Class: Metasploit::Framework::Obfuscation::CRandomizer::Modifier

Inherits:
Object
  • Object
show all
Defined in:
lib/metasploit/framework/obfuscation/crandomizer/modifier.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(p, f, w) ⇒ Modifier

Initializes a Metasploit::Framework::Obfuscation::CRandomizer::Modifier instance.

Parameters:



18
19
20
21
22
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 18

def initialize(p, f, w)
  @parser = p
  @fake_functions = f
  @weight = w
end

Instance Attribute Details

#fake_functions ⇒ Object (readonly)

Returns the value of attribute fake_functions.



10
11
12
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 10

def fake_functions
  @fake_functions
end

#parser ⇒ Object (readonly)

Returns the value of attribute parser.



9
10
11
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 9

def parser
  @parser
end

#weight ⇒ Object (readonly)

Returns the value of attribute weight.



11
12
13
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 11

def weight
  @weight
end

Instance Method Details

#modify_else(s) ⇒ Object

Modifies an else block.

Parameters:

  • s (Metasm::C::Declaration) 


79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 79

def modify_else(s)
  else_block = s.belse

  # The else block is retrieved this way when there is an else if block
  else_block = s.belse.belse if s.belse.respond_to?(:belse)

  # There is really no else block, let's bail.
  # return unless else_block
  return unless else_block.respond_to?(:statements)

  new_else_statements = []

  else_block.statements.each do |stmt|
    modify_nested_blocks(stmt)
    new_else_statements.concat(get_fake_statement)
    new_else_statements << stmt
  end

  else_block.statements = new_else_statements
end

#modify_else_if(s) ⇒ Object

Modifies an else-if block.

Parameters:

  • s (Metasm::C::Declaration)
  • (void) 


55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 55

def modify_else_if(s)
  # There could be multiple else if blocks,
  # this gives the current else if block
  elseif_block = s.belse

  while (elseif_block && elseif_block.respond_to?(:bthen)) do
    new_else_if_statements = []

    elseif_block.bthen.statements.each do |stmt|
      modify_nested_blocks(stmt)
      new_else_if_statements.concat(get_fake_statement)
      new_else_if_statements << stmt
    end

    elseif_block.bthen.statements = new_else_if_statements

    # Move on to the next else if block
    elseif_block = elseif_block.belse
  end
end

#modify_for(s) ⇒ Object

Modifies a for block.

Parameters:

  • s (Metasm::C::Declaration) 


103
104
105
106
107
108
109
110
111
112
113
114
115
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 103

def modify_for(s)
  new_for_statements = []

  s.body.statements.each do |stmt|
    modify_nested_blocks(stmt)
    new_for_statements.concat(get_fake_statement)
    new_for_statements << stmt
  end

  s.body.statements = new_for_statements

  s
end

#modify_function(s) ⇒ Object

Modifies a function.

Parameters:

  • s (Metasploit::C::Declaration) 


132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 132

def modify_function(s)
  function_statements = s.var.initializer.statements
  new_function_statements = []

  function_statements.each do |func_stmt|
    unless feeling_lucky?
      new_function_statements << func_stmt
      next
    end

    case func_stmt
    when Metasm::C::If
      new_function_statements << modify_if_else_blocks(func_stmt)
    when Metasm::C::For
      new_function_statements << modify_for(func_stmt)
    else
      new_function_statements.concat(get_fake_statement(s))
      new_function_statements << func_stmt
    end
  end

  unless new_function_statements.empty?
    s.var.initializer.statements = new_function_statements
  end
end

#modify_if(s) ⇒ Object

Modifies an if block.

return [void]

Parameters:

  • s (Metasm::C::Declaration) 


39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 39

def modify_if(s)
  new_if_statements = []

  s.bthen.statements.each do |stmt|
    modify_nested_blocks(stmt)
    new_if_statements.concat(get_fake_statement)
    new_if_statements << stmt
  end

  s.bthen.statements = new_if_statements
end

#modify_if_else_blocks(s) ⇒ Metasm::C::Declaration

Modifies different if-else blocks recursively.

Parameters:

  • s (Metasm::C::Declaration)

Returns:

  • (Metasm::C::Declaration) 


28
29
30
31
32
33
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 28

def modify_if_else_blocks(s)
  modify_if(s)
  modify_else_if(s)
  modify_else(s)
  s
end

#modify_nested_blocks(s) ⇒ Object

Modifies a nested block.

Parameters:

  • s (Metasm::C::Declaration) 


120
121
122
123
124
125
126
127
 
# File 'lib/metasploit/framework/obfuscation/crandomizer/modifier.rb', line 120

def modify_nested_blocks(s)
  case s
  when Metasm::C::If
    modify_if_else_blocks(s)
  when Metasm::C::For
    modify_for(s)
  end
end