turborex 0.1.1

data/README.md

@@ -0,0 +1,38 @@
+# TurboRex
+---------------------
+TurboRex is a Ruby gem for exploring MSRPC and COM. It is mainly a proof of concept for the topic "Automated Hunting for Cross-Server Xrefs in Microsoft RPC and COM" on Code Blue 2020.
+
+
+## Author
+Exist@SycloverSecurity
+
+## Features
+---------------------
+* MSRPC server/client routines finder
+* COM interface methods finder
+* COM client finder(Not very useful)
+* ALPC server/client
+* COM client
+
+## Installation
+------------------
+To install Turborex, run
+```
+gem install turborex
+```
+And then [install Metasm](https://github.com/jjyg/metasm/blob/master/INSTALL), please DON'T use the old version of Metasm hosted by Rubygems
+
+## Examples
+-----------------
+Please take a look at the examples directory.
+
+
+## Troubleshooting
+-----------------
+#### It is too slow, especially when searching for RPC client routines
+There are many reasons for this result, such as my poor code quality, and the Ruby interpreter runs slower on Windows than Linux. There is a trick that can greatly increase the speed without changing too much code: running in WSL. But I did not fully test whether it is available in WSL, it may be necessary to modify the core library code.
+
+
+## License
+-----------------
+See this license at LICENSE file.

data/README.rdoc

@@ -0,0 +1,19 @@
+= turborex
+
+Description goes here.
+
+== Contributing to turborex
+ 
+* Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet.
+* Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it.
+* Fork the project.
+* Start a feature/bugfix branch.
+* Commit and push until you are happy with your contribution.
+* Make sure to add tests for it. This is important so I don't break it in a future version unintentionally.
+* Please try not to mess with the Rakefile, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so I can cherry-pick around it.
+
+== Copyright
+
+Copyright (c) 2019 dkk. See LICENSE.txt for
+further details.
+

data/examples/alpc_client.rb

@@ -0,0 +1,15 @@
+require 'turborex'
+
+endpoint = ARGV[0]
+message = ARGV[1]
+
+unless endpoint.start_with?("\\RPC Control")
+  endpoint = "\\RPC Control\\#{endpoint}"
+end
+
+client = TurboRex::Windows::ALPC::Client.new endpoint
+server, msg = client.connect do |server|
+  a = server.send_recv ARGV[1], recv_attr: TurboRex::Windows::ALPC::MessageAttribute.new.struct
+  puts a.message_id
+  puts a.payload
+end

data/examples/alpc_server.rb

@@ -0,0 +1,14 @@
+require 'turborex'
+
+endpoint = ARGV[0]
+
+unless endpoint.start_with?("\\RPC Control")
+  endpoint = "\\RPC Control\\#{endpoint}"
+end
+
+server = TurboRex::Windows::ALPC::Server.new endpoint
+server.run do |client|
+  m = client.gets
+  print "Enter the response message: "
+  client.puts STDIN.gets.chomp, m.message_id
+end

data/examples/com_client.rb

@@ -0,0 +1,19 @@
+require 'turborex'
+
+client = TurboRex::Windows::COM::Client.new('E60687F7-01A1-40AA-86AC-DB1CBF673334')
+interface = TurboRex::Windows::COM::Interface.define_interface('5B311480-E5CE-4325-90CD-586C1A123FD3', {
+  Proc5: 'HRESULT Proc5(void *this, GUID* p0, wchar_t* p1,  void* p2);',
+  Proc6: 'HRESULT Proc6(void *this, GUID* p0);',
+  Proc7: 'HRESULT Proc7(void *this, void* p0, int p1,  wchar_t* p2);'
+}, TurboRex::Windows::COM::Interface::IClassFactory)
+client.create_instance cls_context: TurboRex::Windows::COM::CLSCTX_LOCAL_SERVER, interface: interface
+
+
+_iid = "{5B311480-E5CE-4325-90CD-586C1A123FD3}"
+pstr_iid = TurboRex::Windows::Win32API.alloc_c_ary('OLECHAR', _iid.chars.push(0).map{|c|c.ord})
+piid = TurboRex::Windows::Win32API.alloc_c_struct('CLSID')
+TurboRex::Windows::Win32API.clsidfromstring(pstr_iid, piid)
+
+interface.Proc6(piid)
+interface.Release()
+

data/examples/com_finder.rb

@@ -0,0 +1,39 @@
+require 'optparse'
+require 'turborex'
+require 'turborex/windows/com'
+
+options = {}
+OptionParser.new do |opts|
+  opts.banner = "Usage: com_finder.rb [options]"
+
+  opts.on("-c", "--clsid CLSID", "CoClass ID") do |c|
+    options[:clsid] = c
+  end
+
+  opts.on("-i", "--iid IID", "Interface ID") do |i|
+    options[:iid] = i
+  end
+
+  opts.on("-oop", "--out-of-process", "Using out-of-process finder") do |o|
+    options[:oop] = true
+  end
+
+  opts.on("-r", "--relative", "Specify whether the output address is rva") do |o|
+    options[:relative] = true
+  end
+end.parse!
+
+if options[:oop]
+  finder = TurboRex::Windows::COM::OutOfProcFinder.new(options[:clsid])
+else
+  finder = TurboRex::Windows::COM::InProcFinder.new(options[:clsid])
+end
+
+methods = finder.locate_interface_methods(options[:iid], options[:relative])
+puts "Module: #{methods[:module]}"
+
+methods[:methods].each do |m|
+  puts "index: #{m[:index]}"
+  puts "Address: 0x#{(m[:va] || m[:rva]).to_s(16)}"
+  puts
+end

data/examples/create_instance.rb

@@ -0,0 +1,15 @@
+require 'turborex'
+require 'turborex/windows/com'
+
+clsid = ARGV[0]
+ctx = ARGV[1]
+client = TurboRex::Windows::COM::Client.new(clsid)
+interface = TurboRex::Windows::COM::Interface::IUnknown.new
+client.create_instance cls_context: ctx, interface: interface
+
+objref = TurboRex::Windows::Win32API.decode_c_struct('OBJREF', interface.marshal_to_string)
+pid = objref.u_standard.std.ipid.Data2
+
+puts "Create COM object in process #{pid}."
+interface.Release
+

data/examples/cstruct.rb

@@ -0,0 +1,19 @@
+# My syntactic sugar for simply defining the structure. 
+# Does not support enum, union, the first letter of member variables must be lowercase
+# This is a very crude DSL，I strongly recommend you to use Metasm's cparser instead of this
+
+require 'turborex'
+
+include TurboRex::CStruct
+
+StructMgr = define_structs(arch: 'x64') do
+  struct MyStruct {
+    PVOID member1;
+    ULONG length;
+  };
+end
+
+s1 = StructMgr['MyStruct'].from_str "\x00\x00\x00\x00\x00\x00\x00\x01\xA\x00\x00\x00"
+puts s1['length'].to_s.unpack('L')
+
+

data/examples/find_com_client_calls.rb

@@ -0,0 +1,16 @@
+require 'turborex'
+
+file = ARGV[0]
+finder = TurboRex::Windows::COM::ClientFinder.new(file)
+res = finder.find_client_call
+
+if res
+  res.each do |r|
+    puts "Class ID: #{r[:clsid]}"
+    puts "Interface ID: #{r[:iid]}"
+    puts "Context: #{r[:context]}"
+    puts "Method index: #{r[:method_index]}"
+    puts "Call site: 0x#{r[:call_site].to_s(16)}"
+    puts
+  end
+end

data/examples/find_rpc_security_callback.rb

@@ -0,0 +1,12 @@
+require 'turborex'
+
+include TurboRex::MSRPC::RPCFinder::StaticRPCBacktracer
+
+dasm = _disassemble_executable_sections(Metasm::PE.decode_file(ARGV[0]))
+res = bt_security_callback(dasm, true)
+res.each do |r|
+  puts "Interface id: #{r[:interface_id]}"
+  puts "Callback address: 0x#{r[:callback].to_s(16)}"
+  puts "Flags: #{r[:flags]}"
+  puts
+end

data/examples/rpc_finder.rb

@@ -0,0 +1,117 @@
+require 'turborex'
+require 'optparse'
+
+
+options = {}
+OptionParser.new do |opts|
+  opts.banner = "Usage: rpc_finder.rb [options]"
+
+  opts.on("-f", "--file FILE", "File") do |f|
+    options[:file] = f
+  end
+
+  opts.on("-d", "--directory DIRECTORY", "Specify search directory") do |d|
+    options[:directory] = d
+  end
+
+  opts.on("-e", "--extension EXTENSION", "Specify extension") do |e|
+    options[:extension] = e
+  end
+
+  opts.on("", "--only-client", "Search client only") do |o|
+    options[:only_client] = o
+  end
+
+  opts.on("", "--find-client", "Finding client") do |f|
+    options[:find_client] = f
+  end
+
+  opts.on("", "--only-server", "Search server only") do |s|
+    options[:only_server] = s
+  end
+
+  opts.on("-csx", "--csx", "Search cross-server xrefs") do |x|
+    options[:csx] = x
+  end
+end.parse!
+
+def solve_cross_server_xrefs(finder)
+  finder.draw_ifs_xrefs
+  finder.server_interfaces.each do |si|
+    si.xrefs_from.each do |xref|
+      ci = xref[0]
+      call_info = xref[1]
+      
+      puts "Server Interface Id: #{si.interface_id}"
+      puts "Client Interface Id: #{ci.interface_id}"
+
+      call_info.each do |c|
+        puts "Found path:"
+        puts "   From: #{c[:caller].map{|r|'0x'+r.addr.to_s(16)}.join(', ')}"
+        puts "   To: 0x#{c[:called].addr.to_s(16)}"
+        puts "   Proc Number: #{c[:called].proc_num}"
+        puts "------------------------------------------------------------"
+        puts
+      end
+    end
+  end
+end
+
+#pelist = TurboRex::MSRPC::RPCFinder::ImageFinder.glob('C://windows/system32', ['.dll'])
+if options[:file]
+  pelist = [options[:file]]
+elsif options[:directory] && options[:extension]
+  pelist = TurboRex::MSRPC::RPCFinder::ImageFinder.glob(options[:directory], options[:extension].split(',').map {|e| e.strip})
+else
+  raise "The file path must be specified"
+end
+
+
+c  = TurboRex::MSRPC::RPCFinder::Collection.new
+pelist.each do |pe|
+  f = File.new(pe)
+
+  begin
+    finder = TurboRex::MSRPC::RPCFinder::ImageFinder.new pe, collection_proxy: c
+  rescue StandardError => e
+    next
+  end
+
+  res = finder.auto_find do
+    if options[:only_client]
+      only_client
+    elsif options[:only_server]
+      only_server
+    else
+      only_server
+    end
+
+    if options[:find_client]
+      find_client_routines
+    end
+  end
+
+  finder.server_interfaces.each do |si|
+    puts "Server Interface ID: #{si.interface_id}"
+    puts "Server Routines: "
+    si.routines.each_with_index do |r, i|
+      puts "Index: #{i} - 0x#{r.addr.to_s(16)}"
+    end
+    puts
+  end
+
+  finder.client_interfaces.each do |ci|
+    puts "Client Interface ID: #{ci.interface_id}"
+    if options[:find_client]
+      puts "Client Routines: "
+      ci.routines.each do |r|
+        puts "Procedure Number: #{r.proc_num} - 0x#{r.addr.to_s(16)}"
+      end
+    end
+    puts
+  end
+
+  if options[:csx]
+    solve_cross_server_xrefs(finder)
+  end
+end

data/examples/scan_exports.rb

@@ -0,0 +1,5 @@
+require 'turborex'
+
+pelist = TurboRex::MSRPC::RPCFinder::ImageFinder.glob('C://windows/system32', ['.dll'])
+res = TurboRex::Windows::Utils.find_export_func('GetProxyDllInfo', pelist)
+puts res

data/examples/scan_imports.rb

@@ -0,0 +1,5 @@
+require 'turborex'
+
+pelist = TurboRex::MSRPC::RPCFinder::ImageFinder.glob('C://windows/system32', ['.dll'])
+res = TurboRex::Windows::Utils.find_import_func('CoCreateInstance', pelist)
+puts res

data/examples/tinysdk.rb

@@ -0,0 +1,17 @@
+require 'turborex'
+
+sdk = TurboRex::Windows::TinySDK.instance
+sdk.load
+
+sdk.np.parse <<-EOS
+  typedef struct tagBIND_OPTS {
+    DWORD cbStruct;
+    DWORD grfFlags;
+    DWORD grfMode;
+    DWORD dwTickCountDeadline;
+  } BIND_OPTS, *LPBIND_OPTS;
+EOS
+
+bind_opts = sdk.np.alloc_c_struct('BIND_OPTS')
+bind_opts.grfMode = 1
+puts bind_opts.str

data/lib/turborex.rb

@@ -0,0 +1,21 @@
+module TurboRex
+  def self.root
+    File.expand_path('../..', __FILE__)
+  end
+
+  require 'os'
+  require 'securerandom'
+  require 'parallel' unless ::OS.windows?
+  require 'metasm'
+  require 'turborex/monkey'
+  require 'turborex/utils'
+  require 'turborex/exception'
+  require 'turborex/windows'
+  require 'turborex/fuzzer'
+  require 'turborex/pefile'
+  require 'turborex/msrpc'
+  require 'turborex/cstruct'
+
+
+  include TurboRex::Utils
+end

data/lib/turborex/cstruct.rb

@@ -0,0 +1,565 @@
+require 'turborex/cstruct/struct_helper'
+require 'docile'
+require 'rex/struct2'
+
+module RefineAllocCStruct
+  refine Metasm::C::AllocCStruct do
+    def to_string # Warning: must be changed
+      self.str[self.stroff, self.sizeof]
+    end
+  end
+end
+
+module TurboRex
+  module CStruct
+    extend TurboRex::CStruct::Helper
+
+    Docile::FallbackContextProxy.class_eval do # Monkey patch
+      NON_FALLBACK_METHODS = Set[:class, :self, :respond_to?, :instance_of?]
+
+      def initialize(receiver, fallback)
+        @__receiver__ = receiver
+        @__fallback__ = fallback
+
+        # Enables calling DSL methods from helper methods in the block's context
+        unless fallback.respond_to?(:method_missing)
+          # NOTE: There's no {#define_singleton_method} on Ruby 1.8.x
+          singleton_class = (
+          class << fallback;
+            self;
+          end)
+
+          # instrument {#method_missing} on the block's context to fallback to
+          # the DSL object. This allows helper methods in the block's context to
+          # contain calls to methods on the DSL object.
+          singleton_class.
+              send(:define_method, :method_missing) do |method, *args, &block|
+            m = method.to_sym
+            if !NON_FALLBACK_METHODS.include?(m) && !fallback.respond_to?(m) && receiver.respond_to?(m) || receiver.respond_to?(:method_missing)
+              receiver.__send__(method.to_sym, *args, &block)
+            else
+              super(method, *args, &block)
+            end
+          end
+
+          # instrument a helper method to remove the above instrumentation
+          singleton_class.
+              send(:define_method, :__docile_undo_fallback__) do
+            singleton_class.send(:remove_method, :method_missing)
+            singleton_class.send(:remove_method, :__docile_undo_fallback__)
+          end
+        end
+      end
+    end
+
+    ::Rex::Struct2::CStruct.class_eval do
+      attr_reader :name_table
+
+      def offset(struct, index, base_offset = 0)
+        if index == 0
+          return index
+        end
+
+        offset = 0
+
+        (0...index).each do |i|
+          offset += struct[i].slength
+        end
+
+        base_offset + offset
+      end
+
+      def padding_align(base_offset = 0, pack = nil)
+        i = 0
+
+        loop do
+          current_offset = offset(self, i, base_offset)
+          if self[i].is_a? Rex::Struct2::CStruct
+
+            self[i].pack(@pack)
+            self[i].padding_align(@pack)
+            #break if self[i + 1] == nil
+            #binding.pry if @pack == 8
+
+            padding = calc_padding(self[i].self_align, current_offset, @pack)
+          else
+            padding = calc_padding(self[i].slength, current_offset, @pack)
+          end
+
+          if padding == 0
+            break if self[i + 1] == nil
+
+            i += 1
+            next
+          end
+
+          s = Rex::Struct2::CStructTemplate.new
+          padding.times do
+            s.template << ['uint8', 'padding', 0]
+          end
+
+          insert(i, s.make_struct)
+
+          i += 1
+          break if self[i + 1] == nil
+          i += 1
+        end
+
+        self.trailing_padding(@pack)
+      end
+
+      def trailing_padding(pack = nil)
+        pack ||= @pack
+        trailing = self.slength % effective_align(pack)
+        if trailing != 0
+          s = Rex::Struct2::CStructTemplate.new
+          trailing.times do
+            s.template << ['uint8', 'padding', 0]
+          end
+
+          append(s.make_struct)
+        end
+
+        self
+      end
+
+      def get_member_length(arr = [])
+        self.each do |member|
+          #if member.is_a? Rex::Struct2::CStruct
+          #  member.get_member_length(arr)
+          #else
+          arr << member.slength
+          #end
+        end
+
+        arr
+      end
+
+      def self_align
+        arr = []
+
+        self.each do |member|
+          if member.is_a? Rex::Struct2::CStruct
+            arr << member.get_member_self_align.max
+          else
+            arr << member.slength
+          end
+        end
+
+        arr.max
+      end
+
+      def get_member_self_align
+        arr = []
+        self.each do |member|
+          if member.is_a? Rex::Struct2::CStruct
+            arr << member.self_align
+          else
+            arr << member.slength
+          end
+        end
+
+        arr
+      end
+
+      def effective_align(pack = nil)
+        pack ||= @pack
+        effective_value = get_member_self_align.max
+        unless pack.nil?
+          effective_value = [effective_value, pack].min
+        end
+
+        return effective_value
+      end
+
+      def pack(n)
+        @pack = n
+      end
+
+      private def insert(index, obj)
+        elements.insert(index, obj)
+        @name_table.insert(index, 'padding')
+      end
+
+      private def append(obj)
+        elements.push(obj)
+        @name_table.push('padding')
+      end
+
+      private def calc_padding(length, offset, pack = nil)
+        if pack != nil && pack < length
+          length = pack
+        end
+
+        (length - (offset % length)) % length
+      end
+    end
+
+    ::Rex::Struct2::CStructTemplate.class_eval do
+      def initialize(*tem)
+        self.template = tem
+        self.template_create_restraints = []
+        self.template_apply_restraint = []
+        @natural_align = nil
+        @pack = nil
+      end
+
+      def natural_align(align = true)
+        @natural_align = align
+
+        self
+      end
+
+      def pack(n)
+        @pack = n
+
+        self
+      end
+
+      def make_struct(pack = nil, natural_align = nil)
+        s = ::Rex::Struct2::CStruct.new(*self.template).
+            create_restraints(*self.template_create_restraints).
+            apply_restraint(*self.template_apply_restraint)
+
+        pack ||= @pack
+        natural_align ||= @natural_align
+
+        if pack
+          s.pack(pack)
+        end
+
+        if natural_align
+          s.padding_align
+        end
+
+        s
+      end
+    end
+
+    def define_structs(opts = {}, str = nil, &block)
+      if block_given?
+        Docile.dsl_eval(StructMgr.new(opts), &block)
+      elsif opts[:native_parse] # parse with Metasm::C::Parser
+        opts.delete[:native_parse]
+        NativeParser.new(str, opts)
+      end
+    end
+
+    class StructMgr
+      attr_reader :structs_table
+
+      def initialize(opts)
+        @structs_table = {}
+        @opts = opts
+      end
+
+      def [](name)
+        @structs_table[name.to_sym]
+      end
+
+      def build
+        self
+      end
+
+      def struct(obj)
+        @structs_table[obj.struct_name.to_sym] = obj
+        TurboRex::CStruct::CStructBuilder.create_method(obj.struct_name.to_sym) do |name|
+          self.s.template << ['template', name.to_s, obj.s]
+        end
+
+        self
+      end
+
+      def method_missing(m, *args, &block)
+        if block
+          arch = @opts[:arch] || 'x86'
+          return Docile.dsl_eval(CStructBuilder.new(arch), &block).build(m.to_s)
+        end
+
+        FieldsProxy.new m.to_s
+      end
+    end
+
+    class FieldsProxy
+      attr_reader :count
+      attr_reader :name
+
+      def initialize(name)
+        @name = name
+        @count = 1
+        @point_to = nil
+      end
+
+      def [](count)
+        @count = count.to_i
+
+        self
+      end
+
+      def to_s
+        @name.to_s
+      end
+
+      def point_to(cstruct)
+        @point_to = cstruct
+      end
+    end
+
+    class CStructBuilder
+      attr_reader :struct_name
+      attr_reader :s
+
+      def initialize(arch = 'x86')
+        @s = ::Rex::Struct2::CStructTemplate.new
+        @arch = arch
+        define_variable_length_type
+      end
+
+      def char(field, init_value = 0)
+        add_object('int8', field, init_value)
+      end
+
+      def uchar(field, init_value = 0)
+        add_object('uint8', field, init_value)
+      end
+
+      def short(field, init_value = 0, endian = 'v') #  'v' is little-endian, 'n' is big-endian
+        add_object('int16' + endian, field, init_value)
+      end
+
+      def ushort(field, init_value = 0, endian = 'v')
+        add_object('uint16' + endian, field, init_value)
+      end
+
+      def int(field, init_value = 0, endian = 'v')
+        add_object('int32' + endian, field, init_value)
+      end
+
+      def uint(field, init_value = 0, endian = 'v')
+        add_object('uint32' + endian, field, init_value)
+      end
+
+      def word(field, init_value = 0, endian = 'v')
+        add_object('uint16' + endian, field, init_value)
+      end
+
+      def dword(field, init_value = 0, endian = 'v')
+        add_object('uint32' + endian, field, init_value)
+      end
+
+      def int64(field, init_value = 0, endian = 'v')
+        add_object('int64' + endian, field, init_value)
+      end
+
+      def __int64(field, init_value = 0, endian = 'v')
+        add_object('int64' + endian, field, init_value)
+      end
+
+      def uint64(field, init_value = 0, endian = 'v')
+        add_object('uint64' + endian, field, init_value)
+      end
+
+      def pvoid(field, init_value = 0, endian = 'v')
+        case @arch
+        when 'x86'
+          add_object('uint32' + endian, field, init_value)
+        when 'x64'
+          add_object('uint64' + endian, field, init_value)
+        end
+      end
+
+      # https://docs.microsoft.com/en-us/windows/win32/winprog/windows-data-types
+      # https://docs.microsoft.com/en-us/cpp/cpp/data-type-ranges?redirectedfrom=MSDN&view=vs-2019
+      # The data type range follows Microsoft VC/C++ compiler
+      # data model llp64 on 64-bit arch
+      alias ATOM word
+      alias WORD word
+      alias DWORD dword
+      alias SHORT short
+      alias QWORD uint64
+      alias BYTE uchar
+      alias BOOLEAN BYTE
+      alias BOOL int
+      alias CCHAR char
+      alias CHAR char
+      alias UCHAR uchar
+      alias COLORREF DWORD
+      alias DWORDLONG uint64
+      alias DWORD32 uint
+      alias DWORD64 uint64
+      alias HFILE int
+      alias UINT uint
+      alias INT int
+      alias INT8 char
+      alias INT16 short
+      alias INT32 int
+      alias INT64 int64
+      alias UINT8 uchar
+      alias UINT16 ushort
+      alias UINT32 uint
+      alias UINT64 uint64
+      alias LANGID WORD
+      alias LCID DWORD
+      alias LCTYPE DWORD
+      alias LGRPID DWORD
+      alias LONG32 int
+      alias LONG64 int64
+      alias LONG int
+      alias ULONG uint
+      alias ULONG32 uint
+      alias ULONG64 uint64
+      alias USHORT ushort
+      alias PVOID pvoid
+      alias HANDLE PVOID
+
+
+      def alias_singleton_method(alias_sym, method)
+        self.singleton_class.send(:alias_method, alias_sym, method)
+      end
+
+      def define_variable_length_type
+        arch_32? ? alias_singleton_method(:ULONG_PTR, :uint) : alias_singleton_method(:ULONG_PTR, :uint64)
+        arch_32? ? alias_singleton_method(:ULONG_PTR_T, :uint) : alias_singleton_method(:ULONG_PTR_T, :uint64)
+      end
+
+      def struct(&block)
+        yield
+      end
+
+      def add_object(type, field, init_value)
+        if field.count == 1
+          @s.template << [type, field.to_s, init_value]
+        else
+          struct_temp = ::Rex::Struct2::CStructTemplate.new
+          field.count.times do |i|
+            struct_temp.template << [type, field.to_s + '_' + i.to_s, init_value]
+          end
+
+          @s.template << ['template', field.to_s, struct_temp]
+        end
+      end
+
+      def build(name)
+        set_struct_name(name)
+
+        self
+      end
+
+      def self.create_method(method_name, &block)
+        define_method(method_name, &block)
+      end
+
+      def set_struct_name(name)
+        @struct_name = name
+      end
+
+      def make(opts = {})
+        @s.make_struct(opts[:pack], opts[:align])
+      end
+
+      def from_str(s)
+        struct = @s.make_struct
+        struct.from_s(s)
+        struct
+      end
+
+      private
+
+      def arch_32?
+        @arch == 'x86'
+      end
+
+      def arch_64?
+        !arch_32?
+      end
+    end
+
+    class NativeParser
+      attr_reader :parser
+      attr_reader :cpu
+
+      def initialize(str, opts={})
+        @cpu = opts[:cpu].new rescue nil || Metasm::Ia32.new
+        @parser = @cpu.new_cparser
+
+        if opts[:predefined] # TODO: more Predefined macros
+          if opts[:cpu] == Metasm::Ia32
+            @parser.lexer.define("_WIN32")
+          elsif opts[:cpu] == Metasm::X86_64
+            @parser.lexer.define("_WIN64")
+            @parser.llp64
+          end
+        end
+
+        @parser.send(opts[:data_model].to_s) if opts[:data_model]
+        
+        if opts[:visual_studio]
+          @parser.prepare_visualstudio
+        end
+
+        if opts[:gcc]
+          @parser.prepare_gcc
+        end
+
+        @include_path = opts[:include_path] || []
+        perform_include_path
+        @parser.lexer.warn_redefinition = false
+        @parser.lexer.include_search_path = @include_path
+        if opts[:file]
+          @parser.parse_file opts[:file]
+        elsif str
+          @parser.parse str
+        end
+      end
+
+      def find_c_struct(name)
+        @parser.find_c_struct(name)
+      end
+
+      def find_c_type(name)
+        @parser.find_c_type(name)
+      end
+
+      def [](name)
+        NativeStructProxy.new(@parser, name)
+      end
+
+      def method_missing(m, *args, &block)
+        @parser.send(m, *args, &block)
+      end
+
+      private
+
+      def perform_include_path
+        @include_path += TurboRex::Windows.tinysdk.include_path
+        @include_path.uniq!
+      end
+    end
+
+    class NativeStructProxy
+      attr_reader :size
+      attr_reader :sizeof
+      attr_reader :name
+      attr_reader :struct
+
+      def initialize(parser, name)
+        @parser = parser
+        @name = name
+        @size = @sizeof = parser.sizeof(parser.find_c_struct(name))
+      end
+
+      def from_str(str, offset = 0)
+        struct = @parser.find_c_struct(@name)
+        @struct = ::Metasm::C::AllocCStruct.new(@parser, struct, str, offset)
+      end
+
+      def to_s
+        @struct.str
+      end
+
+      def method_missing(m, *args, &block)
+        @struct.send(m, *args, &block)
+      end
+    end
+  end
+end