Custom Column script to parse PE files

[fernandom]

Hi folks,

New XYplorer user here. First of all, thanks for this great tool! <3

I'm trying to create a custom column script that shows some information about PE files. Here's my code:

Code: Select all

$mz = readfile(<cc_item>, , 2);

if $mz != "MZ" {
    return "Not MZ";
}

//readfile(filename, [mode], [numbytes], [codepage], [start=1])
$lfanew = readfile(<cc_item>, , 4, , 0x3c + 1);
$pesig_ofs = "";

// Loop through the data previously read
for ($i=0; $i < 4; $i++) {
    $byte = substr($lfanew, $i, 1);
    $val = asc($byte);
    $pesig_ofs = hex($val, 2) . $pesig_ofs;
}

return $pesig_ofs;

My final goal is to show more information about the PE file (architecture, compilation timestamp, etc), but at this point I'm just trying to return the 4-byte offset of the PE signature that's stored at offset 0x3C of a PE file. For a PE file with the value 0x80 (80 00 00 00) at offset 0x3C, hex() returns 0xAC to me:

xy.png (85.36 KiB) Viewed 2389 times

I believe this has something to do with the fact hex() operates on signed integers only (according to the documentation). I tried to implement my own (unsigned) hex2dec() function, but I found no way to perform bitwise operations either. Is there a workaround to this problem? I'm probably missing something obvious...

Thanks in advance!

[jupe]

Try using "r" mode of readfile.

[fernandom]

Thanks, @jupe. This kind of worked, but readfile() now returns a string of 2 characters, even though I've asked it to read 4 bytes. I think it's creating a string of wide characters? Wouldn't that be the expected behavior for the "ru" mode instead?

Code: Select all

$lfanew = readfile(<cc_item>, "r", 4, , 0x3c + 1);
$pesig_ofs = "";

// Loop through the data previously read
for ($i=0; $i < 4; $i++) {
    $byte = substr($lfanew, $i, 1);
    $val = asc($byte);
    $pesig_ofs = hex($val, 2) . $pesig_ofs;
}

// return strlen($pedig_ofs); // returns 2

return $pesig_ofs; // returns 0080 (expected 00000080)

EDIT: It worked with the "ru" mode. I am bit confused, but will proceed for now.