Add the symbol and source server scripts.

tools/symsrc/pefile.py

+# -*- coding: Latin-1 -*-
+"""pefile, Portable Executable reader module
+
+
+All the PE file basic structures are available with their default names
+as attributes of the instance returned.
+
+Processed elements such as the import table are made available with lowercase
+names, to differentiate them from the upper case basic structure names.
+
+pefile has been tested against the limits of valid PE headers, that is, malware.
+Lots of packed malware attempt to abuse the format way beyond its standard use.
+To the best of my knowledge most of the abuses are handled gracefully.
+
+Copyright (c) 2005, 2006, 2007, 2008 Ero Carrera <ero@dkbza.org>
+
+All rights reserved.
+
+For detailed copyright information see the file COPYING in
+the root of the distribution archive.
+"""
+
+__author__ = 'Ero Carrera'
+__version__ = '1.2.9.1'
+__contact__ = 'ero@dkbza.org'
+
+
+import os
+import struct
+import time
+import math
+import re
+import exceptions
+import string
+import array
+
+sha1, sha256, sha512, md5 = None, None, None, None
+
+try:
+    import hashlib
+    sha1 = hashlib.sha1
+    sha256 = hashlib.sha256
+    sha512 = hashlib.sha512
+    md5 = hashlib.md5
+except ImportError:    
+    try:
+        import sha
+        sha1 = sha.new
+    except ImportError:
+        pass
+    try:
+        import md5
+        md5 = md5.new
+    except ImportError:
+        pass
+
+
+fast_load = False
+
+IMAGE_DOS_SIGNATURE             = 0x5A4D
+IMAGE_OS2_SIGNATURE             = 0x454E
+IMAGE_OS2_SIGNATURE_LE          = 0x454C
+IMAGE_VXD_SIGNATURE             = 0x454C
+IMAGE_NT_SIGNATURE              = 0x00004550
+IMAGE_NUMBEROF_DIRECTORY_ENTRIES= 16
+IMAGE_ORDINAL_FLAG              = 0x80000000L
+IMAGE_ORDINAL_FLAG64            = 0x8000000000000000L
+OPTIONAL_HEADER_MAGIC_PE        = 0x10b
+OPTIONAL_HEADER_MAGIC_PE_PLUS   = 0x20b
+
+
+directory_entry_types = [
+    ('IMAGE_DIRECTORY_ENTRY_EXPORT',        0),
+    ('IMAGE_DIRECTORY_ENTRY_IMPORT',        1),
+    ('IMAGE_DIRECTORY_ENTRY_RESOURCE',      2),
+    ('IMAGE_DIRECTORY_ENTRY_EXCEPTION',     3),
+    ('IMAGE_DIRECTORY_ENTRY_SECURITY',      4),
+    ('IMAGE_DIRECTORY_ENTRY_BASERELOC',     5),
+    ('IMAGE_DIRECTORY_ENTRY_DEBUG',         6),
+    ('IMAGE_DIRECTORY_ENTRY_COPYRIGHT',     7),
+    ('IMAGE_DIRECTORY_ENTRY_GLOBALPTR',     8),
+    ('IMAGE_DIRECTORY_ENTRY_TLS',           9),
+    ('IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG',   10),
+    ('IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT',  11),
+    ('IMAGE_DIRECTORY_ENTRY_IAT',           12),
+    ('IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT',  13),
+    ('IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR',14),
+    ('IMAGE_DIRECTORY_ENTRY_RESERVED',      15) ]
+
+DIRECTORY_ENTRY = dict([(e[1], e[0]) for e in directory_entry_types]+directory_entry_types)
+ 
+
+image_characteristics = [
+    ('IMAGE_FILE_RELOCS_STRIPPED',          0x0001),
+    ('IMAGE_FILE_EXECUTABLE_IMAGE',         0x0002),
+    ('IMAGE_FILE_LINE_NUMS_STRIPPED',       0x0004),
+    ('IMAGE_FILE_LOCAL_SYMS_STRIPPED',      0x0008),
+    ('IMAGE_FILE_AGGRESIVE_WS_TRIM',        0x0010),
+    ('IMAGE_FILE_LARGE_ADDRESS_AWARE',      0x0020),
+    ('IMAGE_FILE_16BIT_MACHINE',            0x0040),
+    ('IMAGE_FILE_BYTES_REVERSED_LO',        0x0080),
+    ('IMAGE_FILE_32BIT_MACHINE',            0x0100),
+    ('IMAGE_FILE_DEBUG_STRIPPED',           0x0200),
+    ('IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP',  0x0400),
+    ('IMAGE_FILE_NET_RUN_FROM_SWAP',        0x0800),
+    ('IMAGE_FILE_SYSTEM',                   0x1000),
+    ('IMAGE_FILE_DLL',                      0x2000),
+    ('IMAGE_FILE_UP_SYSTEM_ONLY',           0x4000),
+    ('IMAGE_FILE_BYTES_REVERSED_HI',        0x8000) ]
+
+IMAGE_CHARACTERISTICS = dict([(e[1], e[0]) for e in
+    image_characteristics]+image_characteristics)
+
+    
+section_characteristics = [
+    ('IMAGE_SCN_CNT_CODE',                  0x00000020),
+    ('IMAGE_SCN_CNT_INITIALIZED_DATA',      0x00000040),
+    ('IMAGE_SCN_CNT_UNINITIALIZED_DATA',    0x00000080),
+    ('IMAGE_SCN_LNK_OTHER',                 0x00000100),
+    ('IMAGE_SCN_LNK_INFO',                  0x00000200),
+    ('IMAGE_SCN_LNK_REMOVE',                0x00000800),
+    ('IMAGE_SCN_LNK_COMDAT',                0x00001000),
+    ('IMAGE_SCN_MEM_FARDATA',               0x00008000),
+    ('IMAGE_SCN_MEM_PURGEABLE',             0x00020000),
+    ('IMAGE_SCN_MEM_16BIT',                 0x00020000),
+    ('IMAGE_SCN_MEM_LOCKED',                0x00040000),
+    ('IMAGE_SCN_MEM_PRELOAD',               0x00080000),
+    ('IMAGE_SCN_ALIGN_1BYTES',              0x00100000),
+    ('IMAGE_SCN_ALIGN_2BYTES',              0x00200000),
+    ('IMAGE_SCN_ALIGN_4BYTES',              0x00300000),
+    ('IMAGE_SCN_ALIGN_8BYTES',              0x00400000),
+    ('IMAGE_SCN_ALIGN_16BYTES',             0x00500000),
+    ('IMAGE_SCN_ALIGN_32BYTES',             0x00600000),
+    ('IMAGE_SCN_ALIGN_64BYTES',             0x00700000),
+    ('IMAGE_SCN_ALIGN_128BYTES',            0x00800000),
+    ('IMAGE_SCN_ALIGN_256BYTES',            0x00900000),
+    ('IMAGE_SCN_ALIGN_512BYTES',            0x00A00000),
+    ('IMAGE_SCN_ALIGN_1024BYTES',           0x00B00000),
+    ('IMAGE_SCN_ALIGN_2048BYTES',           0x00C00000),
+    ('IMAGE_SCN_ALIGN_4096BYTES',           0x00D00000),
+    ('IMAGE_SCN_ALIGN_8192BYTES',           0x00E00000),
+    ('IMAGE_SCN_ALIGN_MASK',                0x00F00000),
+    ('IMAGE_SCN_LNK_NRELOC_OVFL',           0x01000000),
+    ('IMAGE_SCN_MEM_DISCARDABLE',           0x02000000),
+    ('IMAGE_SCN_MEM_NOT_CACHED',            0x04000000),
+    ('IMAGE_SCN_MEM_NOT_PAGED',             0x08000000),
+    ('IMAGE_SCN_MEM_SHARED',                0x10000000),
+    ('IMAGE_SCN_MEM_EXECUTE',               0x20000000),
+    ('IMAGE_SCN_MEM_READ',                  0x40000000),
+    ('IMAGE_SCN_MEM_WRITE',                 0x80000000L) ]
+ 
+SECTION_CHARACTERISTICS = dict([(e[1], e[0]) for e in
+    section_characteristics]+section_characteristics)
+
+
+debug_types = [
+    ('IMAGE_DEBUG_TYPE_UNKNOWN',        0),
+    ('IMAGE_DEBUG_TYPE_COFF',           1),
+    ('IMAGE_DEBUG_TYPE_CODEVIEW',       2),
+    ('IMAGE_DEBUG_TYPE_FPO',            3),
+    ('IMAGE_DEBUG_TYPE_MISC',           4),
+    ('IMAGE_DEBUG_TYPE_EXCEPTION',      5),
+    ('IMAGE_DEBUG_TYPE_FIXUP',          6),
+    ('IMAGE_DEBUG_TYPE_OMAP_TO_SRC',    7),
+    ('IMAGE_DEBUG_TYPE_OMAP_FROM_SRC',  8),
+    ('IMAGE_DEBUG_TYPE_BORLAND',        9),
+    ('IMAGE_DEBUG_TYPE_RESERVED10',     10) ]
+
+DEBUG_TYPE = dict([(e[1], e[0]) for e in debug_types]+debug_types)
+
+
+subsystem_types = [
+    ('IMAGE_SUBSYSTEM_UNKNOWN',     0),
+    ('IMAGE_SUBSYSTEM_NATIVE',      1),
+    ('IMAGE_SUBSYSTEM_WINDOWS_GUI', 2),
+    ('IMAGE_SUBSYSTEM_WINDOWS_CUI', 3),
+    ('IMAGE_SUBSYSTEM_OS2_CUI',     5),
+    ('IMAGE_SUBSYSTEM_POSIX_CUI',   7),
+    ('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI',  9),
+    ('IMAGE_SUBSYSTEM_EFI_APPLICATION', 10),
+    ('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', 11),
+    ('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER',      12),
+    ('IMAGE_SUBSYSTEM_EFI_ROM',     13),
+    ('IMAGE_SUBSYSTEM_XBOX',        14)]
+
+SUBSYSTEM_TYPE = dict([(e[1], e[0]) for e in subsystem_types]+subsystem_types)
+
+
+machine_types = [
+    ('IMAGE_FILE_MACHINE_UNKNOWN',  0),
+    ('IMAGE_FILE_MACHINE_AM33',     0x1d3),
+    ('IMAGE_FILE_MACHINE_AMD64',    0x8664),
+    ('IMAGE_FILE_MACHINE_ARM',      0x1c0),
+    ('IMAGE_FILE_MACHINE_EBC',      0xebc),
+    ('IMAGE_FILE_MACHINE_I386',     0x14c),
+    ('IMAGE_FILE_MACHINE_IA64',     0x200),
+    ('IMAGE_FILE_MACHINE_MR32',     0x9041),
+    ('IMAGE_FILE_MACHINE_MIPS16',   0x266),
+    ('IMAGE_FILE_MACHINE_MIPSFPU',  0x366),
+    ('IMAGE_FILE_MACHINE_MIPSFPU16',0x466),
+    ('IMAGE_FILE_MACHINE_POWERPC',  0x1f0),
+    ('IMAGE_FILE_MACHINE_POWERPCFP',0x1f1),
+    ('IMAGE_FILE_MACHINE_R4000',    0x166),
+    ('IMAGE_FILE_MACHINE_SH3',      0x1a2),
+    ('IMAGE_FILE_MACHINE_SH3DSP',   0x1a3),
+    ('IMAGE_FILE_MACHINE_SH4',      0x1a6),
+    ('IMAGE_FILE_MACHINE_SH5',      0x1a8),
+    ('IMAGE_FILE_MACHINE_THUMB',    0x1c2),
+    ('IMAGE_FILE_MACHINE_WCEMIPSV2',0x169),
+ ]
+
+MACHINE_TYPE = dict([(e[1], e[0]) for e in machine_types]+machine_types)
+
+
+relocation_types = [
+    ('IMAGE_REL_BASED_ABSOLUTE',        0),
+    ('IMAGE_REL_BASED_HIGH',            1),
+    ('IMAGE_REL_BASED_LOW',             2),
+    ('IMAGE_REL_BASED_HIGHLOW',         3),
+    ('IMAGE_REL_BASED_HIGHADJ',         4),
+    ('IMAGE_REL_BASED_MIPS_JMPADDR',    5),
+    ('IMAGE_REL_BASED_SECTION',         6),
+    ('IMAGE_REL_BASED_REL',             7),
+    ('IMAGE_REL_BASED_MIPS_JMPADDR16',  9),
+    ('IMAGE_REL_BASED_IA64_IMM64',      9),
+    ('IMAGE_REL_BASED_DIR64',           10),
+    ('IMAGE_REL_BASED_HIGH3ADJ',        11) ]
+
+RELOCATION_TYPE = dict([(e[1], e[0]) for e in relocation_types]+relocation_types)
+
+
+dll_characteristics = [
+    ('IMAGE_DLL_CHARACTERISTICS_RESERVED_0x0001', 0x0001),
+    ('IMAGE_DLL_CHARACTERISTICS_RESERVED_0x0002', 0x0002),
+    ('IMAGE_DLL_CHARACTERISTICS_RESERVED_0x0004', 0x0004),
+    ('IMAGE_DLL_CHARACTERISTICS_RESERVED_0x0008', 0x0008),
+    ('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE',      0x0040),
+    ('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY',   0x0080),
+    ('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT',         0x0100),
+    ('IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION',      0x0200),
+    ('IMAGE_DLL_CHARACTERISTICS_NO_SEH',    0x0400),
+    ('IMAGE_DLL_CHARACTERISTICS_NO_BIND',   0x0800),
+    ('IMAGE_DLL_CHARACTERISTICS_RESERVED_0x1000', 0x1000),
+    ('IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER',    0x2000),
+    ('IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE', 0x8000) ]
+
+DLL_CHARACTERISTICS = dict([(e[1], e[0]) for e in dll_characteristics]+dll_characteristics)
+
+
+# Resource types
+resource_type = [
+    ('RT_CURSOR',          1),
+    ('RT_BITMAP',          2),
+    ('RT_ICON',            3),
+    ('RT_MENU',            4),
+    ('RT_DIALOG',          5),
+    ('RT_STRING',          6),
+    ('RT_FONTDIR',         7),
+    ('RT_FONT',            8),
+    ('RT_ACCELERATOR',     9),
+    ('RT_RCDATA',          10),
+    ('RT_MESSAGETABLE',    11),
+    ('RT_GROUP_CURSOR',    12),
+    ('RT_GROUP_ICON',      14),
+    ('RT_VERSION',         16),
+    ('RT_DLGINCLUDE',      17),
+    ('RT_PLUGPLAY',        19),
+    ('RT_VXD',             20),
+    ('RT_ANICURSOR',       21),
+    ('RT_ANIICON',         22),
+    ('RT_HTML',            23),
+    ('RT_MANIFEST',        24) ]
+
+RESOURCE_TYPE = dict([(e[1], e[0]) for e in resource_type]+resource_type)
+
+    
+# Language definitions
+lang = [
+ ('LANG_NEUTRAL',       0x00),
+ ('LANG_INVARIANT',     0x7f),
+ ('LANG_AFRIKAANS',     0x36),
+ ('LANG_ALBANIAN',      0x1c),
+ ('LANG_ARABIC',        0x01),
+ ('LANG_ARMENIAN',      0x2b),
+ ('LANG_ASSAMESE',      0x4d),
+ ('LANG_AZERI',         0x2c),
+ ('LANG_BASQUE',        0x2d),
+ ('LANG_BELARUSIAN',    0x23),
+ ('LANG_BENGALI',       0x45),
+ ('LANG_BULGARIAN',     0x02),
+ ('LANG_CATALAN',       0x03),
+ ('LANG_CHINESE',       0x04),
+ ('LANG_CROATIAN',      0x1a),
+ ('LANG_CZECH',         0x05),
+ ('LANG_DANISH',        0x06),
+ ('LANG_DIVEHI',        0x65),
+ ('LANG_DUTCH',         0x13),
+ ('LANG_ENGLISH',       0x09),
+ ('LANG_ESTONIAN',      0x25),
+ ('LANG_FAEROESE',      0x38),
+ ('LANG_FARSI',         0x29),
+ ('LANG_FINNISH',       0x0b),
+ ('LANG_FRENCH',        0x0c),
+ ('LANG_GALICIAN',      0x56),
+ ('LANG_GEORGIAN',      0x37),
+ ('LANG_GERMAN',        0x07),
+ ('LANG_GREEK',         0x08),
+ ('LANG_GUJARATI',      0x47),
+ ('LANG_HEBREW',        0x0d),
+ ('LANG_HINDI',         0x39),
+ ('LANG_HUNGARIAN',     0x0e),
+ ('LANG_ICELANDIC',     0x0f),
+ ('LANG_INDONESIAN',    0x21),
+ ('LANG_ITALIAN',       0x10),
+ ('LANG_JAPANESE',      0x11),
+ ('LANG_KANNADA',       0x4b),
+ ('LANG_KASHMIRI',      0x60),
+ ('LANG_KAZAK',         0x3f),
+ ('LANG_KONKANI',       0x57),
+ ('LANG_KOREAN',        0x12),
+ ('LANG_KYRGYZ',        0x40),
+ ('LANG_LATVIAN',       0x26),
+ ('LANG_LITHUANIAN',    0x27),
+ ('LANG_MACEDONIAN',    0x2f),
+ ('LANG_MALAY',         0x3e),
+ ('LANG_MALAYALAM',     0x4c),
+ ('LANG_MANIPURI',      0x58),
+ ('LANG_MARATHI',       0x4e),
+ ('LANG_MONGOLIAN',     0x50),
+ ('LANG_NEPALI',        0x61),
+ ('LANG_NORWEGIAN',     0x14),
+ ('LANG_ORIYA',         0x48),
+ ('LANG_POLISH',        0x15),
+ ('LANG_PORTUGUESE',    0x16),
+ ('LANG_PUNJABI',       0x46),
+ ('LANG_ROMANIAN',      0x18),
+ ('LANG_RUSSIAN',       0x19),
+ ('LANG_SANSKRIT',      0x4f),
+ ('LANG_SERBIAN',       0x1a),
+ ('LANG_SINDHI',        0x59),
+ ('LANG_SLOVAK',        0x1b),
+ ('LANG_SLOVENIAN',     0x24),
+ ('LANG_SPANISH',       0x0a),
+ ('LANG_SWAHILI',       0x41),
+ ('LANG_SWEDISH',       0x1d),
+ ('LANG_SYRIAC',        0x5a),
+ ('LANG_TAMIL',         0x49),
+ ('LANG_TATAR',         0x44),
+ ('LANG_TELUGU',        0x4a),
+ ('LANG_THAI',          0x1e),
+ ('LANG_TURKISH',       0x1f),
+ ('LANG_UKRAINIAN',     0x22),
+ ('LANG_URDU',          0x20),
+ ('LANG_UZBEK',         0x43),
+ ('LANG_VIETNAMESE',    0x2a),
+ ('LANG_GAELIC',        0x3c),
+ ('LANG_MALTESE',       0x3a),
+ ('LANG_MAORI',         0x28),
+ ('LANG_RHAETO_ROMANCE',0x17),
+ ('LANG_SAAMI',         0x3b),
+ ('LANG_SORBIAN',       0x2e),
+ ('LANG_SUTU',          0x30),
+ ('LANG_TSONGA',        0x31),
+ ('LANG_TSWANA',        0x32),
+ ('LANG_VENDA',         0x33),
+ ('LANG_XHOSA',         0x34),
+ ('LANG_ZULU',          0x35),
+ ('LANG_ESPERANTO',     0x8f),
+ ('LANG_WALON',         0x90),
+ ('LANG_CORNISH',       0x91),
+ ('LANG_WELSH',         0x92),
+ ('LANG_BRETON',        0x93) ]
+
+LANG = dict(lang+[(e[1], e[0]) for e in lang])
+
+
+# Sublanguage definitions
+sublang =  [
+ ('SUBLANG_NEUTRAL',                        0x00),
+ ('SUBLANG_DEFAULT',                        0x01),
+ ('SUBLANG_SYS_DEFAULT',                    0x02),
+ ('SUBLANG_ARABIC_SAUDI_ARABIA',            0x01),
+ ('SUBLANG_ARABIC_IRAQ',                    0x02),
+ ('SUBLANG_ARABIC_EGYPT',                   0x03),
+ ('SUBLANG_ARABIC_LIBYA',                   0x04),
+ ('SUBLANG_ARABIC_ALGERIA',                 0x05),
+ ('SUBLANG_ARABIC_MOROCCO',                 0x06),
+ ('SUBLANG_ARABIC_TUNISIA',                 0x07),
+ ('SUBLANG_ARABIC_OMAN',                    0x08),
+ ('SUBLANG_ARABIC_YEMEN',                   0x09),
+ ('SUBLANG_ARABIC_SYRIA',                   0x0a),
+ ('SUBLANG_ARABIC_JORDAN',                  0x0b),
+ ('SUBLANG_ARABIC_LEBANON',                 0x0c),
+ ('SUBLANG_ARABIC_KUWAIT',                  0x0d),
+ ('SUBLANG_ARABIC_UAE',                     0x0e),
+ ('SUBLANG_ARABIC_BAHRAIN',                 0x0f),
+ ('SUBLANG_ARABIC_QATAR',                   0x10),
+ ('SUBLANG_AZERI_LATIN',                    0x01),
+ ('SUBLANG_AZERI_CYRILLIC',                 0x02),
+ ('SUBLANG_CHINESE_TRADITIONAL',            0x01),
+ ('SUBLANG_CHINESE_SIMPLIFIED',             0x02),
+ ('SUBLANG_CHINESE_HONGKONG',               0x03),
+ ('SUBLANG_CHINESE_SINGAPORE',              0x04),
+ ('SUBLANG_CHINESE_MACAU',                  0x05),
+ ('SUBLANG_DUTCH',                          0x01),
+ ('SUBLANG_DUTCH_BELGIAN',                  0x02),
+ ('SUBLANG_ENGLISH_US',                     0x01),
+ ('SUBLANG_ENGLISH_UK',                     0x02),
+ ('SUBLANG_ENGLISH_AUS',                    0x03),
+ ('SUBLANG_ENGLISH_CAN',                    0x04),
+ ('SUBLANG_ENGLISH_NZ',                     0x05),
+ ('SUBLANG_ENGLISH_EIRE',                   0x06),
+ ('SUBLANG_ENGLISH_SOUTH_AFRICA',           0x07),
+ ('SUBLANG_ENGLISH_JAMAICA',                0x08),
+ ('SUBLANG_ENGLISH_CARIBBEAN',              0x09),
+ ('SUBLANG_ENGLISH_BELIZE',                 0x0a),
+ ('SUBLANG_ENGLISH_TRINIDAD',               0x0b),
+ ('SUBLANG_ENGLISH_ZIMBABWE',               0x0c),
+ ('SUBLANG_ENGLISH_PHILIPPINES',            0x0d),
+ ('SUBLANG_FRENCH',                         0x01),
+ ('SUBLANG_FRENCH_BELGIAN',                 0x02),
+ ('SUBLANG_FRENCH_CANADIAN',                0x03),
+ ('SUBLANG_FRENCH_SWISS',                   0x04),
+ ('SUBLANG_FRENCH_LUXEMBOURG',              0x05),
+ ('SUBLANG_FRENCH_MONACO',                  0x06),
+ ('SUBLANG_GERMAN',                         0x01),
+ ('SUBLANG_GERMAN_SWISS',                   0x02),
+ ('SUBLANG_GERMAN_AUSTRIAN',                0x03),
+ ('SUBLANG_GERMAN_LUXEMBOURG',              0x04),
+ ('SUBLANG_GERMAN_LIECHTENSTEIN',           0x05),
+ ('SUBLANG_ITALIAN',                        0x01),
+ ('SUBLANG_ITALIAN_SWISS',                  0x02),
+ ('SUBLANG_KASHMIRI_SASIA',                 0x02),
+ ('SUBLANG_KASHMIRI_INDIA',                 0x02),
+ ('SUBLANG_KOREAN',                         0x01),
+ ('SUBLANG_LITHUANIAN',                     0x01),
+ ('SUBLANG_MALAY_MALAYSIA',                 0x01),
+ ('SUBLANG_MALAY_BRUNEI_DARUSSALAM',        0x02),
+ ('SUBLANG_NEPALI_INDIA',                   0x02),
+ ('SUBLANG_NORWEGIAN_BOKMAL',               0x01),
+ ('SUBLANG_NORWEGIAN_NYNORSK',              0x02),
+ ('SUBLANG_PORTUGUESE',                     0x02),
+ ('SUBLANG_PORTUGUESE_BRAZILIAN',           0x01),
+ ('SUBLANG_SERBIAN_LATIN',                  0x02),
+ ('SUBLANG_SERBIAN_CYRILLIC',               0x03),
+ ('SUBLANG_SPANISH',                        0x01),
+ ('SUBLANG_SPANISH_MEXICAN',                0x02),
+ ('SUBLANG_SPANISH_MODERN',                 0x03),
+ ('SUBLANG_SPANISH_GUATEMALA',              0x04),
+ ('SUBLANG_SPANISH_COSTA_RICA',             0x05),
+ ('SUBLANG_SPANISH_PANAMA',                 0x06),
+ ('SUBLANG_SPANISH_DOMINICAN_REPUBLIC',     0x07),
+ ('SUBLANG_SPANISH_VENEZUELA',              0x08),
+ ('SUBLANG_SPANISH_COLOMBIA',               0x09),
+ ('SUBLANG_SPANISH_PERU',                   0x0a),
+ ('SUBLANG_SPANISH_ARGENTINA',              0x0b),
+ ('SUBLANG_SPANISH_ECUADOR',                0x0c),
+ ('SUBLANG_SPANISH_CHILE',                  0x0d),
+ ('SUBLANG_SPANISH_URUGUAY',                0x0e),
+ ('SUBLANG_SPANISH_PARAGUAY',               0x0f),
+ ('SUBLANG_SPANISH_BOLIVIA',                0x10),
+ ('SUBLANG_SPANISH_EL_SALVADOR',            0x11),
+ ('SUBLANG_SPANISH_HONDURAS',               0x12),
+ ('SUBLANG_SPANISH_NICARAGUA',              0x13),
+ ('SUBLANG_SPANISH_PUERTO_RICO',            0x14),
+ ('SUBLANG_SWEDISH',                        0x01),
+ ('SUBLANG_SWEDISH_FINLAND',                0x02),
+ ('SUBLANG_URDU_PAKISTAN',                  0x01),
+ ('SUBLANG_URDU_INDIA',                     0x02),
+ ('SUBLANG_UZBEK_LATIN',                    0x01),
+ ('SUBLANG_UZBEK_CYRILLIC',                 0x02),
+ ('SUBLANG_DUTCH_SURINAM',                  0x03),
+ ('SUBLANG_ROMANIAN',                       0x01),
+ ('SUBLANG_ROMANIAN_MOLDAVIA',              0x02),
+ ('SUBLANG_RUSSIAN',                        0x01),
+ ('SUBLANG_RUSSIAN_MOLDAVIA',               0x02),
+ ('SUBLANG_CROATIAN',                       0x01),
+ ('SUBLANG_LITHUANIAN_CLASSIC',             0x02),
+ ('SUBLANG_GAELIC',                         0x01),
+ ('SUBLANG_GAELIC_SCOTTISH',                0x02),
+ ('SUBLANG_GAELIC_MANX',                    0x03) ]
+
+SUBLANG = dict(sublang+[(e[1], e[0]) for e in sublang])
+
+
+class UnicodeStringWrapperPostProcessor:
+    """This class attemps to help the process of identifying strings
+    that might be plain Unicode or Pascal. A list of strings will be
+    wrapped on it with the hope the overlappings will help make the 
+    decission about their type."""
+    
+    def __init__(self, pe, rva_ptr):
+        self.pe = pe
+        self.rva_ptr = rva_ptr
+        self.string = None
+        
+        
+    def get_rva(self):
+        """Get the RVA of the string."""
+        
+        return self.rva_ptr
+        
+        
+    def __str__(self):
+        """Return the escaped ASCII representation of the string."""
+    
+        def convert_char(char):
+            if char in string.printable:
+                return char
+            else:
+                return r'\x%02x' % ord(char)
+                
+        if self.string:
+            return ''.join([convert_char(c) for c in self.string])
+            
+        return ''
+        
+    
+    def invalidate(self):
+        """Make this instance None, to express it's no known string type."""
+        
+        self = None
+    
+        
+    def render_pascal_16(self):
+    
+        self.string = self.pe.get_string_u_at_rva(
+            self.rva_ptr+2, 
+            max_length=self.__get_pascal_16_length())
+
+
+    def ask_pascal_16(self, next_rva_ptr):
+        """The next RVA is taken to be the one immediately following this one.
+        
+        Such RVA could indicate the natural end of the string and will be checked
+        with the possible length contained in the first word.
+        """
+        
+        length = self.__get_pascal_16_length()
+        
+        if length == (next_rva_ptr - (self.rva_ptr+2)) / 2:
+            self.length = length
+            return True
+            
+        return False
+        
+        
+    def __get_pascal_16_length(self):
+    
+        return self.__get_word_value_at_rva(self.rva_ptr)
+        
+    
+    def __get_word_value_at_rva(self, rva):
+
+        try:
+            data = self.pe.get_data(self.rva_ptr, 2)
+        except PEFormatError, e:
+            return False
+
+        if len(data)<2:
+            return False
+
+        return struct.unpack('<H', data)[0]
+
+    
+    #def render_pascal_8(self):
+    #    """"""
+        
+        
+    def ask_unicode_16(self, next_rva_ptr):
+        """The next RVA is taken to be the one immediately following this one.
+        
+        Such RVA could indicate the natural end of the string and will be checked
+        to see if there's a Unicode NULL character there.
+        """
+        
+        if self.__get_word_value_at_rva(next_rva_ptr-2) == 0:
+            self.length = next_rva_ptr - self.rva_ptr
+            return True
+            
+        return False
+        
+
+    def render_unicode_16(self):
+        """"""
+
+        self.string = self.pe.get_string_u_at_rva(self.rva_ptr)
+            
+
+class PEFormatError(Exception):
+    """Generic PE format error exception."""
+    
+    def __init__(self, value):
+        self.value = value
+
+    def __str__(self):
+        return repr(self.value)
+
+
+class Dump:
+    """Convenience class for dumping the PE information."""
+    
+    def __init__(self):
+        self.text = ''
+    
+        
+    def add_lines(self, txt, indent=0):
+        """Adds a list of lines.
+        
+        The list can be indented with the optional argument 'indent'.
+        """
+        for line in txt:
+            self.add_line(line, indent)
+        
+            
+    def add_line(self, txt, indent=0):
+        """Adds a line.
+        
+        The line can be indented with the optional argument 'indent'.
+        """
+        
+        self.add(txt+'\n', indent)
+    
+        
+    def add(self, txt, indent=0):
+        """Adds some text, no newline will be appended.
+        
+        The text can be indented with the optional argument 'indent'.
+        """
+        
+        if isinstance(txt, unicode):
+            s = []
+            for c in txt:
+                try:
+                    s.append(str(c))
+                except UnicodeEncodeError, e:
+                    s.append(repr(c))
+                        
+            txt = ''.join(s)
+        
+        self.text += ' '*indent+txt
+    
+        
+    def add_header(self, txt):
+        """Adds a header element."""
+        
+        self.add_line('-'*10+txt+'-'*10+'\n')
+        
+        
+    def add_newline(self):
+        """Adds a newline."""
+        
+        self.text += '\n'
+        
+        
+    def get_text(self):
+        """Get the text in its current state."""
+    
+        return self.text
+
+
+
+class Structure:
+    """Prepare structure object to extract members from data.
+    
+    Format is a list containing definitions for the elements
+    of the structure.
+    """
+    
+    
+    def __init__(self, format, name=None, file_offset=None):
+        # Format is forced little endian, for big endian non Intel platforms
+        self.__format__ = '<'
+        self.__keys__ = []
+#        self.values = {}
+        self.__format_length__ = 0
+        self.__set_format__(format[1])
+        self._all_zeroes = False
+        self.__unpacked_data_elms__ = None
+        self.__file_offset__ = file_offset
+        if name:
+            self.name = name
+        else:
+            self.name = format[0]
+                
+            
+    def __get_format__(self):
+        return self.__format__
+        
+        
+    def get_file_offset(self):
+        return self.__file_offset__
+
+    def set_file_offset(self, offset):
+        self.__file_offset__ = offset
+        
+    def all_zeroes(self):
+        """Returns true is the unpacked data is all zeroes."""
+        
+        return self._all_zeroes
+
+                
+    def __set_format__(self, format):
+    
+        for elm in format:
+            if ',' in elm:
+                elm_type, elm_name = elm.split(',', 1)
+                self.__format__ += elm_type
+                
+                elm_names = elm_name.split(',')
+                names = []
+                for elm_name in elm_names:
+                    if elm_name in self.__keys__:
+                        search_list = [x[:len(elm_name)] for x in self.__keys__]
+                        occ_count = search_list.count(elm_name)
+                        elm_name = elm_name+'_'+str(occ_count)
+                    names.append(elm_name)
+                # Some PE header structures have unions on them, so a certain
+                # value might have different names, so each key has a list of
+                # all the possible members referring to the data.
+                self.__keys__.append(names)
+                    
+        self.__format_length__ = struct.calcsize(self.__format__)
+        
+        
+    def sizeof(self):
+        """Return size of the structure."""
+    
+        return self.__format_length__
+        
+        
+    def __unpack__(self, data):
+    
+        if len(data)>self.__format_length__:
+            data = data[:self.__format_length__]
+            
+        # OC Patch:
+        # Some malware have incorrect header lengths.
+        # Fail gracefully if this occurs
+        # Buggy malware: a29b0118af8b7408444df81701ad5a7f
+        #
+        elif len(data)<self.__format_length__:
+            raise PEFormatError('Data length less than expected header length.')
+
+            
+        if data.count(chr(0)) == len(data):
+            self._all_zeroes = True
+            
+        self.__unpacked_data_elms__ = struct.unpack(self.__format__, data)
+        for i in xrange(len(self.__unpacked_data_elms__)):
+            for key in self.__keys__[i]:
+#                self.values[key] = self.__unpacked_data_elms__[i]
+                setattr(self, key, self.__unpacked_data_elms__[i])
+
+
+    def __pack__(self):
+    
+        new_values = []
+        
+        for i in xrange(len(self.__unpacked_data_elms__)):
+        
+            for key in self.__keys__[i]:
+                new_val = getattr(self, key)
+                old_val = self.__unpacked_data_elms__[i]
+                
+                # In the case of Unions, when the first changed value
+                # is picked the loop is exited
+                if new_val != old_val:
+                    break
+                
+            new_values.append(new_val)
+            
+        return struct.pack(self.__format__, *new_values)
+        
+                
+    def __str__(self):
+        return '\n'.join( self.dump() )
+
+    def __repr__(self):
+        return '<Structure: %s>' % (' '.join( [' '.join(s.split()) for s in self.dump()] ))
+        
+        
+    def dump(self, indentation=0):
+        """Returns a string representation of the structure."""
+    
+        dump = []
+        
+        dump.append('[%s]' % self.name)
+
+        # Refer to the __set_format__ method for an explanation
+        # of the following construct.
+        for keys in self.__keys__:
+            for key in keys:
+
+                val = getattr(self, key)
+                if isinstance(val, int) or isinstance(val, long):
+                    val_str = '0x%-8X' % (val)
+                    if key == 'TimeDateStamp' or key == 'dwTimeStamp':
+                        try:
+                            val_str += ' [%s UTC]' % time.asctime(time.gmtime(val))
+                        except exceptions.ValueError, e:
+                            val_str += ' [INVALID TIME]'
+                else:
+                    val_str = ''.join(filter(lambda c:c != '\0', str(val)))
+
+                dump.append('%-30s %s' % (key+':', val_str))
+
+        return dump
+
+
+
+class SectionStructure(Structure):
+    """Convenience section handling class."""
+
+    def get_data(self, start, length=None):
+        """Get data chunk from a section.
+        
+        Allows to query data from the section by passing the
+        addresses where the PE file would be loaded by default.
+        It is then possible to retrieve code and data by its real
+        addresses as it would be if loaded.
+        """
+
+        offset = start - self.VirtualAddress
+
+        if length:
+            end = offset+length
+        else:
+            end = len(self.data)
+            
+        return self.data[offset:end]
+
+
+    def get_rva_from_offset(self, offset):
+        return offset - self.PointerToRawData + self.VirtualAddress
+
+
+    def get_offset_from_rva(self, rva):
+        return (rva - self.VirtualAddress) + self.PointerToRawData
+
+
+    def contains_offset(self, offset):
+        """Check whether the section contains the file offset provided."""
+
+        if not self.PointerToRawData:
+           # bss and other sections containing only uninitialized data must have 0
+           # and do not take space in the file
+           return False
+        return self.PointerToRawData <= offset < self.VirtualAddress + self.SizeOfRawData
+
+
+    def contains_rva(self, rva):
+        """Check whether the section contains the address provided."""
+
+        # PECOFF documentation v8 says:
+        # The total size of the section when loaded into memory.
+        # If this value is greater than SizeOfRawData, the section is zero-padded.
+        # This field is valid only for executable images and should be set to zero
+        # for object files.
+
+        if len(self.data) < self.SizeOfRawData:
+            size = self.Misc_VirtualSize
+        else:
+            size = max(self.SizeOfRawData, self.Misc_VirtualSize)
+            
+        return self.VirtualAddress <= rva < self.VirtualAddress + size
+
+    def contains(self, rva):
+        #print "DEPRECATION WARNING: you should use contains_rva() instead of contains()"
+        return self.contains_rva(rva)
+
+
+    def set_data(self, data):
+        """Set the data belonging to the section."""
+        
+        self.data = data
+        
+        
+    def get_entropy(self):
+        """Calculate and return the entropy for the section."""
+        
+        return self.entropy_H( self.data )
+        
+
+    def get_hash_sha1(self):
+        """Get the SHA-1 hex-digest of the section's data."""
+        
+        if sha1 is not None:
+            return sha1( self.data ).hexdigest()
+    
+
+    def get_hash_sha256(self):
+        """Get the SHA-256 hex-digest of the section's data."""
+        
+        if sha256 is not None:
+            return sha256( self.data ).hexdigest()
+    
+
+    def get_hash_sha512(self):
+        """Get the SHA-512 hex-digest of the section's data."""
+        
+        if sha512 is not None:
+            return sha512( self.data ).hexdigest()
+    
+
+    def get_hash_md5(self):
+        """Get the MD5 hex-digest of the section's data."""
+        
+        if md5 is not None:
+            return md5( self.data ).hexdigest()
+    
+
+    def entropy_H(self, data):
+        """Calculate the entropy of a chunk of data."""
+
+        if len(data) == 0:
+            return 0.0
+    
+        occurences = array.array('L', [0]*256)
+    
+        for x in data:
+            occurences[ord(x)] += 1
+    
+        entropy = 0
+        for x in occurences:
+            if x:
+                p_x = float(x) / len(data)
+                entropy -= p_x*math.log(p_x, 2)
+    
+        return entropy
+
+
+
+class DataContainer:
+    """Generic data container."""
+        
+    def __init__(self, **args):
+        for key, value in args.items():
+            setattr(self, key, value)
+
+
+
+class ImportDescData(DataContainer):
+    """Holds import descriptor information.
+    
+    dll:        name of the imported DLL
+    imports:    list of imported symbols (ImportData instances)
+    struct:     IMAGE_IMPORT_DESCRIPTOR sctruture
+    """
+
+class ImportData(DataContainer):
+    """Holds imported symbol's information.
+    
+    ordinal:    Ordinal of the symbol
+    name:       Name of the symbol
+    bound:      If the symbol is bound, this contains
+                the address.
+    """
+    
+class ExportDirData(DataContainer):
+    """Holds export directory information.
+                    
+    struct:     IMAGE_EXPORT_DIRECTORY structure
+    symbols:    list of exported symbols (ExportData instances)
+"""
+    
+class ExportData(DataContainer):
+    """Holds exported symbols' information.
+    
+    ordinal:    ordinal of the symbol
+    address:    address of the symbol
+    name:       name of the symbol (None if the symbol is
+                exported by ordinal only)
+    forwarder:  if the symbol is forwarded it will
+                contain the name of the target symbol,
+                None otherwise.
+    """
+              
+
+class ResourceDirData(DataContainer):
+    """Holds resource directory information.
+    
+    struct:     IMAGE_RESOURCE_DIRECTORY structure
+    entries:    list of entries (ResourceDirEntryData instances)
+    """
+    
+class ResourceDirEntryData(DataContainer):
+    """Holds resource directory entry data.
+    
+    struct:     IMAGE_RESOURCE_DIRECTORY_ENTRY structure
+    name:       If the resource is identified by name this
+                attribute will contain the name string. None
+                otherwise. If identified by id, the id is
+                availabe at 'struct.Id'
+    id:         the id, also in struct.Id
+    directory:  If this entry has a lower level directory
+                this attribute will point to the
+                ResourceDirData instance representing it.
+    data:       If this entry has no futher lower directories
+                and points to the actual resource data, this
+                attribute will reference the corresponding
+                ResourceDataEntryData instance.
+    (Either of the 'directory' or 'data' attribute will exist,
+    but not both.)
+    """
+
+class ResourceDataEntryData(DataContainer):
+    """Holds resource data entry information.
+    
+    struct:     IMAGE_RESOURCE_DATA_ENTRY structure
+    lang:       Primary language ID
+    sublang:    Sublanguage ID
+    """
+
+class DebugData(DataContainer):
+    """Holds debug information.
+    
+    struct:     IMAGE_DEBUG_DIRECTORY structure
+    """
+
+class BaseRelocationData(DataContainer):
+    """Holds base relocation information.
+    
+    struct:     IMAGE_BASE_RELOCATION structure
+    entries:    list of relocation data (RelocationData instances)
+    """
+    
+class RelocationData(DataContainer):
+    """Holds relocation information.
+    
+    type:       Type of relocation
+                The type string is can be obtained by
+                RELOCATION_TYPE[type]
+    rva:        RVA of the relocation
+    """
+
+class TlsData(DataContainer):
+    """Holds TLS information.
+    
+    struct:     IMAGE_TLS_DIRECTORY structure
+    """
+
+class BoundImportDescData(DataContainer):
+    """Holds bound import descriptor data.
+    
+    This directory entry will provide with information on the
+    DLLs this PE files has been bound to (if bound at all).
+    The structure will contain the name and timestamp of the
+    DLL at the time of binding so that the loader can know
+    whether it differs from the one currently present in the
+    system and must, therefore, re-bind the PE's imports.
+    
+    struct:     IMAGE_BOUND_IMPORT_DESCRIPTOR structure
+    name:       DLL name
+    entries:    list of entries (BoundImportRefData instances)
+                the entries will exist if this DLL has forwarded
+                symbols. If so, the destination DLL will have an
+                entry in this list.
+    """
+
+class BoundImportRefData(DataContainer):
+    """Holds bound import forwader reference data.
+    
+    Contains the same information as the bound descriptor but
+    for forwarded DLLs, if any.
+    
+    struct:     IMAGE_BOUND_FORWARDER_REF structure
+    name:       dll name
+    """
+
+
+class PE:
+    """A Portable Executable representation.
+    
+    This class provides access to most of the information in a PE file.
+    
+    It expects to be supplied the name of the file to load or PE data
+    to process and an optional argument 'fast_load' (False by default)
+    which controls whether to load all the directories information,
+    which can be quite time consuming.
+    
+    pe = pefile.PE('module.dll')
+    pe = pefile.PE(name='module.dll')
+    
+    would load 'module.dll' and process it. If the data would be already
+    available in a buffer the same could be achieved with:
+    
+    pe = pefile.PE(data=module_dll_data)
+    
+    The "fast_load" can be set to a default by setting its value in the
+    module itself by means,for instance, of a "pefile.fast_load = True".
+    That will make all the subsequent instances not to load the
+    whole PE structure. The "full_load" method can be used to parse
+    the missing data at a later stage.
+    
+    Basic headers information will be available in the attributes:
+    
+    DOS_HEADER
+    NT_HEADERS
+    FILE_HEADER
+    OPTIONAL_HEADER
+    
+    All of them will contain among their attrbitues the members of the
+    corresponding structures as defined in WINNT.H
+    
+    The raw data corresponding to the header (from the beginning of the
+    file up to the start of the first section) will be avaiable in the
+    instance's attribute 'header' as a string.
+    
+    The sections will be available as a list in the 'sections' attribute.
+    Each entry will contain as attributes all the structure's members.
+    
+    Directory entries will be available as attributes (if they exist):
+    (no other entries are processed at this point)
+    
+    DIRECTORY_ENTRY_IMPORT (list of ImportDescData instances)
+    DIRECTORY_ENTRY_EXPORT (ExportDirData instance)
+    DIRECTORY_ENTRY_RESOURCE (ResourceDirData instance)
+    DIRECTORY_ENTRY_DEBUG (list of DebugData instances)
+    DIRECTORY_ENTRY_BASERELOC (list of BaseRelocationData instances)
+    DIRECTORY_ENTRY_TLS 
+    DIRECTORY_ENTRY_BOUND_IMPORT (list of BoundImportData instances)
+    
+    The following dictionary attributes provide ways of mapping different
+    constants. They will accept the numeric value and return the string
+    representation and the opposite, feed in the string and get the
+    numeric constant:
+    
+    DIRECTORY_ENTRY
+    IMAGE_CHARACTERISTICS
+    SECTION_CHARACTERISTICS
+    DEBUG_TYPE
+    SUBSYSTEM_TYPE
+    MACHINE_TYPE
+    RELOCATION_TYPE
+    RESOURCE_TYPE
+    LANG
+    SUBLANG
+    """
+
+    #
+    # Format specifications for PE structures.
+    #
+    
+    __IMAGE_DOS_HEADER_format__ = ('IMAGE_DOS_HEADER',
+        ('H,e_magic', 'H,e_cblp', 'H,e_cp',
+        'H,e_crlc', 'H,e_cparhdr', 'H,e_minalloc',
+        'H,e_maxalloc', 'H,e_ss', 'H,e_sp', 'H,e_csum',
+        'H,e_ip', 'H,e_cs', 'H,e_lfarlc', 'H,e_ovno', '8s,e_res',
+        'H,e_oemid', 'H,e_oeminfo', '20s,e_res2',
+        'L,e_lfanew'))
+        
+    __IMAGE_FILE_HEADER_format__ = ('IMAGE_FILE_HEADER',
+        ('H,Machine', 'H,NumberOfSections',
+        'L,TimeDateStamp', 'L,PointerToSymbolTable',
+        'L,NumberOfSymbols', 'H,SizeOfOptionalHeader',
+        'H,Characteristics'))
+        
+    __IMAGE_DATA_DIRECTORY_format__ = ('IMAGE_DATA_DIRECTORY',
+        ('L,VirtualAddress', 'L,Size'))
+    
+    
+    __IMAGE_OPTIONAL_HEADER_format__ = ('IMAGE_OPTIONAL_HEADER',
+        ('H,Magic', 'B,MajorLinkerVersion',
+        'B,MinorLinkerVersion', 'L,SizeOfCode',
+        'L,SizeOfInitializedData', 'L,SizeOfUninitializedData',
+        'L,AddressOfEntryPoint', 'L,BaseOfCode', 'L,BaseOfData',
+        'L,ImageBase', 'L,SectionAlignment', 'L,FileAlignment',
+        'H,MajorOperatingSystemVersion', 'H,MinorOperatingSystemVersion',
+        'H,MajorImageVersion', 'H,MinorImageVersion',
+        'H,MajorSubsystemVersion', 'H,MinorSubsystemVersion',
+        'L,Reserved1', 'L,SizeOfImage', 'L,SizeOfHeaders',
+        'L,CheckSum', 'H,Subsystem', 'H,DllCharacteristics',
+        'L,SizeOfStackReserve', 'L,SizeOfStackCommit',
+        'L,SizeOfHeapReserve', 'L,SizeOfHeapCommit',
+        'L,LoaderFlags', 'L,NumberOfRvaAndSizes' ))
+
+
+    __IMAGE_OPTIONAL_HEADER64_format__ = ('IMAGE_OPTIONAL_HEADER64',
+        ('H,Magic', 'B,MajorLinkerVersion',
+        'B,MinorLinkerVersion', 'L,SizeOfCode',
+        'L,SizeOfInitializedData', 'L,SizeOfUninitializedData',
+        'L,AddressOfEntryPoint', 'L,BaseOfCode',
+        'Q,ImageBase', 'L,SectionAlignment', 'L,FileAlignment',
+        'H,MajorOperatingSystemVersion', 'H,MinorOperatingSystemVersion',
+        'H,MajorImageVersion', 'H,MinorImageVersion',
+        'H,MajorSubsystemVersion', 'H,MinorSubsystemVersion',
+        'L,Reserved1', 'L,SizeOfImage', 'L,SizeOfHeaders',
+        'L,CheckSum', 'H,Subsystem', 'H,DllCharacteristics',
+        'Q,SizeOfStackReserve', 'Q,SizeOfStackCommit',
+        'Q,SizeOfHeapReserve', 'Q,SizeOfHeapCommit',
+        'L,LoaderFlags', 'L,NumberOfRvaAndSizes' ))
+
+        
+    __IMAGE_NT_HEADERS_format__ = ('IMAGE_NT_HEADERS', ('L,Signature',))
+        
+    __IMAGE_SECTION_HEADER_format__ = ('IMAGE_SECTION_HEADER',
+        ('8s,Name', 'L,Misc,Misc_PhysicalAddress,Misc_VirtualSize',
+        'L,VirtualAddress', 'L,SizeOfRawData', 'L,PointerToRawData',
+        'L,PointerToRelocations', 'L,PointerToLinenumbers',
+        'H,NumberOfRelocations', 'H,NumberOfLinenumbers',
+        'L,Characteristics'))
+
+    __IMAGE_DELAY_IMPORT_DESCRIPTOR_format__ = ('IMAGE_DELAY_IMPORT_DESCRIPTOR',
+        ('L,grAttrs', 'L,szName', 'L,phmod', 'L,pIAT', 'L,pINT',
+        'L,pBoundIAT', 'L,pUnloadIAT', 'L,dwTimeStamp'))
+
+    __IMAGE_IMPORT_DESCRIPTOR_format__ =  ('IMAGE_IMPORT_DESCRIPTOR',
+        ('L,OriginalFirstThunk,Characteristics',
+        'L,TimeDateStamp', 'L,ForwarderChain', 'L,Name', 'L,FirstThunk'))
+
+    __IMAGE_EXPORT_DIRECTORY_format__ =  ('IMAGE_EXPORT_DIRECTORY',
+        ('L,Characteristics',
+        'L,TimeDateStamp', 'H,MajorVersion', 'H,MinorVersion', 'L,Name',
+        'L,Base', 'L,NumberOfFunctions', 'L,NumberOfNames',
+        'L,AddressOfFunctions', 'L,AddressOfNames', 'L,AddressOfNameOrdinals'))
+
+    __IMAGE_RESOURCE_DIRECTORY_format__ = ('IMAGE_RESOURCE_DIRECTORY',
+        ('L,Characteristics',
+        'L,TimeDateStamp', 'H,MajorVersion', 'H,MinorVersion',
+        'H,NumberOfNamedEntries', 'H,NumberOfIdEntries'))
+
+    __IMAGE_RESOURCE_DIRECTORY_ENTRY_format__ = ('IMAGE_RESOURCE_DIRECTORY_ENTRY',
+        ('L,Name',
+        'L,OffsetToData'))
+            
+    __IMAGE_RESOURCE_DATA_ENTRY_format__ = ('IMAGE_RESOURCE_DATA_ENTRY',
+        ('L,OffsetToData', 'L,Size', 'L,CodePage', 'L,Reserved'))
+    
+    __VS_VERSIONINFO_format__ = ( 'VS_VERSIONINFO',
+        ('H,Length', 'H,ValueLength', 'H,Type' ))
+    
+    __VS_FIXEDFILEINFO_format__ = ( 'VS_FIXEDFILEINFO',
+        ('L,Signature', 'L,StrucVersion', 'L,FileVersionMS', 'L,FileVersionLS',
+         'L,ProductVersionMS', 'L,ProductVersionLS', 'L,FileFlagsMask', 'L,FileFlags',
+         'L,FileOS', 'L,FileType', 'L,FileSubtype', 'L,FileDateMS', 'L,FileDateLS'))
+    
+    __StringFileInfo_format__ = ( 'StringFileInfo',
+        ('H,Length', 'H,ValueLength', 'H,Type' ))
+    
+    __StringTable_format__ = ( 'StringTable',
+        ('H,Length', 'H,ValueLength', 'H,Type' ))
+    
+    __String_format__ = ( 'String',
+        ('H,Length', 'H,ValueLength', 'H,Type' ))
+    
+    __Var_format__ = ( 'Var', ('H,Length', 'H,ValueLength', 'H,Type' ))
+
+    __IMAGE_THUNK_DATA_format__ = ('IMAGE_THUNK_DATA',
+        ('L,ForwarderString,Function,Ordinal,AddressOfData',))
+
+    __IMAGE_THUNK_DATA64_format__ = ('IMAGE_THUNK_DATA',
+        ('Q,ForwarderString,Function,Ordinal,AddressOfData',))
+
+    __IMAGE_DEBUG_DIRECTORY_format__ = ('IMAGE_DEBUG_DIRECTORY',
+        ('L,Characteristics', 'L,TimeDateStamp', 'H,MajorVersion',
+        'H,MinorVersion', 'L,Type', 'L,SizeOfData', 'L,AddressOfRawData',
+        'L,PointerToRawData'))
+    
+    __IMAGE_BASE_RELOCATION_format__ = ('IMAGE_BASE_RELOCATION',
+        ('L,VirtualAddress', 'L,SizeOfBlock') )
+
+    __IMAGE_TLS_DIRECTORY_format__ = ('IMAGE_TLS_DIRECTORY',
+        ('L,StartAddressOfRawData', 'L,EndAddressOfRawData',
+        'L,AddressOfIndex', 'L,AddressOfCallBacks',
+        'L,SizeOfZeroFill', 'L,Characteristics' ) )
+
+    __IMAGE_TLS_DIRECTORY64_format__ = ('IMAGE_TLS_DIRECTORY',
+        ('Q,StartAddressOfRawData', 'Q,EndAddressOfRawData',
+        'Q,AddressOfIndex', 'Q,AddressOfCallBacks',
+        'L,SizeOfZeroFill', 'L,Characteristics' ) )
+
+    __IMAGE_BOUND_IMPORT_DESCRIPTOR_format__ = ('IMAGE_BOUND_IMPORT_DESCRIPTOR',
+        ('L,TimeDateStamp', 'H,OffsetModuleName', 'H,NumberOfModuleForwarderRefs'))
+
+    __IMAGE_BOUND_FORWARDER_REF_format__ = ('IMAGE_BOUND_FORWARDER_REF',
+        ('L,TimeDateStamp', 'H,OffsetModuleName', 'H,Reserved') )
+
+
+    def __init__(self, name=None, data=None, fast_load=None):
+    
+        self.sections = []
+        
+        self.__warnings = []
+        
+        self.PE_TYPE = None
+        
+        if  not name and not data:
+            return
+            
+        # This list will keep track of all the structures created.
+        # That will allow for an easy iteration through the list
+        # in order to save the modifications made
+        self.__structures__ = []
+
+        if not fast_load:
+            fast_load = globals()['fast_load']
+        self.__parse__(name, data, fast_load)
+                    
+        
+    
+    def __unpack_data__(self, format, data, file_offset):
+        """Apply structure format to raw data.
+        
+        Returns and unpacked structure object if successful, None otherwise.
+        """
+    
+        structure = Structure(format, file_offset=file_offset)
+        #if len(data) < structure.sizeof():
+        #    return None
+    
+        try:
+            structure.__unpack__(data)
+        except PEFormatError, err:
+            self.__warnings.append(
+                'Corrupt header "%s" at file offset %d. Exception: %s' % (
+                    format[0], file_offset, str(err))  )
+            return None
+
+        self.__structures__.append(structure)
+    
+        return structure
+        
+
+        
+    def __parse__(self, fname, data, fast_load):
+        """Parse a Portable Executable file.
+        
+        Loads a PE file, parsing all its structures and making them available
+        through the instance's attributes.
+        """
+        
+        if fname:
+            fd = file(fname, 'rb')
+            self.__data__ = fd.read()
+            fd.close()
+        elif data:
+            self.__data__ = data
+        
+
+        self.DOS_HEADER = self.__unpack_data__(
+            self.__IMAGE_DOS_HEADER_format__,
+            self.__data__, file_offset=0)
+            
+        if not self.DOS_HEADER or self.DOS_HEADER.e_magic != IMAGE_DOS_SIGNATURE:
+            raise PEFormatError('DOS Header magic not found.')
+
+        # OC Patch:
+        # Check for sane value in e_lfanew
+        #                
+        if self.DOS_HEADER.e_lfanew > len(self.__data__):
+            raise PEFormatError('Invalid e_lfanew value, probably not a PE file')
+
+        nt_headers_offset = self.DOS_HEADER.e_lfanew
+
+        self.NT_HEADERS = self.__unpack_data__(
+            self.__IMAGE_NT_HEADERS_format__,
+            self.__data__[nt_headers_offset:],
+            file_offset = nt_headers_offset)
+
+        # We better check the signature right here, before the file screws
+        # around with sections:
+        # OC Patch:
+        # Some malware will cause the Signature value to not exist at all
+        if not self.NT_HEADERS or not self.NT_HEADERS.Signature:
+            raise PEFormatError('NT Headers not found.')
+
+        if self.NT_HEADERS.Signature != IMAGE_NT_SIGNATURE:
+            raise PEFormatError('Invalid NT Headers signature.')
+                
+        self.FILE_HEADER = self.__unpack_data__(
+            self.__IMAGE_FILE_HEADER_format__,
+            self.__data__[nt_headers_offset+4:],
+            file_offset = nt_headers_offset+4)
+        image_flags = self.retrieve_flags(IMAGE_CHARACTERISTICS, 'IMAGE_FILE_')
+        
+        if not self.FILE_HEADER:
+            raise PEFormatError('File Header missing')
+
+        # Set the image's flags according the the Characteristics member
+        self.set_flags(self.FILE_HEADER, self.FILE_HEADER.Characteristics, image_flags)
+        
+        optional_header_offset =    \
+            nt_headers_offset+4+self.FILE_HEADER.sizeof()
+
+        # Note: location of sections can be controlled from PE header:
+        sections_offset = optional_header_offset + self.FILE_HEADER.SizeOfOptionalHeader
+
+        self.OPTIONAL_HEADER = self.__unpack_data__(
+            self.__IMAGE_OPTIONAL_HEADER_format__,
+            self.__data__[optional_header_offset:],
+            file_offset = optional_header_offset)
+
+        # According to solardesigner's findings for his
+        # Tiny PE project, the optional header does not
+        # need fields beyond "Subsystem" in order to be
+        # loadable by the Windows loader (given that zeroes
+        # are acceptable values and the header is loaded
+        # in a zeroed memory page)
+        # If trying to parse a full Optional Header fails
+        # we try to parse it again with some 0 padding
+        #
+        MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZE = 69
+        
+        if ( self.OPTIONAL_HEADER is None and 
+            len(self.__data__[optional_header_offset:])
+                >= MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZE ):
+        
+            # Add enough zeroes to make up for the unused fields
+            #
+            padding_length = 128
+            
+            # Create padding
+            #
+            padded_data = self.__data__[optional_header_offset:] + (
+                '\0' * padding_length)
+            
+            self.OPTIONAL_HEADER = self.__unpack_data__(
+                self.__IMAGE_OPTIONAL_HEADER_format__,
+                padded_data,
+                file_offset = optional_header_offset)
+         
+            
+        # Check the Magic in the OPTIONAL_HEADER and set the PE file
+        # type accordingly
+        #
+        if self.OPTIONAL_HEADER is not None:
+        
+            if self.OPTIONAL_HEADER.Magic == OPTIONAL_HEADER_MAGIC_PE:
+            
+                self.PE_TYPE = OPTIONAL_HEADER_MAGIC_PE
+                
+            elif self.OPTIONAL_HEADER.Magic == OPTIONAL_HEADER_MAGIC_PE_PLUS:
+    
+                self.PE_TYPE = OPTIONAL_HEADER_MAGIC_PE_PLUS
+            
+                self.OPTIONAL_HEADER = self.__unpack_data__(
+                    self.__IMAGE_OPTIONAL_HEADER64_format__,
+                    self.__data__[optional_header_offset:],
+                    file_offset = optional_header_offset)
+
+                # Again, as explained above, we try to parse
+                # a reduced form of the Optional Header which
+                # is still valid despite not including all
+                # structure members
+                #
+                MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZE = 69+4
+
+                if ( self.OPTIONAL_HEADER is None and 
+                    len(self.__data__[optional_header_offset:])
+                        >= MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZE ):
+                
+                    padding_length = 128
+                    padded_data = self.__data__[optional_header_offset:] + (
+                        '\0' * padding_length)
+                    self.OPTIONAL_HEADER = self.__unpack_data__(
+                        self.__IMAGE_OPTIONAL_HEADER64_format__,
+                        padded_data,
+                        file_offset = optional_header_offset)
+        
+        
+        if not self.FILE_HEADER:
+            raise PEFormatError('File Header missing')
+
+
+        # OC Patch:
+        # Die gracefully if there is no OPTIONAL_HEADER field
+        # 975440f5ad5e2e4a92c4d9a5f22f75c1
+        if self.PE_TYPE is None or self.OPTIONAL_HEADER is None:
+            raise PEFormatError("No Optional Header found, invalid PE32 or PE32+ file")
+            
+        dll_characteristics_flags = self.retrieve_flags(DLL_CHARACTERISTICS, 'IMAGE_DLL_CHARACTERISTICS_')
+
+        # Set the Dll Characteristics flags according the the DllCharacteristics member
+        self.set_flags(
+            self.OPTIONAL_HEADER,
+            self.OPTIONAL_HEADER.DllCharacteristics,
+            dll_characteristics_flags)
+
+
+        self.OPTIONAL_HEADER.DATA_DIRECTORY = []
+        #offset = (optional_header_offset + self.FILE_HEADER.SizeOfOptionalHeader)
+        offset = (optional_header_offset + self.OPTIONAL_HEADER.sizeof())
+            
+        
+        self.NT_HEADERS.FILE_HEADER = self.FILE_HEADER
+        self.NT_HEADERS.OPTIONAL_HEADER = self.OPTIONAL_HEADER
+            
+
+        # The NumberOfRvaAndSizes is sanitized to stay within 
+        # reasonable limits so can be casted to an int
+        #
+        if self.OPTIONAL_HEADER.NumberOfRvaAndSizes > 0x10:
+            self.__warnings.append(
+                'Suspicious NumberOfRvaAndSizes in the Optional Header. ' +
+                'Normal values are never larger than 0x10, the value is: 0x%x' %
+                self.OPTIONAL_HEADER.NumberOfRvaAndSizes )
+                
+        for i in xrange(int(0x7fffffffL & self.OPTIONAL_HEADER.NumberOfRvaAndSizes)):
+
+            if len(self.__data__[offset:]) == 0:
+                break
+                        
+            if len(self.__data__[offset:]) < 8:
+                data = self.__data__[offset:]+'\0'*8
+            else:
+                data = self.__data__[offset:]
+
+            dir_entry = self.__unpack_data__(
+                self.__IMAGE_DATA_DIRECTORY_format__,
+                data,
+                file_offset = offset)
+                
+            if dir_entry is None:
+                break
+
+            # Would fail if missing an entry
+            # 1d4937b2fa4d84ad1bce0309857e70ca offending sample
+            try:
+                dir_entry.name = DIRECTORY_ENTRY[i]
+            except (KeyError, AttributeError):
+                break
+
+            offset += dir_entry.sizeof()
+            
+            self.OPTIONAL_HEADER.DATA_DIRECTORY.append(dir_entry)
+
+            # If the offset goes outside the optional header,
+            # the loop is broken, regardless of how many directories
+            # NumberOfRvaAndSizes says there are
+            #
+            # We assume a normally sized optional header, hence that we do
+            # a sizeof() instead of reading SizeOfOptionalHeader.
+            # Then we add a default number of drectories times their size,
+            # if we go beyond that, we assume the number of directories
+            # is wrong and stop processing
+            if offset >= (optional_header_offset + 
+                self.OPTIONAL_HEADER.sizeof() + 8*16) :
+                
+                break
+                
+                        
+        offset = self.parse_sections(sections_offset)
+        
+        # OC Patch:
+        # There could be a problem if there are no raw data sections
+        # greater than 0
+        # fc91013eb72529da005110a3403541b6 example
+        # Should this throw an exception in the minimum header offset
+        # can't be found?
+        #
+        rawDataPointers = [
+            s.PointerToRawData for s in self.sections if s.PointerToRawData>0]
+            
+        if len(rawDataPointers) > 0:
+            lowest_section_offset = min(rawDataPointers)
+        else:
+            lowest_section_offset = None
+
+        if not lowest_section_offset or lowest_section_offset<offset:
+            self.header = self.__data__[:offset]
+        else:
+            self.header = self.__data__[:lowest_section_offset]
+        
+
+        # Check whether the entry point lies within a section
+        #
+        if self.get_section_by_rva(self.OPTIONAL_HEADER.AddressOfEntryPoint) is not None:
+        
+            # Check whether the entry point lies within the file
+            #
+            ep_offset = self.get_offset_from_rva(self.OPTIONAL_HEADER.AddressOfEntryPoint)
+            if ep_offset > len(self.__data__):
+            
+                self.__warnings.append(
+                    'Possibly corrupt file. AddressOfEntryPoint lies outside the file. ' +
+                    'AddressOfEntryPoint: 0x%x' %
+                    self.OPTIONAL_HEADER.AddressOfEntryPoint )
+            
+        else:
+
+            self.__warnings.append(
+                'AddressOfEntryPoint lies outside the sections\' boundaries. ' +
+                'AddressOfEntryPoint: 0x%x' %
+                self.OPTIONAL_HEADER.AddressOfEntryPoint )
+                
+        
+        if not fast_load:
+            self.parse_data_directories()
+
+
+    def get_warnings(self):
+        """Return the list of warnings.
+        
+        Non-critical problems found when parsing the PE file are
+        appended to a list of warnings. This method returns the
+        full list.
+        """
+    
+        return self.__warnings
+        
+        
+    def show_warnings(self):
+        """Print the list of warnings.
+        
+        Non-critical problems found when parsing the PE file are
+        appended to a list of warnings. This method prints the
+        full list to standard output.
+        """
+    
+        for warning in self.__warnings:
+            print '>', warning
+
+
+    def full_load(self):
+        """Process the data directories.
+        
+        This mathod will load the data directories which might not have
+        been loaded if the "fast_load" option was used.
+        """
+        
+        self.parse_data_directories()
+        
+        
+    def write(self, filename=None):
+        """Write the PE file.
+        
+        This function will process all headers and components
+        of the PE file and include all changes made (by just
+        assigning to attributes in the PE objects) and write
+        the changes back to a file whose name is provided as
+        an argument. The filename is optional.
+        The data to be written to the file will be returned
+        as a 'str' object.
+        """
+    
+        file_data = list(self.__data__)
+        for struct in self.__structures__:
+        
+            struct_data = list(struct.__pack__())
+            offset = struct.get_file_offset()
+            
+            file_data[offset:offset+len(struct_data)] = struct_data
+            
+        if hasattr(self, 'VS_VERSIONINFO'):
+            if hasattr(self, 'FileInfo'):
+                for entry in self.FileInfo:
+                    if hasattr(entry, 'StringTable'):
+                        for st_entry in entry.StringTable:
+                            for key, entry in st_entry.entries.items():
+                            
+                                offsets = st_entry.entries_offsets[key]
+                                lengths = st_entry.entries_lengths[key]
+                                
+                                if len( entry ) > lengths[1]:
+
+                                    uc = zip(
+                                            list(entry[:lengths[1]]), ['\0'] * lengths[1] )
+                                    l = list()
+                                    map(l.extend, uc)
+
+                                    file_data[ 
+                                        offsets[1] : offsets[1] + lengths[1]*2 ] = l
+                                        
+                                else:
+                                    
+                                    uc = zip(
+                                            list(entry), ['\0'] * len(entry) )
+                                    l = list()
+                                    map(l.extend, uc)
+
+                                    file_data[ 
+                                        offsets[1] : offsets[1] + len(entry)*2 ] = l
+
+                                    remainder = lengths[1] - len(entry)
+                                    file_data[ 
+                                        offsets[1] + len(entry)*2 : 
+                                        offsets[1] + lengths[1]*2 ] = [
+                                            u'\0' ] * remainder*2
+
+        new_file_data = ''.join( [ chr(ord(c)) for c in file_data ] )
+
+        if filename:
+            f = file(filename, 'wb+')
+            f.write(new_file_data)
+            f.close()
+
+        return new_file_data
+        
+
+                
+    def parse_sections(self, offset):
+        """Fetch the PE file sections.
+        
+        The sections will be readily available in the "sections" attribute.
+        Its attributes will contain all the section information plus "data"
+        a buffer containing the section's data.
+        
+        The "Characteristics" member will be processed and attributes 
+        representing the section characteristics (with the 'IMAGE_SCN_'
+        string trimmed from the constant's names) will be added to the
+        section instance.
+        
+        Refer to the SectionStructure class for additional info.
+        """
+        
+        self.sections = []
+        
+        for i in xrange(self.FILE_HEADER.NumberOfSections):
+            section = SectionStructure(self.__IMAGE_SECTION_HEADER_format__)
+            if not section:
+                break
+            section_offset = offset + section.sizeof() * i
+            section.set_file_offset(section_offset)
+            section.__unpack__(self.__data__[section_offset:])
+            self.__structures__.append(section)
+                        
+            if section.SizeOfRawData > len(self.__data__):
+                self.__warnings.append(
+                    ('Error parsing section %d. ' % i) +
+                    'SizeOfRawData is larger than file.')
+
+            if section.PointerToRawData > len(self.__data__):
+                self.__warnings.append(
+                    ('Error parsing section %d. ' % i) +
+                    'PointerToRawData points beyond the end of the file.')
+
+            if section.Misc_VirtualSize > 0x10000000:
+                self.__warnings.append(
+                    ('Suspicious value found parsing section %d. ' % i) +
+                    'VirtualSize is extremely large > 256MiB.')
+
+            if section.VirtualAddress > 0x10000000:
+                self.__warnings.append(
+                    ('Suspicious value found parsing section %d. ' % i) +
+                    'VirtualAddress is beyond 0x10000000.')
+
+            #
+            # Some packer used a non-aligned PointerToRawData in the sections,
+            # which causes several common tools not to load the section data
+            # properly as they blindly read from the indicated offset.
+            # It seems that Windows will round the offset down to the largest
+            # offset multiple of FileAlignment which is smaller than
+            # PointerToRawData. The following code will do the same.
+            #
+            
+            #alignment = self.OPTIONAL_HEADER.FileAlignment
+            section_data_start = section.PointerToRawData
+            
+            if ( self.OPTIONAL_HEADER.FileAlignment != 0 and 
+                (section.PointerToRawData % self.OPTIONAL_HEADER.FileAlignment) != 0):
+                self.__warnings.append(
+                    ('Error parsing section %d. ' % i) +
+                    'Suspicious value for FileAlignment in the Optional Header. ' +
+                    'Normally the PointerToRawData entry of the sections\' structures ' +
+                    'is a multiple of FileAlignment, this might imply the file ' +
+                    'is trying to confuse tools which parse this incorrectly')
+            
+            section_data_end = section_data_start+section.SizeOfRawData
+            section.set_data(self.__data__[section_data_start:section_data_end])
+            
+            section_flags = self.retrieve_flags(SECTION_CHARACTERISTICS, 'IMAGE_SCN_')
+            
+            # Set the section's flags according the the Characteristics member
+            self.set_flags(section, section.Characteristics, section_flags)
+
+            if ( section.__dict__.get('IMAGE_SCN_MEM_WRITE', False)  and 
+                section.__dict__.get('IMAGE_SCN_MEM_EXECUTE', False) ):
+                
+                self.__warnings.append(
+                    ('Suspicious flags set for section %d. ' % i) +
+                    'Both IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE are set.' +
+                    'This might indicate a packed executable.')
+
+            self.sections.append(section)
+            
+        if self.FILE_HEADER.NumberOfSections > 0 and self.sections:
+            return offset + self.sections[0].sizeof()*self.FILE_HEADER.NumberOfSections
+        else:
+            return offset
+
+        
+    def retrieve_flags(self, flag_dict, flag_filter):
+        """Read the flags from a dictionary and return them in a usable form.
+        
+        Will return a list of (flag, value) for all flags in "flag_dict"
+        matching the filter "flag_filter".
+        """
+        
+        return [(f[0], f[1]) for f in flag_dict.items() if
+                isinstance(f[0], str) and f[0].startswith(flag_filter)]
+
+                
+    def set_flags(self, obj, flag_field, flags):
+        """Will process the flags and set attributes in the object accordingly.
+        
+        The object "obj" will gain attritutes named after the flags provided in
+        "flags" and valued True/False, matching the results of applyin each
+        flag value from "flags" to flag_field.
+        """
+    
+        for flag in flags:
+            if flag[1] & flag_field:
+                setattr(obj, flag[0], True)
+            else:
+                setattr(obj, flag[0], False)
+    
+    
+            
+    def parse_data_directories(self):
+        """Parse and process the PE file's data directories."""
+        
+        directory_parsing = (
+            ('IMAGE_DIRECTORY_ENTRY_IMPORT', self.parse_import_directory),
+            ('IMAGE_DIRECTORY_ENTRY_EXPORT', self.parse_export_directory),
+            ('IMAGE_DIRECTORY_ENTRY_RESOURCE', self.parse_resources_directory),
+            ('IMAGE_DIRECTORY_ENTRY_DEBUG', self.parse_debug_directory),
+            ('IMAGE_DIRECTORY_ENTRY_BASERELOC', self.parse_relocations_directory),
+            ('IMAGE_DIRECTORY_ENTRY_TLS', self.parse_directory_tls),
+            ('IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT', self.parse_delay_import_directory),
+            ('IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT', self.parse_directory_bound_imports) )
+            
+        for entry in directory_parsing:
+            # OC Patch:
+            #
+            try:
+                dir_entry = self.OPTIONAL_HEADER.DATA_DIRECTORY[
+                    DIRECTORY_ENTRY[entry[0]]]
+            except IndexError:
+                break
+            if dir_entry.VirtualAddress:
+                value = entry[1](dir_entry.VirtualAddress, dir_entry.Size)
+                if value:
+                    setattr(self, entry[0][6:], value)
+        
+        
+    def parse_directory_bound_imports(self, rva, size):
+        """"""
+        
+        bnd_descr = Structure(self.__IMAGE_BOUND_IMPORT_DESCRIPTOR_format__)
+        bnd_descr_size = bnd_descr.sizeof()
+        start = rva
+        
+        bound_imports = []
+        while True:
+
+            bnd_descr = self.__unpack_data__(
+                self.__IMAGE_BOUND_IMPORT_DESCRIPTOR_format__,
+                   self.__data__[rva:rva+bnd_descr_size],
+                   file_offset = rva)
+            if bnd_descr is None:
+                # If can't parse directory then silently return.
+                # This directory does not necesarily have to be valid to
+                # still have a valid PE file
+
+                self.__warnings.append(
+                    'The Bound Imports directory exists but can\'t be parsed.')
+
+                return
+                   
+            if bnd_descr.all_zeroes():
+                break
+                
+            rva += bnd_descr.sizeof()
+            
+            forwarder_refs = []
+            for idx in xrange(bnd_descr.NumberOfModuleForwarderRefs):
+                # Both structures IMAGE_BOUND_IMPORT_DESCRIPTOR and
+                # IMAGE_BOUND_FORWARDER_REF have the same size.
+                bnd_frwd_ref = self.__unpack_data__(
+                    self.__IMAGE_BOUND_FORWARDER_REF_format__,
+                    self.__data__[rva:rva+bnd_descr_size],
+                    file_offset = rva)
+                # OC Patch:
+                if not bnd_frwd_ref:
+                    raise PEFormatError(
+                        "IMAGE_BOUND_FORWARDER_REF cannot be read")
+                rva += bnd_frwd_ref.sizeof()
+                
+                name_str =  self.get_string_from_data(
+                    start+bnd_frwd_ref.OffsetModuleName, self.__data__)
+                    
+                if not name_str:
+                    break
+                forwarder_refs.append(BoundImportRefData(
+                    struct = bnd_frwd_ref,
+                    name = name_str))
+                
+            name_str = self.get_string_from_data(
+                start+bnd_descr.OffsetModuleName, self.__data__)
+                
+            if not name_str:
+                break
+            bound_imports.append(
+                BoundImportDescData(
+                    struct = bnd_descr,
+                    name = name_str,
+                    entries = forwarder_refs))
+                    
+        return bound_imports
+
+        
+    def parse_directory_tls(self, rva, size):
+        """"""
+            
+        if self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE:
+            format = self.__IMAGE_TLS_DIRECTORY_format__
+            
+        elif self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE_PLUS:
+            format = self.__IMAGE_TLS_DIRECTORY64_format__
+
+        tls_struct = self.__unpack_data__(
+            format,
+            self.get_data(rva),
+            file_offset = self.get_offset_from_rva(rva))
+            
+        if not tls_struct:
+            return None
+                
+        return TlsData( struct = tls_struct )
+    
+    
+    def parse_relocations_directory(self, rva, size):
+        """"""
+        
+        rlc = Structure(self.__IMAGE_BASE_RELOCATION_format__)
+        rlc_size = rlc.sizeof()
+        end = rva+size
+        
+        relocations = []
+        while rva<end:
+            
+            # OC Patch:
+            # Malware that has bad rva entries will cause an error.
+            # Just continue on after an exception
+            #
+            try:
+                rlc = self.__unpack_data__(
+                    self.__IMAGE_BASE_RELOCATION_format__,
+                    self.get_data(rva, rlc_size),
+                    file_offset = self.get_offset_from_rva(rva) )
+            except PEFormatError:
+                self.__warnings.append(
+                    'Invalid relocation information. Can\'t read ' +
+                    'data at RVA: 0x%x' % rva)
+                rlc = None
+            
+            if not rlc:
+                break
+                
+            reloc_entries = self.parse_relocations(
+                rva+rlc_size, rlc.VirtualAddress, rlc.SizeOfBlock-rlc_size)
+                
+            relocations.append(
+                BaseRelocationData(
+                    struct = rlc,
+                    entries = reloc_entries))
+            
+            if not rlc.SizeOfBlock:
+                break
+            rva += rlc.SizeOfBlock
+            
+        return relocations
+    
+        
+    def parse_relocations(self, data_rva, rva, size):
+        """"""
+        
+        data = self.get_data(data_rva, size)
+        
+        entries = []
+        for idx in xrange(len(data)/2):
+            word = struct.unpack('<H', data[idx*2:(idx+1)*2])[0]
+            reloc_type = (word>>12)
+            reloc_offset = (word&0x0fff)
+            entries.append(
+                RelocationData(
+                    type = reloc_type,
+                    rva = reloc_offset+rva))
+            
+        return entries
+
+        
+    def parse_debug_directory(self, rva, size):
+        """"""
+            
+        dbg = Structure(self.__IMAGE_DEBUG_DIRECTORY_format__)
+        dbg_size = dbg.sizeof()
+        
+        debug = []
+        for idx in xrange(size/dbg_size):
+            try:
+                data = self.get_data(rva+dbg_size*idx, dbg_size)
+            except PEFormatError, e:
+                self.__warnings.append(
+                    'Invalid debug information. Can\'t read ' +
+                    'data at RVA: 0x%x' % rva)
+                return None
+                
+            dbg = self.__unpack_data__(
+                self.__IMAGE_DEBUG_DIRECTORY_format__,
+                data, file_offset = self.get_offset_from_rva(rva+dbg_size*idx))
+                
+            if not dbg:
+                return None
+                
+            debug.append(
+                DebugData(
+                    struct = dbg))
+            
+        return debug
+
+                        
+    def parse_resources_directory(self, rva, size=0, base_rva = None, level = 0):
+        """Parse the resources directory.
+        
+        Given the rva of the resources directory, it will process all
+        its entries.
+        
+        The root will have the corresponding member of its structure,
+        IMAGE_RESOURCE_DIRECTORY plus 'entries', a list of all the
+        entries in the directory.
+        
+        Those entries will have, correspondingly, all the structure's
+        members (IMAGE_RESOURCE_DIRECTORY_ENTRY) and an additional one,
+        "directory", pointing to the IMAGE_RESOURCE_DIRECTORY structure
+        representing upper layers of the tree. This one will also have
+        an 'entries' attribute, pointing to the 3rd, and last, level.
+        Another directory with more entries. Those last entries will
+        have a new atribute (both 'leaf' or 'data_entry' can be used to
+        access it). This structure finally points to the resource data.
+        All the members of this structure, IMAGE_RESOURCE_DATA_ENTRY,
+        are available as its attributes.
+        """
+        
+        # OC Patch:
+        original_rva = rva
+        
+        if base_rva is None:
+            base_rva = rva
+        
+        resources_section = self.get_section_by_rva(rva)
+        
+        try:
+            # If the RVA is invalid all would blow up. Some EXEs seem to be
+            # specially nasty and have an invalid RVA.
+            data = self.get_data(rva)
+        except PEFormatError, e:
+            self.__warnings.append(
+                'Invalid resources directory. Can\'t read ' +
+                'directory data at RVA: 0x%x' % rva)
+            return None
+            
+        # Get the resource directory structure, that is, the header
+        # of the table preceding the actual entries
+        #
+        resource_dir = self.__unpack_data__(
+            self.__IMAGE_RESOURCE_DIRECTORY_format__, data,
+            file_offset = self.get_offset_from_rva(rva) )
+        if resource_dir is None:
+            # If can't parse resources directory then silently return.
+            # This directory does not necesarily have to be valid to
+            # still have a valid PE file
+            self.__warnings.append(
+                'Invalid resources directory. Can\'t parse ' +
+                'directory data at RVA: 0x%x' % rva)
+            return None
+        
+        dir_entries = []
+        
+        # Advance the rva to the positon immediately following the directory
+        # table header and pointing to the first entry in the table
+        #
+        rva += resource_dir.sizeof()
+        
+        number_of_entries = (
+            resource_dir.NumberOfNamedEntries +
+            resource_dir.NumberOfIdEntries )
+            
+        strings_to_postprocess = list()
+        
+        for idx in xrange(number_of_entries):
+            
+            res = self.parse_resource_entry(rva)
+            if res is None:
+                self.__warnings.append(
+                    'Error parsing the resources directory, ' +
+                    'Entry %d is invalid, RVA = 0x%x. ' % 
+                    (idx, rva) )
+                break
+            
+
+            entry_name = None
+            entry_id = None
+            
+            # If all named entries have been processed, only Id ones
+            # remain
+            
+            if idx >= resource_dir.NumberOfNamedEntries:
+                entry_id = res.Name
+            else:
+                ustr_offset = base_rva+res.NameOffset
+                try:
+                    #entry_name = self.get_string_u_at_rva(ustr_offset, max_length=16)
+                    entry_name = UnicodeStringWrapperPostProcessor(self, ustr_offset)
+                    strings_to_postprocess.append(entry_name)
+                    
+                except PEFormatError, excp:
+                    self.__warnings.append(
+                        'Error parsing the resources directory, ' +
+                        'attempting to read entry name. ' +
+                        'Can\'t read unicode string at offset 0x%x' % 
+                        (ustr_offset) )
+                
+                
+            if res.DataIsDirectory:
+                # OC Patch:
+                #
+                # One trick malware can do is to recursively reference
+                # the next directory. This causes hilarity to ensue when
+                # trying to parse everything correctly.
+                # If the original RVA given to this function is equal to
+                # the next one to parse, we assume that it's a trick.
+                # Instead of raising a PEFormatError this would skip some
+                # reasonable data so we just break.
+                #
+                # 9ee4d0a0caf095314fd7041a3e4404dc is the offending sample
+                if original_rva == (base_rva + res.OffsetToDirectory):
+                    
+                    break
+                    
+                else:
+                    entry_directory = self.parse_resources_directory(
+                        base_rva+res.OffsetToDirectory,
+                        base_rva=base_rva, level = level+1)
+
+                if not entry_directory:
+                    break
+                dir_entries.append(
+                    ResourceDirEntryData(
+                        struct = res,
+                        name = entry_name,
+                        id = entry_id,
+                        directory = entry_directory))
+
+            else:
+                struct = self.parse_resource_data_entry(
+                    base_rva + res.OffsetToDirectory)
+
+                if struct:
+                    entry_data = ResourceDataEntryData(
+                        struct = struct,
+                        lang = res.Name & 0xff,
+                        sublang = (res.Name>>8) & 0xff)
+                        
+                    dir_entries.append(
+                        ResourceDirEntryData(
+                            struct = res,
+                            name = entry_name,
+                            id = entry_id,
+                            data = entry_data))
+                    
+                else:
+                    break
+
+
+                
+            # Check if this entry contains version information
+            #
+            if level == 0 and res.Id == RESOURCE_TYPE['RT_VERSION']:
+                if len(dir_entries)>0:
+                    last_entry = dir_entries[-1]
+                    
+                rt_version_struct = None
+                try:
+                    rt_version_struct = last_entry.directory.entries[0].directory.entries[0].data.struct
+                except:
+                    # Maybe a malformed directory structure...?
+                    # Lets ignore it
+                    pass
+                    
+                if rt_version_struct is not None:
+                    self.parse_version_information(rt_version_struct)
+    
+            rva += res.sizeof()
+            
+                    
+        string_rvas = [s.get_rva() for s in strings_to_postprocess]
+        string_rvas.sort()
+        
+        for idx, s in enumerate(strings_to_postprocess):
+            s.render_pascal_16()
+            
+            
+        resource_directory_data = ResourceDirData(
+            struct = resource_dir,
+            entries = dir_entries)
+                        
+        return resource_directory_data
+        
+            
+    def parse_resource_data_entry(self, rva):
+        """Parse a data entry from the resources directory."""
+    
+        try:
+            # If the RVA is invalid all would blow up. Some EXEs seem to be
+            # specially nasty and have an invalid RVA.
+            data = self.get_data(rva)
+        except PEFormatError, excp:
+            self.__warnings.append(
+                'Error parsing a resource directory data entry, ' +
+                'the RVA is invalid: 0x%x' % ( rva ) )
+            return None
+            
+        data_entry = self.__unpack_data__(
+            self.__IMAGE_RESOURCE_DATA_ENTRY_format__, data,
+            file_offset = self.get_offset_from_rva(rva) )
+            
+        return data_entry
+
+        
+    def parse_resource_entry(self, rva):
+        """Parse a directory entry from the resources directory."""
+
+        resource = self.__unpack_data__(
+            self.__IMAGE_RESOURCE_DIRECTORY_ENTRY_format__, self.get_data(rva),
+            file_offset = self.get_offset_from_rva(rva) )
+            
+        if resource is None:
+            return None
+            
+        #resource.NameIsString = (resource.Name & 0x80000000L) >> 31
+        resource.NameOffset = resource.Name & 0x7FFFFFFFL
+        
+        resource.__pad = resource.Name & 0xFFFF0000L
+        resource.Id = resource.Name & 0x0000FFFFL
+        
+        resource.DataIsDirectory = (resource.OffsetToData & 0x80000000L) >> 31
+        resource.OffsetToDirectory = resource.OffsetToData & 0x7FFFFFFFL
+        
+        return resource
+            
+            
+    def parse_version_information(self, version_struct):
+        """Parse version information structure.
+        
+        The date will be made available in three attributes of the PE object.
+        
+        VS_VERSIONINFO     will contain the first three fields of the main structure:
+            'Length', 'ValueLength', and 'Type'
+            
+        VS_FIXEDFILEINFO    will hold the rest of the fields, accessible as sub-attributes:
+            'Signature', 'StrucVersion', 'FileVersionMS', 'FileVersionLS',
+            'ProductVersionMS', 'ProductVersionLS', 'FileFlagsMask', 'FileFlags',
+            'FileOS', 'FileType', 'FileSubtype', 'FileDateMS', 'FileDateLS'
+            
+        FileInfo    is a list of all StringFileInfo and VarFileInfo structures.
+        
+        StringFileInfo structures will have a list as an attribute named 'StringTable'
+        containing all the StringTable structures. Each of those structures contains a 
+        dictionary 'entries' with all the key/value version information string pairs.
+        
+        VarFileInfo structures will have a list as an attribute named 'Var' containing
+        all Var structures. Each Var structure will have a dictionary as an attribute
+        named 'entry' which will contain the name and value of the Var.
+        """
+    
+    
+        # Retrieve the data for the version info resource
+        #
+        start_offset = self.get_offset_from_rva( version_struct.OffsetToData )
+        raw_data = self.__data__[ start_offset : start_offset+version_struct.Size ]
+        
+        
+        # Map the main structure and the subsequent string
+        #    
+        versioninfo_struct = self.__unpack_data__(
+            self.__VS_VERSIONINFO_format__, raw_data, 
+            file_offset = start_offset )
+            
+        if versioninfo_struct is None:
+            return 
+            
+        ustr_offset = version_struct.OffsetToData + versioninfo_struct.sizeof()
+        try:
+            versioninfo_string = self.get_string_u_at_rva( ustr_offset )
+        except PEFormatError, excp:
+            self.__warnings.append(
+                'Error parsing the version information, ' +
+                'attempting to read VS_VERSION_INFO string. Can\'t ' +
+                'read unicode string at offset 0x%x' % (
+                ustr_offset ) )
+                
+            versioninfo_string = None
+         
+        # If the structure does not contain the expected name, it's assumed to be invalid
+        #            
+        if versioninfo_string != u'VS_VERSION_INFO':
+
+            self.__warnings.append('Invalid VS_VERSION_INFO block')
+            return
+
+
+        # Set the PE object's VS_VERSIONINFO to this one
+        #
+        self.VS_VERSIONINFO = versioninfo_struct
+
+        # The the Key attribute to point to the unicode string identifying the structure
+        #        
+        self.VS_VERSIONINFO.Key = versioninfo_string
+
+
+        # Process the fixed version information, get the offset and structure
+        #
+        fixedfileinfo_offset = self.dword_align(
+            versioninfo_struct.sizeof() + 2 * (len(versioninfo_string) + 1),
+            version_struct.OffsetToData)
+        fixedfileinfo_struct = self.__unpack_data__(
+            self.__VS_FIXEDFILEINFO_format__,
+            raw_data[fixedfileinfo_offset:], 
+            file_offset = start_offset+fixedfileinfo_offset )
+
+        if not fixedfileinfo_struct:
+            return
+
+
+        # Set the PE object's VS_FIXEDFILEINFO to this one
+        #
+        self.VS_FIXEDFILEINFO = fixedfileinfo_struct
+        
+        
+        # Start parsing all the StringFileInfo and VarFileInfo structures
+        #
+        
+        # Get the first one
+        #
+        stringfileinfo_offset = self.dword_align(
+            fixedfileinfo_offset + fixedfileinfo_struct.sizeof(),
+            version_struct.OffsetToData)
+        original_stringfileinfo_offset = stringfileinfo_offset
+        
+        
+        # Set the PE object's attribute that will contain them all.
+        #
+        self.FileInfo = list()
+
+
+        while True:
+        
+            # Process the StringFileInfo/VarFileInfo struct
+            #
+            stringfileinfo_struct = self.__unpack_data__(
+                self.__StringFileInfo_format__, 
+                raw_data[stringfileinfo_offset:], 
+                file_offset = start_offset+stringfileinfo_offset )
+                
+            if stringfileinfo_struct is None:
+                self.__warnings.append(
+                    'Error parsing StringFileInfo/VarFileInfo struct' )
+                return None
+            
+            # Get the subsequent string defining the structure.
+            #
+            ustr_offset = ( version_struct.OffsetToData + 
+                stringfileinfo_offset + versioninfo_struct.sizeof() )
+            try:
+                stringfileinfo_string = self.get_string_u_at_rva( ustr_offset )
+            except PEFormatError, excp:
+                self.__warnings.append(
+                    'Error parsing the version information, ' +
+                    'attempting to read StringFileInfo string. Can\'t ' +
+                    'read unicode string at offset 0x%x' %  ( ustr_offset ) )
+                break
+        
+            # Set such string as the Key attribute
+            #
+            stringfileinfo_struct.Key = stringfileinfo_string
+            
+            
+            # Append the structure to the PE object's list
+            #
+            self.FileInfo.append(stringfileinfo_struct)
+        
+        
+            # Parse a StringFileInfo entry
+            #
+            if stringfileinfo_string == u'StringFileInfo':
+                
+                if stringfileinfo_struct.Type == 1 and stringfileinfo_struct.ValueLength == 0:
+            
+                    stringtable_offset = self.dword_align(
+                        stringfileinfo_offset + stringfileinfo_struct.sizeof() + 
+                            2*(len(stringfileinfo_string)+1),
+                        version_struct.OffsetToData)
+                  
+                    stringfileinfo_struct.StringTable = list()
+
+                    # Process the String Table entries
+                    #
+                    while True:
+                        stringtable_struct = self.__unpack_data__(
+                            self.__StringTable_format__,
+                            raw_data[stringtable_offset:], 
+                            file_offset = start_offset+stringtable_offset )
+                            
+                        if not stringtable_struct:
+                            break
+                            
+                        ustr_offset = ( version_struct.OffsetToData + stringtable_offset + 
+                            stringtable_struct.sizeof() )
+                        try:
+                            stringtable_string = self.get_string_u_at_rva( ustr_offset )
+                        except PEFormatError, excp:
+                            self.__warnings.append(
+                                'Error parsing the version information, ' +
+                                'attempting to read StringTable string. Can\'t ' +
+                                'read unicode string at offset 0x%x' % ( ustr_offset ) )
+                            break
+                        
+                        stringtable_struct.LangID = stringtable_string
+                        stringtable_struct.entries = dict()
+                        stringtable_struct.entries_offsets = dict()
+                        stringtable_struct.entries_lengths = dict()
+                        stringfileinfo_struct.StringTable.append(stringtable_struct)
+            
+                        entry_offset = self.dword_align(
+                            stringtable_offset + stringtable_struct.sizeof() +
+                                2*(len(stringtable_string)+1),
+                            version_struct.OffsetToData)
+            
+                        # Process all entries in the string table
+                        #
+            
+                        while entry_offset < stringtable_offset + stringtable_struct.Length:
+                    
+                            string_struct = self.__unpack_data__(
+                                self.__String_format__, raw_data[entry_offset:], 
+                                file_offset = start_offset+entry_offset )
+                                
+                            if not string_struct:
+                                break
+                                
+                            ustr_offset = ( version_struct.OffsetToData + entry_offset +
+                                string_struct.sizeof() )
+                            try:
+                                key = self.get_string_u_at_rva( ustr_offset )
+                                key_offset = self.get_offset_from_rva( ustr_offset )
+                            except PEFormatError, excp:
+                                self.__warnings.append(
+                                    'Error parsing the version information, ' +
+                                    'attempting to read StringTable Key string. Can\'t ' +
+                                    'read unicode string at offset 0x%x' % ( ustr_offset ) )
+                                break
+                                
+                            value_offset = self.dword_align(
+                                2*(len(key)+1) + entry_offset + string_struct.sizeof(),
+                                version_struct.OffsetToData)
+            
+                            ustr_offset = version_struct.OffsetToData + value_offset
+                            try:
+                                value = self.get_string_u_at_rva( ustr_offset,
+                                    max_length = string_struct.ValueLength )
+                                value_offset = self.get_offset_from_rva( ustr_offset )
+                            except PEFormatError, excp:
+                                self.__warnings.append(
+                                    'Error parsing the version information, ' +
+                                    'attempting to read StringTable Value string. ' +
+                                    'Can\'t read unicode string at offset 0x%x' % (
+                                    ustr_offset ) )
+                                break
+                                
+                            if string_struct.Length == 0:
+                                entry_offset = stringtable_offset + stringtable_struct.Length
+                            else:
+                                entry_offset = self.dword_align(
+                                    string_struct.Length+entry_offset, version_struct.OffsetToData)
+                                
+                            key_as_char = []
+                            for c in key:
+                                if ord(c)>128:
+                                    key_as_char.append('\\x%02x' %ord(c))
+                                else:
+                                    key_as_char.append(c)
+                            
+                            key_as_char = ''.join(key_as_char)
+
+                            setattr(stringtable_struct, key_as_char, value)
+                            stringtable_struct.entries[key] = value
+                            stringtable_struct.entries_offsets[key] = (key_offset, value_offset)
+                            stringtable_struct.entries_lengths[key] = (len(key), len(value))
+                            
+                    
+                        stringtable_offset = self.dword_align(
+                            stringtable_struct.Length + stringtable_offset,
+                            version_struct.OffsetToData)
+                        if stringtable_offset >= stringfileinfo_struct.Length:
+                            break
+                    
+            # Parse a VarFileInfo entry
+            #
+            elif stringfileinfo_string == u'VarFileInfo':
+            
+                varfileinfo_struct = stringfileinfo_struct
+                varfileinfo_struct.name = 'VarFileInfo'
+            
+                if varfileinfo_struct.Type == 1 and varfileinfo_struct.ValueLength == 0:
+              
+                    var_offset = self.dword_align(
+                        stringfileinfo_offset + varfileinfo_struct.sizeof() +
+                            2*(len(stringfileinfo_string)+1),
+                        version_struct.OffsetToData)
+                        
+                    varfileinfo_struct.Var = list()
+              
+                    # Process all entries
+                    #
+
+                    while True:
+                        var_struct = self.__unpack_data__(
+                            self.__Var_format__,
+                            raw_data[var_offset:], 
+                            file_offset = start_offset+var_offset )
+                            
+                        if not var_struct:
+                            break
+                            
+                        ustr_offset = ( version_struct.OffsetToData + var_offset + 
+                            var_struct.sizeof() )
+                        try:
+                            var_string = self.get_string_u_at_rva( ustr_offset )
+                        except PEFormatError, excp:
+                            self.__warnings.append(
+                                'Error parsing the version information, ' +
+                                'attempting to read VarFileInfo Var string. ' +
+                                'Can\'t read unicode string at offset 0x%x' % (ustr_offset))
+                            break
+
+                        
+                        varfileinfo_struct.Var.append(var_struct)
+                
+                        varword_offset = self.dword_align(
+                            2*(len(var_string)+1) + var_offset + var_struct.sizeof(),
+                            version_struct.OffsetToData)
+                        orig_varword_offset = varword_offset
+                            
+                        while varword_offset < orig_varword_offset + var_struct.ValueLength:
+                            word1 = self.get_word_from_data(
+                                raw_data[varword_offset:varword_offset+2], 0)
+                            word2 = self.get_word_from_data(
+                                raw_data[varword_offset+2:varword_offset+4], 0)
+                            varword_offset += 4
+        
+                            var_struct.entry = {var_string: '0x%04x 0x%04x' % (word1, word2)}
+
+                        var_offset = self.dword_align(
+                            var_offset+var_struct.Length, version_struct.OffsetToData)
+                            
+                        if var_offset <= var_offset+var_struct.Length:
+                            break
+              
+              
+              
+            # Increment and align the offset
+            #
+            stringfileinfo_offset = self.dword_align(
+                stringfileinfo_struct.Length+stringfileinfo_offset,
+                version_struct.OffsetToData)
+          
+            # Check if all the StringFileInfo and VarFileInfo items have been processed
+            #
+            if stringfileinfo_struct.Length == 0 or stringfileinfo_offset >= versioninfo_struct.Length:
+                break
+            
+            
+                            
+    def parse_export_directory(self, rva, size):
+        """Parse the export directory.
+        
+        Given the rva of the export directory, it will process all
+        its entries.
+        
+        The exports will be made available through a list "exports"
+        containing a tuple with the following elements:
+        
+            (ordinal, symbol_address, symbol_name)
+            
+        And also through a dicionary "exports_by_ordinal" whose keys
+        will be the ordinals and the values tuples of the from:
+        
+            (symbol_address, symbol_name)
+            
+        The symbol addresses are relative, not absolute.
+        """
+    
+        try:
+            export_dir =  self.__unpack_data__(
+                self.__IMAGE_EXPORT_DIRECTORY_format__, self.get_data(rva),
+                file_offset = self.get_offset_from_rva(rva) )
+        except PEFormatError:
+            self.__warnings.append(
+                'Error parsing export directory at RVA: 0x%x' % ( rva ) )
+            return
+        
+        if not export_dir:
+            return
+        
+        try:
+            address_of_names = self.get_data(
+                export_dir.AddressOfNames, export_dir.NumberOfNames*4)
+            address_of_name_ordinals = self.get_data(
+                export_dir.AddressOfNameOrdinals, export_dir.NumberOfNames*4)
+            address_of_functions = self.get_data(
+                export_dir.AddressOfFunctions, export_dir.NumberOfFunctions*4)
+        except PEFormatError:
+            self.__warnings.append(
+                'Error parsing export directory at RVA: 0x%x' % ( rva ) )
+            return
+            
+        exports = []
+        
+        for i in xrange(export_dir.NumberOfNames):
+        
+                
+            symbol_name = self.get_string_at_rva(
+                self.get_dword_from_data(address_of_names, i))
+            
+            symbol_ordinal = self.get_word_from_data(
+                address_of_name_ordinals, i)
+                
+            
+            if symbol_ordinal*4<len(address_of_functions):
+                symbol_address = self.get_dword_from_data(
+                    address_of_functions, symbol_ordinal)
+            else:
+                # Corrupt? a bad pointer... we assume it's all
+                # useless, no exports
+                return None
+            
+            # If the funcion's rva points within the export directory
+            # it will point to a string with the forwarded symbol's string
+            # instead of pointing the the function start address.
+            
+            if symbol_address>=rva and symbol_address<rva+size:
+                forwarder_str = self.get_string_at_rva(symbol_address)
+            else:
+                forwarder_str = None
+        
+            
+            exports.append(
+                ExportData(
+                    ordinal = export_dir.Base+symbol_ordinal,
+                    address = symbol_address,
+                    name = symbol_name,
+                    forwarder = forwarder_str))
+                    
+        ordinals = [exp.ordinal for exp in exports]
+        
+        for idx in xrange(export_dir.NumberOfFunctions):
+
+            if not idx+export_dir.Base in ordinals:
+                symbol_address = self.get_dword_from_data(
+                    address_of_functions, 
+                    idx)
+                
+                #
+                # Checking for forwarder again.
+                #
+                if symbol_address>=rva and symbol_address<rva+size:
+                    forwarder_str = self.get_string_at_rva(symbol_address)
+                else:
+                    forwarder_str = None
+                    
+                exports.append(
+                    ExportData(
+                        ordinal = export_dir.Base+idx,
+                        address = symbol_address,
+                        name = None,
+                        forwarder = forwarder_str))
+                      
+        return ExportDirData(
+                struct = export_dir,
+                symbols = exports)
+        
+                    
+    def dword_align(self, offset, base):
+        offset += base
+        return (offset+3) - ((offset+3)%4) - base
+
+
+
+    def parse_delay_import_directory(self, rva, size):
+        """Walk and parse the delay import directory."""
+        
+        import_descs =  []
+        while True:
+            try:
+                # If the RVA is invalid all would blow up. Some PEs seem to be
+                # specially nasty and have an invalid RVA.
+                data = self.get_data(rva)
+            except PEFormatError, e:
+                self.__warnings.append(
+                    'Error parsing the Delay import directory at RVA: 0x%x' % ( rva ) )
+                break
+                
+            import_desc =  self.__unpack_data__(
+                self.__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__,
+                data, file_offset = self.get_offset_from_rva(rva) )
+            
+            
+            # If the structure is all zeores, we reached the end of the list
+            if not import_desc or import_desc.all_zeroes():
+                break
+            
+            
+            rva += import_desc.sizeof()
+            
+            try:
+                import_data =  self.parse_imports(
+                    import_desc.pINT,
+                    import_desc.pIAT,
+                    None)
+            except PEFormatError, e:
+                self.__warnings.append(
+                    'Error parsing the Delay import directory. ' +
+                    'Invalid import data at RVA: 0x%x' % ( rva ) )
+                break
+            
+            if not import_data:
+                continue
+            
+            
+            dll = self.get_string_at_rva(import_desc.szName)
+            if dll:
+                import_descs.append(
+                    ImportDescData(
+                        struct = import_desc,
+                        imports = import_data,
+                        dll = dll))
+        
+        return import_descs
+
+                    
+
+    def parse_import_directory(self, rva, size):
+        """Walk and parse the import directory."""
+
+        import_descs =  []
+        while True:
+            try:
+                # If the RVA is invalid all would blow up. Some EXEs seem to be
+                # specially nasty and have an invalid RVA.
+                data = self.get_data(rva)
+            except PEFormatError, e:
+                self.__warnings.append(
+                    'Error parsing the Import directory at RVA: 0x%x' % ( rva ) )
+                break
+                
+            import_desc =  self.__unpack_data__(
+                self.__IMAGE_IMPORT_DESCRIPTOR_format__,
+                data, file_offset = self.get_offset_from_rva(rva) )
+                
+            # If the structure is all zeores, we reached the end of the list
+            if not import_desc or import_desc.all_zeroes():
+                break
+                
+            rva += import_desc.sizeof()
+                        
+            try:
+                import_data =  self.parse_imports(
+                    import_desc.OriginalFirstThunk,
+                    import_desc.FirstThunk,
+                    import_desc.ForwarderChain)
+            except PEFormatError, excp:
+                self.__warnings.append(
+                    'Error parsing the Import directory. ' +
+                    'Invalid Import data at RVA: 0x%x' % ( rva ) )
+                break
+                #raise excp
+                
+            if not import_data:
+                continue
+                
+            dll = self.get_string_at_rva(import_desc.Name)
+            if dll:
+                import_descs.append(
+                    ImportDescData(
+                        struct = import_desc,
+                        imports = import_data,
+                        dll = dll))
+
+        return import_descs
+            
+
+    
+    def parse_imports(self, original_first_thunk, first_thunk, forwarder_chain):
+        """Parse the imported symbols.
+        
+        It will fill a list, which will be avalable as the dictionary
+        attribute "imports". Its keys will be the DLL names and the values
+        all the symbols imported from that object.
+        """
+        
+        imported_symbols = []
+        imports_section = self.get_section_by_rva(first_thunk)
+        if not imports_section:
+            raise PEFormatError, 'Invalid/corrupt imports.'
+            
+        
+        # Import Lookup Table. Contains ordinals or pointers to strings.
+        ilt = self.get_import_table(original_first_thunk)
+        # Import Address Table. May have identical content to ILT if
+        # PE file is not bounded, Will contain the address of the
+        # imported symbols once the binary is loaded or if it is already
+        # bound.
+        iat = self.get_import_table(first_thunk)
+
+        # OC Patch:
+        # Would crash if iat or ilt had None type 
+        if not iat and not ilt:
+            raise PEFormatError( 
+                'Invalid Import Table information. ' +
+                'Both ILT and IAT appear to be broken.')
+            
+        if not iat and ilt:
+            table = ilt
+        elif iat and not ilt:
+            table = iat
+        elif ilt and ((len(ilt) and len(iat)==0) or (len(ilt) == len(iat))):
+            table = ilt
+        elif (ilt and len(ilt))==0 and (iat and len(iat)):
+            table = iat
+        else:
+            return None
+            
+        for idx in xrange(len(table)):
+
+            imp_ord = None
+            imp_hint = None
+            imp_name = None
+            hint_name_table_rva = None
+                        
+            if table[idx].AddressOfData:
+            
+                if self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE:
+                    ordinal_flag = IMAGE_ORDINAL_FLAG
+                elif self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE_PLUS:
+                    ordinal_flag = IMAGE_ORDINAL_FLAG64
+            
+                # If imported by ordinal, we will append the ordinal number
+                #
+                if table[idx].AddressOfData & ordinal_flag:
+                    import_by_ordinal = True
+                    imp_ord = table[idx].AddressOfData & 0xffff
+                    imp_name = None
+                else:
+                    import_by_ordinal = False
+                    try:
+                        hint_name_table_rva = table[idx].AddressOfData & 0x7fffffff
+                        data = self.get_data(hint_name_table_rva, 2)
+                        # Get the Hint
+                        imp_hint = self.get_word_from_data(data, 0)
+                        imp_name = self.get_string_at_rva(table[idx].AddressOfData+2)
+                    except PEFormatError, e:
+                        pass
+
+            imp_address = first_thunk+self.OPTIONAL_HEADER.ImageBase+idx*4
+                
+            if iat and ilt and ilt[idx].AddressOfData != iat[idx].AddressOfData:
+                imp_bound = iat[idx].AddressOfData
+            else:
+                imp_bound = None
+                
+            if imp_name != '' and (imp_ord or imp_name):
+                imported_symbols.append(
+                    ImportData(
+                        import_by_ordinal = import_by_ordinal,
+                        ordinal = imp_ord,
+                        hint = imp_hint,
+                        name = imp_name,
+                        bound = imp_bound,
+                        address = imp_address,
+                        hint_name_table_rva = hint_name_table_rva))
+            
+        return imported_symbols
+                
+
+
+    def get_import_table(self, rva):
+    
+        table = []
+        
+        while True and rva:
+            try:
+                data = self.get_data(rva)
+            except PEFormatError, e:
+                self.__warnings.append(
+                    'Error parsing the import table. ' +
+                    'Invalid data at RVA: 0x%x' % ( rva ) )
+                return None
+                
+            if self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE:
+                format = self.__IMAGE_THUNK_DATA_format__
+            elif self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE_PLUS:
+                format = self.__IMAGE_THUNK_DATA64_format__
+                
+            thunk_data = self.__unpack_data__(
+                format, data, file_offset=self.get_offset_from_rva(rva) )
+                    
+            if not thunk_data or thunk_data.all_zeroes():
+                break
+                
+            rva += thunk_data.sizeof()
+            
+            table.append(thunk_data)
+            
+        return table
+    
+    
+    def get_memory_mapped_image(self, max_virtual_address=0x10000000, ImageBase=None):
+        """Returns the data corresponding to the memory layout of the PE file.
+        
+        The data includes the PE header and the sections loaded at offsets
+        corresponding to their relative virtual addresses. (the VirtualAddress
+        section header member).
+        Any offset in this data corresponds to the absolute memory address
+        ImageBase+offset.
+        
+        The optional argument 'max_virtual_address' provides with means of limiting
+        which section are processed.
+        Any section with their VirtualAddress beyond this value will be skipped.
+        Normally, sections with values beyond this range are just there to confuse
+        tools. It's a common trick to see in packed executables.
+        
+        If the 'ImageBase' optional argument is supplied, the file's relocations
+        will be applied to the image by calling the 'relocate_image()' method.
+        """
+        
+        # Collect all sections in one code block    
+        data = self.header
+        for section in self.sections:
+
+            # Miscellanous integrity tests.
+            # Some packer will set these to bogus values to
+            # make tools go nuts.
+            #
+            if section.Misc_VirtualSize == 0 or section.SizeOfRawData == 0:
+                continue
+            
+            if section.SizeOfRawData > len(self.__data__):
+                continue
+                
+            if section.PointerToRawData > len(self.__data__):
+                continue
+        
+            if section.VirtualAddress >= max_virtual_address:
+                continue
+                
+            padding_length = section.VirtualAddress - len(data)
+            
+            if padding_length>0:
+                data += '\0'*padding_length
+            elif padding_length<0:
+                data = data[:padding_length]
+                
+            data += section.data
+            
+        return data
+
+            
+    def get_data(self, rva, length=None):
+        """Get data regardless of the section where it lies on.
+        
+        Given a rva and the size of the chunk to retrieve, this method
+        will find the section where the data lies and return the data.
+        """
+        
+        s = self.get_section_by_rva(rva)
+
+        if not s:
+            if rva<len(self.header):
+                if length:
+                    end = rva+length
+                else:
+                    end = None
+                return self.header[rva:end]
+                
+            raise PEFormatError, 'data at RVA can\'t be fetched. Corrupt header?'
+
+        return s.get_data(rva, length)
+
+
+    def get_rva_from_offset(self, offset):
+        """Get the rva corresponding to this file offset. """
+
+        s = self.get_section_by_offset(offset)
+        if not s:
+            raise PEFormatError("specified offset (0x%x) doesn't belong to any section." % offset)
+        return s.get_rva_from_offset(offset)
+
+    def get_offset_from_rva(self, rva):
+        """Get the file offset corresponding to this rva.
+        
+        Given a rva , this method will find the section where the
+        data lies and return the offset within the file.
+        """
+        
+        s = self.get_section_by_rva(rva)
+        if not s:
+                
+            raise PEFormatError, 'data at RVA can\'t be fetched. Corrupt header?'
+            
+        return s.get_offset_from_rva(rva)
+        
+            
+    def get_string_at_rva(self, rva):
+        """Get an ASCII string located at the given address."""
+
+        s = self.get_section_by_rva(rva)
+        if not s:
+            if rva<len(self.header):
+                return self.get_string_from_data(rva, self.header)
+            return None
+                
+        return self.get_string_from_data(rva-s.VirtualAddress, s.data)
+        
+        
+    def get_string_from_data(self, offset, data):
+        """Get an ASCII string from within the data."""
+
+        # OC Patch
+        b = None
+        
+        try:
+            b = data[offset]
+        except IndexError:
+            return ''
+        
+        s = ''
+        while ord(b):
+            s += b
+            offset += 1
+            try:
+                b = data[offset]
+            except IndexError:
+                break
+          
+        return s
+
+                
+    def get_string_u_at_rva(self, rva, max_length = 2**16):
+        """Get an Unicode string located at the given address."""
+        
+        try:
+            # If the RVA is invalid all would blow up. Some EXEs seem to be
+            # specially nasty and have an invalid RVA.
+            data = self.get_data(rva, 2)
+        except PEFormatError, e:
+            return None
+
+        #length = struct.unpack('<H', data)[0]
+                
+        s = u''
+        for idx in xrange(max_length):
+            try:
+                uchr = struct.unpack('<H', self.get_data(rva+2*idx, 2))[0]
+            except struct.error:
+                break
+                
+            if unichr(uchr) == u'\0':
+                break
+            s += unichr(uchr)
+            
+        return s
+
+
+    def get_section_by_offset(self, offset):
+        """Get the section containing the given file offset."""
+    
+        sections = [s for s in self.sections if s.contains_offset(offset)]
+        
+        if sections:
+            return sections[0]
+                    
+        return None
+
+
+    def get_section_by_rva(self, rva):
+        """Get the section containing the given address."""
+    
+        sections = [s for s in self.sections if s.contains_rva(rva)]
+        
+        if sections:
+            return sections[0]
+                    
+        return None
+    
+    def __str__(self):
+        return self.dump_info()
+    
+            
+    def print_info(self):
+        """Print all the PE header information in a human readable from."""
+        print self.dump_info()
+        
+        
+    def dump_info(self, dump=None):
+        """Dump all the PE header information into human readable string."""
+        
+        
+        if dump is None:
+            dump = Dump()
+        
+        warnings = self.get_warnings()
+        if warnings:
+            dump.add_header('Parsing Warnings')
+            for warning in warnings:
+                dump.add_line(warning)
+                dump.add_newline()
+                
+        
+        dump.add_header('DOS_HEADER')
+        dump.add_lines(self.DOS_HEADER.dump())
+        dump.add_newline()
+        
+        dump.add_header('NT_HEADERS')
+        dump.add_lines(self.NT_HEADERS.dump())
+        dump.add_newline()
+        
+        dump.add_header('FILE_HEADER')
+        dump.add_lines(self.FILE_HEADER.dump())
+        
+        image_flags = self.retrieve_flags(IMAGE_CHARACTERISTICS, 'IMAGE_FILE_')
+            
+        dump.add('Flags: ')
+        flags = []
+        for flag in image_flags:
+            if getattr(self.FILE_HEADER, flag[0]):
+                flags.append(flag[0])
+        dump.add_line(', '.join(flags))
+        dump.add_newline()
+        
+        if hasattr(self, 'OPTIONAL_HEADER') and self.OPTIONAL_HEADER is not None:
+            dump.add_header('OPTIONAL_HEADER')
+            dump.add_lines(self.OPTIONAL_HEADER.dump())
+
+        dll_characteristics_flags = self.retrieve_flags(DLL_CHARACTERISTICS, 'IMAGE_DLL_CHARACTERISTICS_')
+            
+        dump.add('DllCharacteristics: ')
+        flags = []
+        for flag in dll_characteristics_flags:
+            if getattr(self.OPTIONAL_HEADER, flag[0]):
+                flags.append(flag[0])
+        dump.add_line(', '.join(flags))
+        dump.add_newline()
+        
+        
+        dump.add_header('PE Sections')
+        
+        section_flags = self.retrieve_flags(SECTION_CHARACTERISTICS, 'IMAGE_SCN_')
+        
+        for section in self.sections:
+            dump.add_lines(section.dump())
+            dump.add('Flags: ')
+            flags = []
+            for flag in section_flags:
+                if getattr(section, flag[0]):
+                    flags.append(flag[0])
+            dump.add_line(', '.join(flags))
+            dump.add_line('Entropy: %f (Min=0.0, Max=8.0)' % section.get_entropy() )
+            if md5 is not None:
+                dump.add_line('MD5     hash: %s' % section.get_hash_md5() )
+            if sha1 is not None:
+                dump.add_line('SHA-1   hash: %s' % section.get_hash_sha1() )
+            if sha256 is not None:
+                dump.add_line('SHA-256 hash: %s' % section.get_hash_sha256() )
+            if sha512 is not None:
+                dump.add_line('SHA-512 hash: %s' % section.get_hash_sha512() )
+            dump.add_newline()
+            
+            
+        
+        if (hasattr(self, 'OPTIONAL_HEADER') and 
+            hasattr(self.OPTIONAL_HEADER, 'DATA_DIRECTORY') ):
+            
+            dump.add_header('Directories')
+            for idx in xrange(len(self.OPTIONAL_HEADER.DATA_DIRECTORY)):
+                directory = self.OPTIONAL_HEADER.DATA_DIRECTORY[idx]
+                dump.add_lines(directory.dump())
+            dump.add_newline()
+
+
+        if hasattr(self, 'VS_VERSIONINFO'):
+            dump.add_header('Version Information')
+            dump.add_lines(self.VS_VERSIONINFO.dump())
+            dump.add_newline()
+
+            if hasattr(self, 'VS_FIXEDFILEINFO'):
+                dump.add_lines(self.VS_FIXEDFILEINFO.dump())
+                dump.add_newline()
+
+            if hasattr(self, 'FileInfo'):
+                for entry in self.FileInfo:
+                    dump.add_lines(entry.dump())
+                    dump.add_newline()
+                    
+                    if hasattr(entry, 'StringTable'):
+                        for st_entry in entry.StringTable:
+                            [dump.add_line('  '+line) for line in st_entry.dump()]
+                            dump.add_line('  LangID: '+st_entry.LangID)
+                            dump.add_newline()
+                            for str_entry in st_entry.entries.items():
+                                dump.add_line('    '+str_entry[0]+': '+str_entry[1])
+                        dump.add_newline()
+                                
+                    elif hasattr(entry, 'Var'):
+                        for var_entry in entry.Var:
+                            if hasattr(var_entry, 'entry'):
+                                [dump.add_line('  '+line) for line in var_entry.dump()]
+                                dump.add_line(
+                                    '    ' + var_entry.entry.keys()[0] + 
+                                    ': ' + var_entry.entry.values()[0])
+                                    
+                        dump.add_newline()
+
+
+            
+        if hasattr(self, 'DIRECTORY_ENTRY_EXPORT'):
+            dump.add_header('Exported symbols')
+            dump.add_lines(self.DIRECTORY_ENTRY_EXPORT.struct.dump())
+            dump.add_newline()
+            dump.add_line('%-10s   %-10s  %s' % ('Ordinal', 'RVA', 'Name'))
+            for export in self.DIRECTORY_ENTRY_EXPORT.symbols:
+                dump.add('%-10d 0x%08Xh    %s' % (
+                    export.ordinal, export.address, export.name))
+                if export.forwarder:
+                    dump.add_line(' forwarder: %s' % export.forwarder)
+                else:
+                    dump.add_newline()
+                
+            dump.add_newline()
+        
+        if hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
+            dump.add_header('Imported symbols')
+            for module in self.DIRECTORY_ENTRY_IMPORT:
+                dump.add_lines(module.struct.dump())
+                dump.add_newline()
+                for symbol in module.imports:
+                
+                    if symbol.import_by_ordinal is True:
+                        dump.add('%s Ordinal[%s] (Imported by Ordinal)' % (
+                            module.dll, str(symbol.ordinal)))
+                    else:
+                        dump.add('%s.%s Hint[%s]' % (
+                            module.dll, symbol.name, str(symbol.hint)))
+
+                    if symbol.bound:
+                        dump.add_line(' Bound: 0x%08X' % (symbol.bound))
+                    else:
+                        dump.add_newline()
+                dump.add_newline()
+                
+        
+        if hasattr(self, 'DIRECTORY_ENTRY_BOUND_IMPORT'):
+            dump.add_header('Bound imports')
+            for bound_imp_desc in self.DIRECTORY_ENTRY_BOUND_IMPORT:
+            
+                dump.add_lines(bound_imp_desc.struct.dump())
+                dump.add_line('DLL: %s' % bound_imp_desc.name)
+                dump.add_newline()
+                
+                for bound_imp_ref in bound_imp_desc.entries:
+                    dump.add_lines(bound_imp_ref.struct.dump(), 4)
+                    dump.add_line('DLL: %s' % bound_imp_ref.name, 4)
+                    dump.add_newline()
+
+
+        if hasattr(self, 'DIRECTORY_ENTRY_DELAY_IMPORT'):
+            dump.add_header('Delay Imported symbols')
+            for module in self.DIRECTORY_ENTRY_DELAY_IMPORT:
+            
+                dump.add_lines(module.struct.dump())
+                dump.add_newline()
+                
+                for symbol in module.imports:
+                    if symbol.import_by_ordinal is True:
+                        dump.add('%s Ordinal[%s] (Imported by Ordinal)' % (
+                            module.dll, str(symbol.ordinal)))
+                    else:
+                        dump.add('%s.%s Hint[%s]' % (
+                            module.dll, symbol.name, str(symbol.hint)))
+                    
+                    if symbol.bound:
+                        dump.add_line(' Bound: 0x%08X' % (symbol.bound))
+                    else:
+                        dump.add_newline()
+                dump.add_newline()
+            
+        
+        if hasattr(self, 'DIRECTORY_ENTRY_RESOURCE'):
+            dump.add_header('Resource directory')
+            
+            dump.add_lines(self.DIRECTORY_ENTRY_RESOURCE.struct.dump())
+            
+            for resource_type in self.DIRECTORY_ENTRY_RESOURCE.entries:
+            
+                if resource_type.name is not None:
+                    dump.add_line('Name: [%s]' % resource_type.name, 2)
+                else:
+                    dump.add_line('Id: [0x%X] (%s)' % (
+                        resource_type.struct.Id, RESOURCE_TYPE.get(
+                            resource_type.struct.Id, '-')),
+                        2)
+                        
+                dump.add_lines(resource_type.struct.dump(), 2)
+
+                if hasattr(resource_type, 'directory'):
+                
+                    dump.add_lines(resource_type.directory.struct.dump(), 4)
+                        
+                    for resource_id in resource_type.directory.entries:
+                    
+                        if resource_id.name is not None:
+                            dump.add_line('Name: [%s]' % resource_id.name, 6)
+                        else:
+                            dump.add_line('Id: [0x%X]' % resource_id.struct.Id, 6)
+                            
+                        dump.add_lines(resource_id.struct.dump(), 6)
+    
+                        if hasattr(resource_id, 'directory'):
+                            dump.add_lines(resource_id.directory.struct.dump(), 8)
+                            
+                            for resource_lang in resource_id.directory.entries:
+                            #    dump.add_line('\\--- LANG [%d,%d][%s]' % (
+                            #        resource_lang.data.lang,
+                            #        resource_lang.data.sublang,
+                            #        LANG[resource_lang.data.lang]), 8)
+                                dump.add_lines(resource_lang.struct.dump(), 10)
+                                dump.add_lines(resource_lang.data.struct.dump(), 12)
+                dump.add_newline()
+    
+            dump.add_newline()
+        
+        
+        if ( hasattr(self, 'DIRECTORY_ENTRY_TLS') and 
+             self.DIRECTORY_ENTRY_TLS and 
+             self.DIRECTORY_ENTRY_TLS.struct ):
+             
+            dump.add_header('TLS')
+            dump.add_lines(self.DIRECTORY_ENTRY_TLS.struct.dump())
+            dump.add_newline()
+
+        
+        if hasattr(self, 'DIRECTORY_ENTRY_DEBUG'):
+            dump.add_header('Debug information')
+            for dbg in self.DIRECTORY_ENTRY_DEBUG:
+                dump.add_lines(dbg.struct.dump())
+                try:
+                    dump.add_line('Type: '+DEBUG_TYPE[dbg.struct.Type])
+                except KeyError:
+                    dump.add_line('Type: 0x%x(Unknown)' % dbg.struct.Type)
+                dump.add_newline()
+        
+        
+        if hasattr(self, 'DIRECTORY_ENTRY_BASERELOC'):
+            dump.add_header('Base relocations')
+            for base_reloc in self.DIRECTORY_ENTRY_BASERELOC:
+                dump.add_lines(base_reloc.struct.dump())
+                for reloc in base_reloc.entries:
+                    try:
+                        dump.add_line('%08Xh %s' % (
+                            reloc.rva, RELOCATION_TYPE[reloc.type][16:]), 4)
+                    except KeyError:
+                        dump.add_line('0x%08X 0x%x(Unknown)' % (
+                            reloc.rva, reloc.type), 4)
+                dump.add_newline()
+        
+
+        return dump.get_text()
+
+    # OC Patch
+    def get_physical_by_rva(self, rva):
+        """Gets the physical address in the PE file from an RVA value."""
+        try:
+            return self.get_offset_from_rva(rva)
+        except Exception:
+            return None
+
+
+    ##
+    # Double-Word get/set
+    ##
+
+    def get_data_from_dword(self, dword):
+        """Return a four byte string representing the double word value. (little endian)."""
+        return struct.pack('<L', dword)
+
+
+    def get_dword_from_data(self, data, offset):
+        """Convert four bytes of data to a double word (little endian)
+        
+        'offset' is assumed to index into a dword array. So setting it to
+        N will return a dword out of the data sarting at offset N*4.
+        
+        Returns None if the data can't be turned into a double word.
+        """
+        
+        if (offset+1)*4 > len(data):
+            return None
+        
+        return struct.unpack('<L', data[offset*4:(offset+1)*4])[0]
+        
+        
+    def get_dword_at_rva(self, rva):
+        """Return the double word value at the given RVA.
+        
+        Returns None if the value can't be read, i.e. the RVA can't be mapped
+        to a file offset.
+        """
+        
+        try:
+            return self.get_dword_from_data(self.get_data(rva)[:4], 0)
+        except PEFormatError:
+            return None
+
+
+    def get_dword_from_offset(self, offset):
+        """Return the double word value at the given file offset. (little endian)"""
+        
+        if offset+4 > len(self.__data__):
+            return None
+            
+        return self.get_dword_from_data(self.__data__[offset:offset+4], 0)
+
+
+    def set_dword_at_rva(self, rva, dword):
+        """Set the double word value at the file offset corresponding to the given RVA."""
+        return self.set_bytes_at_rva(rva, self.get_data_from_dword(dword))
+
+
+    def set_dword_at_offset(self, offset, dword):
+        """Set the double word value at the given file offset."""
+        return self.set_bytes_at_offset(offset, self.get_data_from_dword(dword))
+
+
+
+    ##
+    # Word get/set
+    ##
+
+    def get_data_from_word(self, word):
+        """Return a two byte string representing the word value. (little endian)."""
+        return struct.pack('<H', word)
+
+
+    def get_word_from_data(self, data, offset):
+        """Convert two bytes of data to a word (little endian)
+        
+        'offset' is assumed to index into a word array. So setting it to
+        N will return a dword out of the data sarting at offset N*2.
+
+        Returns None if the data can't be turned into a word.
+        """
+
+        if (offset+1)*2 > len(data):
+            return None
+
+        return struct.unpack('<H', data[offset*2:(offset+1)*2])[0]
+
+
+    def get_word_at_rva(self, rva):
+        """Return the word value at the given RVA.
+        
+        Returns None if the value can't be read, i.e. the RVA can't be mapped
+        to a file offset.
+        """
+        
+        try:
+            return self.get_word_from_data(self.get_data(rva)[:2], 0)
+        except PEFormatError:
+            return None
+            
+
+    def get_word_from_offset(self, offset):
+        """Return the word value at the given file offset. (little endian)"""
+        
+        if offset+2 > len(self.__data__):
+            return None
+            
+        return self.get_word_from_data(self.__data__[offset:offset+2], 0)
+
+
+    def set_word_at_rva(self, rva, word):
+        """Set the word value at the file offset corresponding to the given RVA."""
+        return self.set_bytes_at_rva(rva, self.get_data_from_word(word))
+
+
+    def set_word_at_offset(self, offset, word):
+        """Set the word value at the given file offset."""
+        return self.set_bytes_at_offset(offset, self.get_data_from_word(word))
+
+
+    ##
+    # Quad-Word get/set
+    ##
+
+    def get_data_from_qword(self, word):
+        """Return a eight byte string representing the quad-word value. (little endian)."""
+        return struct.pack('<Q', word)
+
+
+    def get_qword_from_data(self, data, offset):
+        """Convert eight bytes of data to a word (little endian)
+        
+        'offset' is assumed to index into a word array. So setting it to
+        N will return a dword out of the data sarting at offset N*8.
+
+        Returns None if the data can't be turned into a quad word.
+        """
+
+        if (offset+1)*8 > len(data):
+            return None
+
+        return struct.unpack('<Q', data[offset*8:(offset+1)*8])[0]
+
+
+    def get_qword_at_rva(self, rva):
+        """Return the quad-word value at the given RVA.
+        
+        Returns None if the value can't be read, i.e. the RVA can't be mapped
+        to a file offset.
+        """
+        
+        try:
+            return self.get_qword_from_data(self.get_data(rva)[:8], 0)
+        except PEFormatError:
+            return None
+            
+
+    def get_qword_from_offset(self, offset):
+        """Return the quad-word value at the given file offset. (little endian)"""
+        
+        if offset+8 > len(self.__data__):
+            return None
+            
+        return self.get_qword_from_data(self.__data__[offset:offset+8], 0)
+
+
+    def set_qword_at_rva(self, rva, qword):
+        """Set the quad-word value at the file offset corresponding to the given RVA."""
+        return self.set_bytes_at_rva(rva, self.get_data_from_qword(qword))
+
+
+    def set_qword_at_offset(self, offset, qword):
+        """Set the quad-word value at the given file offset."""
+        return self.set_bytes_at_offset(offset, self.get_data_from_qword(qword))
+
+
+
+    ##
+    # Set bytes
+    ##
+
+
+    def set_bytes_at_rva(self, rva, data):
+        """Overwrite, with the given string, the bytes at the file offset corresponding to the given RVA.
+        
+        Return True if successful, False otherwise. It can fail if the
+        offset is outside the file's boundaries.
+        """
+
+        offset = self.get_physical_by_rva(rva)
+        if not offset:
+            raise False
+            
+        return self.set_bytes_at_offset(offset, data)
+
+        
+    def set_bytes_at_offset(self, offset, data):
+        """Overwrite the bytes at the given file offset with the given string.
+        
+        Return True if successful, False otherwise. It can fail if the
+        offset is outside the file's boundaries.
+        """
+    
+        if not isinstance(data, str):
+            raise TypeError('data should be of type: str')
+        
+        if offset >= 0 and offset < len(self.__data__):
+            self.__data__ = ( self.__data__[:offset] + 
+                data +
+                self.__data__[offset+len(data):] )
+        else:
+            return False
+            
+        # Refresh the section's data with the modified information
+        #
+        for section in self.sections:
+            section_data_start = section.PointerToRawData
+            section_data_end = section_data_start+section.SizeOfRawData
+            section.data = self.__data__[section_data_start:section_data_end]
+
+        return True
+        
+
+
+    def relocate_image(self, new_ImageBase):
+        """Apply the relocation information to the image using the provided new image base.
+        
+        This method will apply the relocation information to the image. Given the new base,
+        all the relocations will be processed and both the raw data and the section's data
+        will be fixed accordingly.
+        The resulting image can be retrieved as well through the method:
+        
+            get_memory_mapped_image()
+            
+        In order to get something that would more closely match what could be found in memory
+        once the Windows loader finished its work.
+        """
+        
+        relocation_difference = new_ImageBase - self.OPTIONAL_HEADER.ImageBase
+        
+        
+        for reloc in self.DIRECTORY_ENTRY_BASERELOC:
+
+            virtual_address = reloc.struct.VirtualAddress
+            size_of_block = reloc.struct.SizeOfBlock
+            
+            # We iterate with an index because if the relocation is of type
+            # IMAGE_REL_BASED_HIGHADJ we need to also process the next entry
+            # at once and skip it for the next interation
+            # 
+            entry_idx = 0
+            while entry_idx<len(reloc.entries):
+            
+                entry = reloc.entries[entry_idx]
+                entry_idx += 1
+                                
+                if entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_ABSOLUTE']:
+                    # Nothing to do for this type of relocation
+                    pass
+                    
+                elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGH']:
+                    # Fix the high 16bits of a relocation
+                    #
+                    # Add high 16bits of relocation_difference to the
+                    # 16bit value at RVA=entry.rva
+                    
+                    self.set_word_at_rva(
+                        entry.rva,
+                        ( self.get_word_at_rva(entry.rva) + relocation_difference>>16)&0xffff )
+                  
+                elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_LOW']:
+                    # Fix the low 16bits of a relocation
+                    #
+                    # Add low 16 bits of relocation_difference to the 16bit value
+                    # at RVA=entry.rva
+                    
+                    self.set_word_at_rva(
+                        entry.rva,
+                        ( self.get_word_at_rva(entry.rva) + relocation_difference)&0xffff)
+                    
+                elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGHLOW']:
+                    # Handle all high and low parts of a 32bit relocation
+                    #
+                    # Add relocation_difference to the value at RVA=entry.rva
+                    
+                    self.set_dword_at_rva(
+                        entry.rva,
+                        self.get_dword_at_rva(entry.rva)+relocation_difference)
+                  
+                elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGHADJ']:
+                    # Fix the high 16bits of a relocation and adjust
+                    #
+                    # Add high 16bits of relocation_difference to the 32bit value
+                    # composed from the (16bit value at RVA=entry.rva)<<16 plus 
+                    # the 16bit value at the next relocation entry.
+                    #
+                    
+                    # If the next entry is beyond the array's limits,
+                    # abort... the table is corrupt
+                    #
+                    if entry_idx == len(reloc.entries):
+                        break
+                    
+                    next_entry = reloc.entries[entry_idx]
+                    entry_idx += 1
+                    self.set_word_at_rva( entry.rva, 
+                        ((self.get_word_at_rva(entry.rva)<<16) + next_entry.rva +
+                        relocation_difference & 0xffff0000) >> 16 )
+                
+                elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_DIR64']:
+                    # Apply the difference to the 64bit value at the offset
+                    # RVA=entry.rva
+                    
+                    self.set_qword_at_rva(
+                        entry.rva,
+                        self.get_qword_at_rva(entry.rva) + relocation_difference)
+
+
+    def verify_checksum(self):
+    
+        return self.OPTIONAL_HEADER.CheckSum == self.generate_checksum()
+        
+    
+    def generate_checksum(self):
+    
+        # Get the offset to the CheckSum field in the OptionalHeader
+        #
+        checksum_offset = self.OPTIONAL_HEADER.__file_offset__ + 0x40 # 64
+        
+        checksum = 0
+        
+        for i in range( len(self.__data__) / 4 ):
+        
+            # Skip the checksum field
+            #
+            if i == checksum_offset / 4:
+                continue
+
+            dword = struct.unpack('L', self.__data__[ i*4 : i*4+4 ])[0]
+            checksum = (checksum & 0xffffffff) + dword + (checksum>>32)
+            if checksum > 2**32:
+                checksum = (checksum & 0xffffffff) + (checksum >> 32)
+        
+        checksum = (checksum & 0xffff) + (checksum >> 16)
+        checksum = (checksum) + (checksum >> 16)
+        checksum = checksum & 0xffff
+        
+        return checksum + len(self.__data__)