metasploit-framework/lib/rex/peparsey/pe_memdump.rb

#!/usr/bin/env ruby

require 'rex/peparsey/pebase'
require 'rex/peparsey/exceptions'

require 'rex/peparsey/image_source'
require 'rex/peparsey/section'

require 'rex/struct2'

#
# This class is for use with memdump.exe generated dump images.  It basically
# just lies, gets the ImageBase from the file name, and generates 1 big
# header_section with all of the data in it...
#

module Rex
module PeParsey
class PeMemDump < PeBase

	def self.new_from_string(data)
		raise NotImplementError
	end

	def self.new_from_file(filename, disk_backed = false)
		if filename[-4, 4] != '.rng'
			raise "Not a .rng file: #{filename}"
		end

		file = File.open(filename, 'rb')

		if disk_backed
			obj = ImageSource::Disk.new(file)
		else
			obj = ImageSource::Memory.new(file.read)
			obj.close
		end

		return self.new(obj, filename[0, 8].hex)
	end

	def initialize(isource, base)

		self._isource = isource
		self.header_section = Section.new(isource, base, nil)
		self.sections = [ ]

	end


end end end