class TurboRex::Windows::ALPC::APIProxy
Public Class Methods
alloc_c_type(typename, init_value = 0)
click to toggle source
# File lib/turborex/windows/alpc.rb, line 113 def self.alloc_c_type(typename, init_value = 0) alloc_c_ary(typename, [init_value]) end
init(cpu = Metasm::Ia32)
click to toggle source
# File lib/turborex/windows/alpc.rb, line 37 def self.init(cpu = Metasm::Ia32) if @initialized return true end opts = {} opts[:cpu] = cpu opts[:include_path] = [TurboRex.root + "/resources/headers/alpc"] opts[:visual_studio] = true opts[:data_model] = 'llp64' if cpu == Metasm::X86_64 opts[:predefined] = true @np = TurboRex::CStruct::NativeParser.new(nil, opts) @cp = @np.parser @cp.parse("#define NT_VERSION #{TurboRex::Windows.version.join}") @cp.parse_file TurboRex.root + '/resources/headers/alpc/ntlpcapi.h' new_api_c('ntdll.dll') @initialized = true end
initialized?()
click to toggle source
# File lib/turborex/windows/alpc.rb, line 63 def self.initialized? @initialized end
new_api_c(fromlib = nil)
click to toggle source
# File lib/turborex/windows/alpc.rb, line 67 def self.new_api_c(fromlib = nil) cp.toplevel.symbol.dup.each_value { |v| next if not v.kind_of? Metasm::C::Variable # enums cp.toplevel.symbol.delete v.name lib = fromlib || lib_from_sym(v.name) addr = sym_addr(lib, v.name) if addr == 0 or addr == -1 or addr == 0xffff_ffff or addr == 0xffffffff_ffffffff api_not_found(lib, v) next end rbname = c_func_name_to_rb(v.name) if not v.type.kind_of? Metasm::C::Function class << self; self; end.send(:define_method, rbname) { addr } next end next if v.initializer new_caller_for(v, rbname, addr) } cexist = constants.inject({}) { |h, c| h.update c.to_s => true } cp.toplevel.symbol.each { |k, v| if v.kind_of? ::Integer n = c_const_name_to_rb(k) const_set(n, v) if v.kind_of? Integer and not cexist[n] end } cp.lexer.definition.each_key { |k| n = c_const_name_to_rb(k) if not cexist[n] and Object.const_defined?(n) and v = @cp.macro_numeric(n) const_set(n, v) end } end
np()
click to toggle source
# File lib/turborex/windows/alpc.rb, line 109 def self.np @np end
reload(cpu = Metasm::Ia32)
click to toggle source
# File lib/turborex/windows/alpc.rb, line 58 def self.reload(cpu = Metasm::Ia32) @initialized = false init(cpu) end