Method: Rex::Encoder::Alpha2::AlphaUpper.gen_decoder_prefix

Defined in:

lib/rex/encoder/alpha2/alpha_upper.rb

.gen_decoder_prefix(reg, offset) ⇒ Object

# File 'lib/rex/encoder/alpha2/alpha_upper.rb', line 12

def self.gen_decoder_prefix(reg, offset)
  if (offset > 20)
    raise "Critical: Offset is greater than 20"
  end

  # use inc ebx as a nop here so we still pad correctly
  if (offset <= 10)
    nop = 'C' * offset
    mod = 'I' * (10 - offset) + nop + 'QZ'    # dec ecx,,, push ecx, pop edx
    edxmod = 'J' * (11 - offset)
  else
    mod = 'A' * (offset - 10)
    nop = 'C' * (10 - mod.length)
    mod << nop + 'QZ'
    edxmod = 'B' * (11 - (offset - 10))
  end
  regprefix = {
    'EAX'   => 'PY' + mod,                        # push eax, pop ecx
    'ECX'   => 'I' + mod,                         # dec ecx
    'EDX'   =>  edxmod + nop + 'RY',  			  # mod edx,,, push edx, pop ecx
    'EBX'   => 'SY' + mod,                        # push ebx, pop ecx
    'ESP'   => 'TY' + mod,                        # push esp, pop ecx
    'EBP'   => 'UY' + mod,                        # push ebp, pop ecx
    'ESI'   => 'VY' + mod,                        # push esi, pop ecx
    'EDI'   => 'WY' + mod,                        # push edi, pop edi
  }

  reg.upcase!
  if (not regprefix.keys.include? reg)
    raise ArgumentError.new("Invalid register name")
  end
  return regprefix[reg]

end