class Metasm::WinOS::Process
Attributes
debugger[W]
handle[W]
memory[W]
peb_base[W]
ppid[RW]
Public Class Methods
new(pid, handle=nil)
click to toggle source
# File metasm/os/windows.rb, line 1213 def initialize(pid, handle=nil) @pid = pid @handle = handle end
Public Instance Methods
addrsz()
click to toggle source
returns the memory address size of the target process
# File metasm/os/windows.rb, line 1236 def addrsz @addrsz ||= if WinAPI.respond_to?(:iswow64process) byte = 0.chr*8 if WinAPI.iswow64process(handle, byte) if byte != 0.chr*8 32 # target = wow64 elsif WinAPI.iswow64process(WinAPI.getcurrentprocess, byte) and byte != 0.chr*8 64 # us = wow64, target is not else WinAPI.host_cpu.size end else WinAPI.host_cpu.size end end end
debugger()
click to toggle source
# File metasm/os/windows.rb, line 1230 def debugger @debugger ||= WinDebugger.new(@pid) end
handle()
click to toggle source
on-demand cached openprocess(ALL_ACCESS) handle
# File metasm/os/windows.rb, line 1219 def handle @handle ||= WinAPI.openprocess(WinAPI::PROCESS_ALL_ACCESS, 0, @pid) end
heaps()
click to toggle source
# File metasm/os/windows.rb, line 1261 def heaps WinOS.list_heaps(@pid) end
mappings()
click to toggle source
return a list of [addr_start, length, perms]
# File metasm/os/windows.rb, line 1266 def mappings addr = 0 list = [] info = WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}") path = [0xff].pack('C') * 512 hcache = heaps while WinAPI.virtualqueryex(handle, addr, info, info.sizeof) != 0 addr += info.regionsize next unless info.state & WinAPI::MEM_COMMIT > 0 prot = { WinAPI::PAGE_NOACCESS => '---', WinAPI::PAGE_READONLY => 'r--', WinAPI::PAGE_READWRITE => 'rw-', WinAPI::PAGE_WRITECOPY => 'rw-', WinAPI::PAGE_EXECUTE => '--x', WinAPI::PAGE_EXECUTE_READ => 'r-x', WinAPI::PAGE_EXECUTE_READWRITE => 'rwx', WinAPI::PAGE_EXECUTE_WRITECOPY => 'rwx' }[info[:protect] & 0xff] prot = prot.sub('r', '-') + 'g' if info[:protect] & WinAPI::PAGE_GUARD > 0 prot << 'p' if info[:type] & WinAPI::MEM_PRIVATE > 0 if h = hcache[info.baseaddress] a = [] a << 'default' if h[:default] a << 'shared' if h[:shared] a << 'heap' #a << h[:flags].to_s(16) cmt = '[' + a.join(' ') + ']' elsif WinAPI.ntqueryvirtualmemory(handle, info.baseaddress, WinAPI::MEMORYMAPFILENAME, path, path.length, 0) == 0 us = WinAPI.decode_c_struct('UNICODE_STRING', path) s = WinAPI.decode_c_ary('USHORT', us['Length']/2, WinAPI.memory_read(us['Buffer'], us['MaximumLength'])) cmt = s.to_strz else cmt = '' end list << [info.baseaddress, info.regionsize, prot, cmt] end list end
memory()
click to toggle source
return/create a WindowsRemoteString
# File metasm/os/windows.rb, line 1225 def memory @memory ||= WindowsRemoteString.new(handle) end
modules()
click to toggle source
# File metasm/os/windows.rb, line 1253 def modules WinOS.list_modules(@pid) end
peb_base()
click to toggle source
# File metasm/os/windows.rb, line 1312 def peb_base @peb_base ||= if WinAPI.respond_to?(:ntqueryinformationprocess) pinfo = WinAPI.alloc_c_struct('PROCESS_BASIC_INFORMATION') if WinAPI.ntqueryinformationprocess(handle, WinAPI::PROCESSBASICINFORMATION, pinfo, pinfo.sizeof, 0) == 0 pinfo.pebbaseaddress end else # pre-NT: all pebs should have the same addr WinAPI.new_func_asm('unsigned get_peb(void)', 'mov eax, fs:[30h] ret') { WinAPI.get_peb } end end
terminate(exitcode=0)
click to toggle source
# File metasm/os/windows.rb, line 1326 def terminate(exitcode=0) WinAPI.terminateprocess(handle, exitcode) end
threads()
click to toggle source
# File metasm/os/windows.rb, line 1257 def threads WinOS.list_threads(@pid) end