class Rex::PeScan::Scanner::Generic
Attributes
pe[RW]
regex[RW]
Public Class Methods
new(pe)
click to toggle source
# File lib/rex/pescan/scanner.rb, line 11 def initialize(pe) self.pe = pe end
Public Instance Methods
config(param)
click to toggle source
# File lib/rex/pescan/scanner.rb, line 15 def config(param) end
scan(param)
click to toggle source
# File lib/rex/pescan/scanner.rb, line 18 def scan(param) config(param) $stdout.puts "[#{param['file']}]" pe.all_sections.each do |section| hits = scan_section(section, param) hits.each do |hit| vma = pe.rva_to_vma(hit[0]) next if (param['filteraddr'] and [vma].pack("V").reverse !~ /#{param['filteraddr']}/) msg = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1] $stdout.puts pe.ptr_s(vma) + " " + msg if(param['disasm']) #puts [msg].pack('H*').inspect insns = [] msg.gsub!("; ", "\n") if msg.include?("retn") msg.gsub!("retn", "ret") end #puts msg begin d2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, msg).disassemble rescue Metasm::ParseError d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, [msg].pack('H*')) end addr = 0 while ((di = d2.disassemble_instruction(addr))) insns << di.instruction disasm = "0x%08x\t" % (vma + addr) disasm << di.instruction.to_s $stdout.puts disasm addr = di.next_addr end # ::Rex::Assembly::Nasm.disassemble([msg].pack("H*")).split("\n").each do |line| # $stdout.puts "\tnasm: #{line.strip}" #end end end end end
scan_section(section, param={})
click to toggle source
# File lib/rex/pescan/scanner.rb, line 61 def scan_section(section, param={}) [] end