Class: Rex::PeScan::Search::DumpRVA

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/pescan/search.rb

Direct Known Subclasses

DumpOffset

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(pe) ⇒ DumpRVA

Returns a new instance of DumpRVA.



10
11
12
 
# File 'lib/rex/pescan/search.rb', line 10

def initialize(pe)
  self.pe = pe
end

Instance Attribute Details

#pe ⇒ Object

Returns the value of attribute pe.



8
9
10
 
# File 'lib/rex/pescan/search.rb', line 8

def pe
  @pe
end

Instance Method Details

#config(param) ⇒ Object 



14
15
16
 
# File 'lib/rex/pescan/search.rb', line 14

def config(param)
  @address = pe.vma_to_rva(param['args'])
end

#scan(param) ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/rex/pescan/search.rb', line 18

def scan(param)
  config(param)
  
  $stdout.puts "[#{param['file']}]"
  
  # Adjust based on -A and -B flags
  pre = param['before'] || 0
  suf = param['after']  || 16
  
  @address -= pre
  @address = 0 if (@address < 0 || ! @address)
  
  begin
    buf = pe.read_rva(@address, suf)
  rescue ::Rex::PeParsey::WtfError
    return
  end
  
  $stdout.puts pe.ptr_s(pe.rva_to_vma(@address)) + " " + buf.unpack("H*")[0]
  if(param['disasm'])
    ::Rex::Assembly::Nasm.disassemble(buf).split("\n").each do |line|
      $stdout.puts "\t#{line.strip}"
    end
  end
  
end