class Metasm::WinOS::Process
Attributes
debugger[W]
handle[W]
iswow64[RW]
memory[W]
peb_base[W]
ppid[RW]
Public Class Methods
new(pid, handle=nil)
click to toggle source
# File metasm/os/windows.rb, line 1213 def initialize(pid, handle=nil) @pid = pid @handle = handle end
Public Instance Methods
addrsz()
click to toggle source
returns the memory address size of the target process if the target is a wow64 process (32bit process under a 64bit os), return 64
# File metasm/os/windows.rb, line 1258 def addrsz @addrsz ||= ((cpusz == 32 and iswow64) ? 64 : cpusz) end
cpusz()
click to toggle source
return 32 for 32bit process, 64 for 64bit process populates iswow64
# File metasm/os/windows.rb, line 1237 def cpusz @cpusz ||= ( byte = 0.chr*8 if WinAPI.respond_to?(:iswow64process) and WinAPI.iswow64process(handle, byte) # os supports iswow64process, so target may be 64bits if byte != 0.chr*8 @iswow64 = true 32 else @iswow64 = false WinAPI.host_cpu.size end else WinAPI.host_cpu.size end ) end
debugger()
click to toggle source
# File metasm/os/windows.rb, line 1230 def debugger @debugger ||= WinDebugger.new(@pid) end
handle()
click to toggle source
on-demand cached openprocess(ALL_ACCESS) handle
# File metasm/os/windows.rb, line 1219 def handle @handle ||= WinAPI.openprocess(WinAPI::PROCESS_ALL_ACCESS, 0, @pid) end
heaps()
click to toggle source
# File metasm/os/windows.rb, line 1270 def heaps WinOS.list_heaps(@pid) end
mappings()
click to toggle source
return a list of [addr_start, length, perms]
# File metasm/os/windows.rb, line 1275 def mappings addr = 0 list = [] info = WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}") path = [0xff].pack('C') * 512 hcache = heaps while WinAPI.virtualqueryex(handle, addr, info, info.sizeof) != 0 addr += info.regionsize next unless info.state & WinAPI::MEM_COMMIT > 0 prot = { WinAPI::PAGE_NOACCESS => '---', WinAPI::PAGE_READONLY => 'r--', WinAPI::PAGE_READWRITE => 'rw-', WinAPI::PAGE_WRITECOPY => 'rw-', WinAPI::PAGE_EXECUTE => '--x', WinAPI::PAGE_EXECUTE_READ => 'r-x', WinAPI::PAGE_EXECUTE_READWRITE => 'rwx', WinAPI::PAGE_EXECUTE_WRITECOPY => 'rwx' }[info[:protect] & 0xff] prot = prot.sub('r', '-') + 'g' if info[:protect] & WinAPI::PAGE_GUARD > 0 prot << 'p' if info[:type] & WinAPI::MEM_PRIVATE > 0 if h = hcache[info.baseaddress] a = [] a << 'default' if h[:default] a << 'shared' if h[:shared] a << 'heap' #a << h[:flags].to_s(16) cmt = '[' + a.join(' ') + ']' elsif WinAPI.ntqueryvirtualmemory(handle, info.baseaddress, WinAPI::MEMORYMAPFILENAME, path, path.length, 0) == 0 us = WinAPI.decode_c_struct('UNICODE_STRING', path) s = WinAPI.decode_c_ary('USHORT', us['Length']/2, WinAPI.memory_read(us['Buffer'], us['MaximumLength'])) cmt = s.to_strz else cmt = '' end list << [info.baseaddress, info.regionsize, prot, cmt] end list end
memory()
click to toggle source
return/create a WindowsRemoteString
# File metasm/os/windows.rb, line 1225 def memory @memory ||= WindowsRemoteString.new(handle) end
modules()
click to toggle source
# File metasm/os/windows.rb, line 1262 def modules WinOS.list_modules(@pid) end
peb_base()
click to toggle source
# File metasm/os/windows.rb, line 1321 def peb_base @peb_base ||= if WinAPI.respond_to?(:ntqueryinformationprocess) pinfo = WinAPI.alloc_c_struct('PROCESS_BASIC_INFORMATION') if WinAPI.ntqueryinformationprocess(handle, WinAPI::PROCESSBASICINFORMATION, pinfo, pinfo.sizeof, 0) == 0 pinfo.pebbaseaddress end else # pre-NT: all pebs should have the same addr WinAPI.new_func_asm('unsigned get_peb(void)', 'mov eax, fs:[30h] ret') { WinAPI.get_peb } end end
terminate(exitcode=0)
click to toggle source
# File metasm/os/windows.rb, line 1335 def terminate(exitcode=0) WinAPI.terminateprocess(handle, exitcode) end
threads()
click to toggle source
# File metasm/os/windows.rb, line 1266 def threads WinOS.list_threads(@pid) end