removed nasm calls inplace of metasm, cleaned up some formatting as well
git-svn-id: file:///home/svn/framework3/trunk@12741 4d416f70-5f16-0410-b530-b9f4589650daunstable
parent
a891d53be4
commit
f92819e754
|
@ -1,3 +1,5 @@
|
||||||
|
require 'metasm'
|
||||||
|
|
||||||
module Rex
|
module Rex
|
||||||
module PeScan
|
module PeScan
|
||||||
module Scanner
|
module Scanner
|
||||||
|
@ -27,8 +29,15 @@ module Scanner
|
||||||
msg = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
|
msg = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
|
||||||
$stdout.puts pe.ptr_s(vma) + " " + msg
|
$stdout.puts pe.ptr_s(vma) + " " + msg
|
||||||
if(param['disasm'])
|
if(param['disasm'])
|
||||||
::Rex::Assembly::Nasm.disassemble([msg].pack("H*")).split("\n").each do |line|
|
insns = []
|
||||||
$stdout.puts "\t#{line.strip}"
|
d2 = Metasm::Shellcode.decode(msg, Metasm::Ia32.new).disassembler
|
||||||
|
addr = 0
|
||||||
|
while ((di = d2.disassemble_instruction(addr)))
|
||||||
|
insns << di.instruction
|
||||||
|
disasm = "0x%08x\t" % (vma + addr)
|
||||||
|
disasm << di.instruction.to_s
|
||||||
|
$stdout.puts disasm
|
||||||
|
addr = di.next_addr
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -35,11 +35,17 @@ module Search
|
||||||
|
|
||||||
$stdout.puts pe.ptr_s(pe.rva_to_vma(@address)) + " " + buf.unpack("H*")[0]
|
$stdout.puts pe.ptr_s(pe.rva_to_vma(@address)) + " " + buf.unpack("H*")[0]
|
||||||
if(param['disasm'])
|
if(param['disasm'])
|
||||||
::Rex::Assembly::Nasm.disassemble(buf).split("\n").each do |line|
|
insns = []
|
||||||
$stdout.puts "\t#{line.strip}"
|
d2 = Metasm::Shellcode.decode(buf, Metasm::Ia32.new).disassembler
|
||||||
|
addr = 0
|
||||||
|
while ((di = d2.disassemble_instruction(addr)))
|
||||||
|
insns << di.instruction
|
||||||
|
disasm = "0x%08x\t" % (pe.rva_to_vma(@address) + addr)
|
||||||
|
disasm << di.instruction.to_s
|
||||||
|
$stdout.puts disasm
|
||||||
|
addr = di.next_addr
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue