class Metasm::Shellcode

a shellcode is a simple sequence of instructions

Attributes

base_addr[RW]

the base address of the shellcode (nil if unspecified)

source[RW]

the array of source elements (Instr/Data etc)

Public Class Methods

disassemble(cpu, str, eip=0) click to toggle source
# File metasm/exe_format/shellcode.rb, line 85
def self.disassemble(cpu, str, eip=0)
        sc = decode(str, cpu)
        sc.disassemble(eip)
end
new(cpu=nil, base_addr=nil) click to toggle source
Calls superclass method Metasm::ExeFormat.new
# File metasm/exe_format/shellcode.rb, line 17
def initialize(cpu=nil, base_addr=nil)
        @base_addr = base_addr
        @source = []
        super(cpu)
end
withcpu(cpu) click to toggle source

returns a virtual subclass of Shellcode whose cpu_from_headers will return cpu

# File metasm/exe_format/shellcode.rb, line 108
def self.withcpu(cpu)
        c = Class.new(self)
        c.send(:define_method, :cpu_from_headers) {
                cpu = Metasm.const_get(cpu) if cpu.kind_of?(::String)
                cpu = cpu.new if cpu.kind_of?(::Class) and cpu.ancestors.include?(CPU)
                cpu
        }
        c
end

Public Instance Methods

addr_to_fileoff(addr) click to toggle source
# File metasm/exe_format/shellcode.rb, line 55
def addr_to_fileoff(addr)
        addr - (base_addr || 0)
end
assemble(*a) click to toggle source

encodes the source found in self.source appends it to self.encoded clears self.source the optional parameter may contain a binding used to fixup! self.encoded uses self.base_addr if it exists

# File metasm/exe_format/shellcode.rb, line 68
def assemble(*a)
        parse(*a) if not a.empty?
        @encoded << assemble_sequence(@source, @cpu)
        @source.clear
        self
end
compile_setsection(src, section) click to toggle source
# File metasm/exe_format/shellcode.rb, line 96
def compile_setsection(src, section)
end
decode() click to toggle source
# File metasm/exe_format/shellcode.rb, line 82
def decode
end
dump_section_header(addr, edata) click to toggle source
# File metasm/exe_format/shellcode.rb, line 99
def dump_section_header(addr, edata)
        ''
end
each_section() { |encoded, (base_addr || 0)| ... } click to toggle source
# File metasm/exe_format/shellcode.rb, line 51
def each_section
        yield @encoded, (@base_addr || 0)
end
encode(binding={}) click to toggle source
# File metasm/exe_format/shellcode.rb, line 75
def encode(binding={})
        @encoded.fixup! binding if binding.kind_of? Hash
        @encoded.fixup @encoded.binding(@base_addr)
        @encoded.fill @encoded.rawsize
        self
end
fileoff_to_addr(foff) click to toggle source
# File metasm/exe_format/shellcode.rb, line 59
def fileoff_to_addr(foff)
        foff + (base_addr || 0)
end
get_default_entrypoints() click to toggle source
# File metasm/exe_format/shellcode.rb, line 103
def get_default_entrypoints
        [@base_addr || 0]
end
get_section_at(addr) click to toggle source
# File metasm/exe_format/shellcode.rb, line 41
def get_section_at(addr)
        base = @base_addr || 0
        if not addr.kind_of? Integer
                [@encoded, addr] if @encoded.ptr = @encoded.export[addr]
        elsif addr >= base and addr < base + @encoded.virtsize
                @encoded.ptr = addr - base
                [@encoded, addr]
        end
end
init_disassembler() click to toggle source
Calls superclass method Metasm::ExeFormat#init_disassembler
# File metasm/exe_format/shellcode.rb, line 90
def init_disassembler
        d = super()
        d.function[:default] = @cpu.disassembler_default_func
        d
end
parse_init() click to toggle source
Calls superclass method Metasm::ExeFormat#parse_init
# File metasm/exe_format/shellcode.rb, line 23
def parse_init
        @cursource = @source
        super()
end
parse_parser_instruction(instr) click to toggle source

allows definition of the base address

# File metasm/exe_format/shellcode.rb, line 29
def parse_parser_instruction(instr)
        case instr.raw.downcase
        when '.base', '.baseaddr', '.base_addr'
                # ".base_addr <expression>"
                # expression should #reduce to integer
                @lexer.skip_space
                raise instr, 'syntax error' if not @base_addr = Expression.parse(@lexer).reduce
                raise instr, 'syntax error' if tok = @lexer.nexttok and tok.type != :eol
        else super(instr)
        end
end