class Metasm::Shellcode
a shellcode is a simple sequence of instructions
Attributes
base_addr[RW]
the base address of the shellcode (nil if unspecified)
source[RW]
the array of source elements (Instr/Data etc)
Public Class Methods
disassemble(cpu, str, eip=0)
click to toggle source
# File metasm/exe_format/shellcode.rb, line 85 def self.disassemble(cpu, str, eip=0) sc = decode(str, cpu) sc.disassemble(eip) end
new(cpu=nil, base_addr=nil)
click to toggle source
Calls superclass method
Metasm::ExeFormat::new
# File metasm/exe_format/shellcode.rb, line 17 def initialize(cpu=nil, base_addr=nil) @base_addr = base_addr @source = [] super(cpu) end
withcpu(cpu)
click to toggle source
returns a virtual subclass of Shellcode
whose cpu_from_headers will return cpu
# File metasm/exe_format/shellcode.rb, line 108 def self.withcpu(cpu) c = Class.new(self) c.send(:define_method, :cpu_from_headers) { cpu = Metasm.const_get(cpu) if cpu.kind_of?(::String) cpu = cpu.new if cpu.kind_of?(::Class) and cpu.ancestors.include?(CPU) cpu } c end
Public Instance Methods
addr_to_fileoff(addr)
click to toggle source
# File metasm/exe_format/shellcode.rb, line 55 def addr_to_fileoff(addr) addr - (base_addr || 0) end
assemble(*a)
click to toggle source
encodes the source found in self.source appends it to self.encoded clears self.source the optional parameter may contain a binding used to fixup! self.encoded uses self.base_addr if it exists
# File metasm/exe_format/shellcode.rb, line 68 def assemble(*a) parse(*a) if not a.empty? @encoded << assemble_sequence(@source, @cpu) @source.clear self end
compile_setsection(src, section)
click to toggle source
# File metasm/exe_format/shellcode.rb, line 96 def compile_setsection(src, section) end
decode()
click to toggle source
# File metasm/exe_format/shellcode.rb, line 82 def decode end
dump_section_header(addr, edata)
click to toggle source
# File metasm/exe_format/shellcode.rb, line 99 def dump_section_header(addr, edata) '' end
each_section() { |encoded, (base_addr || 0)| ... }
click to toggle source
# File metasm/exe_format/shellcode.rb, line 51 def each_section yield @encoded, (@base_addr || 0) end
encode(binding={})
click to toggle source
# File metasm/exe_format/shellcode.rb, line 75 def encode(binding={}) @encoded.fixup! binding if binding.kind_of? Hash @encoded.fixup @encoded.binding(@base_addr) @encoded.fill @encoded.rawsize self end
fileoff_to_addr(foff)
click to toggle source
# File metasm/exe_format/shellcode.rb, line 59 def fileoff_to_addr(foff) foff + (base_addr || 0) end
get_default_entrypoints()
click to toggle source
# File metasm/exe_format/shellcode.rb, line 103 def get_default_entrypoints [@base_addr || 0] end
get_section_at(addr)
click to toggle source
# File metasm/exe_format/shellcode.rb, line 41 def get_section_at(addr) base = @base_addr || 0 if not addr.kind_of? Integer [@encoded, addr] if @encoded.ptr = @encoded.export[addr] elsif addr >= base and addr < base + @encoded.virtsize @encoded.ptr = addr - base [@encoded, addr] end end
init_disassembler()
click to toggle source
Calls superclass method
Metasm::ExeFormat#init_disassembler
# File metasm/exe_format/shellcode.rb, line 90 def init_disassembler d = super() d.function[:default] = @cpu.disassembler_default_func d end
parse_init()
click to toggle source
Calls superclass method
Metasm::ExeFormat#parse_init
# File metasm/exe_format/shellcode.rb, line 23 def parse_init @cursource = @source super() end
parse_parser_instruction(instr)
click to toggle source
allows definition of the base address
Calls superclass method
Metasm::ExeFormat#parse_parser_instruction
# File metasm/exe_format/shellcode.rb, line 29 def parse_parser_instruction(instr) case instr.raw.downcase when '.base', '.baseaddr', '.base_addr' # ".base_addr <expression>" # expression should #reduce to integer @lexer.skip_space raise instr, 'syntax error' if not @base_addr = Expression.parse(@lexer).reduce raise instr, 'syntax error' if tok = @lexer.nexttok and tok.type != :eol else super(instr) end end