class TurboRex::Windows::ALPC::MessageAttribute
Attributes
attr[R]
buf[R]
struct[R]
Public Class Methods
new(attr = nil)
click to toggle source
# File lib/turborex/windows/alpc.rb, line 569 def initialize(attr = nil) @attr = attr ||= ( TurboRex::Windows::ALPC::ALPC_MESSAGE_SECURITY_ATTRIBUTE | TurboRex::Windows::ALPC::ALPC_MESSAGE_VIEW_ATTRIBUTE | TurboRex::Windows::ALPC::ALPC_MESSAGE_CONTEXT_ATTRIBUTE | TurboRex::Windows::ALPC::ALPC_MESSAGE_HANDLE_ATTRIBUTE | TurboRex::Windows::ALPC::ALPC_MESSAGE_TOKEN_ATTRIBUTE | TurboRex::Windows::ALPC::ALPC_MESSAGE_DIRECT_ATTRIBUTE | TurboRex::Windows::ALPC::ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE ) msg_attr = APIProxy.alloc_c_struct('ALPC_MESSAGE_ATTRIBUTES') reqired_buf_size = APIProxy.alloc_c_type('ULONG') @buf = required_buf(attr) ntstatus = APIProxy.alpcinitializemessageattribute(attr, @buf, @buf.sizeof, reqired_buf_size) unless TinySDK.nt_success? ntstatus formatted = TurboRex::Windows::TinySDK.format_hex_ntstatus ntstatus, hex_str: true raise "Failed to call AlpcInitializeMessageAttribute: #{formatted}" end @struct = @buf end
Public Instance Methods
required_buf(attr)
click to toggle source
# File lib/turborex/windows/alpc.rb, line 591 def required_buf(attr) size = required_buf_size(attr) APIProxy.alloc_c_ary('BYTE', size) end
required_buf_size(attr)
click to toggle source
# File lib/turborex/windows/alpc.rb, line 596 def required_buf_size(attr) required_bud_size = APIProxy.alloc_c_type('ULONG') ntstatus = APIProxy.alpcinitializemessageattribute(attr, 0, 0, required_bud_size) required_bud_size.str.unpack('V')[0] end