ragweed 0.1.7.3 → 0.2.0.pre1
Sign up to get free protection for your applications and to get access to all the features.
- data/README.rdoc +33 -8
- data/Rakefile +80 -23
- data/VERSION +1 -0
- data/examples/hittracertux.rb +2 -6
- data/examples/hook_notepad.rb +1 -1
- data/examples/tux-example.rb +3 -2
- data/lib/.DS_Store +0 -0
- data/lib/ragweed/debugger32.rb +188 -145
- data/lib/ragweed/debuggerosx.rb +13 -13
- data/lib/ragweed/debuggertux.rb +267 -140
- data/lib/ragweed/rasm.rb +1 -1
- data/lib/ragweed/wrap32/debugging.rb +184 -64
- data/lib/ragweed/wrap32/hooks.rb +27 -11
- data/lib/ragweed/wrap32/process.rb +114 -7
- data/lib/ragweed/wrap32/process_token.rb +23 -7
- data/lib/ragweed/wrap32/thread_context.rb +100 -166
- data/lib/ragweed/wrap32/wrap32.rb +127 -72
- data/lib/ragweed/wrap32.rb +1 -1
- data/lib/ragweed/wraposx/constants.rb +1 -9
- data/lib/ragweed/wraposx/region_info.rb +209 -188
- data/lib/ragweed/wraposx/structs.rb +102 -0
- data/lib/ragweed/wraposx/thread_context.rb +636 -159
- data/lib/ragweed/wraposx/thread_info.rb +40 -107
- data/lib/ragweed/wraposx/thread_info.rb.old +121 -0
- data/lib/ragweed/wraposx/wraposx.rb +154 -231
- data/lib/ragweed/wraposx.rb +2 -1
- data/lib/ragweed/wraptux/constants.rb +46 -22
- data/lib/ragweed/wraptux/struct_helpers.rb +25 -0
- data/lib/ragweed/wraptux/threads.rb +0 -0
- data/lib/ragweed/wraptux/wraptux.rb +58 -62
- data/lib/ragweed/wraptux.rb +3 -4
- data/lib/ragweed.rb +36 -8
- data/ragweed.gemspec +85 -15
- metadata +50 -18
data/README.rdoc
CHANGED
@@ -1,35 +1,60 @@
|
|
1
|
-
Ragweed
|
2
|
-
by tduehr,
|
3
|
-
http://matasano.com
|
1
|
+
== Ragweed
|
2
|
+
by tduehr, crohlf, and tqbf
|
3
|
+
http://chargen.matasano.com
|
4
4
|
|
5
5
|
== DESCRIPTION:
|
6
6
|
|
7
7
|
* Ragweed is a set of scriptable debugging tools written mostly in native ruby.
|
8
8
|
|
9
9
|
* Where required the Ruby/DL and Win32API libraries are used to interface the machine
|
10
|
-
and OS native system calls.
|
10
|
+
and OS native system calls.
|
11
|
+
|
12
|
+
== Supported Platforms
|
13
|
+
|
14
|
+
Ragweed is supported and has been tested on the following platforms (32bit intel only):
|
15
|
+
|
16
|
+
Windows 7
|
17
|
+
Windows XP
|
18
|
+
Linux Ubuntu 10.4
|
19
|
+
Linux Ubuntu 9.10
|
20
|
+
Mac OS X 10.6
|
21
|
+
Mac OS X 10.5
|
22
|
+
|
23
|
+
At this time only Ruby 1.8.x has been tested. We are actively investigating both 64 bit
|
24
|
+
support for each platform and support for Ruby 1.9.x. Unfortunately, both of these things
|
25
|
+
require significant changes to Ragweed.
|
26
|
+
|
27
|
+
* We are currently moving to FFI from ruby/dl. This will likely result in some incompatibilities if you are using the low level functions calls directly. It will also add ffi as a dependency. This move is to facilitate 1.9 and 64bit support.
|
11
28
|
|
12
29
|
== FEATURES/PROBLEMS:
|
13
30
|
|
14
31
|
* This suite is currently fairly piecemeal. Each OS has it's own set of tools.
|
15
|
-
The most complete set is for Win32.
|
32
|
+
The most complete set is for Win32.
|
16
33
|
|
17
34
|
* Work is ongoing to complete and unify the OSX and Linux portions.
|
18
35
|
|
36
|
+
* The FFI move is mostly complete. There may be a few changes to some structures to come, but everything should mostly match the C APIs.
|
37
|
+
|
38
|
+
* The move to FFI should give us free support for jRuby. This is, however, untested at this time.
|
39
|
+
|
40
|
+
* Struct's Nerve[http://github.com/struct/Nerve] is an example of the API we are heading toward
|
41
|
+
|
19
42
|
== SYNOPSIS:
|
20
43
|
|
21
44
|
require 'debuggerosx'
|
22
45
|
d = Debuggerosx.new(514) # pid of process to trace
|
23
46
|
|
47
|
+
Please see the examples directory for more. There are hit tracers for each platform.
|
48
|
+
|
24
49
|
== REQUIREMENTS:
|
25
50
|
|
26
|
-
*
|
51
|
+
* FFI - This was required to get around the limitations of Ruby/DL. If you're using Ragweed from jRuby, this should be free.
|
27
52
|
|
28
53
|
== INSTALL:
|
29
54
|
|
30
|
-
# we're using gemcutter now. once gemcutter is a source just:
|
31
55
|
sudo gem install ragweed
|
56
|
+
# relax with a tasty beverage, you're done
|
32
57
|
|
33
58
|
== LICENSE:
|
34
59
|
|
35
|
-
Copyright 2009 Matasano Security, LLC All Rights Reserved
|
60
|
+
Copyright 2009/2010 Matasano Security, LLC All Rights Reserved
|
data/Rakefile
CHANGED
@@ -1,28 +1,85 @@
|
|
1
1
|
|
2
|
+
# begin
|
3
|
+
# require 'bones'
|
4
|
+
# rescue LoadError
|
5
|
+
# abort '### Please install the "bones" gem ###'
|
6
|
+
# end
|
7
|
+
#
|
8
|
+
# ensure_in_path 'lib'
|
9
|
+
# require 'ragweed'
|
10
|
+
#
|
11
|
+
# task :default => 'test:run'
|
12
|
+
# task 'gem:release' => 'test:run'
|
13
|
+
#
|
14
|
+
# Bones {
|
15
|
+
# name 'ragweed'
|
16
|
+
# ignore_file '.gitignore'
|
17
|
+
# authors 'tduehr, tqbf, struct'
|
18
|
+
# email 'td@matasano.com'
|
19
|
+
# description 'General debugging tool written in Ruby for OSX/Win32/Linux'
|
20
|
+
# summary 'Scriptable debugger'
|
21
|
+
# exclude << %w(old$)
|
22
|
+
# url 'http://github.com/tduehr/ragweed/tree/master'
|
23
|
+
# version Ragweed::VERSION
|
24
|
+
# rdoc.opts << "--inline-source"
|
25
|
+
# rdoc.opts << "--line-numbers"
|
26
|
+
# spec.opts << '--color'
|
27
|
+
# }
|
28
|
+
# # EOF
|
29
|
+
|
30
|
+
require 'rubygems'
|
31
|
+
require 'rake'
|
32
|
+
|
33
|
+
begin
|
34
|
+
require 'jeweler'
|
35
|
+
Jeweler::Tasks.new do |gem|
|
36
|
+
gem.name = "ragweed"
|
37
|
+
gem.summary = %Q{Scriptable debugger}
|
38
|
+
gem.description = %Q{General debugging tool written in Ruby for OSX/Win32/Linux}
|
39
|
+
gem.email = "td@matasano.com"
|
40
|
+
gem.homepage = "http://github.com/tduehr/ragweed"
|
41
|
+
gem.authors = ["tduehr", "struct", "tqbf"]
|
42
|
+
gem.rdoc_options = ["--inline-source", "--line-numbers", "--main", "README.rdoc"]
|
43
|
+
gem.add_dependency "ffi", ">= 0"
|
44
|
+
# gem.exclude = [%w(old)]
|
45
|
+
# gem.add_development_dependency "thoughtbot-shoulda", ">= 0"
|
46
|
+
# gem is a Gem::Specification... see http://www.rubygems.org/read/chapter/20 for additional settings
|
47
|
+
end
|
48
|
+
Jeweler::GemcutterTasks.new
|
49
|
+
rescue LoadError
|
50
|
+
puts "Jeweler (or a dependency) not available. Install it with: gem install jeweler"
|
51
|
+
end
|
52
|
+
|
53
|
+
require 'rake/testtask'
|
54
|
+
Rake::TestTask.new(:test) do |test|
|
55
|
+
test.libs << 'lib' << 'test'
|
56
|
+
test.pattern = 'test/**/test_*.rb'
|
57
|
+
test.verbose = true
|
58
|
+
end
|
59
|
+
|
2
60
|
begin
|
3
|
-
require '
|
61
|
+
require 'rcov/rcovtask'
|
62
|
+
Rcov::RcovTask.new do |test|
|
63
|
+
test.libs << 'test'
|
64
|
+
test.pattern = 'test/**/test_*.rb'
|
65
|
+
test.verbose = true
|
66
|
+
end
|
4
67
|
rescue LoadError
|
5
|
-
|
68
|
+
task :rcov do
|
69
|
+
abort "RCov is not available. In order to run rcov, you must: sudo gem install spicycode-rcov"
|
70
|
+
end
|
6
71
|
end
|
7
72
|
|
8
|
-
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
exclude << %w(old$)
|
22
|
-
url 'http://github.com/tduehr/ragweed/tree/master'
|
23
|
-
version Ragweed::VERSION
|
24
|
-
rdoc.opts << "--inline-source"
|
25
|
-
rdoc.opts << "--line-numbers"
|
26
|
-
spec.opts << '--color'
|
27
|
-
}
|
28
|
-
# EOF
|
73
|
+
task :test => :check_dependencies
|
74
|
+
|
75
|
+
task :default => :test
|
76
|
+
|
77
|
+
require 'rake/rdoctask'
|
78
|
+
Rake::RDocTask.new do |rdoc|
|
79
|
+
version = File.exist?('VERSION') ? File.read('VERSION') : ""
|
80
|
+
|
81
|
+
rdoc.rdoc_dir = 'rdoc'
|
82
|
+
rdoc.title = "ragweed #{version}"
|
83
|
+
rdoc.rdoc_files.include('README*')
|
84
|
+
rdoc.rdoc_files.include('lib/**/*.rb')
|
85
|
+
end
|
data/VERSION
ADDED
@@ -0,0 +1 @@
|
|
1
|
+
0.2.0.pre1
|
data/examples/hittracertux.rb
CHANGED
@@ -1,17 +1,14 @@
|
|
1
1
|
#!/usr/bin/env ruby
|
2
2
|
|
3
3
|
require 'ragweed'
|
4
|
-
require 'debuggertux'
|
5
|
-
require 'pp'
|
6
|
-
require 'irb'
|
7
|
-
#include Ragweed
|
8
4
|
|
9
5
|
filename = ARGV[0]
|
10
6
|
pid = ARGV[1].to_i
|
11
7
|
|
12
8
|
raise "hittracertux.rb FILE PID" if (ARGV.size < 2 or pid <= 0)
|
13
9
|
|
14
|
-
|
10
|
+
opts = {}
|
11
|
+
d = Ragweed::Debuggertux.new(pid, opts)
|
15
12
|
d.attach
|
16
13
|
|
17
14
|
File.open(filename, "r") do |fd|
|
@@ -27,7 +24,6 @@ d.install_bps
|
|
27
24
|
d.continue
|
28
25
|
catch(:throw) { d.loop }
|
29
26
|
|
30
|
-
|
31
27
|
# An IDC script for generating the text file this hit tracer requires
|
32
28
|
=begin
|
33
29
|
#include <idc.idc>
|
data/examples/hook_notepad.rb
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
require "ragweed"
|
2
2
|
include Ragweed
|
3
3
|
|
4
|
-
dbg =
|
4
|
+
dbg = Debugger32.find_by_regex /notepad/i
|
5
5
|
raise "notepad not running" if dbg.nil?
|
6
6
|
|
7
7
|
dbg.hook('kernel32!CreateFileW', 7) {|e,c,d,a| puts "#{d} CreateFileW for #{dbg.process.read(a[0],512).from_utf16_buffer}"}
|
data/examples/tux-example.rb
CHANGED
@@ -2,7 +2,6 @@
|
|
2
2
|
|
3
3
|
## Simple example of attaching to a process and letting it run
|
4
4
|
|
5
|
-
require 'rubygems' # Yah I know its bad
|
6
5
|
require 'ragweed'
|
7
6
|
|
8
7
|
pid = Ragweed::Debuggertux.find_by_regex(/gcalctool/)
|
@@ -14,7 +13,9 @@ begin
|
|
14
13
|
puts "Which thread do you want to attach to?"
|
15
14
|
pid = STDIN.gets.chomp.to_i
|
16
15
|
|
17
|
-
|
16
|
+
opts = {}
|
17
|
+
opts[:fork] = true ## This flag tells ragweed to trace any forked child processes
|
18
|
+
d = Ragweed::Debuggertux.new(pid, opts)
|
18
19
|
d.attach
|
19
20
|
d.continue
|
20
21
|
catch(:throw) { d.loop }
|
data/lib/.DS_Store
ADDED
Binary file
|