`dissect.executable.pe.directory.resource`¶

Module Contents¶

Classes¶

`ResourceDirectory`	The resource directory of a PE file.
`Resource`	Higher level representation of a resource in a PE file.
`ResourceEntry`	Base class for resource entries in a PE file.
`ResourceDataEntry`	A resource data entry in a PE file.
`ResourceDirectoryEntry`	A resource directory entry in a PE file.

class dissect.executable.pe.directory.resource.ResourceDirectory(pe: dissect.executable.pe.pe.PE, address: int, size: int)¶

Bases: dissect.executable.pe.directory.base.DataDirectory

The resource directory of a PE file.

This class provides a higher-level interface to access resources in a PE file. If you wish to access the raw resource directory structure, you can traverse it with the tree attribute.

tree¶

__repr__() → str¶

__len__() → int¶

__iter__() → collections.abc.Iterator[Resource]¶

__getitem__(idx: int | str | dissect.executable.pe.c_pe.c_pe.RT) → list[Resource] | None¶

Get a resource by index or type.

Parameters:: idx – The index of the resource to get, which can be an integer, a string (resource type name), or a member of the c_pe.RT enum. Integers refer to the index in the resources list, while strings and enum members refer to the resource type.

__contains__(idx: str | dissect.executable.pe.c_pe.c_pe.RT) → bool¶

get(type: int | str | dissect.executable.pe.c_pe.c_pe.RT) → list[Resource] | None¶

Get all resources of a specific type.

Parameters:: type – The type of the resource (e.g. c_pe.RT.ICON). Integers can also be used to refer to resource types by their numeric value, or strings to refer to resource types by their name.

find(type: int | str | dissect.executable.pe.c_pe.c_pe.RT, name: str | int) → Resource | None¶

Find a specific resource by type and name.

Parameters:

type – The type of the resource (e.g. c_pe.RT.ICON). Integers can also be used to refer to resource types by their numeric value, or strings to refer to resource types by their name.
name – The name of the resource, which can be a string or an integer ID.

property resources: list[Resource]¶: Return a list of all resources.

property cursor: list[Resource] | None¶: Return a list of hardware-dependent cursor resources, if available.

property bitmap: list[Resource] | None¶: Return a list of bitmap resources, if available.

property icon: list[Resource] | None¶: Return a list of hardware-dependent icon resources, if available.

property menu: list[Resource] | None¶: Return a list of menu resources, if available.

property dialog: list[Resource] | None¶: Return a list of dialog box resources, if available.

property string: list[Resource] | None¶: Return a list of string table resources, if available.

string_table(language: str | int | None = None) → dict[int, str]¶

Return the parsed string table for a specific language.

Parameters:: language – The language of the string table to return. If None, the first available language is used.

property fontdir: list[Resource] | None¶: Return a list of font directory resources, if available.

property font: list[Resource] | None¶: Return a list of font resources, if available.

property accelerator: list[Resource] | None¶: Return a list of accelerator table resources, if available.

accelerator_table(language: str | int | None = None) → dict[int, str]¶

Return the parsed accelerator table for a specific language.

Parameters:: language – The language of the version information to return. If None, the first available language is used.

property rcdata: list[Resource] | None¶: Return a list of application-defined (raw data) resources, if available.

property message_table: list[Resource] | None¶: Return a list of message table resources, if available.

property group_cursor: list[Resource] | None¶: Return a list of hardware-independent group cursor resources, if available.

property group_icon: list[Resource] | None¶: Return a list of hardware-independent group icon resources, if available.

property version: list[Resource] | None¶: Return a list of version resources, if available.

vs_version_info(language: str | int | None = None) → dict | None¶

Return the parsed version information for a specific language.

Parameters:: language – The language of the version information to return. If None, the first available language is used.

property dialog_include: list[Resource] | None¶: Return a list of dialog include resources, if available.

property plug_and_play: list[Resource] | None¶: Return a list of plug and play resources, if available.

property vxd: list[Resource] | None¶: Return a list of VXD resources, if available.

property animated_cursor: list[Resource] | None¶: Return a list of animated cursor resources, if available.

property animated_icon: list[Resource] | None¶: Return a list of animated icon resources, if available.

property html: list[Resource] | None¶: Return a list of HTML resources, if available.

property manifest: list[Resource] | None¶: Return a list of side-by-side assembly manifest resources, if available.

class dissect.executable.pe.directory.resource.Resource(type: dissect.executable.pe.c_pe.c_pe.RT | str, name: str | int, entry: ResourceDirectoryEntry)¶

Higher level representation of a resource in a PE file.

This class provides a convenient interface to access resource data, abstracting away the details of the underlying resource directory structure.

Parameters:

type – The type of the resource (e.g. c_pe.RT.ICON).
name – The name of the resource, which can be a string or an integer ID.
entry – The resource directory entry that contains the resource data per language.

type¶

name¶

entry¶

__repr__() → str¶

__iter__() → collections.abc.Iterator[Resource]¶

__getitem__(idx: int | str) → ResourceDataEntry¶

Get a specific resource data entry by language.

Parameters:: idx – The index of the resource data entry, which can be an integer (LCID) or a string (language tag).

__contains__(idx: str | dissect.executable.pe.c_pe.c_pe.RT) → bool¶

languages() → list[str]¶: Return a list of languages for this resource.

data(language: str | int | None = None) → bytes¶

Get the resource data for a specific language.

Parameters:: language – The language of the resource to open. If None, the first available resource is opened.

open(language: str | int | None = None) → dissect.util.stream.RangeStream¶

Open the resource data as a stream.

Parameters:: language – The language of the resource to open. If None, the first available resource is opened.

class dissect.executable.pe.directory.resource.ResourceEntry(rsrc: ResourceDirectory, address: int)¶

Base class for resource entries in a PE file.

rsrc¶

address¶

property entry: dissect.executable.pe.c_pe.c_pe.IMAGE_RESOURCE_DATA_ENTRY¶

Abstractmethod:

class dissect.executable.pe.directory.resource.ResourceDataEntry(rsrc: ResourceDirectory, address: int)¶

Bases: ResourceEntry

A resource data entry in a PE file.

__repr__() → str¶

property entry: dissect.executable.pe.c_pe.c_pe.IMAGE_RESOURCE_DATA_ENTRY¶: The resource data entry structure.

property offset_to_data: int¶: The offset to the resource data in the file.

property size: int¶: The size of the resource data.

property code_page: int¶: The code page of the resource data.

property data: bytes¶: The raw resource data.

open() → dissect.util.stream.RangeStream¶: Open the resource data as a stream.

class dissect.executable.pe.directory.resource.ResourceDirectoryEntry(rsrc: ResourceDirectory, address: int)¶

Bases: ResourceEntry

A resource directory entry in a PE file.

__repr__() → str¶

property entry: dissect.executable.pe.c_pe.c_pe.IMAGE_RESOURCE_DIRECTORY¶: The resource directory entry structure.

property timestamp: datetime.datetime | None¶: The timestamp of this resource directory, or None if the PE file is compiled as reproducible.

get(name: int | str | dissect.executable.pe.c_pe.c_pe.RT) → ResourceDataEntry | ResourceDirectoryEntry | None¶: Get a resource entry by name.

listdir() → dict[int | str, ResourceEntry]¶: Return a dictionary of the entries in this resource directory.

iterdir() → collections.abc.Iterator[tuple[int | str, ResourceDataEntry | ResourceDirectoryEntry]]¶: Iterate over the entries in this resource directory.

dissect.executable.pe.directory.resource¶

Module Contents¶

Classes¶

`dissect.executable.pe.directory.resource`¶