2009-03-29 07:30:54 +00:00
|
|
|
# This file is part of Metasm, the Ruby assembly manipulation suite
|
2010-09-09 18:19:35 +00:00
|
|
|
# Copyright (C) 2006-2009 Yoann GUILLOT
|
2009-03-29 07:30:54 +00:00
|
|
|
#
|
|
|
|
|
# Licence is LGPL, see LICENCE in the top-level directory
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
require 'metasm'
|
2010-09-09 18:19:35 +00:00
|
|
|
Metasm.require 'samples/metasm-shell'
|
2009-03-29 07:30:54 +00:00
|
|
|
|
|
|
|
|
include Metasm
|
|
|
|
|
|
|
|
|
|
# open target
|
|
|
|
|
WinOS.get_debug_privilege
|
|
|
|
|
if not pr = WinOS.find_process(ARGV.first)
|
2013-08-30 21:28:33 +00:00
|
|
|
puts WinOS.list_processes.sort_by { |pr_| pr_.pid }
|
|
|
|
|
exit
|
2009-03-29 07:30:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
# retrieve the pe load address
|
|
|
|
|
baseaddr = pr.modules[0].addr
|
|
|
|
|
|
|
|
|
|
# decode the COFF headers
|
|
|
|
|
pe = Metasm::LoadedPE.load pr.memory[baseaddr, 0x100000]
|
|
|
|
|
pe.decode_header
|
|
|
|
|
|
|
|
|
|
# get the entrypoint address
|
|
|
|
|
eip = baseaddr + pe.label_rva(pe.optheader.entrypoint)
|
|
|
|
|
|
|
|
|
|
# use degraded disasm mode: assume all calls will return
|
|
|
|
|
String.cpu.opcode_list.each { |op| op.props.delete :stopexec if op.props[:saveip] }
|
|
|
|
|
|
|
|
|
|
# disassemble & dump opcodes
|
|
|
|
|
puts pe.encoded[pe.optheader.entrypoint, 0x100].data.decode(eip)
|
