New Executable

from hachoir.field import (FieldSet, Bit, UInt8, UInt16, UInt32, Bytes, PaddingBits, PaddingBytes, NullBits, NullBytes) from hachoir.core.text handler import textHandler, hexadecimal, filesizeHandler class NE Header(FieldSet): static size = 64 8 def createFields(self): yield Bytes(self, "signature", 2, "New executable signature (NE)") yield UInt8(self, "link ver", "Linker version number") yield UInt8(self, "link rev", "Linker revision number") yield UInt16(self, "entry table ofst", "Offset to the entry table") yield UInt16(self, "entry table size", "Length (in bytes) of the entry table") yield PaddingBytes(self, "reserved[]", 4) yield Bit(self, "is dll", "Is a dynamic-link library (DLL)?") yield Bit(self, "is win app", "Is a Windows application?") yield PaddingBits(self, "reserved[]", 9) yield Bit(self, "first seg code", "First segment contains code that loads the application?") yield NullBits(self, "reserved[]", 1) yield Bit(self, "link error", "Load even if linker detects errors?") yield NullBits(self, "reserved[]", 1) yield Bit(self, "is lib", "Is a library module?") yield UInt16(self, "auto data seg", "Automatic data segment number") yield filesizeHandler(UInt16(self, "local heap size", "Initial size (in bytes) of the local heap")) yield filesizeHandler(UInt16(self, "stack size", "Initial size (in bytes) of the stack")) yield textHandler(UInt32(self, "cs ip", "Value of CS:IP"), hexadecimal) yield textHandler(UInt32(self, "ss sp", "Value of SS:SP"), hexadecimal) yield UInt16(self, "nb entry seg tab", "Number of entries in the segment table") yield UInt16(self, "nb entry modref tab", "Number of entries in the module-reference table") yield filesizeHandler(UInt16(self, "size nonres name tab", "Number of bytes in the nonresident-name table")) yield UInt16(self, "seg tab ofs", "Segment table offset") yield UInt16(self, "rsrc ofs", "Resource offset") yield UInt16(self, "res name tab ofs", "Resident-name table offset") yield UInt16(self, "mod ref tab ofs", "Module-reference table offset") yield UInt16(self, "import tab ofs", "Imported-name table offset") yield UInt32(self, "non res name tab ofs", "Nonresident-name table offset") yield UInt16(self, "nb mov ent pt", "Number of movable entry points") yield UInt16(self, "log2 sector size", "Log2 of the segment sector size") yield UInt16(self, "nb rsrc seg", "Number of resource segments") yield Bit(self, "unknown os format", "Operating system format is unknown") yield PaddingBits(self, "reserved[]", 1) yield Bit(self, "os windows", "Operating system is Microsoft Windows") yield NullBits(self, "reserved[]", 6) yield Bit(self, "is win20 prot", "Is Windows 2.x application running in version 3.x protected mode") yield Bit(self, "is win20 font", "Is Windows 2.x application supporting proportional fonts") yield Bit(self, "fast load", "Contains a fast-load area?") yield NullBits(self, "reserved[]", 4) yield UInt16(self, "fastload ofs", "Fast-load area offset (in sector)") yield UInt16(self, "fastload size", "Fast-load area length (in sector)") yield NullBytes(self, "reserved[]", 2) yield textHandler(UInt16(self, "win version", "Expected Windows version number"), hexadecimal)