class Rex::ElfScan::Scanner::Generic
Attributes
elf[RW]
regex[RW]
Public Class Methods
new(elf)
click to toggle source
# File lib/rex/elfscan/scanner.rb, line 10 def initialize(elf) self.elf = elf end
Public Instance Methods
config(param)
click to toggle source
# File lib/rex/elfscan/scanner.rb, line 14 def config(param) end
scan(param)
click to toggle source
# File lib/rex/elfscan/scanner.rb, line 17 def scan(param) config(param) $stdout.puts "[#{param['file']}]" elf.program_header.each do |program_header| # Scan only loadable segment entries in the program header table if program_header.p_type == Rex::ElfParsey::ElfBase::PT_LOAD hits = scan_segment(program_header, param) hits.each do |hit| rva = hit[0] message = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1] $stdout.puts elf.ptr_s(rva) + " " + message if(param['disasm']) message.gsub!("; ", "\n") if message.include?("retn") message.gsub!("retn", "ret") end begin d2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, message).disassemble rescue Metasm::ParseError d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, [message].pack('H*')) end addr = 0 while ((di = d2.disassemble_instruction(addr))) disasm = "0x%08x\t" % (rva + addr) disasm << di.instruction.to_s $stdout.puts disasm addr = di.next_addr end end end end end end
scan_segment(program_header, param={})
click to toggle source
# File lib/rex/elfscan/scanner.rb, line 56 def scan_segment(program_header, param={}) [] end