class PEdump::RichHdr

ntcore.com/files/richsign.htm

Attributes

key[RW]
offset[RW]
skip[RW]

Public Class Methods

from_dos_stub(stub) click to toggle source
# File lib/pedump.rb, line 274
def self.from_dos_stub stub
  #stub.hexdump
  key = stub[stub.index('Rich')+4,4]
  start_idx = stub.index(key.xor('DanS'))
  skip = 0
  if start_idx
    skip = 4
  else
    PEdump.logger.warn "[?] cannot find rich_hdr start_idx, using heuristics"
    start_idx = stub.index("$\x00\x00\x00\x00\x00\x00\x00")
    unless start_idx
      PEdump.logger.warn "[?] heuristics failed :("
      return nil
    end
    start_idx += 8
  end
  end_idx   = stub.index('Rich')+8
  if stub[end_idx..-1].tr("\x00",'') != ''
    t = stub[end_idx..-1]
    t = "#{t[0,0x100]}..." if t.size > 0x100
    PEdump.logger.error "[!] non-zero dos stub after rich_hdr: #{t.inspect}"
    return nil
  end
  #stub[start_idx, end_idx-start_idx].hexdump
  RichHdr.new(stub[start_idx, end_idx-start_idx]).tap do |x|
    x.key = key
    x.offset = stub.offset + start_idx
    x.skip = skip
  end
end

Public Instance Methods

decode() click to toggle source
# File lib/pedump.rb, line 309
def decode
  x = dexor
  if x.size%8 == 0
    x.unpack('vvV'*(x.size/8)).each_slice(3).map{ |slice| Entry.new(*slice)}
  else
    PEdump.logger.error "[?] #{self.class}: dexored size(#{x.size}) must be a multiple of 8"
    nil
  end
end
dexor() click to toggle source
# File lib/pedump.rb, line 305
def dexor
  self[skip..-9].sub(/\A(#{Regexp::escape(key)}){3}/,'').xor(key)
end