Qch@st dZdZdZdeedd!ZdZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZdI\ZZZZy4ddlZejZejZejZejZWnkek rNyddlZejZWnek rnXyddlZejZWqOek rJqOXnXyeWnek rsd ZnXeZd Zd Zd Zd ZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYgZ(e)ge(D]Z*e*de*df^qe(Z+dZd[d\d]d^d_d`dadbdcdddedfdgdhdigZ,e)ge,D]Z*e*de*df^qie,Z-djdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddddddddddg#Z.e)ge.D]Z*e*de*df^q e.Z/dddddddddddg Z0e)ge0D]Z*e*de*df^qae0Z1ddddddddddddg Z2e)ge2D]Z*e*de*df^qe2Z3ddddddddddddddddddddgZ4e)ge4D]Z*e*de*df^q/e4Z5ddddddddddddg Z6e)ge6D]Z*e*de*df^qe6Z7dddddddddddddg Z8e)ge8D]Z*e*de*df^qe8Z9dddddddddddddddddddddgZ:e)ge:D]Z*e*de*df^q^e:Z;dddddddddddddddddddddddddddddddddddd d d d d ddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCg^Z<e)e<ge<D]Z*e*de*df^qZ=dDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddddddddddddddddddddddddddddddddddddddddggZ>e)e>ge>D]Z*e*de*df^qZ?e)e>Z?xDe>D]<\Z@ZAe?jBeAre?eAjCe@qUe@ge?eAeQfd?YZ^d@eQfdAYZ_e j`e jae jbdBdCjcgedd@dBD]Zeefee^q ZgdDZhe j`e jae jbdEZidFZjdGddHYZkdS(spefile, Portable Executable reader module All the PE file basic structures are available with their default names as attributes of the instance returned. Processed elements such as the import table are made available with lowercase names, to differentiate them from the upper case basic structure names. pefile has been tested against the limits of valid PE headers, that is, malware. Lots of packed malware attempt to abuse the format way beyond its standard use. To the best of my knowledge most of the abuses are handled gracefully. Copyright (c) 2005-2011 Ero Carrera All rights reserved. For detailed copyright information see the file COPYING in the root of the distribution archive. s$LastChangedRevision: 102 $s Ero Carreras 1.2.10-%diisero.carrera@gmail.comiNcCs(t|}ttdt||S(Ni(tlisttziptrangetlen(titertL((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt enumerate>s iiMZiZMiNEiLEiLXiPEilli i tIMAGE_DIRECTORY_ENTRY_EXPORTitIMAGE_DIRECTORY_ENTRY_IMPORTitIMAGE_DIRECTORY_ENTRY_RESOURCEitIMAGE_DIRECTORY_ENTRY_EXCEPTIONitIMAGE_DIRECTORY_ENTRY_SECURITYitIMAGE_DIRECTORY_ENTRY_BASERELOCitIMAGE_DIRECTORY_ENTRY_DEBUGitIMAGE_DIRECTORY_ENTRY_COPYRIGHTitIMAGE_DIRECTORY_ENTRY_GLOBALPTRitIMAGE_DIRECTORY_ENTRY_TLSi t!IMAGE_DIRECTORY_ENTRY_LOAD_CONFIGi t"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORTi tIMAGE_DIRECTORY_ENTRY_IATi t"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORTi t$IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTORitIMAGE_DIRECTORY_ENTRY_RESERVEDitIMAGE_FILE_RELOCS_STRIPPEDtIMAGE_FILE_EXECUTABLE_IMAGEtIMAGE_FILE_LINE_NUMS_STRIPPEDtIMAGE_FILE_LOCAL_SYMS_STRIPPEDtIMAGE_FILE_AGGRESIVE_WS_TRIMtIMAGE_FILE_LARGE_ADDRESS_AWAREi tIMAGE_FILE_16BIT_MACHINEi@tIMAGE_FILE_BYTES_REVERSED_LOitIMAGE_FILE_32BIT_MACHINEitIMAGE_FILE_DEBUG_STRIPPEDit"IMAGE_FILE_REMOVABLE_RUN_FROM_SWAPitIMAGE_FILE_NET_RUN_FROM_SWAPitIMAGE_FILE_SYSTEMitIMAGE_FILE_DLLi tIMAGE_FILE_UP_SYSTEM_ONLYi@tIMAGE_FILE_BYTES_REVERSED_HIitIMAGE_SCN_CNT_CODEtIMAGE_SCN_CNT_INITIALIZED_DATAt IMAGE_SCN_CNT_UNINITIALIZED_DATAtIMAGE_SCN_LNK_OTHERtIMAGE_SCN_LNK_INFOtIMAGE_SCN_LNK_REMOVEtIMAGE_SCN_LNK_COMDATtIMAGE_SCN_MEM_FARDATAtIMAGE_SCN_MEM_PURGEABLEitIMAGE_SCN_MEM_16BITtIMAGE_SCN_MEM_LOCKEDitIMAGE_SCN_MEM_PRELOADitIMAGE_SCN_ALIGN_1BYTEStIMAGE_SCN_ALIGN_2BYTESi tIMAGE_SCN_ALIGN_4BYTESi0tIMAGE_SCN_ALIGN_8BYTESi@tIMAGE_SCN_ALIGN_16BYTESiPtIMAGE_SCN_ALIGN_32BYTESi`tIMAGE_SCN_ALIGN_64BYTESiptIMAGE_SCN_ALIGN_128BYTESitIMAGE_SCN_ALIGN_256BYTESitIMAGE_SCN_ALIGN_512BYTESitIMAGE_SCN_ALIGN_1024BYTESitIMAGE_SCN_ALIGN_2048BYTESitIMAGE_SCN_ALIGN_4096BYTESitIMAGE_SCN_ALIGN_8192BYTESitIMAGE_SCN_ALIGN_MASKitIMAGE_SCN_LNK_NRELOC_OVFLitIMAGE_SCN_MEM_DISCARDABLEitIMAGE_SCN_MEM_NOT_CACHEDitIMAGE_SCN_MEM_NOT_PAGEDitIMAGE_SCN_MEM_SHAREDitIMAGE_SCN_MEM_EXECUTEi tIMAGE_SCN_MEM_READi@tIMAGE_SCN_MEM_WRITEtIMAGE_DEBUG_TYPE_UNKNOWNtIMAGE_DEBUG_TYPE_COFFtIMAGE_DEBUG_TYPE_CODEVIEWtIMAGE_DEBUG_TYPE_FPOtIMAGE_DEBUG_TYPE_MISCtIMAGE_DEBUG_TYPE_EXCEPTIONtIMAGE_DEBUG_TYPE_FIXUPtIMAGE_DEBUG_TYPE_OMAP_TO_SRCtIMAGE_DEBUG_TYPE_OMAP_FROM_SRCtIMAGE_DEBUG_TYPE_BORLANDtIMAGE_DEBUG_TYPE_RESERVED10tIMAGE_SUBSYSTEM_UNKNOWNtIMAGE_SUBSYSTEM_NATIVEtIMAGE_SUBSYSTEM_WINDOWS_GUItIMAGE_SUBSYSTEM_WINDOWS_CUItIMAGE_SUBSYSTEM_OS2_CUItIMAGE_SUBSYSTEM_POSIX_CUItIMAGE_SUBSYSTEM_WINDOWS_CE_GUItIMAGE_SUBSYSTEM_EFI_APPLICATIONt'IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVERt"IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVERtIMAGE_SUBSYSTEM_EFI_ROMtIMAGE_SUBSYSTEM_XBOXtIMAGE_FILE_MACHINE_UNKNOWNtIMAGE_FILE_MACHINE_AM33itIMAGE_FILE_MACHINE_AMD64idtIMAGE_FILE_MACHINE_ARMitIMAGE_FILE_MACHINE_EBCitIMAGE_FILE_MACHINE_I386iLtIMAGE_FILE_MACHINE_IA64tIMAGE_FILE_MACHINE_MR32iAtIMAGE_FILE_MACHINE_MIPS16iftIMAGE_FILE_MACHINE_MIPSFPUiftIMAGE_FILE_MACHINE_MIPSFPU16iftIMAGE_FILE_MACHINE_POWERPCitIMAGE_FILE_MACHINE_POWERPCFPitIMAGE_FILE_MACHINE_R4000iftIMAGE_FILE_MACHINE_SH3itIMAGE_FILE_MACHINE_SH3DSPitIMAGE_FILE_MACHINE_SH4itIMAGE_FILE_MACHINE_SH5itIMAGE_FILE_MACHINE_THUMBitIMAGE_FILE_MACHINE_WCEMIPSV2iitIMAGE_REL_BASED_ABSOLUTEtIMAGE_REL_BASED_HIGHtIMAGE_REL_BASED_LOWtIMAGE_REL_BASED_HIGHLOWtIMAGE_REL_BASED_HIGHADJtIMAGE_REL_BASED_MIPS_JMPADDRtIMAGE_REL_BASED_SECTIONtIMAGE_REL_BASED_RELtIMAGE_REL_BASED_MIPS_JMPADDR16tIMAGE_REL_BASED_IA64_IMM64tIMAGE_REL_BASED_DIR64tIMAGE_REL_BASED_HIGH3ADJt)IMAGE_DLL_CHARACTERISTICS_RESERVED_0x0001t)IMAGE_DLL_CHARACTERISTICS_RESERVED_0x0002t)IMAGE_DLL_CHARACTERISTICS_RESERVED_0x0004t)IMAGE_DLL_CHARACTERISTICS_RESERVED_0x0008t&IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASEt)IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITYt#IMAGE_DLL_CHARACTERISTICS_NX_COMPATt&IMAGE_DLL_CHARACTERISTICS_NO_ISOLATIONt IMAGE_DLL_CHARACTERISTICS_NO_SEHt!IMAGE_DLL_CHARACTERISTICS_NO_BINDt)IMAGE_DLL_CHARACTERISTICS_RESERVED_0x1000t$IMAGE_DLL_CHARACTERISTICS_WDM_DRIVERt/IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWAREt RT_CURSORt RT_BITMAPtRT_ICONtRT_MENUt RT_DIALOGt RT_STRINGt RT_FONTDIRtRT_FONTtRT_ACCELERATORt RT_RCDATAtRT_MESSAGETABLEtRT_GROUP_CURSORt RT_GROUP_ICONt RT_VERSIONt RT_DLGINCLUDEit RT_PLUGPLAYitRT_VXDit RT_ANICURSORt RT_ANIICONitRT_HTMLit RT_MANIFESTit LANG_NEUTRALtLANG_INVARIANTitLANG_AFRIKAANSi6t LANG_ALBANIANit LANG_ARABICt LANG_ARMENIANi+t LANG_ASSAMESEiMt LANG_AZERIi,t LANG_BASQUEi-tLANG_BELARUSIANi#t LANG_BENGALIiEtLANG_BULGARIANt LANG_CATALANt LANG_CHINESEt LANG_CROATIANit LANG_CZECHt LANG_DANISHt LANG_DIVEHIiet LANG_DUTCHt LANG_ENGLISHt LANG_ESTONIANi%t LANG_FAEROESEi8t LANG_FARSIi)t LANG_FINNISHt LANG_FRENCHt LANG_GALICIANiVt LANG_GEORGIANi7t LANG_GERMANt LANG_GREEKt LANG_GUJARATIiGt LANG_HEBREWt LANG_HINDIi9tLANG_HUNGARIANtLANG_ICELANDICtLANG_INDONESIANi!t LANG_ITALIANt LANG_JAPANESEt LANG_KANNADAiKt LANG_KASHMIRIi`t LANG_KAZAKi?t LANG_KONKANIiWt LANG_KOREANit LANG_KYRGYZt LANG_LATVIANi&tLANG_LITHUANIANi'tLANG_MACEDONIANi/t LANG_MALAYi>tLANG_MALAYALAMiLt LANG_MANIPURIiXt LANG_MARATHIiNtLANG_MONGOLIANiPt LANG_NEPALIiatLANG_NORWEGIANt LANG_ORIYAiHt LANG_POLISHtLANG_PORTUGUESEt LANG_PUNJABIiFt LANG_ROMANIANt LANG_RUSSIANit LANG_SANSKRITiOt LANG_SERBIANt LANG_SINDHIiYt LANG_SLOVAKitLANG_SLOVENIANi$t LANG_SPANISHt LANG_SWAHILIiAt LANG_SWEDISHit LANG_SYRIACiZt LANG_TAMILiIt LANG_TATARiDt LANG_TELUGUiJt LANG_THAIit LANG_TURKISHitLANG_UKRAINIANi"t LANG_URDUt LANG_UZBEKiCtLANG_VIETNAMESEi*t LANG_GAELICi<t LANG_MALTESEi:t LANG_MAORIi(tLANG_RHAETO_ROMANCEt LANG_SAAMIi;t LANG_SORBIANi.t LANG_SUTUi0t LANG_TSONGAi1t LANG_TSWANAi2t LANG_VENDAi3t LANG_XHOSAi4t LANG_ZULUi5tLANG_ESPERANTOit LANG_WALONit LANG_CORNISHit LANG_WELSHit LANG_BRETONitSUBLANG_NEUTRALtSUBLANG_DEFAULTtSUBLANG_SYS_DEFAULTtSUBLANG_ARABIC_SAUDI_ARABIAtSUBLANG_ARABIC_IRAQtSUBLANG_ARABIC_EGYPTtSUBLANG_ARABIC_LIBYAtSUBLANG_ARABIC_ALGERIAtSUBLANG_ARABIC_MOROCCOtSUBLANG_ARABIC_TUNISIAtSUBLANG_ARABIC_OMANtSUBLANG_ARABIC_YEMENtSUBLANG_ARABIC_SYRIAtSUBLANG_ARABIC_JORDANtSUBLANG_ARABIC_LEBANONtSUBLANG_ARABIC_KUWAITtSUBLANG_ARABIC_UAEtSUBLANG_ARABIC_BAHRAINtSUBLANG_ARABIC_QATARtSUBLANG_AZERI_LATINtSUBLANG_AZERI_CYRILLICtSUBLANG_CHINESE_TRADITIONALtSUBLANG_CHINESE_SIMPLIFIEDtSUBLANG_CHINESE_HONGKONGtSUBLANG_CHINESE_SINGAPOREtSUBLANG_CHINESE_MACAUt SUBLANG_DUTCHtSUBLANG_DUTCH_BELGIANtSUBLANG_ENGLISH_UStSUBLANG_ENGLISH_UKtSUBLANG_ENGLISH_AUStSUBLANG_ENGLISH_CANtSUBLANG_ENGLISH_NZtSUBLANG_ENGLISH_EIREtSUBLANG_ENGLISH_SOUTH_AFRICAtSUBLANG_ENGLISH_JAMAICAtSUBLANG_ENGLISH_CARIBBEANtSUBLANG_ENGLISH_BELIZEtSUBLANG_ENGLISH_TRINIDADtSUBLANG_ENGLISH_ZIMBABWEtSUBLANG_ENGLISH_PHILIPPINEStSUBLANG_FRENCHtSUBLANG_FRENCH_BELGIANtSUBLANG_FRENCH_CANADIANtSUBLANG_FRENCH_SWISStSUBLANG_FRENCH_LUXEMBOURGtSUBLANG_FRENCH_MONACOtSUBLANG_GERMANtSUBLANG_GERMAN_SWISStSUBLANG_GERMAN_AUSTRIANtSUBLANG_GERMAN_LUXEMBOURGtSUBLANG_GERMAN_LIECHTENSTEINtSUBLANG_ITALIANtSUBLANG_ITALIAN_SWISStSUBLANG_KASHMIRI_SASIAtSUBLANG_KASHMIRI_INDIAtSUBLANG_KOREANtSUBLANG_LITHUANIANtSUBLANG_MALAY_MALAYSIAtSUBLANG_MALAY_BRUNEI_DARUSSALAMtSUBLANG_NEPALI_INDIAtSUBLANG_NORWEGIAN_BOKMALtSUBLANG_NORWEGIAN_NYNORSKtSUBLANG_PORTUGUESEtSUBLANG_PORTUGUESE_BRAZILIANtSUBLANG_SERBIAN_LATINtSUBLANG_SERBIAN_CYRILLICtSUBLANG_SPANISHtSUBLANG_SPANISH_MEXICANtSUBLANG_SPANISH_MODERNtSUBLANG_SPANISH_GUATEMALAtSUBLANG_SPANISH_COSTA_RICAtSUBLANG_SPANISH_PANAMAt"SUBLANG_SPANISH_DOMINICAN_REPUBLICtSUBLANG_SPANISH_VENEZUELAtSUBLANG_SPANISH_COLOMBIAtSUBLANG_SPANISH_PERUtSUBLANG_SPANISH_ARGENTINAtSUBLANG_SPANISH_ECUADORtSUBLANG_SPANISH_CHILEtSUBLANG_SPANISH_URUGUAYtSUBLANG_SPANISH_PARAGUAYtSUBLANG_SPANISH_BOLIVIAtSUBLANG_SPANISH_EL_SALVADORtSUBLANG_SPANISH_HONDURAStSUBLANG_SPANISH_NICARAGUAtSUBLANG_SPANISH_PUERTO_RICOtSUBLANG_SWEDISHtSUBLANG_SWEDISH_FINLANDtSUBLANG_URDU_PAKISTANtSUBLANG_URDU_INDIAtSUBLANG_UZBEK_LATINtSUBLANG_UZBEK_CYRILLICtSUBLANG_DUTCH_SURINAMtSUBLANG_ROMANIANtSUBLANG_ROMANIAN_MOLDAVIAtSUBLANG_RUSSIANtSUBLANG_RUSSIAN_MOLDAVIAtSUBLANG_CROATIANtSUBLANG_LITHUANIAN_CLASSICtSUBLANG_GAELICtSUBLANG_GAELIC_SCOTTISHtSUBLANG_GAELIC_MANXcCsYtj|d}x-tj|tD]}||kr(|Sq(Wtj|dgdS(Ns *unknown*i(tLANGtgettSUBLANGR(t lang_valuet sublang_valuet lang_namet sublang_name((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytget_sublang_name_for_langs  cCsd}d}x|t|kr |||d!}t|dkrHPntjd|d}|d7}|dkrd|dkot|knry&||||d!jd||Make this instance None, to express it's no known string type.N(R(R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt invalidatescCs,|jj|jdd|j|_dS(Nit max_length(Rtget_string_u_at_rvaRt8_UnicodeStringWrapperPostProcessor__get_pascal_16_lengthR(R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytrender_pascal_16s  cCs8|j}|||jddkr4||_tStS(sThe next RVA is taken to be the one immediately following this one. Such RVA could indicate the natural end of the string and will be checked with the possible length contained in the first word. i(RRtlengthRR(Rt next_rva_ptrR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt ask_pascal_16s   cCs|j|jS(N(t9_UnicodeStringWrapperPostProcessor__get_word_value_at_rvaR(R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt__get_pascal_16_lengthscCs]y|jj|jd}Wntk r2}tSXt|dkrItStjd|dS(NisR(RRR(RR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt__repr__sic Cs6g}|jd|jx|jD] }x|D]}t||}t|tsdt|trd|}|dks|dkry$|dtjtj |7}Wqt j k r}|d7}qXqn!dj t dt|}|jd |j||j|j||d |fq1Wq$W|S( s1Returns a string representation of the structure.s[%s]s0x%-8Xt TimeDateStampt dwTimeStamps [%s UTC]s [INVALID TIME]RcSs |dkS(Nt((R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytss0x%-8X 0x%-3X %-30s %st:(RRRRR}Rtlongttimetasctimetgmtimet exceptionst ValueErrorRtfilterR~RR(Rt indentationRtkeysRRtval_strR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs"  $! $N(RRRRRRRRRRRRRRRRRRR(((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR#s             tSectionStructurecBseZdZdZdddZdZdZdZdZ dZ dZ d Z d Z d Zd Zd ZdZRS(s#Convenience section handling class.cOs:d|kr#|d|_|d=ntj|||dS(NR(RRR(Rtargltargd((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs   cCst|j|jjj}t|j|jjj|jjj}|dkrW|}n|||}|dk r~||}n ||j }||j|j kr|j|j }n|jj ||!S(sGet data chunk from a section. Allows to query data from the section by passing the addresses where the PE file would be loaded by default. It is then possible to retrieve code and data by its real addresses as it would be if loaded. N( RtPointerToRawDataRtOPTIONAL_HEADERt FileAlignmentRtVirtualAddresstSectionAlignmentRt SizeOfRawDatat__data__(RtstartRtPointerToRawData_adjtVirtualAddress_adjRtend((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs       cCs|dkr.ttd}t|||nUd|krt||r|ri|jdct|O|d@B}nC|dkr||j}|dkrjd}n|d@|d@B}n||j_n||j|ffZd?d!d"d#d$d%d&d'd(d@d+d,d-d.d/d0d1d2d3d4d5d6d7d8dAdBdCdDd=d>ffZdEdFffZdGdHdIddJdKdLdMdNdOdPf fZ dQdRdSdTdUdVdWdXdYffZ dZd[dd\d]d^ffZ d_dPdd`dad]dbdcdddedfdgf fZ dhdPdd`dadidjffZ dkd]dlffZdmdlddndoffZdpdqdrdsffZdtdFdudvdwdxdydzd{d|d}d~ddf fZddqdrdsffZddqdrdsffZddqdrdsffZddqdrdsffZddffZddffZddPdd`daddddKffZdddffZddffZdddddddPffZdddddddPffZdddd`daddddddddddddddddffZdddd`daddddddddddddddddffZddddffZddddffZ e!e!e!dZ"dZ#dZ$dZ%dZ&dZ'dZ(e!dZ)dZ*e!dZ+dZ,dZ-dZ.dZ/dZ0dZ1de!de!dZ2dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:dZ;de!dZ<dZ=de!dZ>dZ?dZ@dZAdZBdddZCdZDdZEdZFdZGe!dZHdZIdZJdZKdZLdZMdZNdZOdZPdZQdZRdZSdZTdZUdZVdZWdZXdZYdZZdZ[dZ\dZ]dZ^dZ_dZ`dZadZbdZcdZddZedZfdZgRS(s A Portable Executable representation. This class provides access to most of the information in a PE file. It expects to be supplied the name of the file to load or PE data to process and an optional argument 'fast_load' (False by default) which controls whether to load all the directories information, which can be quite time consuming. pe = pefile.PE('module.dll') pe = pefile.PE(name='module.dll') would load 'module.dll' and process it. If the data would be already available in a buffer the same could be achieved with: pe = pefile.PE(data=module_dll_data) The "fast_load" can be set to a default by setting its value in the module itself by means,for instance, of a "pefile.fast_load = True". That will make all the subsequent instances not to load the whole PE structure. The "full_load" method can be used to parse the missing data at a later stage. Basic headers information will be available in the attributes: DOS_HEADER NT_HEADERS FILE_HEADER OPTIONAL_HEADER All of them will contain among their attributes the members of the corresponding structures as defined in WINNT.H The raw data corresponding to the header (from the beginning of the file up to the start of the first section) will be available in the instance's attribute 'header' as a string. The sections will be available as a list in the 'sections' attribute. Each entry will contain as attributes all the structure's members. Directory entries will be available as attributes (if they exist): (no other entries are processed at this point) DIRECTORY_ENTRY_IMPORT (list of ImportDescData instances) DIRECTORY_ENTRY_EXPORT (ExportDirData instance) DIRECTORY_ENTRY_RESOURCE (ResourceDirData instance) DIRECTORY_ENTRY_DEBUG (list of DebugData instances) DIRECTORY_ENTRY_BASERELOC (list of BaseRelocationData instances) DIRECTORY_ENTRY_TLS DIRECTORY_ENTRY_BOUND_IMPORT (list of BoundImportData instances) The following dictionary attributes provide ways of mapping different constants. They will accept the numeric value and return the string representation and the opposite, feed in the string and get the numeric constant: DIRECTORY_ENTRY IMAGE_CHARACTERISTICS SECTION_CHARACTERISTICS DEBUG_TYPE SUBSYSTEM_TYPE MACHINE_TYPE RELOCATION_TYPE RESOURCE_TYPE LANG SUBLANG tIMAGE_DOS_HEADERs H,e_magicsH,e_cblpsH,e_cpsH,e_crlcs H,e_cparhdrs H,e_minallocs H,e_maxallocsH,e_sssH,e_spsH,e_csumsH,e_ipsH,e_css H,e_lfarlcsH,e_ovnos8s,e_ress H,e_oemids H,e_oeminfos 20s,e_res2s I,e_lfanewtIMAGE_FILE_HEADERs H,MachinesH,NumberOfSectionssI,TimeDateStampsI,PointerToSymbolTablesI,NumberOfSymbolssH,SizeOfOptionalHeadersH,CharacteristicstIMAGE_DATA_DIRECTORYsI,VirtualAddresssI,SizetIMAGE_OPTIONAL_HEADERsH,MagicsB,MajorLinkerVersionsB,MinorLinkerVersions I,SizeOfCodesI,SizeOfInitializedDatasI,SizeOfUninitializedDatasI,AddressOfEntryPoints I,BaseOfCodes I,BaseOfDatas I,ImageBasesI,SectionAlignmentsI,FileAlignmentsH,MajorOperatingSystemVersionsH,MinorOperatingSystemVersionsH,MajorImageVersionsH,MinorImageVersionsH,MajorSubsystemVersionsH,MinorSubsystemVersions I,Reserved1s I,SizeOfImagesI,SizeOfHeaderss I,CheckSums H,SubsystemsH,DllCharacteristicssI,SizeOfStackReservesI,SizeOfStackCommitsI,SizeOfHeapReservesI,SizeOfHeapCommits I,LoaderFlagssI,NumberOfRvaAndSizestIMAGE_OPTIONAL_HEADER64s Q,ImageBasesQ,SizeOfStackReservesQ,SizeOfStackCommitsQ,SizeOfHeapReservesQ,SizeOfHeapCommittIMAGE_NT_HEADERSs I,SignaturetIMAGE_SECTION_HEADERs8s,Names,I,Misc,Misc_PhysicalAddress,Misc_VirtualSizesI,SizeOfRawDatasI,PointerToRawDatasI,PointerToRelocationssI,PointerToLinenumberssH,NumberOfRelocationssH,NumberOfLinenumberssI,CharacteristicstIMAGE_DELAY_IMPORT_DESCRIPTORs I,grAttrssI,szNamesI,phmodsI,pIATsI,pINTs I,pBoundIATs I,pUnloadIATs I,dwTimeStamptIMAGE_IMPORT_DESCRIPTORs$I,OriginalFirstThunk,CharacteristicssI,ForwarderChainsI,Names I,FirstThunktIMAGE_EXPORT_DIRECTORYsH,MajorVersionsH,MinorVersionsI,BasesI,NumberOfFunctionssI,NumberOfNamessI,AddressOfFunctionssI,AddressOfNamessI,AddressOfNameOrdinalstIMAGE_RESOURCE_DIRECTORYsH,NumberOfNamedEntriessH,NumberOfIdEntriestIMAGE_RESOURCE_DIRECTORY_ENTRYsI,OffsetToDatatIMAGE_RESOURCE_DATA_ENTRYs I,CodePages I,ReservedtVS_VERSIONINFOsH,Lengths H,ValueLengthsH,TypetVS_FIXEDFILEINFOsI,StrucVersionsI,FileVersionMSsI,FileVersionLSsI,ProductVersionMSsI,ProductVersionLSsI,FileFlagsMasks I,FileFlagssI,FileOSs I,FileTypes I,FileSubtypes I,FileDateMSs I,FileDateLStStringFileInfot StringTabletStringtVartIMAGE_THUNK_DATAs0I,ForwarderString,Function,Ordinal,AddressOfDatas0Q,ForwarderString,Function,Ordinal,AddressOfDatatIMAGE_DEBUG_DIRECTORYsI,Types I,SizeOfDatasI,AddressOfRawDatatIMAGE_BASE_RELOCATIONs I,SizeOfBlocktIMAGE_BASE_RELOCATION_ENTRYsH,DatatIMAGE_TLS_DIRECTORYsI,StartAddressOfRawDatasI,EndAddressOfRawDatasI,AddressOfIndexsI,AddressOfCallBackssI,SizeOfZeroFillsQ,StartAddressOfRawDatasQ,EndAddressOfRawDatasQ,AddressOfIndexsQ,AddressOfCallBackstIMAGE_LOAD_CONFIG_DIRECTORYsI,GlobalFlagsClearsI,GlobalFlagsSetsI,CriticalSectionDefaultTimeoutsI,DeCommitFreeBlockThresholdsI,DeCommitTotalFreeThresholdsI,LockPrefixTablesI,MaximumAllocationSizesI,VirtualMemoryThresholdsI,ProcessHeapFlagssI,ProcessAffinityMasks H,CSDVersions H,Reserved1s I,EditListsI,SecurityCookiesI,SEHandlerTablesI,SEHandlerCountsQ,DeCommitFreeBlockThresholdsQ,DeCommitTotalFreeThresholdsQ,LockPrefixTablesQ,MaximumAllocationSizesQ,VirtualMemoryThresholdsQ,ProcessAffinityMasks Q,EditListsQ,SecurityCookiesQ,SEHandlerTablesQ,SEHandlerCounttIMAGE_BOUND_IMPORT_DESCRIPTORsH,OffsetModuleNamesH,NumberOfModuleForwarderRefstIMAGE_BOUND_FORWARDER_REFs H,ReservedcCscg|_g|_d|_| r-| r-dSg|_|sLtd}n|j|||dS(Nt fast_load(tsectionst _PE__warningsRRKt__structures__tglobalst __parse__(RRRtR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs    cCsut|d|}y|j|Wn;tk r`}|jjd|d|t|fdSX|jj||S(sApply structure format to raw data. Returns and unpacked structure object if successful, None otherwise. Rs4Corrupt header "%s" at file offset %d. Exception: %siN(RRRRRR~RR(RRRtRt structureterr((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt__unpack_data__s c Cs|rRt|d}|j|_tj|jddtj|_|jn|rd||_n|jd }t|dkrtdn|j|j |dd|_ |j j t krtdn|j s|j j t krtdn|j jt|jkr&td n|j j}|j|j|j||d !d||_|j su|jj rtd nd |jj@tkrtd nd |jj@tkrtdnd |jj@tkrtdn|jjtkrtdn|j|j|j|d|dd!d|d|_ttd}|jsstdnt|j|jj||d|jj}||jj} |j|j|j|d||_d} |jd'krPt|j||d!| krPd} |j||d!d| } |j|j| d||_n|jd'k rB|jj!t"kr}t"|_#qB|jj!t$krBt$|_#|j|j%|j||d!d||_d(} |jd'kr?t|j||d!| kr?d} |j||d!d| } |j|j%| d||_q?qBn|jsZtdn|j#d'ksx|jd'krtdntt&d} t|j|jj'| g|j_(||jj}|j|j_|j|j_|jj)dkr|j*j+dd|jj)nd}xt,t-d|jj)@D]}t|j|dkrePnt|j|d kr|j|d)}n|j|||!}|j|j.|d|}|d'krPnyt/||_0Wnt1t2fk rPnX||j7}|jj(j+||||jjd*krBPqBqBW|j3| }g|j4D]-}|j5dkr^t6|j5|jj7^q^}t|dkrt8|}nd'}| s||kr|j| |_9n|j| |_9|j:|jj;d'k rW|j<|jj;}|t|jkru|j*j+d d!|jj;qun|j*j+d"d!|jj;|s|j=d#d+d$Y}|j>}|r||_?|j@d%d'|j?_A|j@d&d'|j?_Bqd'|_?nd'S(,sParse a Portable Executable file. Loads a PE file, parsing all its structures and making them available through the instance's attributes. trbitaccessi@s9Unable to read the DOS Header, possibly a truncated file.Rs)Probably a ZM Executable (not a PE file).sDOS Header magic not found.s.Invalid e_lfanew value, probably not a PE fileisNT Headers not found.is0Invalid NT Headers signature. Probably a NE files0Invalid NT Headers signature. Probably a LE files0Invalid NT Headers signature. Probably a LX filesInvalid NT Headers signature.ii t IMAGE_FILE_sFile Header missingiEiiR s4No Optional Header found, invalid PE32 or PE32+ filetIMAGE_DLL_CHARACTERISTICS_is7Suspicious NumberOfRvaAndSizes in the Optional Header. s<Normal values are never larger than 0x10, the value is: 0x%xilsBPossibly corrupt file. AddressOfEntryPoint lies outside the file. sAddressOfEntryPoint: 0x%xs;AddressOfEntryPoint lies outside the sections' boundaries. t RichHeadercBseZRS((RR(((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRstchecksumtvaluesNiIti((Ctfiletfilenotmmapt ACCESS_READRtcloseRRRt__IMAGE_DOS_HEADER_format__t DOS_HEADERte_magictIMAGE_DOSZM_SIGNATUREtIMAGE_DOS_SIGNATUREte_lfanewt__IMAGE_NT_HEADERS_format__t NT_HEADERSt SignaturetIMAGE_NE_SIGNATUREtIMAGE_LE_SIGNATUREtIMAGE_LX_SIGNATUREtIMAGE_NT_SIGNATUREt__IMAGE_FILE_HEADER_format__t FILE_HEADERRtIMAGE_CHARACTERISTICSRR$RtSizeOfOptionalHeadert __IMAGE_OPTIONAL_HEADER_format__RRtMagicRLRKRNt"__IMAGE_OPTIONAL_HEADER64_format__tDLL_CHARACTERISTICStDllCharacteristicstDATA_DIRECTORYtNumberOfRvaAndSizesRRRRt__IMAGE_DATA_DIRECTORY_format__tDIRECTORY_ENTRYRtKeyErrortAttributeErrortparse_sectionsRRRRtmintheadertget_section_by_rvatAddressOfEntryPointR+tparse_data_directoriestparse_rich_headert RICH_HEADERRiRR(RtfnameRtRtfdtdos_header_datatnt_headers_offsett image_flagstoptional_header_offsettsections_offsett&MINIMUM_VALID_OPTIONAL_HEADER_RAW_SIZEtpadding_lengtht padded_datatdll_characteristics_flagsRt)MAX_ASSUMED_VALID_NUMBER_OF_RVA_AND_SIZESRwt dir_entryRtrawDataPointerstlowest_section_offsett ep_offsetRt rich_header((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs(!                   #    :     cCs<d}d}y(ttjd|jdd}Wnd SX|d}|d|A|ks}|d|ks}|d|krd Si|d 6}g}||d <|d }xtt|dD]u}|d||kr|d|d|kr|jjd nPn||d||A|d|d|Ag7}qW|S(s*Parses the rich header see http://www.ntcore.com/files/richsign.htm for more information Structure: 00 DanS ^ checksum, checksum, checksum, checksum 10 Symbol RVA ^ checksum, Symbol size ^ checksum... ... XX Rich, checksum, 0, 0,... iDanSiRichs<32IiiiiiRRisRich Header corruptedN( RRpRqRRRRRR(RtDANStRICHRtRtresultt headervaluesRw((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs, (    0cCs|jS(sReturn the list of warnings. Non-critical problems found when parsing the PE file are appended to a list of warnings. This method returns the full list. (R(R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt get_warningsscCs!x|jD]}dG|GHq WdS(sPrint the list of warnings. Non-critical problems found when parsing the PE file are appended to a list of warnings. This method prints the full list to standard output. t>N(R(Rtwarning((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt show_warningsscCs|jdS(sProcess the data directories. This method will load the data directories which might not have been loaded if the "fast_load" option was used. N(R(R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt full_load*sc Cs"t|j}xF|jD];}t|j}|j}||||t|+qWt|drt|drxA|jD]3}t|drx|jD] }x|j j D]\}}|j |} |j |} t|| dkrt} xt |D]w\} } t| dkr_| jtt| d@tt| d@d?gq| jtt| d gqW| || d| d| dd +qt} xt |D]w\} } t| dkr| jtt| d@tt| d@d?gq| jtt| d gqW| || d| dt|d +| dt|}d g|d || dt|d | d| dd +qWqWqqWqnd jg|D]} tt| ^q}|rt|d }|j||jn|SdS(sWrite the PE file. This function will process all headers and components of the PE file and include all changes made (by just assigning to attributes in the PE objects) and write the changes back to a file whose name is provided as an argument. The filename is optional, if not provided the data will be returned as a 'str' object. RtFileInfoRiiiiiR iuRswb+N(RRRRRRR'RRtentriesR|tentries_offsetstentries_lengthsRRtextendRRRtwriteR(Rtfilenamet file_dataRt struct_dataRtentrytst_entryRtoffsetstlengthsRvtidxRt remaindert new_file_dataR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR4sD     :#$ :##O.  cCsg|_x9t|jjD]%}t|jd|}|sAPn||j|}|j||j|j |||j!|j j ||j t |j kr|jj d|dnt|j|jjt |j kr|jj d|dn|jdkr2|jj d|dnt|j|jj|jjdkrt|jj d|dn|jjd kr|j|jjd kr|jj d|d d d d nttd}t||j||jjdtr1|jjdtr1|jj d|ddn|jj |qW|jjd kr|jr||jd j|jjS|SdS(s7Fetch the PE file sections. The sections will be readily available in the "sections" attribute. Its attributes will contain all the section information plus "data" a buffer containing the section's data. The "Characteristics" member will be processed and attributes representing the section characteristics (with the 'IMAGE_SCN_' string trimmed from the constant's names) will be added to the section instance. Refer to the SectionStructure class for additional info. RsError parsing section %d. s"SizeOfRawData is larger than file.s3PointerToRawData points beyond the end of the file.is+Suspicious value found parsing section %d. s(VirtualSize is extremely large > 256MiB.s$VirtualAddress is beyond 0x10000000.is;Suspicious value for FileAlignment in the Optional Header. s@Normally the PointerToRawData entry of the sections' structures s:is a multiple of FileAlignment, this might imply the file s7is trying to confuse tools which parse this incorrectlyR%RIRGs%Suspicious flags set for section %d. s<Both IMAGE_SCN_MEM_WRITE and IMAGE_SCN_MEM_EXECUTE are set. s(This might indicate a packed executable.N(RRRtNumberOfSectionsRt__IMAGE_SECTION_HEADER_format__RRRRRRRRRRRRRR-RRRRR&RR$RRiR(RRRwtsectiontsection_offsetR(((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRysV  !               c Csd|jfd|jfd|jfd|jfd|jfd|jfd|jfd|jfd |jff }|d k rt |t t fs|g}qnx|D]}y"t |d }|jj|}Wntk rPnX|d ks||krG|jrG|d |j|j}|rDt||d d |qDqGn|d k rt |t r|d |kr|j|qqWd S(sParse and process the PE file's data directories. If the optional argument 'directories' is given, only the directories at the specified indices will be parsed. Such functionality allows parsing of areas of interest without the burden of having to parse all others. The directories can then be specified as: For export/import only: directories = [ 0, 1 ] or (more verbosely): directories = [ DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT'], DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT'] ] If 'directories' is a list, the ones that are processed will be removed, leaving only the ones that are not present in the image. RRR R R RRRRiiiN(tparse_import_directorytparse_export_directorytparse_resources_directorytparse_debug_directorytparse_relocations_directorytparse_directory_tlstparse_directory_load_configtparse_delay_import_directorytparse_directory_bound_importsRR}ttupleRRRRt IndexErrorRtSizeRtremove(Rt directoriestdirectory_parsingRtdirectory_indexRR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs2            !+c Cst|j}|j}|}g}xtr|j|j|j|||!d|}|dkry|jjddS|j rPn||j7}g}xt |j D]}|j|j |j|||!d|} | st dn|| j7}|| j} |jd|j| | t!} | s:Pn|jtd| d| qW||j} |jd|j| | t!} | sPn|jtd|d| d|q*W|S( RRs7The Bound Imports directory exists but can't be parsed.Ns(IMAGE_BOUND_FORWARDER_REF cannot be readiRpRR(Rt(__IMAGE_BOUND_IMPORT_DESCRIPTOR_format__RRRRRRRRRtNumberOfModuleForwarderRefst$__IMAGE_BOUND_FORWARDER_REF_format__RtOffsetModuleNametget_string_from_datatMAX_STRING_LENGTHRoRm( RRR/t bnd_descrtbnd_descr_sizeR t bound_importstforwarder_refsRt bnd_frwd_refRtname_str((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR sZ           cCs|jtkr|j}n|jtkr6|j}ny=|j||j|t|jd|j |}Wn/t k r|j j dd|d}nX|sdStd|S(RRs$Invalid TLS information. Can't read sdata at RVA: 0x%xRpN(RKRLt__IMAGE_TLS_DIRECTORY_format__RNt __IMAGE_TLS_DIRECTORY64_format__RRRRR+RRRRRl(RRR/Rt tls_struct((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRW s"      cCs|jtkr|j}n|jtkr6|j}ny=|j||j|t|jd|j |}Wn/t k r|j j dd|d}nX|sdStd|S(RRs,Invalid LOAD_CONFIG information. Can't read sdata at RVA: 0x%xRpN(RKRLt&__IMAGE_LOAD_CONFIG_DIRECTORY_format__RNt(__IMAGE_LOAD_CONFIG_DIRECTORY64_format__RRRRR+RRRRRn(RRR/Rtload_config_struct((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRq s"      cCst|jj}||}g}x||kry4|j|j|j||d|j|}Wn/tk r|jjdd|d}nX|sPn|j |||j |j |}|jt d|d||j sPn||j 7}q(W|S(RRs+Invalid relocation information. Can't read sdata at RVA: 0x%xRpRN(Rt __IMAGE_BASE_RELOCATION_format__RRRR+RRRRtparse_relocationsRt SizeOfBlockRf(RRR/trlc_sizeR#t relocationstrlct reloc_entries((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR s4       c Cs|j||}|j|}g}xtt|dD]}|j|j||d|dd!d|}|s|Pn|j} | d?} | d@} |jtd|d| d|d | |||j 7}q>W|S( RiiRi iRpRhRjR( RR+RRRt&__IMAGE_BASE_RELOCATION_ENTRY_format__RiRRgR( Rtdata_rvaRR/RtRRRRRkt reloc_typet reloc_offset((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR s*    c Cst|jj}g}xt||D]}y|j||||}Wn,tk r~}|jjdd|dSX|j |j|d|j |||}|sdS|jt d|q,W|S(Rs&Invalid debug information. Can't read sdata at RVA: 0x%xRRpN( Rt __IMAGE_DEBUG_DIRECTORY_format__RRRRRRRRR+Re( RRR/tdbg_sizetdebugRRtRtdbg((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR s&   ic$ Cs |dkr|g}n|dkr-|}n|j|}y%|j|t|jj}Wn,tk r}|jjdd|dSX|j |j|d|j |} | dkr|jjdd|dSg} || j7}| j | j } d} | | kr2|jjd| | fdSt } xyt| D]k}|j|}|dkr|jjd||fPnd}d}|| j kr|j}nW||j}y t||}| j|Wn'tk r}|jjd|nX|jr||j|kr%PnE|j||j|||d |d |d d |||jg}|stPnd}|td krvt}x|jD]}t|drx|jjD]}t}|jjj}|jjj}|j}|jjjdks|jdkrqn|j||}t |t!|d d||j"|qW||j_#qqWn| jt$d|d|d|d|nq|j%||j}|rt&d|d|jd@d|jd?}| jt$d|d|d|d|nP|dkr|j'tdkrt(| dkrP| d}nd} y$|jjdjjdjj} WnnX| dk r|j)| qn||j7}qHWg| D]}!|!j*^q}"|"j+x$t,| D]\}}!|!j-qWt.d| d| }#|#S(sParse the resources directory. Given the RVA of the resources directory, it will process all its entries. The root will have the corresponding member of its structure, IMAGE_RESOURCE_DIRECTORY plus 'entries', a list of all the entries in the directory. Those entries will have, correspondingly, all the structure's members (IMAGE_RESOURCE_DIRECTORY_ENTRY) and an additional one, "directory", pointing to the IMAGE_RESOURCE_DIRECTORY structure representing upper layers of the tree. This one will also have an 'entries' attribute, pointing to the 3rd, and last, level. Another directory with more entries. Those last entries will have a new attribute (both 'leaf' or 'data_entry' can be used to access it). This structure finally points to the resource data. All the members of this structure, IMAGE_RESOURCE_DATA_ENTRY, are available as its attributes. s(Invalid resources directory. Can't read sdirectory data at RVA: 0x%xRs)Invalid resources directory. Can't parse isNError parsing the resources directory, The directory contains %d entries (>%s)sHError parsing the resources directory, Entry %d is invalid, RVA = 0x%x. snError parsing the resources directory, attempting to read entry name. Can't read unicode string at offset 0x%xRjtlevelitdirsRt directoryiRpRtidtlangitsublangi RtiRiRN(/RRRRt#__IMAGE_RESOURCE_DIRECTORY_format__RRRRRR+tNumberOfNamedEntriestNumberOfIdEntriesRRtparse_resource_entrytNamet NameOffsetRtDataIsDirectorytOffsetToDirectoryRt RESOURCE_TYPERRR'R+RtRpt OffsetToDataRR,R{RtupdatetstringsRctparse_resource_data_entryRdtIdRtparse_version_informationRtsortRRRb($RRR/RjR)R*tresources_sectionRtRt resource_dirt dir_entriestnumber_of_entriestMAX_ALLOWED_ENTRIEStstrings_to_postprocessRtrest entry_nametentry_idt ustr_offsettexcptentry_directoryR:t resource_idt resource_langtresource_stringststring_entry_rvatstring_entry_sizetstring_entry_idtstring_entry_dataRpt entry_datat last_entrytrt_version_structRt string_rvastresource_directory_data((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR s    %                     $    $   cCs|y%|j|t|jj}Wn,tk rS}|jjdd|dSX|j|j|d|j |}|S(s0Parse a data entry from the resources directory.s/Error parsing a resource directory data entry, sthe RVA is invalid: 0x%xRN( RRt$__IMAGE_RESOURCE_DATA_ENTRY_format__RRRRRRR+(RRRtRIt data_entry((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR; s%   cCsy%|j|t|jj}Wntk r;}dSX|j|j|d|j|}|dkrpdS|jd@|_ |jd@|_ |jd@|_ |j d@d?|_ |j d@|_|S(s5Parse a directory entry from the resources directory.RlllliN(RRt)__IMAGE_RESOURCE_DIRECTORY_ENTRY_format__RRRRR+R3R4t_PE__padR<R8R5R6(RRRtRItresource((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR2 s%  c" Cs|j|j}|j|||j!}|j|j|d|}|dkrTdS|j|j}y|j|}Wn5t k r}|j j ddd|d}nX|dkr|j j ddS||_ ||j _ |j|jdt|d |j}|j|j||d||} | sAdS| |_|j|| j|j} | } t|_x8tr|j|j|| d|| } | dkr|j j d dS|j| |j}y|j|} Wn0t k r#}|j j dd d|PnX| | _ |jj | | r5| jd r5| jd krt| jd krt|j| | jdt| d |j}t| _xtr.|j|j||d||}|sPn|j||j}y|j|}Wn0t k r?}|j j ddd|PnX||_t|_t|_t|_| jj ||j||jdt|d |j}x5|||j kr|j|j!||d||}|sPn|j||j}y"|j|}|j|}Wn0t k r\}|j j ddd|PnX|jdt|d ||j|j}|j|}y+|j|d|j}|j|}Wn0t k r}|j j ddd|PnX|j d kr||j }n|j|j ||j}g}xG|D]?}t"|dkrs|j dt"|qA|j |qAWdj#|}t$|||||j|<||f|j|g}|jtkr't}|j}n!|jtkrHt}|j}nxtr9|r9y"|j|t |j }Wn,t k r}|j j dd|dSX|j||d|j|}|r|jr|j|@r|jd@dkrgSqn| s|jrPn||j 7}|j |qKW|S(Ns Error parsing the import table. sInvalid data at RVA: 0x%xRii(RKRLRMt__IMAGE_THUNK_DATA_format__RNROt__IMAGE_THUNK_DATA64_format__RRRRRRRRRR+RRR(RRRRZRRtRt thunk_data((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR s4  "    icCs[|dk r%|j}|j|nd|j}x |jD]}|jdks=|jdkrgq=n|jt|jkrq=nt|j|j j t|jkrq=nt |j |j j |j j }||krq=n|t|}|dkr|d|7}n|dkr+|| }n||j7}q=W|dk rW||_n|S(sReturns the data corresponding to the memory layout of the PE file. The data includes the PE header and the sections loaded at offsets corresponding to their relative virtual addresses. (the VirtualAddress section header member). Any offset in this data corresponds to the absolute memory address ImageBase+offset. The optional argument 'max_virtual_address' provides with means of limiting which section are processed. Any section with their VirtualAddress beyond this value will be skipped. Normally, sections with values beyond this range are just there to confuse tools. It's a common trick to see in packed executables. If the 'ImageBase' optional argument is supplied, the file's relocations will be applied to the image by calling the 'relocate_image()' method. Beware that the relocation information is applied permanently. RiR N(RRtrelocate_imageRR-RRRRRRRRRR(Rtmax_virtual_addressRt original_datat mapped_dataRR"R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytget_memory_mapped_images2          cCst}t|drx|jjD]}t|dr%xt|jjD]c}t|drGt|jdr|jjrx*|jjjD]}|j|qWqqGqGWq%q%Wn|S(s(Returns a list of all the strings found withing the resources (if any). This method will scan all entries in the resources directory of the PE, if there is one, and will return a list() with the strings. An empty list will be returned otherwise. tDIRECTORY_ENTRY_RESOURCER+R:(RR'RRR+R:RR(Rtresources_stringst resource_typeRKt res_string((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytget_resources_stringsgs %cCs|j|}|r"||}nd}|s|t|jkrQ|j||!S|t|jkrt|j||!Stdn|j||S(sGet data regardless of the section where it lies on. Given a RVA and the size of the chunk to retrieve, this method will find the section where the data lies and return the data. s-data at RVA can't be fetched. Corrupt header?N(RRRRRRR(RRRRR#((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs   cCs|j|}|su|jrntg|jD]'}t|j|jj|jj^q+}||krr|Squ|Sn|j|S(s/Get the RVA corresponding to this file offset. ( tget_section_by_offsetRRRRRRRR*(RRRt lowest_rva((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR*s 7 cCsG|j|}|s:|t|jkr.|Stdn|j|S(sGet the file offset corresponding to this RVA. Given a RVA , this method will find the section where the data lies and return the offset within the file. s-data at RVA can't be fetched. Corrupt header?(RRRRR+(RRR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR+s  cCsR|j|}|s3|jd|j||t!S|jd|j|dtS(s1Get an ASCII string located at the given address.iR(RR RR R(RRR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRscCs}d}y||}Wntk r(dSXd}xGt|rx||7}|d7}y||}Wq2tk rtPq2Xq2W|S(s)Get an ASCII string from within the data.RiN(RRR(RRRtRR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR s     iicCsy|j|d}Wntk r,}dSXd}xt|D]r}y.tjd|j|d|dd}Wntjk rPnXt|dkrPn|t|7}q@W|S(s3Get an Unicode string located at the given address.iusWn|jd|j|jj|j|jd|j|j j|j|jd|j|j jt t d}|j dg}x8|D]0}t|j |dr|j|dqqW|jdj||jt|d r|jdUk r|jd |j|jjnt td }|j d g}x8|D]0}t|j|dr|j|dqqW|jdj||j|jd t td }x>|jD]3} |j| j|j dg}x5|D]-}t| |drv|j|dqvqvW|jdj||jd| jtdUk r|jd| jntdUk r |jd| jntdUk rF|jd| jntdUk rl|jd| jn|jqCWt|d rt|jdr|jdxCtt |jj!D])} |jj!| } |j| jqW|jndfd} t|dr+|jd|j|j"j|jt|dr|j|j#j|jnt|dr+x|j$D]} |j| j|jt| dr|x| j%D]}g|jD]}|jd|^q|jd|j&|jxD|j'j(D]3}|jd| |dd| |d q4WqW|jqt| d!rx| j)D]{}t|d"rg|jD]}|jd|^q|jd| |j*j+dd|j*j,dqqW|jqqWq+nt|d#r|jd$|j|j-j.j|j|jd%dVxs|j-j/D]e}|j0dUk r|j d)|j1|j0|j2f|j3r|jd*|j3q|jqqW|jnt|d+r|jd,x|j4D]}|j|j.j|jx|j5D]}|j6t7kr|j d-|j8t9|j1fn)|j d.|j8|j2t9|j:f|j;r|jd/|j;qT|jqTW|jq$Wnt|d0r|jd1x|j<D]}|j|j.j|jd2|j2|jxK|j'D]@}|j|j.jd3|jd2|j2d3|jqaWqWnt|d4r |jd5x|j=D]}|j|j.j|jx|j5D]}|j6t7kr= |j d-|j8t9|j1fn)|j d.|j8|j2t9|j:f|j;r |jd/|j;q |jq W|jqWnt|d6rp |jd7|j|j>j.jx|j>j'D]x}|j2dUk r |jd8|j2d9n2|jd:|j.j?t@jA|j.j?d;fd9|j|j.jd9t|d<rU |j|jBj.jd3x|jBj'D]}|j2dUk r |jd8|j2d=n|jd>|j.j?d=|j|j.jd=t|d<r |j|jBj.jd?x|jBj'D]}t|d@r3 |jdA|jCjD|jCjEtFjA|jCjDdBtG|jCjD|jCjEfd?|j|j.jdC|j|jCj.jdDq3 q3 Wt|jBdErN |jBjHrN |jdFdCxC|jBjHj(D],\} }|jdG| | |fdDq WqN q q Wn|jq W|jnt|dHr |jIr |jIj.r |jdI|j|jIj.j|jnt|dJr |jJr |jJj.r |jdK|j|jJj.j|jnt|dLr |jdMx~|jKD]p}|j|j.jy|jdNtL|j.jMWn(tNk r |jdO|j.jMnX|jqD Wnt|dPr|jdQx|jOD]}|j|j.jxq|j'D]f}y,|jdR|jPtQ|jRdSfd3WqtNk rl|jdT|jP|jRfd3qXqW|jq Wn|jSS(Ws>Dump all the PE header information into human readable string.sParsing WarningsRRRRsFlags: is, RRsDllCharacteristics: s PE SectionsR%sEntropy: %f (Min=0.0, Max=8.0)sMD5 hash: %ssSHA-1 hash: %ssSHA-256 hash: %ssSHA-512 hash: %sRt DirectoriescSsR|tjks<|tjks<|tjks<|tjkr@|Sdt|SdS(Ns\x%02x(Rt ascii_lettersRt punctuationt whitespaceR(R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR~s<cs&djg|D]}|^q S(NR(R(RR(R(sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytconvert_to_printablesRsVersion InformationRRRs s LangID: s s: iRRtDIRECTORY_ENTRY_EXPORTsExported symbolss%-10s %-10s %sRQtRVAR3s%-10d 0x%08Xh %ss forwarder: %stDIRECTORY_ENTRY_IMPORTsImported symbolss$%s Ordinal[%s] (Imported by Ordinal)s%s.%s Hint[%s]s Bound: 0x%08XtDIRECTORY_ENTRY_BOUND_IMPORTs Bound importssDLL: %sitDIRECTORY_ENTRY_DELAY_IMPORTsDelay Imported symbolsRsResource directorys Name: [%s]isId: [0x%X] (%s)RR+is Id: [0x%X]iRts\--- LANG [%d,%d][%s,%s]s *unknown*i i R:s [STRINGS]s%6d: %stDIRECTORY_ENTRY_TLStTLStDIRECTORY_ENTRY_LOAD_CONFIGt LOAD_CONFIGtDIRECTORY_ENTRY_DEBUGsDebug informationsType: sType: 0x%x(Unknown)tDIRECTORY_ENTRY_BASERELOCsBase relocationss%08Xh %sis0x%08X 0x%x(Unknown)N(sOrdinalRsName(TRRRRRRRRRRRRRRRRRR'RRR&RR3R;R<R4R6R7R8R9R:RRRRRRRReRR|RRRRRRpRRJRHRR^RRRRRR~RRIRRRR<R7RiR+RtR-R.RhRoR:RRRt DEBUG_TYPERbRRRtRELOCATION_TYPERhR(RRtwarningsRRRRRR(RRR+RRRRt str_entryt var_entrytexporttmoduleRtbound_imp_desct bound_imp_refRRKRLRR(t base_reloctreloc((RsYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR(s                                *  *:                        ##1             #  cCs*y|j|SWntk r%dSXdS(s;Gets the physical address in the PE file from an RVA value.N(R+t ExceptionR(RR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytget_physical_by_rvaXs cCstjd|d@S(sNReturn a four byte string representing the double word value. (little endian).s|j |d @d?qA|jt d krA|j|j |j|j |qAqAWqWd S( sRApply the relocation information to the image using the provided new image base. This method will apply the relocation information to the image. Given the new base, all the relocations will be processed and both the raw data and the section's data will be fixed accordingly. The resulting image can be retrieved as well through the method: get_memory_mapped_image() In order to get something that would more closely match what could be found in memory once the Windows loader finished its work. iiRuRviiRwRxRylRN(RRRRpRRRRRhRRRRRRR R( Rt new_ImageBasetrelocation_differenceRtvirtual_addresst size_of_blockt entry_idxRt next_entry((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyR:sD    "    cCs|jj|jkS(N(RtCheckSumtgenerate_checksum(R((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytverify_checksumscCs)|j|_|jjd}d}t|jd}|jdd||dk}xtt|dD]|}||dkrqnntjd||d|dd!d}|d@||d?}|d krn|d@|d?}qnqnW|d @|d ?}||d ?}|d @}|t|jS( Ni@iiR Rli iiil(RRRRRRRpRq(Rtchecksum_offsetRRRtRwR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs )  cCsBtd}|j r>|j r>||jj@|kr>tStS(sCheck whether the file is a standard executable. This will return true only if the file has the IMAGE_FILE_EXECUTABLE_IMAGE flag set and the IMAGE_FILE_DLL not set and the file does not appear to be a driver either. R(Rtis_dllt is_driverRR$RR(RtEXE_flag((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytis_exes  cCs(td}||jj@|kr$tStS(sCheck whether the file is a standard DLL. This will return true only if the image has the IMAGE_FILE_DLL flag set. R$(RRR$RR(RtDLL_flag((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs cCsNt|drJtdjg|jD]}|jj^q%rJtSntS(sCheck whether the file is a Windows driver. This will return true only if there are reliable indicators of the image being a driver. Rs ntoskrnl.exeshal.dllsndis.syss bootvid.dlls kdcom.dll(s ntoskrnl.exeshal.dllsndis.syss bootvid.dlls kdcom.dll(R'Rt intersectionRRtlowerRR(Rtimp((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRs4cCsd}d}xe|jD]Z}|j|jt|jkrAqn|j|j||kr|j}|j}qqWt|j||kr||SdS(sgGet the offset of data appended to the file and not contained within the area described in the headers.iN(RRRRRR(Rthighest_PointerToRawDatathighest_SizeOfRawDataR((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pytget_overlay_data_start_offsets cCs'|j}|dk r#|j|SdS(s]Get the data appended to the file and not contained within the area described in the headers.N(R$RR(Rtoverlay_data_offset((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyt get_overlays   cCs+|j}|dk r#|j| S|jS(sLReturn the just data defined by the PE headers, removing any overlayed data.N(R$RR(RR%((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyttrim#s   (hRRRRRRRRRRRRRR/RYRWR]R`RaRdRgRhRRR%RR!RRRRRR RRRRRRRRRRRRRRRRRRR;R2R=RR_RRRRRRRR*R+RR RRRRRRRRRRRRRWRRiRRRR_RRRRR R RRYRRRRRRRR$R&R'(((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyRtsC                             # 8 E ] = D   *     U  8 F -I #      1            ^  )     (NNNN(sIMAGE_DIRECTORY_ENTRY_EXPORTi(sIMAGE_DIRECTORY_ENTRY_IMPORTi(sIMAGE_DIRECTORY_ENTRY_RESOURCEi(R i(R i(sIMAGE_DIRECTORY_ENTRY_BASERELOCi(sIMAGE_DIRECTORY_ENTRY_DEBUGi(Ri(Ri(sIMAGE_DIRECTORY_ENTRY_TLSi (s!IMAGE_DIRECTORY_ENTRY_LOAD_CONFIGi (s"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORTi (Ri (s"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORTi (Ri(Ri(Ri(sIMAGE_FILE_EXECUTABLE_IMAGEi(Ri(Ri(Ri(Ri (Ri@(Ri(Ri(R i(R!i(R"i(R#i(sIMAGE_FILE_DLLi (R%i@(R&i(R'i (R(i@(R)i(R*i(R+i(R,i(R-i(R.i(R/i(R0i(R1i(R2i(R3i(R4i (R5i0(R6i@(R7iP(R8i`(R9ip(R:i(R;i(R<i(R=i(R>i(R?i(R@i(RAi(RBi(RCi(RDi(REi(RFi(sIMAGE_SCN_MEM_EXECUTEi (RHi@(sIMAGE_SCN_MEM_WRITEl(sIMAGE_DEBUG_TYPE_UNKNOWNi(sIMAGE_DEBUG_TYPE_COFFi(sIMAGE_DEBUG_TYPE_CODEVIEWi(sIMAGE_DEBUG_TYPE_FPOi(sIMAGE_DEBUG_TYPE_MISCi(sIMAGE_DEBUG_TYPE_EXCEPTIONi(sIMAGE_DEBUG_TYPE_FIXUPi(sIMAGE_DEBUG_TYPE_OMAP_TO_SRCi(sIMAGE_DEBUG_TYPE_OMAP_FROM_SRCi(RSi (RTi (RUi(RVi(RWi(RXi(RYi(RZi(R[i (R\i (R]i (R^i (R_i (R`i(sIMAGE_FILE_MACHINE_UNKNOWNi(Rbi(Rcid(Rdi(Rei(RfiL(Rgi(RhiA(Riif(Rjif(Rkif(Rli(Rmi(Rnif(Roi(Rpi(Rqi(Rri(Rsi(Rtii(sIMAGE_REL_BASED_ABSOLUTEi(sIMAGE_REL_BASED_HIGHi(sIMAGE_REL_BASED_LOWi(sIMAGE_REL_BASED_HIGHLOWi(sIMAGE_REL_BASED_HIGHADJi(sIMAGE_REL_BASED_MIPS_JMPADDRi(R{i(R|i(R}i (R~i (sIMAGE_REL_BASED_DIR64i (Ri (Ri(Ri(Ri(Ri(Ri@(Ri(Ri(Ri(Ri(Ri(Ri(Ri (Ri(s RT_CURSORi(s RT_BITMAPi(sRT_ICONi(sRT_MENUi(s RT_DIALOGi(s RT_STRINGi(s RT_FONTDIRi(sRT_FONTi(sRT_ACCELERATORi (s RT_RCDATAi (sRT_MESSAGETABLEi (sRT_GROUP_CURSORi (s RT_GROUP_ICONi(s RT_VERSIONi(s RT_DLGINCLUDEi(s RT_PLUGPLAYi(sRT_VXDi(s RT_ANICURSORi(s RT_ANIICONi(sRT_HTMLi(s RT_MANIFESTi(s LANG_NEUTRALi(Ri(Ri6(Ri(Ri(Ri+(RiM(Ri,(Ri-(Ri#(RiE(sLANG_BULGARIANi(Ri(s LANG_CHINESEi(s LANG_CROATIANi(s LANG_CZECHi(s LANG_DANISHi(Rie(s LANG_DUTCHi(s LANG_ENGLISHi (Ri%(Ri8(Ri)(s LANG_FINNISHi (s LANG_FRENCHi (RiV(Ri7(s LANG_GERMANi(s LANG_GREEKi(RiG(Ri (Ri9(sLANG_HUNGARIANi(sLANG_ICELANDICi(Ri!(s LANG_ITALIANi(s LANG_JAPANESEi(RiK(Ri`(Ri?(RiW(s LANG_KOREANi(Ri@(Ri&(Ri'(Ri/(Ri>(RiL(RiX(RiN(RiP(Ria(sLANG_NORWEGIANi(RiH(s LANG_POLISHi(sLANG_PORTUGUESEi(RiF(s LANG_ROMANIANi(s LANG_RUSSIANi(RiO(Ri(RiY(s LANG_SLOVAKi(sLANG_SLOVENIANi$(s LANG_SPANISHi (RiA(s LANG_SWEDISHi(RiZ(RiI(RiD(RiJ(Ri(s LANG_TURKISHi(Ri"(Ri (RiC(Ri*(Ri<(Ri:(Ri((Ri(Ri;(Ri.(Ri0(Ri1(Ri2(Ri3(Ri4(Ri5(Ri(Ri(Ri(Ri(Ri(sSUBLANG_NEUTRALi(sSUBLANG_DEFAULTi(sSUBLANG_SYS_DEFAULTi(Ri(Ri(Ri(Ri(Ri(R i(R i(R i(R i (R i (Ri (Ri (Ri (Ri(Ri(Ri(Ri(Ri(sSUBLANG_CHINESE_TRADITIONALi(sSUBLANG_CHINESE_SIMPLIFIEDi(sSUBLANG_CHINESE_HONGKONGi(sSUBLANG_CHINESE_SINGAPOREi(Ri(s SUBLANG_DUTCHi(sSUBLANG_DUTCH_BELGIANi(sSUBLANG_ENGLISH_USi(sSUBLANG_ENGLISH_UKi(sSUBLANG_ENGLISH_AUSi(sSUBLANG_ENGLISH_CANi(sSUBLANG_ENGLISH_NZi(sSUBLANG_ENGLISH_EIREi(R#i(R$i(R%i (R&i (R'i (R(i (R)i (sSUBLANG_FRENCHi(sSUBLANG_FRENCH_BELGIANi(sSUBLANG_FRENCH_CANADIANi(sSUBLANG_FRENCH_SWISSi(R.i(R/i(sSUBLANG_GERMANi(sSUBLANG_GERMAN_SWISSi(sSUBLANG_GERMAN_AUSTRIANi(R3i(R4i(sSUBLANG_ITALIANi(sSUBLANG_ITALIAN_SWISSi(R7i(R8i(R9i(R:i(R;i(R<i(R=i(sSUBLANG_NORWEGIAN_BOKMALi(sSUBLANG_NORWEGIAN_NYNORSKi(sSUBLANG_PORTUGUESEi(sSUBLANG_PORTUGUESE_BRAZILIANi(RBi(RCi(sSUBLANG_SPANISHi(sSUBLANG_SPANISH_MEXICANi(sSUBLANG_SPANISH_MODERNi(RGi(RHi(RIi(RJi(RKi(RLi (RMi (RNi (ROi (RPi (RQi(RRi(RSi(RTi(RUi(RVi(RWi(RXi(RYi(RZi(R[i(R\i(R]i(R^i(R_i(R`i(Rai(Rbi(Rci(Rdi(Rei(Rfi(Rgi((((((lRt __revision__t __author__Rt __version__t __contact__tosRpR R?treRRR=RRR4R7R9R;thashlibt ImportErrortshatnewRt NameErrorRRR RRRRRRt IMAGE_NUMBEROF_DIRECTORY_ENTRIESRMRORLRNtdirectory_entry_typesRRRtimage_characteristicsRtsection_characteristicsR&t debug_typesRtsubsystem_typestSUBSYSTEM_TYPEt machine_typest MACHINE_TYPEtrelocation_typesRtdll_characteristicsRRR7R-RhR.RjRnRlthas_keyRRoR{RRRRRRRRRRRRDRFRGR\R]RbRcRdReRfRgRlRmRnRot lowercaset uppercaseRRRRwRRpRqRrRsRt(((sYC:\Users\Salopaasi\My Documents\pyinstaller-pyinstaller-275d4c9\PyInstaller\lib\pefile.pyts                        1 + + 1 1 1 1 1 1 1 1    h A#  9(!J