataDirectory` The resource directory of a PE file. This class provides a higher-level interface to access resources in a PE file. If you wish to access the raw resource directory structure, you can traverse it with the ``tree`` attribute. .. py:attribute:: tree .. py:method:: __repr__() -> str .. py:method:: __len__() -> int .. py:method:: __iter__() -> collections.abc.Iterator[Resource] .. py:method:: __getitem__(idx: int | str | dissect.executable.pe.c_pe.c_pe.RT) -> list[Resource] | None Get a resource by index or type. :param idx: The index of the resource to get, which can be an integer, a string (resource type name), or a member of the ``c_pe.RT`` enum. Integers refer to the index in the resources list, while strings and enum members refer to the resource type. .. py:method:: __contains__(idx: str | dissect.executable.pe.c_pe.c_pe.RT) -> bool .. py:method:: get(type: int | str | dissect.executable.pe.c_pe.c_pe.RT) -> list[Resource] | None Get all resources of a specific type. :param type: The type of the resource (e.g. ``c_pe.RT.ICON``). Integers can also be used to refer to resource types by their numeric value, or strings to refer to resource types by their name. .. py:method:: find(type: int | str | dissect.executable.pe.c_pe.c_pe.RT, name: str | int) -> Resource | None Find a specific resource by type and name. :param type: The type of the resource (e.g. ``c_pe.RT.ICON``). Integers can also be used to refer to resource types by their numeric value, or strings to refer to resource types by their name. :param name: The name of the resource, which can be a string or an integer ID. .. py:property:: resources :type: list[Resource] Return a list of all resources. .. py:property:: cursor :type: list[Resource] | None Return a list of hardware-dependent cursor resources, if available. .. py:property:: bitmap :type: list[Resource] | None Return a list of bitmap resources, if available. .. py:property:: icon :type: list[Resource] | None Return a list of hardware-dependent icon resources, if available. .. py:property:: menu :type: list[Resource] | None Return a list of menu resources, if available. .. py:property:: dialog :type: list[Resource] | None Return a list of dialog box resources, if available. .. py:property:: string :type: list[Resource] | None Return a list of string table resources, if available. .. py:method:: string_table(language: str | int | None = None) -> dict[int, str] Return the parsed string table for a specific language. :param language: The language of the string table to return. If ``None``, the first available language is used. .. py:property:: fontdir :type: list[Resource] | None Return a list of font directory resources, if available. .. py:property:: font :type: list[Resource] | None Return a list of font resources, if available. .. py:property:: accelerator :type: list[Resource] | None Return a list of accelerator table resources, if available. .. py:method:: accelerator_table(language: str | int | None = None) -> dict[int, str] Return the parsed accelerator table for a specific language. :param language: The language of the version information to return. If ``None``, the first available language is used. .. py:property:: rcdata :type: list[Resource] | None Return a list of application-defined (raw data) resources, if available. .. py:property:: message_table :type: list[Resource] | None Return a list of message table resources, if available. .. py:property:: group_cursor :type: list[Resource] | None Return a list of hardware-independent group cursor resources, if available. .. py:property:: group_icon :type: list[Resource] | None Return a list of hardware-independent group icon resources, if available. .. py:property:: version :type: list[Resource] | None Return a list of version resources, if available. .. py:method:: vs_version_info(language: str | int | None = None) -> dict | None Return the parsed version information for a specific language. :param language: The language of the version information to return. If ``None``, the first available language is used. .. py:property:: dialog_include :type: list[Resource] | None Return a list of dialog include resources, if available. .. py:property:: plug_and_play :type: list[Resource] | None Return a list of plug and play resources, if available. .. py:property:: vxd :type: list[Resource] | None Return a list of VXD resources, if available. .. py:property:: animated_cursor :type: list[Resource] | None Return a list of animated cursor resources, if available. .. py:property:: animated_icon :type: list[Resource] | None Return a list of animated icon resources, if available. .. py:property:: html :type: list[Resource] | None Return a list of HTML resources, if available. .. py:property:: manifest :type: list[Resource] | None Return a list of side-by-side assembly manifest resources, if available. .. py:class:: Resource(type: dissect.executable.pe.c_pe.c_pe.RT | str, name: str | int, entry: ResourceDirectoryEntry) Higher level representation of a resource in a PE file. This class provides a convenient interface to access resource data, abstracting away the details of the underlying resource directory structure. :param type: The type of the resource (e.g. ``c_pe.RT.ICON``). :param name: The name of the resource, which can be a string or an integer ID. :param entry: The resource directory entry that contains the resource data per language. .. py:attribute:: type .. py:attribute:: name .. py:attribute:: entry .. py:method:: __repr__() -> str .. py:method:: __iter__() -> collections.abc.Iterator[Resource] .. py:method:: __getitem__(idx: int | str) -> ResourceDataEntry Get a specific resource data entry by language. :param idx: The index of the resource data entry, which can be an integer (LCID) or a string (language tag). .. py:method:: __contains__(idx: str | dissect.executable.pe.c_pe.c_pe.RT) -> bool .. py:method:: languages() -> list[str] Return a list of languages for this resource. .. py:method:: data(language: str | int | None = None) -> bytes Get the resource data for a specific language. :param language: The language of the resource to open. If ``None``, the first available resource is opened. .. py:method:: open(language: str | int | None = None) -> dissect.util.stream.RangeStream Open the resource data as a stream. :param language: The language of the resource to open. If ``None``, the first available resource is opened. .. py:class:: ResourceEntry(rsrc: ResourceDirectory, address: int) Base class for resource entries in a PE file. .. py:attribute:: rsrc .. py:attribute:: address .. py:property:: entry :type: dissect.executable.pe.c_pe.c_pe.IMAGE_RESOURCE_DATA_ENTRY :abstractmethod: .. py:class:: ResourceDataEntry(rsrc: ResourceDirectory, address: int) Bases: :py:obj:`ResourceEntry` A resource data entry in a PE file. .. py:method:: __repr__() -> str .. py:property:: entry :type: dissect.executable.pe.c_pe.c_pe.IMAGE_RESOURCE_DATA_ENTRY The resource data entry structure. .. py:property:: offset_to_data :type: int The offset to the resource data in the file. .. py:property:: size :type: int The size of the resource data. .. py:property:: code_page :type: int The code page of the resource data. .. py:property:: data :type: bytes The raw resource data. .. py:method:: open() -> dissect.util.stream.RangeStream Open the resource data as a stream. .. py:class:: ResourceDirectoryEntry(rsrc: ResourceDirectory, address: int) Bases: :py:obj:`ResourceEntry` A resource directory entry in a PE file. .. py:method:: __repr__() -> str .. py:property:: entry :type: dissect.executable.pe.c_pe.c_pe.IMAGE_RESOURCE_DIRECTORY The resource directory entry structure. .. py:property:: timestamp :type: datetime.datetime | None The timestamp of this resource directory, or ``None`` if the PE file is compiled as reproducible. .. py:method:: get(name: int | str | dissect.executable.pe.c_pe.c_pe.RT) -> ResourceDataEntry | ResourceDirectoryEntry | None Get a resource entry by name. .. py:method:: listdir() -> dict[int | str, ResourceEntry] Return a dictionary of the entries in this resource directory. .. py:method:: iterdir() -> collections.abc.Iterator[tuple[int | str, ResourceDataEntry | ResourceDirectoryEntry]] Iterate over the entries in this resource directory.