add examples for SSL_read hooking

struct · Oct 28, 2010 · d2eb227 · d2eb227
1 parent 9304ff3
commit d2eb227
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/example_configuration_files/Win32_SSL_read.txt b/example_configuration_files/Win32_SSL_read.txt
@@ -0,0 +1,3 @@
+; Please see scripts/Win32_SSL_read.rb
+
+bp=SSL_read!ssleay32, name=SSL_read, code=scripts/Win32_SSL_read.rb
diff --git a/scripts/Win32_SSL_read.rb b/scripts/Win32_SSL_read.rb
@@ -0,0 +1,14 @@
+## Please see example_configuration_files/Win32_SSL_read.txt
+
+if dir.to_s =~ /leave/
+    addr = @ragweed.process.read32(ctx.esp+4)
+    len = ctx.eax
+
+    @log.str "Read #{len.to_s(16)} from #{addr.to_s(16)}; #{@ragweed.process.read32(ctx.esp).to_s(16)}"
+
+    if len != 0xffffffff
+        buf = @ragweed.process.read(addr, len)
+        @log.str "Read #{len} from #{addr} got:"
+        @log.str buf
+    end
+end