class TurboRex::MSRPC::OifDecompiler

Constants

FORMAT_STRING_STYLE

Public Class Methods

new(interface, cparser) click to toggle source
# File lib/turborex/msrpc/decompiler.rb, line 192
def initialize(interface, cparser)
  @interface = interface
  @interface.decompiler = self
  @cparser = cparser

  @procfs_stream = nil
  @typefs_stream = nil
  @offset_table = interface.offset_table

  make_istream
end

Public Instance Methods

decompile(interface=nil) click to toggle source
# File lib/turborex/msrpc/decompiler.rb, line 204
def decompile(interface=nil)
  interface ||= @interface
  midl_interface = Interface.new(interface)

  @offset_table.each do |offset|
    _procfs = @procfs_stream.dup
    _procfs.base_drift(offset)
    proc_fs = FORMAT_STRING_STYLE[:proc_fs].new(_procfs, @typefs_stream, @cparser)
    procedure = proc_fs.decompile
    midl_interface.push_procedure(procedure)
    midl_interface.push_typedef(procedure.typedefs)
  end

  midl_interface
end
parse_proc_fs_header(raw_header, mode = :Oif) click to toggle source
# File lib/turborex/msrpc/decompiler.rb, line 220
def parse_proc_fs_header(raw_header, mode = :Oif)
  mode = :Oif
  super(raw_header, mode)
end
parse_proc_fs_header_dasm(dasm, addr, mode = :Oif) click to toggle source
# File lib/turborex/msrpc/decompiler.rb, line 225
def parse_proc_fs_header_dasm(dasm, addr, mode = :Oif)
  mode = :Oif
  super(dasm, addr ,mode)
end

Private Instance Methods

make_istream() click to toggle source
# File lib/turborex/msrpc/decompiler.rb, line 232
def make_istream
  unless (@interface.pproc_fs && @interface.ptype_fs && @interface.offset_table)
    raise "The format string is not initialized."
  end

  isource = @interface.finder.pe._isource
  @procfs_stream = IStream.new(isource, @interface.pproc_fs)
  @typefs_stream = IStream.new(isource, @interface.ptype_fs)
  true
end