class Metasm::WinOS::Thread
Attributes
context[W]
handle[W]
process[RW]
teb_base[W]
tid[RW]
Public Class Methods
new(tid, handle=nil, process=nil)
click to toggle source
# File metasm/os/windows.rb, line 1335 def initialize(tid, handle=nil, process=nil) @tid = tid @handle = handle @process = process end
Public Instance Methods
context() { |context| ... }
click to toggle source
returns a Context object. Can be reused, refresh the values with update (target thread must be suspended) if a block is given, suspend the thread, update the context, yield it, and resume the thread
# File metasm/os/windows.rb, line 1384 def context @context ||= Context.new(self, :all) if block_given? suspend begin @context.update yield @context ensure resume end else @context end end
handle()
click to toggle source
# File metasm/os/windows.rb, line 1341 def handle @handle ||= WinAPI.openthread(WinAPI::THREAD_ALL_ACCESS, 0, @tid) end
resume()
click to toggle source
decrease the suspend count of the target thread - runs at 0
# File metasm/os/windows.rb, line 1374 def resume WinAPI.resumethread(handle) end
suspend()
click to toggle source
increment the suspend count of the target thread - stop at >0
# File metasm/os/windows.rb, line 1365 def suspend if WinAPI.host_cpu.size == 64 and process and process.addrsz == 32 WinAPI.wow64suspendthread(handle) else WinAPI.suspendthread(handle) end end
teb_base()
click to toggle source
return the address of the TEB for the target thread
# File metasm/os/windows.rb, line 1347 def teb_base @teb_base ||= if WinAPI.respond_to?(:ntqueryinformationthread) tinfo = WinAPI.alloc_c_struct('THREAD_BASIC_INFORMATION') if WinAPI.ntqueryinformationthread(handle, WinAPI::THREADBASICINFORMATION, tinfo, tinfo.sizeof, 0) == 0 tinfo.tebbaseaddress end else fs = context { |c| c[:fs] } ldte = WinAPI.alloc_c_struct('LDT_ENTRY') if WinAPI.getthreadselectorentry(handle, fs, ldte) ldte.baselow | (ldte.basemid << 16) | (ldte.basehi << 24) end end end
terminate(exitcode=0)
click to toggle source
# File metasm/os/windows.rb, line 1378 def terminate(exitcode=0) WinAPI.terminatethread(handle, exitcode) end