Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- import ctypes
- from ctypes import Structure, windll, byref, POINTER, sizeof
- from ctypes.wintypes import DWORD, HANDLE, LPVOID, LPWSTR, ULONG
- # --- Structure Definitions ---
- class MIB_TCPROW_OWNER_PID(Structure):
- _fields_ = [
- ("dwState", DWORD),
- ("dwLocalAddr", DWORD),
- ("dwLocalPort", DWORD),
- ("dwRemoteAddr", DWORD),
- ("dwRemotePort", DWORD),
- ("dwOwningPid", DWORD),
- ]
- class MIB_UDPROW_OWNER_PID(Structure):
- _fields_ = [
- ("dwLocalAddr", DWORD),
- ("dwLocalPort", DWORD),
- ("dwOwningPid", DWORD),
- ]
- class IMAGE_DOS_HEADER(Structure):
- _fields_ = [
- ("e_magic", ctypes.c_uint16),
- ("e_cblp", ctypes.c_uint16),
- ("e_cp", ctypes.c_uint16),
- ("e_lfanew", DWORD),
- ]
- class IMAGE_DATA_DIRECTORY(Structure):
- _fields_ = [
- ("VirtualAddress", ctypes.c_uint32),
- ("Size", ctypes.c_uint32),
- ]
- class IMAGE_OPTIONAL_HEADER(Structure):
- _fields_ = [
- ("Magic", ctypes.c_uint16),
- ("AddressOfEntryPoint", ctypes.c_uint32),
- ("DataDirectory", IMAGE_DATA_DIRECTORY * 16),
- ]
- class IMAGE_NT_HEADERS(Structure):
- _fields_ = [
- ("Signature", ctypes.c_uint32),
- ("FileHeader", ctypes.c_uint32),
- ("OptionalHeader", POINTER(IMAGE_OPTIONAL_HEADER)),
- ]
- # --- Example: Open a file and read IMAGE_DOS_HEADER ---
- def read_dos_header(path):
- with open(path, 'rb') as f:
- dos_header = IMAGE_DOS_HEADER()
- f.readinto(dos_header)
- print(f'DOS Magic: {hex(dos_header.e_magic)}')
- print(f'DOS LFA New: {hex(dos_header.e_lfanew)}')
- # --- Example Usage (for a PE file, like notepad.exe) ---
- if __name__ == "__main__":
- exe_path = r"C:\Windows\System32\notepad.exe" # Adjust if needed
- try:
- read_dos_header(exe_path)
- except Exception as e:
- print("Error:", e)
Advertisement
Add Comment
Please, Sign In to add comment