class Rex::ElfScan::Scanner::Generic

Attributes

elf[RW]
regex[RW]

Public Class Methods

new(elf) click to toggle source
# File lib/rex/elfscan/scanner.rb, line 10
def initialize(elf)
  self.elf = elf
end

Public Instance Methods

config(param) click to toggle source
# File lib/rex/elfscan/scanner.rb, line 14
def config(param)
end
scan(param) click to toggle source
# File lib/rex/elfscan/scanner.rb, line 17
def scan(param)
  config(param)

  $stdout.puts "[#{param['file']}]"
  elf.program_header.each do |program_header|

    # Scan only loadable segment entries in the program header table
    if program_header.p_type == Rex::ElfParsey::ElfBase::PT_LOAD
      hits = scan_segment(program_header, param)
      hits.each do |hit|
        rva  = hit[0]
        message  = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
        $stdout.puts elf.ptr_s(rva) + " " + message
        if(param['disasm'])
          message.gsub!("; ", "\n")
          if message.include?("retn")
            message.gsub!("retn", "ret")
          end

          begin
            d2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, message).disassemble
          rescue Metasm::ParseError
            d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, [message].pack('H*'))
          end

          addr = 0
          while ((di = d2.disassemble_instruction(addr)))
            disasm = "0x%08x\t" % (rva + addr)
            disasm << di.instruction.to_s
            $stdout.puts disasm
            addr = di.next_addr
          end
        end
      end
    end

  end
end
scan_segment(program_header, param={}) click to toggle source
# File lib/rex/elfscan/scanner.rb, line 56
def scan_segment(program_header, param={})
  []
end