third_party/pefile_py3/pefile.py
def is_driver(self):
        """Check whether the file is a Windows driver.

        This will return true only if there are reliable indicators of the image
        being a driver.
        """

        # Checking that the ImageBase field of the OptionalHeader is above or
        # equal to 0x80000000 (that is, whether it lies in the upper 2GB of
        # the address space, normally belonging to the kernel) is not a
        # reliable enough indicator.  For instance, PEs that play the invalid
        # ImageBase trick to get relocated could be incorrectly assumed to be
        # drivers.

        # This is not reliable either...
        #
        # if any((section.Characteristics &
        #           SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_NOT_PAGED']) for
        #        section in self.sections ):
        #    return True

        # If the import directory was not parsed (fast_load = True); do it now.
        if not hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
            self.parse_data_directories(directories=[
                DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT']])

        # If there's still no import directory (the PE doesn't have one or it's
        # malformed), give up.
        if not hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
            return False

        # self.DIRECTORY_ENTRY_IMPORT will now exist, although it may be empty.
        # If it imports from "ntoskrnl.exe" or other kernel components it should
        # be a driver
        #
        system_DLLs = set((b'ntoskrnl.exe', b'hal.dll', b'ndis.sys',
                           b'bootvid.dll', b'kdcom.dll'))
        if system_DLLs.intersection(
                [imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT]):
            return True

        driver_like_section_names = set(
            (b'page', b'paged'))
        if driver_like_section_names.intersection(
                [section.Name.lower().rstrip(b'\x00') for section in self.sections]) and (
            self.OPTIONAL_HEADER.Subsystem in (
                SUBSYSTEM_TYPE['IMAGE_SUBSYSTEM_NATIVE'],
                SUBSYSTEM_TYPE['IMAGE_SUBSYSTEM_NATIVE_WINDOWS'])):
            return True

        return False
Check whether the file is a Windows driver.

        This will return true only if there are reliable indicators of the image
        being a driver.
        
Check whether the file is a Windows driver.
This will return true only if there are reliable indicators of the image
being a driver.
Check whether the file is a Windows driver . This will return true only if there are reliable indicators of the image being a driver .
def is_driver(self):
         if any((section.Characteristics &
                   SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_NOT_PAGED']) for
                section in self.sections ):
            return True
         If the import directory was not parsed (fast_load = True); do it now.
        if not hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
            self.parse_data_directories(directories=[
                DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT']])
         If there's still no import directory (the PE doesn't have one or it's
         malformed), give up.
        if not hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
            return False
         self.DIRECTORY_ENTRY_IMPORT will now exist, although it may be empty.
         If it imports from "ntoskrnl.exe" or other kernel components it should
         be a driver
        system_DLLs = set((b'ntoskrnl.exe', b'hal.dll', b'ndis.sys',
                           b'bootvid.dll', b'kdcom.dll'))
        if system_DLLs.intersection(
                [imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT]):
            return True
        driver_like_section_names = set(
            (b'page', b'paged'))
        if driver_like_section_names.intersection(
                [section.Name.lower().rstrip(b'\x00') for section in self.sections]) and (
            self.OPTIONAL_HEADER.Subsystem in (
                SUBSYSTEM_TYPE['IMAGE_SUBSYSTEM_NATIVE'],
                SUBSYSTEM_TYPE['IMAGE_SUBSYSTEM_NATIVE_WINDOWS'])):
            return True
        return False
def is_driver ( self ) : if not hasattr ( self , 'DIRECTORY_ENTRY_IMPORT' ) : self . parse_data_directories ( directories = [ DIRECTORY_ENTRY [ 'IMAGE_DIRECTORY_ENTRY_IMPORT' ] ] ) if not hasattr ( self , 'DIRECTORY_ENTRY_IMPORT' ) : return False system_DLLs = set ( ( b'ntoskrnl.exe' , b'hal.dll' , b'ndis.sys' , b'bootvid.dll' , b'kdcom.dll' ) ) if system_DLLs . intersection ( [ imp . dll . lower ( ) for imp in self . DIRECTORY_ENTRY_IMPORT ] ) : return True driver_like_section_names = set ( ( b'page' , b'paged' ) ) if driver_like_section_names . intersection ( [ section . Name . lower ( ) . rstrip ( b'\x00' ) for section in self . sections ] ) and ( self . OPTIONAL_HEADER . Subsystem in ( SUBSYSTEM_TYPE [ 'IMAGE_SUBSYSTEM_NATIVE' ] , SUBSYSTEM_TYPE [ 'IMAGE_SUBSYSTEM_NATIVE_WINDOWS' ] ) ) : return True return False
Check whether the file is a Windows driver.
Check whether the file is a Windows driver .
"""Check whether the file is a Windows driver.

        This will return true only if there are reliable indicators of the image
        being a driver.
        """ # Checking that the ImageBase field of the OptionalHeader is above or # equal to 0x80000000 (that is, whether it lies in the upper 2GB of # the address space, normally belonging to the kernel) is not a # reliable enough indicator.  For instance, PEs that play the invalid # ImageBase trick to get relocated could be incorrectly assumed to be # drivers. # This is not reliable either... # # if any((section.Characteristics & #           SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_NOT_PAGED']) for #        section in self.sections ): #    return True # If the import directory was not parsed (fast_load = True); do it now. # If there's still no import directory (the PE doesn't have one or it's # malformed), give up. # self.DIRECTORY_ENTRY_IMPORT will now exist, although it may be empty. # If it imports from "ntoskrnl.exe" or other kernel components it should # be a driver #
self