class Metasm::WindowsRemoteString
Attributes
handle[RW]
Public Class Methods
new(handle, addr_start=0, length=nil)
click to toggle source
returns a virtual string proxying the specified process memory range reads are cached (4096 aligned bytes read at once) writes are done directly (if handle has appropriate privileges)
Calls superclass method
Metasm::VirtualString.new
# File metasm/os/windows.rb, line 1708 def initialize(handle, addr_start=0, length=nil) @handle = handle length ||= 1 << (WinOS.open_process_handle(@handle).addrsz rescue 32) super(addr_start, length) end
open_pid(pid, access = nil)
click to toggle source
# File metasm/os/windows.rb, line 1688 def self.open_pid(pid, access = nil) if access handle = WinAPI.openprocess(access, 0, pid) else handle = WinAPI.openprocess(WinAPI::PROCESS_ALL_ACCESS, 0, pid) if not handle puts "cannot openprocess ALL_ACCESS pid #{pid}, try ro" if $VERBOSE handle = WinAPI.openprocess(WinAPI::PROCESS_VM_READ, 0, pid) end end raise "OpenProcess(#{pid}): #{WinAPI.last_error_msg}" if not handle new(handle) end
Public Instance Methods
dup(addr = @addr_start, len = @length)
click to toggle source
# File metasm/os/windows.rb, line 1714 def dup(addr = @addr_start, len = @length) self.class.new(@handle, addr, len) end
get_page(addr, len=@pagelength)
click to toggle source
# File metasm/os/windows.rb, line 1722 def get_page(addr, len=@pagelength) page = [0].pack('C')*len return if WinAPI.readprocessmemory(@handle, addr, page, len, 0) == 0 page end
rewrite_at(addr, data)
click to toggle source
# File metasm/os/windows.rb, line 1718 def rewrite_at(addr, data) WinAPI.writeprocessmemory(@handle, addr, data, data.length, nil) end