"""
Scans for specific instructions(hex code - only for x86 arch - Disassemble mode Intel) in the pe file
Test1234
"""

import pefile
import binascii


file_handle = open("instr.info","r")

dict_anti_debug_instr = {}
for line in file_handle:
  val_arr = line.strip('\n').split('=')
  dict_anti_debug_instr[val_arr[1]]=val_arr[0]


pe =  pefile.PE('C:/test/pefile.exe', fast_load=True)
start_address_tls =  0x00
start_address_text =  0x00
dict_start_address_section = {}
dict_virtual_size = {}
for section in pe.sections:
  if 'tls' in section.Name:
    start_address_tls = section.VirtualAddress
    dict_start_address_section[start_address_tls] = "tls"
    dict_virtual_size[start_address_tls] = section.Misc_VirtualSize
  if 'text' in section.Name:
    start_address_text = section.VirtualAddress
    dict_start_address_section[start_address_text] = "text"
    dict_virtual_size[start_address_text] = section.Misc_VirtualSize

for section_address in dict_start_address_section:
  offset = 0
  data = pe.get_data(section_address, dict_virtual_size[section_address])
  str = data[offset:]
  hexstring = binascii.hexlify(str).decode()
  for hex_instr in dict_anti_debug_instr:
    if hex_instr in hexstring:
      print 'found the instruction ' + dict_anti_debug_instr[hex_instr] + ' in ' + dict_start_address_section[section_address] + ' section'     
