class TurboRex::Windows::Process
Public Instance Methods
close_handle()
click to toggle source
# File lib/turborex/windows/process.rb, line 36 def close_handle Metasm::WinAPI.closehandle(handle) end
disassembler()
click to toggle source
# File lib/turborex/windows/process.rb, line 6 def disassembler return @disassembler if @disassembler case self.cpusz when 32 @disassembler = Metasm::Shellcode.decode(self.memory, Metasm::Ia32.new).disassembler when 64 @disassembler = Metasm::Shellcode.decode(self.memory, Metasm::X86_64.new).disassembler end end
load_symbol_table(libname)
click to toggle source
# File lib/turborex/windows/process.rb, line 16 def load_symbol_table(libname) initialize_sym_handler unless lib = modules.find { |m| m.path =~ Regexp.new(libname, true) } return false end if Win32API.symloadmoduleex(self.handle, 0, libname, 0, lib.addr, lib.size, 0, 0) == 0 && Win32API.getlasterror != 0 return false end # module_info = Win32API.alloc_c_struct('IMAGEHLP_MODULE64') # module_info.SizeOfStruct = module_info.sizeof # unless Win32API.symgetmoduleinfo64(self.handle, lib.addr, module_info) == 1 # return false # end true end
Private Instance Methods
initialize_sym_handler()
click to toggle source
# File lib/turborex/windows/process.rb, line 42 def initialize_sym_handler return true if @sym_handler_initialized Win32API.syminitialize(self.handle, 0, false) Win32API.symsetoptions(Win32API.symgetoptions | Win32API::SYMOPT_DEFERRED_LOADS | Win32API::SYMOPT_NO_PROMPTS # | Win32API::SYMOPT_DEBUG ) sympath = ENV.fetch('_NT_SYMBOL_PATH') { 'srv*C:\\symbols*https://msdl.microsoft.com/download/symbols;' } Win32API.symsetsearchpath(self.handle, sympath.dup) @sym_handler_initialized = true end