-
Notifications
You must be signed in to change notification settings - Fork 0
/
find_exe_or_pdb.py
72 lines (55 loc) · 2.46 KB
/
find_exe_or_pdb.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
#!/usr/bin/python
import sys,os,os.path,argparse,fnmatch,stat
import pdb_info
import pe_header
##########################################################################
##########################################################################
g_verbose=False
def pv(x):
if g_verbose:
sys.stdout.write(x)
sys.stdout.flush()
##########################################################################
##########################################################################
def main2(options):
global g_verbose
g_verbose=options.verbose
# pdb_info.set_verbose(options.verbose)
if options.timestamp is None:
print>>sys.stderr,'FATAL: must specify something to search by'
sys.exit(1)
def check_pdb(path):
try:
st=os.stat(path)
if st.st_size==0: return False
header=pdb_info.get_pdb_header(path)
pv('%08x : %s\n'%(header.Signature,path))
return header.Signature==options.timestamp
except pdb_info.PDBError,e: print>>sys.stderr,'WARNING: %s: %s'%(e.pdb_path,e.pdb_message)
except Error,e: print>>sys.stderr,'WARNING: %s: %s'%(path,e.message)
return False
def check_exe(path):
timestamp=pe_header.get_pe_timestamp(path)
pv('%08x : %s\n'%(timestamp,path))
return timestamp==options.timestamp
for path in options.paths:
for dirpath,dirnames,filenames in os.walk(path):
for filename in filenames:
ext=os.path.splitext(os.path.normcase(filename))[1]
if ext=='.exe': pred=check_exe
elif ext=='.pdb': pred=check_pdb
else: pred=None
if pred is not None:
# pv('%s\n'%path)
path=os.path.join(dirpath,filename)
if pred(path): print path
##########################################################################
##########################################################################
def auto_int(x): return int(x,0)
def main(argv):
parser=argparse.ArgumentParser()
parser.add_argument('-v','--verbose',action='store_true',help='be more verbose')
parser.add_argument('-t','--timestamp',metavar='TIMESTAMP',type=auto_int,help='search by timestamp')
parser.add_argument('paths',nargs='+',metavar='FOLDER',help='look for EXEs/PDBs in %(metavar)s')
main2(parser.parse_args(argv))
if __name__=='__main__': main(sys.argv[1:])