class Metasm::WindowsRemoteString

Attributes

handle[RW]

Public Class Methods

new(handle, addr_start=0, length=nil) click to toggle source

returns a virtual string proxying the specified process memory range reads are cached (4096 aligned bytes read at once) writes are done directly (if handle has appropriate privileges)

Calls superclass method Metasm::VirtualString.new
# File metasm/os/windows.rb, line 1708
def initialize(handle, addr_start=0, length=nil)
        @handle = handle
        length ||= 1 << (WinOS.open_process_handle(@handle).addrsz rescue 32)
        super(addr_start, length)
end
open_pid(pid, access = nil) click to toggle source
# File metasm/os/windows.rb, line 1688
def self.open_pid(pid, access = nil)
        if access
                handle = WinAPI.openprocess(access, 0, pid)
        else
                handle = WinAPI.openprocess(WinAPI::PROCESS_ALL_ACCESS, 0, pid)
                if not handle
                        puts "cannot openprocess ALL_ACCESS pid #{pid}, try ro" if $VERBOSE
                        handle = WinAPI.openprocess(WinAPI::PROCESS_VM_READ, 0, pid)
                end
        end
        raise "OpenProcess(#{pid}): #{WinAPI.last_error_msg}" if not handle

        new(handle)
end

Public Instance Methods

dup(addr = @addr_start, len = @length) click to toggle source
# File metasm/os/windows.rb, line 1714
def dup(addr = @addr_start, len = @length)
        self.class.new(@handle, addr, len)
end
get_page(addr, len=@pagelength) click to toggle source
# File metasm/os/windows.rb, line 1722
def get_page(addr, len=@pagelength)
        page = [0].pack('C')*len
        return if WinAPI.readprocessmemory(@handle, addr, page, len, 0) == 0
        page
end
rewrite_at(addr, data) click to toggle source
# File metasm/os/windows.rb, line 1718
def rewrite_at(addr, data)
        WinAPI.writeprocessmemory(@handle, addr, data, data.length, nil)
end