37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
# File 'lib/msf/core/post/windows/file_info.rb', line 37
def file_version(filepath)
file_version_info_size = client.railgun.version.GetFileVersionInfoSizeA(
filepath,
nil
)['return']
if file_version_info_size == 0
return nil
end
buffer = session.railgun.kernel32.VirtualAlloc(
nil,
file_version_info_size,
MEM_COMMIT|MEM_RESERVE,
PAGE_READWRITE
)['return']
client.railgun.version.GetFileVersionInfoA(
filepath,
0,
file_version_info_size,
buffer
)
result = client.railgun.version.VerQueryValueA(buffer, "\\", 4, 4)
ffi = client.railgun.memread(result['lplpBuffer'], result['puLen'])
vs_fixed_file_info = ffi.unpack('V13')
unless vs_fixed_file_info and (vs_fixed_file_info.length == 13) and
(vs_fixed_file_info[0] = 0xfeef04bd)
return nil
end
major = hiword(vs_fixed_file_info[2])
minor = loword(vs_fixed_file_info[2])
build = hiword(vs_fixed_file_info[3])
revision = loword(vs_fixed_file_info[3])
branch = revision.to_s[0..1].to_i
return major, minor, build, revision, branch
end
|