Class: TurboRex::Windows::Process

Inherits:
Metasm::WinOS::Process
  • Object
show all
Defined in:
lib/turborex/windows/process.rb

Instance Method Summary collapse

Instance Method Details

#close_handle ⇒ Object 



36
37
38
 
# File 'lib/turborex/windows/process.rb', line 36

def close_handle
  Metasm::WinAPI.closehandle(handle)
end

#disassembler ⇒ Object 



6
7
8
9
10
11
12
13
14
 
# File 'lib/turborex/windows/process.rb', line 6

def disassembler
  return @disassembler if @disassembler
  case self.cpusz 
  when 32
    @disassembler = Metasm::Shellcode.decode(self.memory, Metasm::Ia32.new).disassembler
  when 64
    @disassembler = Metasm::Shellcode.decode(self.memory, Metasm::X86_64.new).disassembler
  end
end

#load_symbol_table(libname) ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
 
# File 'lib/turborex/windows/process.rb', line 16

def load_symbol_table(libname)  
  initialize_sym_handler
  unless lib = modules.find { |m| m.path =~ Regexp.new(libname, true) }
    return false
  end

  if Win32API.symloadmoduleex(self.handle, 0, libname, 0, lib.addr, lib.size, 0, 0) == 0 &&
     Win32API.getlasterror != 0
      return false
  end

  # module_info = Win32API.alloc_c_struct('IMAGEHLP_MODULE64')
  # module_info.SizeOfStruct = module_info.sizeof
  # unless Win32API.symgetmoduleinfo64(self.handle, lib.addr, module_info) == 1
  #   return false
  # end

  true
end