class TurboRex::MSRPC::OifDecompiler
Constants
- FORMAT_STRING_STYLE
Public Class Methods
new(interface, cparser)
click to toggle source
# File lib/turborex/msrpc/decompiler.rb, line 192 def initialize(interface, cparser) @interface = interface @interface.decompiler = self @cparser = cparser @procfs_stream = nil @typefs_stream = nil @offset_table = interface.offset_table make_istream end
Public Instance Methods
decompile(interface=nil)
click to toggle source
# File lib/turborex/msrpc/decompiler.rb, line 204 def decompile(interface=nil) interface ||= @interface midl_interface = Interface.new(interface) @offset_table.each do |offset| _procfs = @procfs_stream.dup _procfs.base_drift(offset) proc_fs = FORMAT_STRING_STYLE[:proc_fs].new(_procfs, @typefs_stream, @cparser) procedure = proc_fs.decompile midl_interface.push_procedure(procedure) midl_interface.push_typedef(procedure.typedefs) end midl_interface end
parse_proc_fs_header(raw_header, mode = :Oif)
click to toggle source
Calls superclass method
TurboRex::MSRPC::Decompiler#parse_proc_fs_header
# File lib/turborex/msrpc/decompiler.rb, line 220 def parse_proc_fs_header(raw_header, mode = :Oif) mode = :Oif super(raw_header, mode) end
parse_proc_fs_header_dasm(dasm, addr, mode = :Oif)
click to toggle source
Calls superclass method
TurboRex::MSRPC::Decompiler#parse_proc_fs_header_dasm
# File lib/turborex/msrpc/decompiler.rb, line 225 def parse_proc_fs_header_dasm(dasm, addr, mode = :Oif) mode = :Oif super(dasm, addr ,mode) end
Private Instance Methods
make_istream()
click to toggle source
# File lib/turborex/msrpc/decompiler.rb, line 232 def make_istream unless (@interface.pproc_fs && @interface.ptype_fs && @interface.offset_table) raise "The format string is not initialized." end isource = @interface.finder.pe._isource @procfs_stream = IStream.new(isource, @interface.pproc_fs) @typefs_stream = IStream.new(isource, @interface.ptype_fs) true end