class Metasm::WinOS::Process

Attributes

debugger[W]
handle[W]
memory[W]
peb_base[W]
ppid[RW]

Public Class Methods

new(pid, handle=nil) click to toggle source
# File metasm/os/windows.rb, line 1213
def initialize(pid, handle=nil)
        @pid = pid
        @handle = handle
end

Public Instance Methods

addrsz() click to toggle source

returns the memory address size of the target process

# File metasm/os/windows.rb, line 1236
def addrsz
        @addrsz ||= if WinAPI.respond_to?(:iswow64process)
                byte = 0.chr*8
                if WinAPI.iswow64process(handle, byte)
                        if byte != 0.chr*8
                                32 # target = wow64
                        elsif WinAPI.iswow64process(WinAPI.getcurrentprocess, byte) and byte != 0.chr*8
                                64 # us = wow64, target is not
                        else
                                WinAPI.host_cpu.size
                        end
                else
                        WinAPI.host_cpu.size
                end
        end
end
debugger() click to toggle source
# File metasm/os/windows.rb, line 1230
def debugger
        @debugger ||= WinDebugger.new(@pid)
end
handle() click to toggle source

on-demand cached openprocess(ALL_ACCESS) handle

# File metasm/os/windows.rb, line 1219
def handle
        @handle ||= WinAPI.openprocess(WinAPI::PROCESS_ALL_ACCESS, 0, @pid)
end
heaps() click to toggle source
# File metasm/os/windows.rb, line 1261
def heaps
        WinOS.list_heaps(@pid)
end
mappings() click to toggle source

return a list of [addr_start, length, perms]

# File metasm/os/windows.rb, line 1266
def mappings
        addr = 0
        list = []
        info = WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}")
        path = [0xff].pack('C') * 512

        hcache = heaps

        while WinAPI.virtualqueryex(handle, addr, info, info.sizeof) != 0
                addr += info.regionsize
                next unless info.state & WinAPI::MEM_COMMIT > 0

                prot = {
                        WinAPI::PAGE_NOACCESS => '---',
                        WinAPI::PAGE_READONLY => 'r--',
                        WinAPI::PAGE_READWRITE => 'rw-',
                        WinAPI::PAGE_WRITECOPY => 'rw-',
                        WinAPI::PAGE_EXECUTE => '--x',
                        WinAPI::PAGE_EXECUTE_READ => 'r-x',
                        WinAPI::PAGE_EXECUTE_READWRITE => 'rwx',
                        WinAPI::PAGE_EXECUTE_WRITECOPY => 'rwx'
                }[info[:protect] & 0xff]
                prot = prot.sub('r', '-') + 'g' if info[:protect] & WinAPI::PAGE_GUARD > 0
                prot << 'p' if info[:type]    & WinAPI::MEM_PRIVATE > 0

                if h = hcache[info.baseaddress]
                        a = []
                        a << 'default' if h[:default]
                        a << 'shared' if h[:shared]
                        a << 'heap'
                        #a << h[:flags].to_s(16)
                        cmt = '[' + a.join(' ') + ']'
                elsif WinAPI.ntqueryvirtualmemory(handle, info.baseaddress, WinAPI::MEMORYMAPFILENAME, path, path.length, 0) == 0
                        us = WinAPI.decode_c_struct('UNICODE_STRING', path)
                        s = WinAPI.decode_c_ary('USHORT', us['Length']/2, WinAPI.memory_read(us['Buffer'], us['MaximumLength']))
                        cmt = s.to_strz
                else
                        cmt = ''
                end

                list << [info.baseaddress, info.regionsize, prot, cmt]
        end

        list
end
memory() click to toggle source

return/create a WindowsRemoteString

# File metasm/os/windows.rb, line 1225
def memory
        @memory ||= WindowsRemoteString.new(handle)
end
modules() click to toggle source
# File metasm/os/windows.rb, line 1253
def modules
        WinOS.list_modules(@pid)
end
peb_base() click to toggle source
# File metasm/os/windows.rb, line 1312
def peb_base
        @peb_base ||=
        if WinAPI.respond_to?(:ntqueryinformationprocess)
                pinfo = WinAPI.alloc_c_struct('PROCESS_BASIC_INFORMATION')
                if WinAPI.ntqueryinformationprocess(handle, WinAPI::PROCESSBASICINFORMATION, pinfo, pinfo.sizeof, 0) == 0
                        pinfo.pebbaseaddress
                end
        else
                # pre-NT: all pebs should have the same addr
                WinAPI.new_func_asm('unsigned get_peb(void)', 'mov eax, fs:[30h] ret') { WinAPI.get_peb }
        end
end
terminate(exitcode=0) click to toggle source
# File metasm/os/windows.rb, line 1326
def terminate(exitcode=0)
        WinAPI.terminateprocess(handle, exitcode)
end
threads() click to toggle source
# File metasm/os/windows.rb, line 1257
def threads
        WinOS.list_threads(@pid)
end