73 lines
2.5 KiB
ActionScript
73 lines
2.5 KiB
ActionScript
|
package
|
||
|
|
{
|
||
|
|
public class PE
|
||
|
|
{
|
||
|
|
private var eba:ExploitByteArray
|
||
|
|
|
||
|
|
public function PE(ba:ExploitByteArray)
|
||
|
|
{
|
||
|
|
eba = ba
|
||
|
|
}
|
||
|
|
|
||
|
|
public function base(addr:uint):uint
|
||
|
|
{
|
||
|
|
addr &= 0xffff0000
|
||
|
|
while (true) {
|
||
|
|
if (eba.read(addr) == 0x00905a4d) return addr
|
||
|
|
addr -= 0x10000
|
||
|
|
}
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
public function module(name:String, addr:uint):uint
|
||
|
|
{
|
||
|
|
var iat:uint = addr + eba.read(addr + eba.read(addr + 0x3c) + 0x80), i:int = -1
|
||
|
|
var mod_name:String
|
||
|
|
|
||
|
|
while (true) {
|
||
|
|
var entry:uint = eba.read(iat + (++i) * 0x14 + 12)
|
||
|
|
if (!entry) throw new Error("FAIL!");
|
||
|
|
mod_name = eba.read_string(addr + entry, name.length)
|
||
|
|
if (mod_name.toUpperCase() == name.toUpperCase()) break
|
||
|
|
}
|
||
|
|
return base(eba.read(addr + eba.read(iat + i * 0x14 + 16)))
|
||
|
|
}
|
||
|
|
|
||
|
|
public function procedure(name:String, addr:uint):uint
|
||
|
|
{
|
||
|
|
var eat:uint = addr + eba.read(addr + eba.read(addr + 0x3c) + 0x78)
|
||
|
|
var numberOfNames:uint = eba.read(eat + 0x18)
|
||
|
|
var addressOfFunctions:uint = addr + eba.read(eat + 0x1c)
|
||
|
|
var addressOfNames:uint = addr + eba.read(eat + 0x20)
|
||
|
|
var addressOfNameOrdinals:uint = addr + eba.read(eat + 0x24)
|
||
|
|
var proc_name:String
|
||
|
|
|
||
|
|
for (var i:uint = 0; ; i++) {
|
||
|
|
var entry:uint = eba.read(addressOfNames + i * 4)
|
||
|
|
proc_name = eba.read_string(addr + entry, name.length + 2)
|
||
|
|
if (proc_name.toUpperCase() == name.toUpperCase()) break
|
||
|
|
}
|
||
|
|
return addr + eba.read(addressOfFunctions + eba.read(addressOfNameOrdinals + i * 2, "word") * 4)
|
||
|
|
}
|
||
|
|
|
||
|
|
public function gadget(gadget:String, hint:uint, addr:uint):uint
|
||
|
|
{
|
||
|
|
var find:uint = 0
|
||
|
|
var contents:uint = 0
|
||
|
|
var limit:uint = eba.read(addr + eba.read(addr + 0x3c) + 0x50)
|
||
|
|
var value:uint = parseInt(gadget, 16)
|
||
|
|
|
||
|
|
for (var i:uint = 0; i < limit - 4; i++) {
|
||
|
|
contents = eba.read(addr + i)
|
||
|
|
if (hint == 0xffffffff && value == contents) {
|
||
|
|
return addr + i
|
||
|
|
}
|
||
|
|
if (hint != 0xffffffff && value == (contents & hint)) {
|
||
|
|
return addr + i
|
||
|
|
}
|
||
|
|
}
|
||
|
|
throw new Error()
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|