-
Notifications
You must be signed in to change notification settings - Fork 12
/
generator.py
executable file
·86 lines (63 loc) · 2.05 KB
/
generator.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
import os
import sys
import ntpath
import pefile
def getDLLsinFolder(folder):
dlls = []
try:
path = os.walk(folder)
for root, directories, files in path:
#for directory in directories:
# print(directory)
for f in files:
if f[-4:].lower() == '.dll':
dlls.append(os.path.join(folder, f))
except:
pass
return dlls
def getExports(f):
exports = []
try:
pe = pefile.PE(f, fast_load=True)
pe.parse_data_directories()
if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
if exp.name:
#exports.append(exp.name.decode('ascii'))
exports.append(exp.name.decode('utf-8'))
except pefile.PEFormatError:
print(f + ' is apparently not a PE file. SKIPPED')
except FileNotFoundError:
print(f + ' is not found. SKIPPED')
return exports
def getFileName(path):
head, tail = ntpath.split(path)
return tail or ntpath.basename(head)
def createFolder(f):
try:
os.makedirs(f)
except FileExistsError:
pass
def doFolder(folder, outFolder):
createFolder(outFolder)
dlls = getDLLsinFolder(folder)
for dll in dlls:
fileName = getFileName(dll)
print(dll)
exports = getExports(dll)
if len(exports) > 0:
f = open(os.path.join(outFolder, fileName + '.cpp'), 'w')
defF = open(os.path.join(outFolder, fileName + '.def'), 'w')
defF.write('EXPORTS' + '\n')
for export in exports:
line = '#pragma comment(linker, "/export:' + export + '=\\"' + dll.replace('\\', '\\\\')[:-3] + export + '\\"")'
f.write(line + '\n')
defLine = ' ' + export + '="' + dll[:-4] + '".' + export
defF.write(defLine + '\n')
f.close()
defF.close()
if __name__ == "__main__":
parentFolder = 'win10.19044'
createFolder(parentFolder)
doFolder('C:\\Windows\\SysWOW64', os.path.join(parentFolder, 'SysWOW64'))
doFolder('C:\\Windows\\System32', os.path.join(parentFolder, 'System32'))