librex 0.0.19 → 0.0.20

data/lib/rex/pescan/scanner.rb

@@ -1,206 +0,0 @@
-module Rex
-module PeScan
-module Scanner
-
-	class Generic
-
-		attr_accessor :pe, :regex
-
-		def initialize(pe)
-			self.pe = pe
-		end
-
-		def config(param)
-		end
-
-		def scan(param)
-			config(param)
-
-			$stdout.puts "[#{param['file']}]"
-			pe.all_sections.each do |section|
-				hits = scan_section(section, param)
-				hits.each do |hit|
-					vma  = pe.rva_to_vma(hit[0])
-
-					next if (param['filteraddr'] and [vma].pack("V").reverse !~ /#{param['filteraddr']}/)
-
-					msg  = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
-					$stdout.puts pe.ptr_s(vma) + " " + msg
-					if(param['disasm'])
-						::Rex::Assembly::Nasm.disassemble([msg].pack("H*")).split("\n").each do |line|
-							$stdout.puts "\t#{line.strip}"
-						end
-					end
-				end
-			end
-		end
-
-		def scan_section(section, param={})
-			[]
-		end
-	end
-
-	class JmpRegScanner < Generic
-
-		def config(param)
-			regnums = param['args']
-
-			# build a list of the call bytes
-			calls  = _build_byte_list(0xd0, regnums - [4]) # note call esp's don't work..
-			jmps   = _build_byte_list(0xe0, regnums)
-			pushs1 = _build_byte_list(0x50, regnums)
-			pushs2 = _build_byte_list(0xf0, regnums)
-
-			regexstr = '('
-			if !calls.empty?
-				regexstr += "\xff[#{calls}]|"
-			end
-
-			regexstr += "\xff[#{jmps}]|([#{pushs1}]|\xff[#{pushs2}])(\xc3|\xc2..))"
-
-			self.regex = Regexp.new(regexstr, nil, 'n')
-		end
-
-		# build a list for regex of the possible bytes, based on a base
-		# byte and a list of register numbers..
-		def _build_byte_list(base, regnums)
-			regnums.collect { |regnum| Regexp.escape((base | regnum).chr) }.join('')
-		end
-
-		def _ret_size(section, index)
-			d = section.read(index, 1)
-			case d
-				when "\xc3"
-					return 1
-				when "\xc2"
-					return 3
-			end
-
-			raise RuntimeError, "invalid return opcode"
-		end
-
-		def _parse_ret(data)
-			if data.length == 1
-				return "ret"
-			else
-				return "retn 0x%04x" % data[1, 2].unpack('v')[0]
-			end
-		end
-
-
-		def scan_section(section, param={})
-			index = 0
-
-			hits  = [ ]
-
-			while (index = section.index(regex, index)) != nil
-				rva     = section.offset_to_rva(index)
-				message = ''
-
-				parse_ret = false
-
-				byte1 = section.read(index, 1).unpack("C*")[0]
-
-				if byte1 == 0xff
-					byte2   = section.read(index+1, 1).unpack("C*")[0]
-					regname = Rex::Arch::X86.reg_name32(byte2 & 0x7)
-
-					case byte2 & 0xf8
-					when 0xd0
-						message = "call #{regname}"
-						index += 2
-					when 0xe0
-						message = "jmp #{regname}"
-						index += 2
-					when 0xf0
-						retsize = _ret_size(section, index+2)
-						message = "push #{regname}; " + _parse_ret(section.read(index+2, retsize))
-						index += 2 + retsize
-					else
-						raise "wtf"
-					end
-				else
-					regname = Rex::Arch::X86.reg_name32(byte1 & 0x7)
-					retsize = _ret_size(section, index+1)
-					message = "push #{regname}; " + _parse_ret(section.read(index+1, retsize))
-					index += 1 + retsize
-				end
-
-				hits << [ rva, message ]
-			end
-
-			return hits
-		end
-	end
-
-	class PopPopRetScanner < JmpRegScanner
-
-		def config(param)
-			pops = _build_byte_list(0x58, (0 .. 7).to_a - [4]) # we don't want pop esp's...
-			self.regex = Regexp.new("[#{pops}][#{pops}](\xc3|\xc2..)", nil, 'n')
-		end
-
-		def scan_section(section, param={})
-
-			index = 0
-
-			hits  = [ ]
-
-			while index < section.size && (index = section.index(regex, index)) != nil
-				rva     = section.offset_to_rva(index)
-				message = ''
-
-				pops = section.read(index, 2)
-				reg1 = Rex::Arch::X86.reg_name32(pops[0,1].unpack("C*")[0] & 0x7)
-				reg2 = Rex::Arch::X86.reg_name32(pops[1,1].unpack("C*")[0] & 0x7)
-
-				message = "pop #{reg1}; pop #{reg2}; "
-
-				retsize = _ret_size(section, index+2)
-				message += _parse_ret(section.read(index+2, retsize))
-
-				index += 2 + retsize
-
-				hits << [ rva, message ]
-			end
-
-			return hits
-		end
-	end
-
-	class RegexScanner < Generic
-
-		def config(param)
-			self.regex = Regexp.new(param['args'], nil, 'n')
-		end
-
-		def scan_section(section, param={})
-			index = 0
-
-			hits  = [ ]
-
-			while index < section.size && (index = section.index(regex, index)) != nil
-
-				idx = index
-				buf = ''
-				mat = nil
-
-				while (! (mat = buf.match(regex)))
-					buf << section.read(idx, 1)
-					idx += 1
-				end
-
-				rva = section.offset_to_rva(index)
-
-				hits << [ rva, buf.unpack("H*") ]
-				index += buf.length
-			end
-
-			return hits
-		end
-	end
-
-end
-end
-end
-

data/lib/rex/pescan/search.rb

@@ -1,56 +0,0 @@
-module Rex
-module PeScan
-module Search
-
-	require "rex/assembly/nasm"
-	
-	class DumpRVA
-		attr_accessor :pe
-		
-		def initialize(pe)
-			self.pe = pe
-		end
-		
-		def config(param)
-			@address = pe.vma_to_rva(param['args'])
-		end
-		
-		def scan(param)
-			config(param)
-			
-			$stdout.puts "[#{param['file']}]"
-			
-			# Adjust based on -A and -B flags
-			pre = param['before'] || 0
-			suf = param['after']  || 16
-			
-			@address -= pre
-			@address = 0 if (@address < 0 || ! @address)
-			
-			begin
-				buf = pe.read_rva(@address, suf)
-			rescue ::Rex::PeParsey::WtfError
-				return
-			end
-			
-			$stdout.puts pe.ptr_s(pe.rva_to_vma(@address)) + " " + buf.unpack("H*")[0]
-			if(param['disasm'])
-				::Rex::Assembly::Nasm.disassemble(buf).split("\n").each do |line|
-					$stdout.puts "\t#{line.strip}"
-				end
-			end
-			
-		end	
-	end
-
-	class DumpOffset < DumpRVA
-		def config(param)
-			begin
-				@address = pe.file_offset_to_rva(param['args'])
-			rescue Rex::PeParsey::BoundsError
-			end
-		end
-	end	
-end
-end
-end

data/lib/rex/platforms.rb

@@ -1 +0,0 @@
-require 'rex/platforms/windows'

data/lib/rex/platforms/windows.rb

@@ -1,51 +0,0 @@
-module Rex
-module Platforms
-module Windows
-
-
-
-#
-# Windows Registry Constants
-#
-	REG_NONE = 1
-	REG_SZ = 1
-	REG_EXPAND_SZ = 2
-	REG_BINARY = 3
-	REG_DWORD = 4
-	REG_LITTLE_ENDIAN = 4
-	REG_BIG_ENDIAN = 5
-	REG_LINK = 6
-	REG_MULTI_SZ = 7
-
-	HKEY_CLASSES_ROOT = 0x80000000
-	HKEY_CURRENT_USER = 0x80000001
-	HKEY_LOCAL_MACHINE = 0x80000002
-	HKEY_USERS = 0x80000003
-	HKEY_PERFORMANCE_DATA = 0x80000004
-	HKEY_CURRENT_CONFIG = 0x80000005
-	HKEY_DYN_DATA = 0x80000006
-
-	def registry_hive_lookup(hive)
-		case hive
-		when 'HKCR'
-			HKEY_LOCAL_MACHINE
-		when 'HKCU'
-			HKEY_CURRENT_USER
-		when 'HKLM'
-			HKEY_LOCAL_MACHINE
-		when 'HKU'
-			HKEY_USERS
-		when 'HKPD'
-			HKEY_PERFORMANCE_DATA
-		when 'HKCC'
-			HKEY_CURRENT_CONFIG
-		when 'HKDD'
-			HKEY_DYN_DATA
-		else
-			HKEY_LOCAL_MACHINE
-		end
-	end
-	
-end
-end
-end

data/lib/rex/poly.rb

@@ -1,132 +0,0 @@
-module Rex
-module Poly
-
-require 'rex/poly/register'
-require 'rex/poly/block'
-
-###
-#
-# This class encapsulates the state of a single polymorphic block set
-# generation.  It tracks the current set of consumed registers, the linear
-# list of blocks generated, the end-result buffer, and the phase of
-# generation.  The fields exposed by the State class are intended for use only
-# by the polymorphic generation subsystem and should not be modified directly.
-#
-###
-class State
-
-	#
-	# Initializes the polymorphic generation state.
-	#
-	def initialize
-		@block_list = nil
-		reset
-	end
-
-	#
-	# Resets the generation state to have a plain start by clearing all
-	# consumed registers, resetting the polymorphic buffer back to its
-	# beginning and destroying any block generation state.
-	#
-	def reset
-		# Reset the generation flag on any blocks in the block list
-		@block_list.each { |block|
-			block[0].generated = false
-		} if (@block_list)
-
-		@regnums     = Hash.new
-		@buffer      = ''
-		@block_list  = []
-		@curr_offset = 0
-		@first_phase = true
-		@badchars    = nil
-	end
-
-	#
-	# Returns true if the supplied register number is already consumed.
-	#
-	def consumed_regnum?(regnum)
-		@regnums[regnum]
-	end
-
-	#
-	# Consumes a register number, thus removing it from the pool that can be
-	# assigned.  The consumed register number is returned to the caller.
-	#
-	def consume_regnum(regnum)
-		raise RuntimeError, "Register #{regnum} is already consumed." if (consumed_regnum?(regnum))
-
-		@regnums[regnum] = true	
-
-		regnum
-	end
-
-	#
-	# Acquires a register number that has not already been consumed from the
-	# supplied register number set and consumes it, returning the selected
-	# register number to the caller.  The register number is selected from the
-	# set at random.
-	#
-	def consume_regnum_from_set(regnum_set)
-		# Pick a random starting point within the supplied set.
-		idx = rand(regnum_set.length)
-
-		# Try each index in the set.
-		regnum_set.length.times { |x|
-			regnum = regnum_set[(idx + x) % regnum_set.length]
-
-			next if (consumed_regnum?(regnum))
-
-			return consume_regnum(regnum)
-		}
-
-		# If we get through the entire iteration without finding a register,
-		# then we are out of registers to assign.
-		raise RuntimeError, "No registers are available to consume from the set"
-	end
-
-	#
-	# Eliminates a register number from the consumed pool so that it can be
-	# used in the future.  This happens after a block indicates that a register
-	# has been clobbered.
-	#
-	def defecate_regnum(regnum)
-		@regnums.delete(regnum)
-	end
-
-	#
-	# The buffer state for the current polymorphic generation.  This stores the
-	# end-result of a call to generate on a LogicalBlock.
-	#
-	attr_accessor :buffer
-
-	#
-	# The linear list of blocks that is generated by calling the generate
-	# method on a LogicalBlock.
-	#
-	attr_accessor :block_list
-
-	#
-	# The current offset into the polymorphic buffer that is being generated.
-	# This is updated as blocks are appended to the block_list.
-	#
-	attr_accessor :curr_offset
-
-	#
-	# A boolean field that is used by the LogicalBlock class to track whether
-	# or not it is in the first phase (generating the block list), or in the
-	# second phase (generating the polymorphic buffer).  This phases are used
-	# to indicate whether or not the offset_of and regnum_of methods will
-	# return actual results.
-	#
-	attr_accessor :first_phase
-
-	#
-	# Characters to avoid when selecting permutations, if any.
-	#
-	attr_accessor :badchars
-
-end
-
-end
-end