class Metasm::WinOS::Thread

Attributes

context[W]
handle[W]
process[RW]
teb_base[W]
tid[RW]

Public Class Methods

new(tid, handle=nil, process=nil) click to toggle source
# File metasm/os/windows.rb, line 1344
def initialize(tid, handle=nil, process=nil)
        @tid = tid
        @handle = handle
        @process = process
end

Public Instance Methods

context() { |context| ... } click to toggle source

returns a Context object. Can be reused, refresh the values with update (target thread must be suspended) if a block is given, suspend the thread, update the context, yield it, and resume the thread

# File metasm/os/windows.rb, line 1393
def context
        @context ||= Context.new(self, :all)
        if block_given?
                suspend
                begin
                        @context.update
                        yield @context
                ensure
                        resume
                end
        else
                @context
        end
end
handle() click to toggle source
# File metasm/os/windows.rb, line 1350
def handle
        @handle ||= WinAPI.openthread(WinAPI::THREAD_ALL_ACCESS, 0, @tid)
end
resume() click to toggle source

decrease the suspend count of the target thread - runs at 0

# File metasm/os/windows.rb, line 1383
def resume
        WinAPI.resumethread(handle)
end
suspend() click to toggle source

increment the suspend count of the target thread - stop at >0

# File metasm/os/windows.rb, line 1374
def suspend
        if WinAPI.host_cpu.size == 64 and process and process.iswow64
                WinAPI.wow64suspendthread(handle)
        else
                WinAPI.suspendthread(handle)
        end
end
teb_base() click to toggle source

return the address of the TEB for the target thread

# File metasm/os/windows.rb, line 1356
def teb_base
        @teb_base ||=
        if WinAPI.respond_to?(:ntqueryinformationthread)
                tinfo = WinAPI.alloc_c_struct('THREAD_BASIC_INFORMATION')
                if WinAPI.ntqueryinformationthread(handle, WinAPI::THREADBASICINFORMATION, tinfo, tinfo.sizeof, 0) == 0
                        tinfo.tebbaseaddress
                end
        else
                fs = context { |c| c[:fs] }
                ldte = WinAPI.alloc_c_struct('LDT_ENTRY')
                if WinAPI.getthreadselectorentry(handle, fs, ldte)
                        ldte.baselow | (ldte.basemid << 16) | (ldte.basehi << 24)
                end
        end
end
terminate(exitcode=0) click to toggle source
# File metasm/os/windows.rb, line 1387
def terminate(exitcode=0)
        WinAPI.terminatethread(handle, exitcode)
end