class Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Image
Interacts with loading, unloading, enumerating, and querying image files in the context of a given process.
Public Class Methods
new(process)
click to toggle source
Initializes the image instance.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 30 def initialize(process) self.process = process end
Public Instance Methods
[](key)
click to toggle source
Returns the image base address associated with the supplied image name.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 37 def [](key) each_image { |i| if (i['name'].downcase == key.downcase) return i['base'] end } return nil end
each_image(&block)
click to toggle source
Enumerates through each image in the process.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 95 def each_image(&block) get_images.each(&block) end
get_images()
click to toggle source
Returns an array of images in the process with hash objects that have keys for ‘name’, ‘path’, and ‘base’.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 103 def get_images request = Packet.create_request('stdapi_sys_process_image_get_images') images = [] request.add_tlv(TLV_TYPE_HANDLE, process.handle) response = process.client.send_request(request) response.each(TLV_TYPE_IMAGE_GROUP) { |i| images << { 'name' => i.get_tlv_value(TLV_TYPE_IMAGE_NAME), 'base' => i.get_tlv_value(TLV_TYPE_IMAGE_BASE), 'path' => i.get_tlv_value(TLV_TYPE_IMAGE_FILE_PATH) } } return images end
get_procedure_address(image_file, procedure)
click to toggle source
Returns the address of the procedure that is found in the supplied library.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 65 def get_procedure_address(image_file, procedure) request = Packet.create_request('stdapi_sys_process_image_get_proc_address') request.add_tlv(TLV_TYPE_HANDLE, process.handle) request.add_tlv(TLV_TYPE_IMAGE_FILE, image_file) request.add_tlv(TLV_TYPE_PROCEDURE_NAME, procedure) response = process.client.send_request(request) return response.get_tlv_value(TLV_TYPE_PROCEDURE_ADDRESS) end
load(image_path)
click to toggle source
Loads an image file into the context of the process.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 50 def load(image_path) request = Packet.create_request('stdapi_sys_process_image_load') request.add_tlv(TLV_TYPE_HANDLE, process.handle) request.add_tlv(TLV_TYPE_IMAGE_FILE_PATH, image_path) response = process.client.send_request(request) return response.get_tlv_value(TLV_TYPE_IMAGE_BASE) end
unload(base)
click to toggle source
Unloads an image file that is loaded into the address space of the process by its base address.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 81 def unload(base) request = Packet.create_request('stdapi_sys_process_image_unload') request.add_tlv(TLV_TYPE_HANDLE, process.handle) request.add_tlv(TLV_TYPE_IMAGE_BASE, base) response = process.client.send_request(request) return true end