metasploit-framework/lib/metasm/samples/dasm-plugins/dasm_all.rb

71 lines
1.8 KiB
Ruby

# This file is part of Metasm, the Ruby assembly manipulation suite
# Copyright (C) 2006-2009 Yoann GUILLOT
#
# Licence is LGPL, see LICENCE in the top-level directory
# metasm dasm plugin: retrieve a section section, and disassemble everything it can, skipping existing code and nops
# usage: load the plugin, then call (ruby snipped): dasm.dasm_all_section '.text'
def dasm_all(addrstart, length, method=:disassemble_fast_deep)
s = get_section_at(addrstart)
return if not s
s = s[0]
boff = s.ptr
off = 0
while off < length
if di = di_at(addrstart + off)
off += di.bin_length
elsif @decoded[addrstart+off]
off += 1
else
s.ptr = boff+off
maydi = cpu.decode_instruction(s, 0)
if not maydi
off += 1
elsif maydi.instruction.to_s =~ /nop|lea (.*), \[\1(?:\+0)?\]|mov (.*), \2|int 3/
off += maydi.bin_length
else
puts "dasm_all: found #{Expression[addrstart+off]}" if $VERBOSE
send(method, addrstart+off)
end
end
Gui.main_iter if gui and off & 15 == 0
end
count = 0
off = 0
while off < length
addr = addrstart+off
if di = di_at(addr)
if di.block_head?
b = di.block
if not @function[addr] and b.from_subfuncret.to_a.empty? and b.from_normal.to_a.empty?
l = auto_label_at(addr, 'sub_orph')
puts "dasm_all: found orphan function #{l}"
@function[addrstart+off] = DecodedFunction.new
@function[addrstart+off].finalized = true
detect_function_thunk(addr)
count += 1
end
end
off += di.bin_length
else
off += 1
end
Gui.main_iter if gui and off & 15 == 0
end
puts "found #{count} orphan functions" if $VERBOSE
gui.gui_update if gui
end
def dasm_all_section(name, method=:disassemble_fast_deep)
section_info.each { |n, a, l, i|
if name == n
dasm_all(Expression[a].reduce, l, method)
end
}
true
end