class Metasm::Shellcode_RWX
Similar to Shellcode, with distinct sections per memory permission (R / RW / RX) encoding-side only
Attributes
base_r[RW]
base address per section
base_w[RW]
base address per section
base_x[RW]
base address per section
encoded_r[RW]
encodeddata
encoded_w[RW]
encodeddata
encoded_x[RW]
encodeddata
source_r[RW]
the array of source elements (Instr/Data etc)
source_w[RW]
the array of source elements (Instr/Data etc)
source_x[RW]
the array of source elements (Instr/Data etc)
Public Class Methods
new(cpu=nil)
click to toggle source
Calls superclass method
Metasm::ExeFormat.new
# File metasm/exe_format/shellcode_rwx.rb, line 20 def initialize(cpu=nil) @base_r = @base_w = @base_x = nil @encoded_r = EncodedData.new @encoded_w = EncodedData.new @encoded_x = EncodedData.new super(cpu) end
Public Instance Methods
assemble(*a)
click to toggle source
encodes the source found in self.source appends it to self.encoded clears self.source the optional parameter may contain a binding used to fixup! self.encoded uses self.base_addr if it exists
# File metasm/exe_format/shellcode_rwx.rb, line 69 def assemble(*a) parse(*a) if not a.empty? @encoded_r << assemble_sequence(@source_r, @cpu); @source_r.clear @encoded_w << assemble_sequence(@source_w, @cpu); @source_w.clear @encoded_x << assemble_sequence(@source_x, @cpu); @source_x.clear self end
encode(binding={})
click to toggle source
# File metasm/exe_format/shellcode_rwx.rb, line 77 def encode(binding={}) bd = {} bd.update @encoded_r.binding(@base_r) bd.update @encoded_w.binding(@base_w) bd.update @encoded_x.binding(@base_x) bd.update binding if binding.kind_of?(Hash) @encoded_r.fixup bd @encoded_w.fixup bd @encoded_x.fixup bd self end
Also aliased as: fixup
encode_string(*a)
click to toggle source
# File metasm/exe_format/shellcode_rwx.rb, line 106 def encode_string(*a) encode(*a) ed = EncodedData.new << @encoded_r << @encoded_w << @encoded_x ed.fixup(ed.binding) raise ["Unresolved relocations:", ed.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not ed.reloc.empty? ed.data end
fixup_check(base_r=nil, base_w=nil, base_x=nil, bd={})
click to toggle source
resolve inter-section xrefs, raise if unresolved relocations remain call this when you have assembled+allocated memory for every section
# File metasm/exe_format/shellcode_rwx.rb, line 92 def fixup_check(base_r=nil, base_w=nil, base_x=nil, bd={}) if base_r.kind_of?(Hash) bd = base_r base_r = nil end @base_r = base_r if base_r @base_w = base_w if base_w @base_x = base_x if base_x fixup bd ed = EncodedData.new << @encoded_r << @encoded_w << @encoded_x raise ["Unresolved relocations:", ed.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not ed.reloc.empty? self end
parse_init()
click to toggle source
Calls superclass method
Metasm::ExeFormat#parse_init
# File metasm/exe_format/shellcode_rwx.rb, line 29 def parse_init @source_r = [] @source_w = [] @source_x = [] @cursource = @source_x super() end
parse_parser_instruction(instr)
click to toggle source
allows definition of the base address
Calls superclass method
Metasm::ExeFormat#parse_parser_instruction
# File metasm/exe_format/shellcode_rwx.rb, line 38 def parse_parser_instruction(instr) case instr.raw.downcase when '.base', '.baseaddr', '.base_addr' # ".base_addr <expression>" # expression should #reduce to integer @lexer.skip_space raise instr, 'syntax error' if not base = Expression.parse(@lexer).reduce raise instr, 'syntax error' if tok = @lexer.nexttok and tok.type != :eol if @cursource.equal?(@source_r) @base_r = base elsif @cursource.equal?(@source_w) @base_w = base elsif @cursource.equal?(@source_x) @base_x = base else raise instr, "Where am I ?" end when '.rdata', '.rodata' @cursource = @source_r when '.data', '.bss' @cursource = @source_w when '.text' @cursource = @source_x else super(instr) end end