Exe Object

Exe

Exe object always points to the currently loaded application.

It provides a bunch of properties and a generous set of functions for accessing its internals and for setting up changes for a patch.

Table of Contents

• Properties
• Functions
  • User Input
  • Patch related
  • Section retrieval
  • Data Directory retrieval
  • Address Conversion
  • Extractors
  • Modifiers

Properties

Property name	Description
Exe.PEoffset	The PHYSICAL address of the PE header
Exe.ImageBase	Base Address where the exe is loaded in memory
Exe.BuildDate	The application's build date in the form yyyymmdd
Exe.Version	The linker version used for building this app in the form major.minor
Exe.Unpacked	Self explanatory
Exe.FileSize	Self explanatory
Exe.FilePath	Self explanatory
Exe.TestMode	Set to true when you are loading the app in the Test Bench

Functions

User Input

• Exe.GetUserInput(varName, dtype, title, prompt, defValue, constraints)
  This function allows you to collect inputs from user, which you can then use in your Patches & Extensions*

  Argument	Description
  varName	Variable Name. Every input value needs a way to refer it later, For this purpose, we make use of a 'variable name'.
  dtype	DataType of the user input expected. The Dialog shown will differ based on this.
  title	Title text to use in the Dialog that pops up to get the user's input.
  prompt	Prompt to shown in the Dialog for describing what the input is for.
  defValue	Default value for the input. This value is displayed in the Dialog that pops up and also serves as an initial value. You can opt to save or ignore default value by means of the saveDefault constraint explained below.
  constraints	This is an optional hash map specifying the constraints which vary based on the type of input.

  constraints would be specified in the form:

  {
      name1: <value1>,
      name2: <value2>
  }

  Currently the following constraint names are recognized:

  Name	Applicable DataTypes	Description
  saveDefault	All of them	Indicates whether the tool should save default values or not (when the user chooses them). If not specified then only D_InFile & D_OutFile types will save default values. In either case, if the default value is not being saved, the function will return false instead.
  acceptText rejectText	All of them	Button Texts for the Acceptor (OK) & Rejector (Cancel) Buttons. These are more useful for D_Bool type.
  min max	D_Int8 D_Int16 D_Int32 D_Uint8 D_Uint16 D_Uint16 D_FontSize	Lower & Upper limit overrides for numeric DataTypes.
  minLen maxLen	D_Text D_Hex D_FontName D_InFile D_OutFile	Length limits for string DataTypes. For D_Hex this corresponds to number of bytes. Without maxLen the strings would be limited to length of 32k (16k for D_Hex). If a minLen is specified then the result is padded with space (0 for D_Hex) to meet the criterion.
  align	D_Text D_Hex D_FontName D_InFile D_OutFile	Alignment for string DataTypes. It specifies whether to keep the value aligned to right or left while padding to meet minLen constraint. Default alignment is right.
  reversed	D_Hex	Indicates whether the final value needs the byte order reversed (for little endian). By default, no reversal is done.
  encoding	D_Text D_FontName D_InFile D_OutFile	Specifies the Encoding of the string. By default the string is considered to be ASCII encoded.
  choices	D_List	Specifies the list of strings from which the user needs to choose one. **This is a mandatory constraint for D_List. While you can keep it empty, it will not look good and it kind of defeats the purpose of the list.
  defaultAlpha	D_Color	Indicates that the Alpha component of the Default value need to be preserved, i.e. Even if the user selects a different alpha component it will be ignored.
  ignoreAlpha	D_Color	Indicates that the tool should ignore the alpha component while displaying the values in the ColorDialog. Makes more sense when used in tandem with defaultAlpha constraint.
  order	D_Color	Specifies the order in which the component bytes need to be saved. Need to be a combination of R, G, B & A. For e.g. "ARGB" which is also the default order.
  dataSize	D_Bool	Specifies the number of bytes to be used for saving the boolean result internally.

Patch related

• Exe.IsSelected(name)
  Checks whether a patch is currently selected.

  Argument	Description
  name	The name of the Patch.

  *Returns: true if selected else false
  
  

• Exe.SetActivePatch(name)
  Set a patch as active. All Set* and Add* functions setup changes into the active patch.

  Argument	Description
  name	The name of the Patch.

  
  

• Exe.ClearPatch(name)
  Clear any setup done for a Patch i.e. all staged changes and reservations are removed.

  Argument	Description
  name	The name of the Patch.

Section retrieval

• Exe.GetSectBegin(stype, [atype])
  Retrieve the starting address of a section.

  Argument	Description
  stype	SectionType specifying the section.
  atype	Optional AddrType of the returned address. If omitted the PHYSICAL address is returned.

  *Returns: the requested address or -1 in case of failure.
  
  

• Exe.GetSectEnd(stype, [atype])
  Retrieve the ending address of a section.

  Argument	Description
  stype	SectionType specifying the section.
  atype	Optional AddrType of the returned address. If omitted the PHYSICAL address is returned.

  *Returns: the requested address or -1 in case of failure.
  
  

• Exe.GetSectSize(stype, [atype])
  Retrieve the size of the section. Equivalent to Exe.GetSectEnd - Exe.GetSectBegin.

  Argument	Description
  stype	SectionType specifying the section.
  atype	Optional AddrType denoting the size required. If omitted the PHYSICAL size is returned.

  *Returns: the requested size or 0 in case of failure.

Data Directory retrieval

• Exe.GetDirAddr(dtype, [atype])
  Retrieve the starting address of an Image Data Directory

  Argument	Description
  dtype	DirType specifying the Data Directory.
  atype	Optional AddrType of the returned address. If omitted the VIRTUAL address is returned.

  *Returns: the requested address or -1 in case of failure.
  
  

• Exe.GetDirSize(dtype)
  Retrieve the size of an Image Data Directory. There is no PHYSICAL & VIRTUAL distinction for this one.

  Argument	Description
  dtype	DirType specifying the Data Directory.

  *Returns: the requested size or 0 in case of failure.

Address Conversion

• Exe.Phy2Vir(addr, [stype])
  Converts a PHYSICAL address to VIRTUAL.

  Argument	Description
  addr	The PHYSICAL address to be converted.
  stype	Optional SectionType to restrict conversion to a specific section i.e. addr is only converted if it is in the section specified.

  *Returns: the VIRTUAL address or -1 in case of failure.
  
  

• Exe.Phy2Rva(addr, [stype])
  Converts a PHYSICAL address to Relative VIRTUAL address. Basically Exe.ImageBase isn't added.*

  Argument	Description
  addr	The PHYSICAL address to be converted.
  stype	Optional SectionType to restrict conversion to a specific section i.e. addr is only converted if it is in the section specified.

  *Returns: the relative VIRTUAL address or -1 in case of failure.
  
  

• Exe.Vir2Phy(addr, [stype])
  Converts a VIRTUAL address to PHYSICAL.

  Argument	Description
  addr	The VIRTUAL address to be converted.
  stype	Optional SectionType to restrict conversion to a specific section i.e. addr is only converted if it is in the section specified.

  *Returns: the PHYSICAL address or -1 in case of failure.
  
  

• Exe.Rva2Phy(addr, [stype]) *Converts a relative VIRTUAL address to PHYSICAL. *

  Argument	Description
  addr	The relative VIRTUAL address to be converted.
  stype	Optional SectionType to restrict conversion to a specific section i.e. addr is only converted if it is in the section specified.

  *Returns: the PHYSICAL address or -1 in case of failure.

Extractors

Modifiers