metasploit-framework/tools/pattern_offset.rb

125 lines
3.5 KiB
Ruby
Executable File

#!/usr/bin/env ruby
# $Id$
# $Revision$
msfbase = __FILE__
while File.symlink?(msfbase)
msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
end
$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib')))
require 'fastlib'
require 'msfenv'
$:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
require 'rex'
if ARGV.length < 1
$stderr.puts("Usage: #{File.basename($0)} <search item> <length of buffer>")
$stderr.puts("Default length of buffer if none is inserted: 8192")
$stderr.puts("This buffer is generated by pattern_create() in the Rex library automatically")
exit
end
value = ARGV.shift
len = ARGV.shift || 8192
=begin
Examples:
$ ./tools/pattern_create.rb 128
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae
$ ./tools/pattern_offset.rb 8Ac9
[*] Exact match at offset 86
$ ./tools/pattern_offset.rb 39634138
[*] Exact match at offset 86
$ ./tools/pattern_offset.rb 0x39634138
[*] Exact match at offset 86
$ ./tools/pattern_offset.rb 0x396341FF
[*] No exact matches, looking for likely candidates...
[+] Possible match at offset 86 (adjusted [ little-endian: 199 | big-endian: 18996934 ] ) byte offset 0
$ ./tools/pattern_offset.rb 0x3963FFFF
[*] No exact matches, looking for likely candidates...
[+] Possible match at offset 86 (adjusted [ little-endian: 48839 | big-endian: 19045574 ] )
[ snip ]
$ ./tools/pattern_offset.rb 0xFFFF4138
[*] No exact matches, looking for likely candidates...
[+] Possible match at offset 26 (adjusted [ little-endian: 3332243456 | big-endian: 3351109631 ] )
[+] Possible match at offset 56 (adjusted [ little-endian: 3332177920 | big-endian: 3351109375 ] )
[+] Possible match at offset 86 (adjusted [ little-endian: 3332112384 | big-endian: 3351109119 ] )
[ snip ]
=end
# The normal format is a full hexadecimal value: 0x41424344
if (value.length >= 8 and value.hex > 0)
value = value.hex
# However, you can also specify a four-byte string
elsif (value.length == 4)
value = value.unpack("V").first
else
# Or even a hex value that isn't 8 bytes long
value = value.to_i(16)
end
buffer = Rex::Text.pattern_create(len.to_i)
offset = Rex::Text.pattern_offset(buffer, value)
# Handle cases where there is no match by looking for "close" matches
unless offset
found = false
$stderr.puts "[*] No exact matches, looking for likely candidates..."
# Look for shifts by a single byte
0.upto(3) do |idx|
0.upto(255) do |c|
nvb = [value].pack("V")
nvb[idx, 1] = [c].pack("C")
nvi = nvb.unpack("V").first
off = Rex::Text.pattern_offset(buffer, nvi)
if off
mle = value - buffer[off,4].unpack("V").first
mbe = value - buffer[off,4].unpack("N").first
puts "[+] Possible match at offset #{off} (adjusted [ little-endian: #{mle} | big-endian: #{mbe} ] ) byte offset #{idx}"
found = true
end
end
end
exit if found
# Look for 16-bit offsets
[0, 2].each do |idx|
0.upto(65535) do |c|
nvb = [value].pack("V")
nvb[idx, 2] = [c].pack("v")
nvi = nvb.unpack("V").first
off = Rex::Text.pattern_offset(buffer, nvi)
if off
mle = value - buffer[off,4].unpack("V").first
mbe = value - buffer[off,4].unpack("N").first
puts "[+] Possible match at offset #{off} (adjusted [ little-endian: #{mle} | big-endian: #{mbe} ] )"
found = true
end
end
end
end
while offset
puts "[*] Exact match at offset #{offset}"
offset = Rex::Text.pattern_offset(buffer, value, offset + 1)
end