class Rex::PeScan::Scanner::Generic

Attributes

pe[RW]
regex[RW]

Public Class Methods

new(pe) click to toggle source
# File lib/rex/pescan/scanner.rb, line 11
def initialize(pe)
  self.pe = pe
end

Public Instance Methods

config(param) click to toggle source
# File lib/rex/pescan/scanner.rb, line 15
def config(param)
end
scan(param) click to toggle source
# File lib/rex/pescan/scanner.rb, line 18
    def scan(param)
      config(param)

      $stdout.puts "[#{param['file']}]"
      pe.all_sections.each do |section|
        hits = scan_section(section, param)
        hits.each do |hit|
          vma  = pe.rva_to_vma(hit[0])

          next if (param['filteraddr'] and [vma].pack("V").reverse !~ /#{param['filteraddr']}/)

          msg  = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
          $stdout.puts pe.ptr_s(vma) + " " + msg
          if(param['disasm'])
            #puts [msg].pack('H*').inspect
            insns = []

            msg.gsub!("; ", "\n")
            if msg.include?("retn")
              msg.gsub!("retn", "ret")
            end
            #puts msg
            begin
              d2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, msg).disassemble
            rescue Metasm::ParseError
              d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, [msg].pack('H*'))
            end
            addr = 0
            while ((di = d2.disassemble_instruction(addr)))
              insns << di.instruction
              disasm = "0x%08x\t" % (vma + addr)
              disasm << di.instruction.to_s
              $stdout.puts disasm
              addr = di.next_addr
            end
#                                               ::Rex::Assembly::Nasm.disassemble([msg].pack("H*")).split("\n").each do |line|
#                                                       $stdout.puts "\tnasm: #{line.strip}"
            #end
          end
        end
      end
    end
scan_section(section, param={}) click to toggle source
# File lib/rex/pescan/scanner.rb, line 61
def scan_section(section, param={})
  []
end