class Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessSubsystem::Image

Interacts with loading, unloading, enumerating, and querying image files in the context of a given process.

Public Class Methods

new(process) click to toggle source

Initializes the image instance.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 30
def initialize(process)
  self.process = process
end

Public Instance Methods

[](key) click to toggle source

Returns the image base address associated with the supplied image name.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 37
def [](key)
  each_image { |i|
    if (i['name'].downcase == key.downcase)
      return i['base']
    end
  }

  return nil
end
each_image(&block) click to toggle source

Enumerates through each image in the process.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 95
def each_image(&block)
  get_images.each(&block)
end
get_images() click to toggle source

Returns an array of images in the process with hash objects that have keys for 'name', 'path', and 'base'.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 103
def get_images
  request = Packet.create_request('stdapi_sys_process_image_get_images')
  images  = []

  request.add_tlv(TLV_TYPE_HANDLE, process.handle)

  response = process.client.send_request(request)

  response.each(TLV_TYPE_IMAGE_GROUP) { |i|
    images <<
      {
        'name' => i.get_tlv_value(TLV_TYPE_IMAGE_NAME),
        'base' => i.get_tlv_value(TLV_TYPE_IMAGE_BASE),
        'path' => i.get_tlv_value(TLV_TYPE_IMAGE_FILE_PATH)
      }
  }

  return images
end
get_procedure_address(image_file, procedure) click to toggle source

Returns the address of the procedure that is found in the supplied library.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 65
def get_procedure_address(image_file, procedure)
  request = Packet.create_request('stdapi_sys_process_image_get_proc_address')

  request.add_tlv(TLV_TYPE_HANDLE, process.handle)
  request.add_tlv(TLV_TYPE_IMAGE_FILE, image_file)
  request.add_tlv(TLV_TYPE_PROCEDURE_NAME, procedure)

  response = process.client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_PROCEDURE_ADDRESS)
end
load(image_path) click to toggle source

Loads an image file into the context of the process.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 50
def load(image_path)
  request = Packet.create_request('stdapi_sys_process_image_load')

  request.add_tlv(TLV_TYPE_HANDLE, process.handle)
  request.add_tlv(TLV_TYPE_IMAGE_FILE_PATH, image_path)

  response = process.client.send_request(request)

  return response.get_tlv_value(TLV_TYPE_IMAGE_BASE)
end
unload(base) click to toggle source

Unloads an image file that is loaded into the address space of the process by its base address.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/image.rb, line 81
def unload(base)
  request = Packet.create_request('stdapi_sys_process_image_unload')

  request.add_tlv(TLV_TYPE_HANDLE, process.handle)
  request.add_tlv(TLV_TYPE_IMAGE_BASE, base)

  response = process.client.send_request(request)

  return true
end