Hello,
I have an array of objects named sections
like so:
{
"structure": "IMAGE_SECTION_HEADER",
"name": ".text",
"flags": [
"IMAGE_SCN_CNT_CODE",
"IMAGE_SCN_MEM_EXECUTE",
"IMAGE_SCN_MEM_READ"
]
},
{
"structure": "IMAGE_SECTION_HEADER",
"name": ".rdata",
"flags": [
"IMAGE_SCN_CNT_INITIALIZED_DATA",
"IMAGE_SCN_MEM_READ"
]
},
{
"structure": "IMAGE_SECTION_HEADER",
"name": ".idata",
"flags": [
"IMAGE_SCN_CNT_INITIALIZED_DATA",
"IMAGE_SCN_MEM_READ",
"IMAGE_SCN_MEM_WRITE"
]
}
I would like to dynamically create fields like so (basically set the whole object for each name
as the value for the newly created field):
sections.text :
{
"structure": "IMAGE_SECTION_HEADER",
".name": ".text",
"flags": [
"IMAGE_SCN_CNT_CODE",
"IMAGE_SCN_MEM_EXECUTE",
"IMAGE_SCN_MEM_READ"
]
}
The following Ruby code works fine for setting the field name, however, I am not able to populate the entire object into the value:
ruby {
code => "event.get('sections').each {|hash| event.set('[new_sections][' + hash['name'].gsub('.', '') + ']', hash['value'])};"
}
How would I access the current object that event.get('sections').each
would be looking at to set that as the value for the hash in the event.set
portion?
Any advice would be much appreciated. Thanks!