module TurboRex::PEFile::Scanner

Public Class Methods

data_section?(section) click to toggle source
# File lib/turborex/pefile/scanner.rb, line 41
def self.data_section?(section)
  if section.flags & 0x20000000 != 0 #IMAGE_SCN_MEM_EXECUTE
    return false
  end

  unless section.flags & 0x40000000 != 0 #IMAGE_SCN_MEM_READ
    return false
  end

  return true
end
scan_all_sections(pe, regex) click to toggle source
# File lib/turborex/pefile/scanner.rb, line 31
def self.scan_all_sections(pe, regex)
  result = []

  pe.all_sections.each do |section|
    Scanner.scan_section(section, regex).each do |r|
      result << r
    end
  end
end
scan_section(section, regex) click to toggle source
# File lib/turborex/pefile/scanner.rb, line 6
def self.scan_section(section, regex)
  index = 0

  hits = []

  while index < section.size && (index = section.index(regex, index)) != nil

    idx = index
    buf = ''
    mat = nil

    while (!(mat = buf.match(regex)))
      buf << section.read(idx, 1)
      idx += 1
    end

    rva = section.offset_to_rva(index)

    hits << [rva, buf.unpack("H*")]
    index += buf.length
  end

  return hits
end

Public Instance Methods

draw_xrefs_dg(dasm, addr1) click to toggle source
# File lib/turborex/pefile/scanner.rb, line 61
def draw_xrefs_dg(dasm, addr1)
  g = dasm.function_graph_from(addr1)
  dg = RGL::DirectedAdjacencyGraph.new

  (g.keys + g.values).flatten.uniq.each do |e|
    label = dasm.get_label_at(e) || e.to_s
    dg.add_vertex label
  end
  
  g.each do |k, v|
    kl = dasm.get_label_at(k) || k.to_s
    v.each do |e|
      el = dasm.get_label_at(e) || e.to_s
      dg.add_edge(kl, el)
    end
  end

  dg
end
has_path?(dasm, addr1, addr2, dg=nil) click to toggle source
# File lib/turborex/pefile/scanner.rb, line 53
def has_path?(dasm, addr1, addr2, dg=nil)
  dg = draw_xrefs_dg(dasm, addr1) unless dg

  v1 = dasm.get_label_at(addr1) || addr1.to_s
  v2 = dasm.get_label_at(addr2) || addr2.to_s
  dg.path?(v1, v2)
end