class PEdump::RichHdr
Attributes
key[RW]
offset[RW]
skip[RW]
Public Class Methods
from_dos_stub(stub)
click to toggle source
# File lib/pedump.rb, line 274 def self.from_dos_stub stub #stub.hexdump key = stub[stub.index('Rich')+4,4] start_idx = stub.index(key.xor('DanS')) skip = 0 if start_idx skip = 4 else PEdump.logger.warn "[?] cannot find rich_hdr start_idx, using heuristics" start_idx = stub.index("$\x00\x00\x00\x00\x00\x00\x00") unless start_idx PEdump.logger.warn "[?] heuristics failed :(" return nil end start_idx += 8 end end_idx = stub.index('Rich')+8 if stub[end_idx..-1].tr("\x00",'') != '' t = stub[end_idx..-1] t = "#{t[0,0x100]}..." if t.size > 0x100 PEdump.logger.error "[!] non-zero dos stub after rich_hdr: #{t.inspect}" return nil end #stub[start_idx, end_idx-start_idx].hexdump RichHdr.new(stub[start_idx, end_idx-start_idx]).tap do |x| x.key = key x.offset = stub.offset + start_idx x.skip = skip end end
Public Instance Methods
decode()
click to toggle source
# File lib/pedump.rb, line 309 def decode x = dexor if x.size%8 == 0 x.unpack('vvV'*(x.size/8)).each_slice(3).map{ |slice| Entry.new(*slice)} else PEdump.logger.error "[?] #{self.class}: dexored size(#{x.size}) must be a multiple of 8" nil end end
dexor()
click to toggle source
# File lib/pedump.rb, line 305 def dexor self[skip..-9].sub(/\A(#{Regexp::escape(key)}){3}/,'').xor(key) end