class Rex::PeScan::Search::DumpRVA

Attributes

pe[RW]

Public Class Methods

new(pe) click to toggle source
# File lib/rex/pescan/search.rb, line 10
def initialize(pe)
  self.pe = pe
end

Public Instance Methods

config(param) click to toggle source
# File lib/rex/pescan/search.rb, line 14
def config(param)
  @address = pe.vma_to_rva(param['args'])
end
scan(param) click to toggle source
# File lib/rex/pescan/search.rb, line 18
def scan(param)
  config(param)

  $stdout.puts "[#{param['file']}]"

  # Adjust based on -A and -B flags
  pre = param['before'] || 0
  suf = param['after']  || 16

  @address -= pre
  @address = 0 if (@address < 0 || ! @address)

  begin
    buf = pe.read_rva(@address, suf)
  rescue ::Rex::PeParsey::PeParseyError
    return
  end

  $stdout.puts pe.ptr_s(pe.rva_to_vma(@address)) + " " + buf.unpack("H*")[0]
  if(param['disasm'])
    insns = []
    buf.gsub!("; ", "\n")
    if buf.include?("retn")
      buf.gsub!("retn", "ret")
    end
    d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, buf)
    addr = 0
    while ((di = d2.disassemble_instruction(addr)))
      insns << di.instruction
      disasm = "0x%08x\t" % (pe.rva_to_vma(@address) + addr)
      disasm << di.instruction.to_s
      $stdout.puts disasm
      addr = di.next_addr
    end
  end

end