Class: TurboRex::MSRPC::RPCFinder::ImageFinder::InterfaceModel

Inherits:
Object
  • Object
show all
Defined in:
lib/turborex/msrpc/rpcfinder.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(struct, finder, dasm = nil) ⇒ InterfaceModel

Returns a new instance of InterfaceModel.



188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 188

def initialize(struct, finder, dasm = nil)
  @struct = struct # RPC_SERVER_INTERFACE_Klass
  @protocol = get_protocol
  @interface_id = @uuid = TurboRex::MSRPC::Utils.raw_to_guid_str(struct.InterfaceId_Value)
  @interface_ver = get_interface_ver
  @transfer_syntax = TurboRex::MSRPC::Utils.raw_to_guid_str(struct.TransferSyntax_Value)
  @transfer_syntax_ver = get_trans_syntax_ver
  @midl_switches = RPCBase::MIDL_SWITCHES.new
  @dasm = dasm || finder.dasm
  @endpoints = []
  @finder = finder
  @routines = []
  @xrefs_to = []
  @xrefs_from = []
end

Dynamic Method Handling

This class handles dynamic methods through the method_missing method

#method_missing(m, *args) ⇒ Object 



316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 316

def method_missing(m, *args)
  if m.to_s.start_with?('raw_')
    camelcase_name = camelcase(m.to_s.sub('raw_', ''))
    if @struct.respond_to? camelcase_name
      @struct.public_send camelcase_name, *args
    end
  elsif @struct.respond_to? m
    @struct.public_send m, *args
  else
    begin
      @struct.public_send m, *args
    rescue StandardError
      super(m, *args)
    end
  end
end

Instance Attribute Details

#dasm ⇒ Object

Returns the value of attribute dasm.



168
169
170
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 168

def dasm
  @dasm
end

#decompiler ⇒ Object

Returns the value of attribute decompiler.



177
178
179
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 177

def decompiler
  @decompiler
end

#endpoints ⇒ Object

Returns the value of attribute endpoints.



181
182
183
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 181

def endpoints
  @endpoints
end

#finder ⇒ Object (readonly)

Returns the value of attribute finder.



175
176
177
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 175

def finder
  @finder
end

#interface_id ⇒ Object (readonly)

Returns the value of attribute interface_id.



171
172
173
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 171

def interface_id
  @interface_id
end

#interface_ver ⇒ Object (readonly)

Returns the value of attribute interface_ver.



173
174
175
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 173

def interface_ver
  @interface_ver
end

#midl_switches ⇒ Object (readonly)

Returns the value of attribute midl_switches.



174
175
176
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 174

def midl_switches
  @midl_switches
end

#offset_table ⇒ Object

Returns the value of attribute offset_table.



184
185
186
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 184

def offset_table
  @offset_table
end

#pproc_fs ⇒ Object

Returns the value of attribute pproc_fs.



183
184
185
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 183

def pproc_fs
  @pproc_fs
end

#protocol ⇒ Object

Returns the value of attribute protocol.



170
171
172
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 170

def protocol
  @protocol
end

#ptype_fs ⇒ Object

Returns the value of attribute ptype_fs.



185
186
187
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 185

def ptype_fs
  @ptype_fs
end

#routines ⇒ Object

Returns the value of attribute routines.



178
179
180
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 178

def routines
  @routines
end

#struct ⇒ Object (readonly)

Returns the value of attribute struct.



169
170
171
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 169

def struct
  @struct
end

#uuid ⇒ Object (readonly)

Returns the value of attribute uuid.



172
173
174
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 172

def uuid
  @uuid
end

#xrefs_from ⇒ Object

Returns the value of attribute xrefs_from.



180
181
182
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 180

def xrefs_from
  @xrefs_from
end

#xrefs_to ⇒ Object

Returns the value of attribute xrefs_to.



179
180
181
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 179

def xrefs_to
  @xrefs_to
end

Instance Method Details

#analysis_midl_switches ⇒ Object 



256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 256

def analysis_midl_switches
  # Don't analyze the client interfaces. It is performed when parsing the client dispatch functions.
  if server?
    dispatch_funcs = @struct.DispatchTable.DispatchTable

    # TODO: Refine the parse methods with format string
    # Oi/Oicf/ndr64
    unless dispatch_funcs.empty?
      begin
        @dasm.disassemble dispatch_funcs[0]
      rescue StandardError
        return false
      end

      label = @dasm.get_label_at dispatch_funcs[0]
      case label
      when /NdrServerCall2/i
        @midl_switches << %w[Oif Oicf]
      when /NdrServerCall/i
        @midl_switches << %w[Oi Oic]
      when /NdrServerCallNdr64/i
        if @struct.ndr64?
          @midl_switches << 'ndr64'
          @midl_switches << %w[win64 amd64 ia64]
        end
      end
    end

    if (@struct.Flags & 0x6000000) == 0x6000000 # test /Oicf /protocol all /win64(amd64/ia64)
      interpreter_info = @struct.InterpreterInfo
      unless interpreter_info == 0
        if interpreter_info.nCount >= 2 && interpreter_info.ProcString != 0
          begin
            interpreter_info.pSyntaxInfo.each do |syntax_info|
              disp_funcs = syntax_info.DispatchTable.DispatchFunctions
              @dasm.disassemble disp_funcs.first
              label = @dasm.get_label_at disp_funcs.first

              next unless label =~ /NdrServerCallAll/

              @midl_switches << 'all'
              @midl_switches << %w[win64 amd64 ia64]
              @protocol = :all
            end
          rescue StandardError
            # TODO: exception handle
          end
        end
      end
    end

    # Os is contradictory with '/protocol ndr64/all'
    unless @midl_switches.has_one_of_switches?(%w[Oi Oic Oif Oicf ndr64 all])
      if @struct.interpreter_info_nullptr? && @struct.Flags == 0
        @midl_switches << 'Os'
      end
    end
  end
end

#client? ⇒ Boolean

Returns:

  • (Boolean) 


208
209
210
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 208

def client?
  !server?
end

#decompile ⇒ Object 



232
233
234
235
236
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 232

def decompile
  return false unless set_fs

  @finder.ndr_decompiler.decompile(self)
end

#func_in_server_routines(addr) ⇒ Object 



242
243
244
245
246
247
248
249
250
251
252
253
254
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 242

def func_in_server_routines(addr)
  return false unless server?

  @finder.disassemble_executable_sections
  res = []

  routines = @routines
  routines.each do |r|
    res << r if @finder.has_path?(dasm, r.addr, addr)
  end

  res
end

#func_in_server_routines?(addr) ⇒ Boolean

Returns:

  • (Boolean) 


238
239
240
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 238

def func_in_server_routines?(addr)
  func_in_server_routines(addr).empty? ? false : true
end

#server? ⇒ Boolean

Returns:

  • (Boolean) 


204
205
206
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 204

def server?
  !@struct.dispatch_table_nullptr?
end

#set_fs ⇒ Object 



212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
 
# File 'lib/turborex/msrpc/rpcfinder.rb', line 212

def set_fs
  return false if client?
  analysis_midl_switches

  pe = finder.pe
  @poffset_table = pe.vma_to_file_offset(self.InterpreterInfo.FormatStringOffset_Value)
  @pproc_fs = pe.vma_to_file_offset(self.InterpreterInfo.ProcFormatString_Value)

  if @midl_switches.has_switch?('Oi')
    @ptype_fs = pe.vma_to_file_offset(self.InterpreterInfo.pStubDesc.pFormatTypes_Value)
    mode = :Oi
  elsif @midl_switches.has_switch?('all') && @midl_switches.arch_64?
    return false # TODO: Implement
  elsif @midl_switches.has_switch?('Oicf')
    @ptype_fs = pe.vma_to_file_offset(self.InterpreterInfo.pStubDesc.pFormatTypes_Value)
  end

  true
end