dissect.executable.pe.directory.debug

Module Contents

Classes

DebugDirectory

The debug directory of a PE file.

DebugEntry

A single debug entry in the debug directory.

CodeViewDebugEntry

A CodeView debug entry.

VcFeatureDebugEntry

A VC feature debug entry.

PogoDebugEntry

A POGO debug entry.

ReproDebugEntry

A Repro debug entry.
class dissect.executable.pe.directory.debug.DebugDirectory(pe: dissect.executable.pe.pe.PE, address: int, size: int)

Bases: dissect.executable.pe.directory.base.DataDirectory

The debug directory of a PE file.

__repr__() → str
__len__() → int
__iter__() → collections.abc.Iterator[DebugEntry]
__getitem__(idx: int) → DebugEntry
property entries: list[DebugEntry]

List of debug entries in the debug directory.

class dissect.executable.pe.directory.debug.DebugEntry(pe: dissect.executable.pe.pe.PE, entry: dissect.executable.pe.c_pe.c_pe.IMAGE_DEBUG_DIRECTORY)

A single debug entry in the debug directory.

pe
entry
__repr__() → str
property timestamp: datetime.datetime | None

The timestamp of this debug entry, or None if the PE file is compiled as reproducible.

property type: dissect.executable.pe.c_pe.c_pe.IMAGE_DEBUG_TYPE

The type of the debug entry.

property size: int

The size of the debug entry.

property data: bytes

The data of the debug entry.

open() → BinaryIO

Return a file-like object to read the debug entry data.

class dissect.executable.pe.directory.debug.CodeViewDebugEntry(pe: dissect.executable.pe.pe.PE, entry: dissect.executable.pe.c_pe.c_pe.IMAGE_DEBUG_DIRECTORY)

Bases: DebugEntry

A CodeView debug entry.

__repr__() → str
property info: dissect.executable.pe.c_pe.c_pe.CV_INFO_PDB20 | dissect.executable.pe.c_pe.c_pe.CV_INFO_PDB70 | dissect.executable.pe.c_pe.c_pe.CV_INFO_MTOC

The CodeView debug information.

property signature: uuid.UUID | int | None

The signature of the CodeView debug entry.

property age: int | None

The age of the CodeView debug entry.

property pdb: str

The PDB filename of the CodeView debug entry.

class dissect.executable.pe.directory.debug.VcFeatureDebugEntry(pe: dissect.executable.pe.pe.PE, entry: dissect.executable.pe.c_pe.c_pe.IMAGE_DEBUG_DIRECTORY)

Bases: DebugEntry

A VC feature debug entry.

__repr__() → str
property info: dissect.executable.pe.c_pe.c_pe.VC_FEATURE

The VC feature debug information.

property pre_vc11: int

Return the count for Pre-VC++ 11.00.

property ccpp: int

Return the count for C/C++.

property gs: int

Return the count for /GS (number of guard stack).

property sdl: int

Return the count for /sdl (Security Development Lifecycle).

property guards: int

Return the count for /guardN.

class dissect.executable.pe.directory.debug.PogoDebugEntry(pe: dissect.executable.pe.pe.PE, entry: dissect.executable.pe.c_pe.c_pe.IMAGE_DEBUG_DIRECTORY)

Bases: DebugEntry

A POGO debug entry.

__repr__() → str
__len__() → int
__iter__() → collections.abc.Iterator[tuple[int, int, str]]
__getitem__(idx: int) → tuple[int, int, str]
property entries: list[tuple[int, int, str]]

The POGO debug entries.

class dissect.executable.pe.directory.debug.ReproDebugEntry(pe: dissect.executable.pe.pe.PE, entry: dissect.executable.pe.c_pe.c_pe.IMAGE_DEBUG_DIRECTORY)

Bases: DebugEntry

A Repro debug entry.

__repr__() → str
property hash: bytes

The hash of the Repro debug entry.