class TurboRex::Windows::ALPC::MessageAttribute

Attributes

attr[R]
buf[R]
struct[R]

Public Class Methods

new(attr = nil) click to toggle source
# File lib/turborex/windows/alpc.rb, line 569
def initialize(attr = nil)
  @attr = attr ||= (
  TurboRex::Windows::ALPC::ALPC_MESSAGE_SECURITY_ATTRIBUTE |
      TurboRex::Windows::ALPC::ALPC_MESSAGE_VIEW_ATTRIBUTE |
      TurboRex::Windows::ALPC::ALPC_MESSAGE_CONTEXT_ATTRIBUTE |
      TurboRex::Windows::ALPC::ALPC_MESSAGE_HANDLE_ATTRIBUTE |
      TurboRex::Windows::ALPC::ALPC_MESSAGE_TOKEN_ATTRIBUTE |
      TurboRex::Windows::ALPC::ALPC_MESSAGE_DIRECT_ATTRIBUTE |
      TurboRex::Windows::ALPC::ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE
  )
  msg_attr = APIProxy.alloc_c_struct('ALPC_MESSAGE_ATTRIBUTES')
  reqired_buf_size = APIProxy.alloc_c_type('ULONG')
  @buf = required_buf(attr)
  ntstatus = APIProxy.alpcinitializemessageattribute(attr, @buf, @buf.sizeof, reqired_buf_size)
  unless TinySDK.nt_success? ntstatus
    formatted = TurboRex::Windows::TinySDK.format_hex_ntstatus ntstatus, hex_str: true
    raise "Failed to call AlpcInitializeMessageAttribute: #{formatted}"
  end

  @struct = @buf
end

Public Instance Methods

required_buf(attr) click to toggle source
# File lib/turborex/windows/alpc.rb, line 591
def required_buf(attr)
  size = required_buf_size(attr)
  APIProxy.alloc_c_ary('BYTE', size)
end
required_buf_size(attr) click to toggle source
# File lib/turborex/windows/alpc.rb, line 596
def required_buf_size(attr)
  required_bud_size = APIProxy.alloc_c_type('ULONG')
  ntstatus = APIProxy.alpcinitializemessageattribute(attr, 0, 0, required_bud_size)
  required_bud_size.str.unpack('V')[0]
end