Class: Rex::PeScan::Analyze::ContextMapDumper

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/pescan/analyze.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(pe) ⇒ ContextMapDumper

Returns a new instance of ContextMapDumper.



308
309
310
 
# File 'lib/rex/pescan/analyze.rb', line 308

def initialize(pe)
	self.pe = pe
end

Instance Attribute Details

#pe ⇒ Object

Returns the value of attribute pe.



306
307
308
 
# File 'lib/rex/pescan/analyze.rb', line 306

def pe
  @pe
end

Instance Method Details

#scan(param) ⇒ Object 



312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
 
# File 'lib/rex/pescan/analyze.rb', line 312

def scan(param)
	dest = param['dir']
	path = ''

	::FileUtils.mkdir_p(dest)

	if(not (param['dir'] and param['file']))
		$stderr.puts "No directory or file specified"
		return
	end

	if (param['file'])
		path = File.join(dest, File.basename(param['file']) + ".map")
	end

	fd = File.new(path, "wb")
	pe.all_sections.each do |section|

		# Skip over known bad sections
		next if section.name == ".data"
		next if section.name == ".reloc"

		offset = 0
		while offset < section.size
			byte = section.read(offset, 1)[0]
			if byte != 0
				chunkbase = pe.rva_to_vma(section.base_rva) + offset
				data = ''
				while byte != 0
					data << byte
					offset += 1
					byte = 0
					byte = section.read(offset, 1)[0] if offset < section.size
				end
				buff = nil
				buff = [ 0x01, chunkbase, data.length, data].pack("CNNA*") if data.length > 0

				fd.write(buff) if buff
			end
			offset += 1
		end

	end


	fd.close
end