class Rex::PeScan::Analyze::ContextMapDumper

Attributes

pe[RW]

Public Class Methods

new(pe) click to toggle source
# File lib/rex/pescan/analyze.rb, line 307
def initialize(pe)
  self.pe = pe
end

Public Instance Methods

scan(param) click to toggle source
# File lib/rex/pescan/analyze.rb, line 311
def scan(param)
  dest = param['dir']
  path = ''

  ::FileUtils.mkdir_p(dest)

  if(not (param['dir'] and param['file']))
    $stderr.puts "No directory or file specified"
    return
  end

  if (param['file'])
    path = File.join(dest, File.basename(param['file']) + ".map")
  end

  fd = File.new(path, "wb")
  pe.all_sections.each do |section|

    # Skip over known bad sections
    next if section.name == ".data"
    next if section.name == ".reloc"

    offset = 0
    while offset < section.size
      byte = section.read(offset, 1)[0]
      if byte != 0
        chunkbase = pe.rva_to_vma(section.base_rva) + offset
        data = ''
        while byte != 0
          data << byte
          offset += 1
          byte = 0
          byte = section.read(offset, 1)[0] if offset < section.size
        end
        buff = nil
        buff = [ 0x01, chunkbase, data.length, data].pack("CNNA*") if data.length > 0

        fd.write(buff) if buff
      end
      offset += 1
    end

  end


  fd.close
end