module TurboRex::Windows::Utils
Public Class Methods
find_export_func(func, filenames, stop_when_found = false)
click to toggle source
# File lib/turborex/windows/utils.rb, line 120 def self.find_export_func(func, filenames, stop_when_found = false) found = [] filenames.each do |f| dfile = ::Metasm::PE.decode_file_header f dfile.decode_exports export = dfile.export next if !export next if !export.exports export.exports.each do |exp| if exp.name == func && !exp.forwarder_lib return f if stop_when_found found << f end end end end
find_import_func(func, filenames, stop_when_found = false)
click to toggle source
# File lib/turborex/windows/utils.rb, line 100 def self.find_import_func(func, filenames, stop_when_found = false) found = [] filenames.each do |f| dfile = ::Metasm::PE.decode_file_header f dfile.decode_imports imports = dfile.imports next if not imports imports.each do |import_dict| import_dict.imports.each do |import_desc| if import_desc.name == func return f if stop_when_found found << f end end end end found end
is_wow64?()
click to toggle source
# File lib/turborex/windows/utils.rb, line 79 def self.is_wow64? fIsWow64Process = API.new('IsWow64Process', 'PP', 'I', 'kernel32') wow64 = 0.chr raise "Failed to call IsWow64Process" if fIsWow64Process.call(-1, wow64) == 0 wow64.unpack('C').first == 1 end
multibyte_to_widechar(str)
click to toggle source
# File lib/turborex/windows/utils.rb, line 55 def self.multibyte_to_widechar(str) fMultiByteToWideChar = API.new('MultiByteToWideChar', 'ILSIPI', 'I', 'kernel32') code_page = 65001 # CP_UTF8 flag = 0 ilength = fMultiByteToWideChar.call(code_page, flag, str, -1, 0, 0) return false if ilength == 0 buf = 0.chr * ilength * 2 res = fMultiByteToWideChar.call(code_page, flag, str, -1, buf, ilength) return false if res == 0 buf end
process_arch(pid=nil, handle=-1)
click to toggle source
# File lib/turborex/windows/utils.rb, line 87 def self.process_arch(pid=nil, handle=-1) case Metasm::WinOS::Process.new(pid, handle).addrsz / 8 when 4 'x86' when 8 'x64' end end
process_arch_x64?(pid=nil, handle=-1)
click to toggle source
# File lib/turborex/windows/utils.rb, line 96 def self.process_arch_x64?(pid=nil, handle=-1) Metasm::WinOS::Process.new(pid, handle).addrsz / 8 == 8 end
read_memory(base, size, handle = -1)
click to toggle source
# File lib/turborex/windows/utils.rb, line 68 def self.read_memory(base, size, handle = -1) fReadProcessMemory = API.new('ReadProcessMemory', 'LPPPP', 'I', 'kernel32') i1 = 0.chr * 8 buf = 0.chr * size if fReadProcessMemory.call(handle, base, buf, size, i1) == 1 buf else nil end end
Public Instance Methods
get_version(path)
click to toggle source
# File lib/turborex/windows/utils.rb, line 8 def get_version(path) structmgr = define_structs do struct tagVS_FIXEDFILEINFO { DWORD dwSignature; DWORD dwStrucVersion; DWORD dwFileVersionMS; DWORD dwFileVersionLS; DWORD dwProductVersionMS; DWORD dwProductVersionLS; DWORD dwFileFlagsMask; DWORD dwFileFlags; DWORD dwFileOS; DWORD dwFileType; DWORD dwFileSubtype; DWORD dwFileDateMS; DWORD dwFileDateLS; }; end fGetFileVersionInfoSize = API.new('GetFileVersionInfoSize', 'PP', 'L', 'version') lpdwHandle = 0 lptstrFilename = path buf_len = fGetFileVersionInfoSize.call(lptstrFilename, lpdwHandle) fGetFileVersionInfo = API.new('GetFileVersionInfo', 'PLLP', 'I', 'version') buf = 0.chr * buf_len res = fGetFileVersionInfo.call(lptstrFilename, 0, buf_len, buf) if res == 1 fVerQueryValueW = API.new('VerQueryValue', 'PPPP', 'I', 'version') fileInfo = 0.chr * 8 size = 0.chr * 4 lpSubBlock = '\\' res = fVerQueryValueW.call(buf, lpSubBlock, fileInfo, size) if res == 1 fReadProcessMemory = API.new('ReadProcessMemory', 'LPPPP', 'I', 'kernel32') size_i = size.unpack('V')[0] buf = 0.chr * size_i i1 = 0.chr * 8 fReadProcessMemory.call(-1, fileInfo.unpack('Q<')[0], buf, size_i, i1) moduleVersion = structmgr['tagVS_FIXEDFILEINFO'].from_str buf return [moduleVersion['dwFileVersionMS'].value, moduleVersion['dwFileVersionLS'].value] end end end