class Metasm::WindowsExports

Constants

EXPORT

exported symbol name => exporting library name for common libraries used by PE#autoimports

IMPORT_HASH

Public Class Methods

patch_rubylib_name(newname) click to toggle source

update the autoexport data so that it refers to a specific ruby library

# File metasm/os/windows_exports.rb, line 714
def self.patch_rubylib_name(newname)
        EXPORT.each_key { |export|
                EXPORT[export] = newname if EXPORT[export] =~ /ruby/
        }
end
patch_rubylib_to_current_interpreter() click to toggle source

patch the ruby library name based on the current interpreter so that we can eg compile the dynldr binary module for windows (we need the correct name in the import directory to avoid loading

an incorrect lib in the current ruby process)

this also means we can't rely on dynldr to find the ruby lib name

# File metasm/os/windows_exports.rb, line 725
def self.patch_rubylib_to_current_interpreter
        #if OS.current == WinOS and pr = WinOS.find_process(Process.pid)
        #     rubylib = pr.modules[1..-1].find { |m| m.path =~ /ruby/ }
        #end

        # we could also make a shellcode ruby module to fetch it from
        # the PEB, but it would need too much hacks to communicate back
        # or create a new process to debug&patch us ?

        # we'll simply use a regexp now, but this won't handle unknown
        # interpreter versions..
        # TODO mingw, cygwin, x64...
        if RUBY_PLATFORM == 'i386-mswin32' and RUBY_VERSION >= '1.9'
                patch_rubylib_name("msvcrt-ruby#{RUBY_VERSION.gsub('.', '')}")
        end
end