Class: PEdump::RichHdr

Inherits:
String show all
Defined in:
lib/pedump.rb

Overview

ntcore.com/files/richsign.htm

Defined Under Namespace

Classes: Entry

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from String

#xor

Instance Attribute Details

#key ⇒ Object

xor key



250
251
252
 
# File 'lib/pedump.rb', line 250

def key
  @key
end

#offset ⇒ Object

xor key



250
251
252
 
# File 'lib/pedump.rb', line 250

def offset
  @offset
end

Class Method Details

.from_dos_stub(stub) ⇒ Object 



258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
 
# File 'lib/pedump.rb', line 258

def self.from_dos_stub stub
  key = stub[stub.index('Rich')+4,4]
  start_idx = stub.index(key.xor('DanS'))
  end_idx   = stub.index('Rich')+8
  if stub[end_idx..-1].tr("\x00",'') != ''
    t = stub[end_idx..-1]
    t = "#{t[0,0x100]}..." if t.size > 0x100
    PEdump.logger.error "[!] non-zero dos stub after rich_hdr: #{t.inspect}"
    return nil
  end
  RichHdr.new(stub[start_idx, end_idx-start_idx]).tap do |x|
    x.key = key
    x.offset = stub.offset + start_idx
  end
end

Instance Method Details

#decode ⇒ Object 



278
279
280
281
282
283
284
285
286
 
# File 'lib/pedump.rb', line 278

def decode
  x = dexor
  if x.size%8 == 0
    x.unpack('vvV'*(x.size/8)).each_slice(3).map{ |slice| Entry.new(*slice)}
  else
    PEdump.logger.error "[?] #{self.class}: dexored size(#{x.size}) must be a multiple of 8"
    nil
  end
end

#dexor ⇒ Object 



274
275
276
 
# File 'lib/pedump.rb', line 274

def dexor
  self[4..-9].sub(/\A(#{Regexp::escape(key)}){3}/,'').xor(key)
end