class TurboRex::MSRPC::MIDL::TypeFormatString::PointerLayout
Public Instance Methods
decompile()
click to toggle source
# File lib/turborex/msrpc/midl.rb, line 627 def decompile offset = 2 layouts = [] loop do begin layout, len = decompile_instance_layout(offset) offset += len layouts << layout rescue TurboRex::Exception::MSRPC::InvalidTypeFormatString break end end @fs_length = offset + 1 layouts end
fs_length()
click to toggle source
# File lib/turborex/msrpc/midl.rb, line 645 def fs_length @fs_length end
Private Instance Methods
decompile_instance_layout(offset)
click to toggle source
# File lib/turborex/msrpc/midl.rb, line 651 def decompile_instance_layout(offset) length = 0 ptr_instance_cstruct = @cparser.find_c_struct('Pointer_Instance_t') ptr_instance_size = @cparser.sizeof(ptr_instance_cstruct) case @typefs_stream.read(1, offset).unpack('C').first when FC_NO_REPEAT cstruct = @cparser.find_c_struct('No_Repeat_Layout_t') size = @cparser.sizeof(cstruct) layout = @cparser.decode_c_struct('No_Repeat_Layout_t', @typefs_stream.read(size)) ptr_desc = layout.PtrDesc _stream = @typefs_stream.dup _stream.base_drift(offset+cstruct.offsetof(@cparser, 'Simple')) length = layout.sizeof pointer = CommonPtr.new(_stream, @cparser).decompile return {repeat: 0, type: :no_repeat, pointer: pointer}, length when FC_FIXED_REPEAT cstruct = @cparser.find_c_struct('Fixed_Repeat_Layout_Header_t') size = @cparser.sizeof(cstruct) layout_header = @cparser.decode_c_struct('Fixed_Repeat_Layout_Header_t', @typefs_stream.read(size, offset)) ary_size = layout_header.NumberOfPointers #ptr_instance_ary = @cparser.decode_c_ary('Pointer_Instance_t', ary_size, @typefs_stream.read(ary_size*ptr_instance_size, offset+size)) ptr_ary = [] ary_size.times do |i| _stream = @typefs_stream.dup _stream.base_drift(offset+layout_header.sizeof+i*ptr_instance_size+ptr_instance_cstruct.offsetof(@cparser, 'Simple')) ptr_ary << CommonPtr.new(_stream, @cparser).decompile end length = layout_header.sizeof + ary_size*ptr_instance_size return {repeat: layout_header.Iterations, type: :fixed, pointer: ptr_ary}, length when FC_VARIABLE_REPEAT cstruct = @cparser.find_c_struct('Variable_Repeat_Layout_Header_t') size = @cparser.sizeof(cstruct) layout_header = @cparser.decode_c_struct('Variable_Repeat_Layout_Header_t', @typefs_stream.read(size, offset)) case layout_header.OffsetType when FC_FIXED_OFFSET offset_type = :fixed when FC_VARIABLE_OFFSET offset_type = :variable end ary_size = layout_header.NumberOfPointers ptr_ary = [] ary_size.times do |i| _stream = @typefs_stream.dup _stream.base_drift(offset+layout_header.sizeof+i*ptr_instance_size+ptr_instance_cstruct.offsetof(@cparser, 'Simple')) ptr_ary << CommonPtr.new(_stream, @cparser).decompile end length = layout_header.sizeof + ary_size*ptr_instance_size return {repeat: layout_header.Iterations, type: :variable, offset: offset_type, pointer: ptr_ary}, length else raise TurboRex::Exception::MSRPC::InvalidTypeFormatString end end