RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable > Class Template Reference

More...

Public Member Functions
	CodeCaveBuilder (Injector< TMemoryAlterationSetID, TCodeCave, TVariable > injector)
	Constructor. More...
CodeCaveDefinition< TMemoryAlterationSetID, TCodeCave, TVariable >	Build ()
	Called as the last step for building a CodeCaveDefinition<TMemoryAlterationSetID, TCodeCave, TVariable>, returning the produced definition. More...
CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >	VarAddr (TVariable varId)
	Adds the bytes that represent the address of an injected code cave to the code cave being built. This effectivelly adds a CodeCaveArtifactVariableAddress<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts. More...
CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >	CaveAddr (TCodeCave caveId)
	Adds the bytes that represent the address of an injected variable to the code cave being built. This effectivelly adds a CodeCaveArtifactCodeCaveAddress<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts. More...
CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >	SBytes (params sbyte[] bytes)
	Adds the given sequence of signed bytes (SByte) to the code cave being built. This effectivelly adds a CodeCaveArtifactSignedBytesSequence<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts. More...
CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >	Bytes (params byte[] bytes)
	Adds the given sequence of unsigned bytes (Byte) to the code cave being built. This effectivelly adds a CodeCaveArtifactUnsignedBytesSequence<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts. More...
CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >	X86Call (MemoryAddress targetAddress)
	Adds the bytes corresponding to a CALL instruction to the code cave being built. This effectivelly adds a CodeCaveArtifactX86Call<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts. More...
CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >	X86NearJump (EJumpInstructionType jumpInstructionType, MemoryAddress targetAddress)
	Adds the bytes corresponding to a NEAR JUMP instruction to the code cave being built. This effectivelly adds a CodeCaveArtifactX86NearJump<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts. More...
CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >	X86FarJump (EJumpInstructionType jumpInstructionType, MemoryAddress targetAddress)
	Adds the bytes corresponding to a FAR JUMP instruction to the code cave being built. This effectivelly adds a CodeCaveArtifactX86FarJump<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts. More...

Detailed Description

A class specialized in building CodeCaveDefinition<TMemoryAlterationSetID, TCodeCave, TVariable> objects. This class follows a fluid design pattern, allowing calls to its code cave construction-related methods to be cascaded, making code easier to read and maintain.

Under the hoods, this class generates CodeCaveArtifact<TMemoryAlterationSetID, TCodeCave, TVariable> objects, which are kept in a list that can be used to generate the code cave definition.

Constructor & Destructor Documentation

CodeCaveBuilder()

RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.CodeCaveBuilder

(

Injector< TMemoryAlterationSetID, TCodeCave, TVariable >

injector

)

Constructor.

Parameters

injector

A reference to the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> object to which the CodeCaveDefinition<TMemoryAlterationSetID, TCodeCave, TVariable> objects will be created.

Member Function Documentation

Build()

CodeCaveDefinition<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.Build

(

)

Called as the last step for building a CodeCaveDefinition<TMemoryAlterationSetID, TCodeCave, TVariable>, returning the produced definition.

Returns

Returns the created CodeCaveDefinition<TMemoryAlterationSetID, TCodeCave, TVariable> instance.

Bytes()

CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.Bytes

(

params byte []

bytes

)

Adds the given sequence of unsigned bytes (Byte) to the code cave being built. This effectivelly adds a CodeCaveArtifactUnsignedBytesSequence<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts.

Parameters

bytes

The sequence of (unsigned) bytes which will be added.

Returns

Returns a reference to the object used to call the method.

CaveAddr()

CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.CaveAddr

(

TCodeCave

caveId

)

Adds the bytes that represent the address of an injected variable to the code cave being built. This effectivelly adds a CodeCaveArtifactCodeCaveAddress<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts.

Parameters

caveId

The identifier of the code cave whose address will be added.

Returns

Returns a reference to the object used to call the method.

SBytes()

CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.SBytes

(

params sbyte []

bytes

)

Adds the given sequence of signed bytes (SByte) to the code cave being built. This effectivelly adds a CodeCaveArtifactSignedBytesSequence<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts.

Parameters

bytes

The sequence of (signed) bytes which will be added.

Returns

Returns a reference to the object used to call the method.

VarAddr()

CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.VarAddr

(

TVariable

varId

)

Adds the bytes that represent the address of an injected code cave to the code cave being built. This effectivelly adds a CodeCaveArtifactVariableAddress<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts.

Parameters

varId

The identifier of the variable whose address will be added.

Returns

Returns a reference to the object used to call the method.

X86Call()

CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.X86Call

(

MemoryAddress

targetAddress

)

Adds the bytes corresponding to a CALL instruction to the code cave being built. This effectivelly adds a CodeCaveArtifactX86Call<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts.

Parameters

targetAddress

The address to be CALLed.

Returns

Returns a reference to the object used to call the method.

X86FarJump()

CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.X86FarJump	(	EJumpInstructionType	jumpInstructionType,
		MemoryAddress	targetAddress
	)

Adds the bytes corresponding to a FAR JUMP instruction to the code cave being built. This effectivelly adds a CodeCaveArtifactX86FarJump<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts.

Parameters

jumpInstructionType	The specific type of jump instruction to be generated.
targetAddress	The address to which the instruction will jump.

Returns

Returns a reference to the object used to call the method.

X86NearJump()

CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >.X86NearJump	(	EJumpInstructionType	jumpInstructionType,
		MemoryAddress	targetAddress
	)

Adds the bytes corresponding to a NEAR JUMP instruction to the code cave being built. This effectivelly adds a CodeCaveArtifactX86NearJump<TMemoryAlterationSetID, TCodeCave, TVariable> artifact to the list of generated artifacts.

Parameters

jumpInstructionType	The specific type of jump instruction to be generated.
targetAddress	The address to which the instruction will jump.

Returns

Returns a reference to the object used to call the method.