/*

  *  Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
  *  Copyright (C) 2007-2013 Sourcefire, Inc.

  *
  *  Authors: Alberto Wu

  *
  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.

  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  *  MA 02110-1301, USA.
  */
 
 /*
 ** unsp.c
 **
 ** 11/10/2k6 - Merge started.
 **
 */
 
 /*
 ** Plays around with NsPack compressed executables
 **
 ** This piece of code is dedicated to Damian Put
 ** who I made a successful and wealthy man.
 **
 ** Damian, you owe me a pint!
 */
 
 /*
 ** TODO:
 **
 ** - Investigate the "unused" code in NsPack
 ** - Fetch all the nspacked samples from the zoo and run extensive testing
 ** - Add bound checks
 ** - Test against the zoo again
 ** - Perform regression testing against the full zoo 
 ** - check nested
 ** - look at the 64bit version (one of these days)
 **
 */
 
 /* 
 
    FIXME: clean this rubbish
 
 
 init_and_check_dll_loadflags();
 
 nsp1:004359FE                 add     edi, [ebp-28Dh]
 nsp1:00435A04                 mov     ebx, edi
 nsp1:00435A06                 cmp     dword ptr [edi], 0
 nsp1:00435A09                 jnz     short loc_435A15
 nsp1:00435A0B                 add     edi, 4
 nsp1:00435A0E                 mov     ecx, 0
 nsp1:00435A13                 jmp     short loc_435A2B
 nsp1:00435A15 ; ---------------------------------------------------------------------------
 nsp1:00435A15
 nsp1:00435A15 loc_435A15:                             ; CODE XREF: start+349EEj
 nsp1:00435A15                 mov     ecx, 1
 nsp1:00435A1A                 add     edi, [ebx]
 nsp1:00435A1C                 add     ebx, 4
 nsp1:00435A1F
 nsp1:00435A1F loc_435A1F:                             ; CODE XREF: start+34A3Dj
 nsp1:00435A1F                 cmp     dword ptr [ebx], 0
 nsp1:00435A22                 jz      short loc_435A5A
 nsp1:00435A24                 add     [ebx], edx
 nsp1:00435A26                 mov     esi, [ebx]
 nsp1:00435A28                 add     edi, [ebx+4]
 nsp1:00435A2B
 nsp1:00435A2B loc_435A2B:                             ; CODE XREF: start+349F8j
 nsp1:00435A2B                 push    edi
 nsp1:00435A2C                 push    ecx
 nsp1:00435A2D                 push    edx
 nsp1:00435A2E                 push    ebx
 nsp1:00435A2F                 push    dword ptr [ebp-1D1h] ; VirtualFree
 nsp1:00435A35                 push    dword ptr [ebp-1D5h] ; alloc
 nsp1:00435A3B                 mov     edx, esi
 nsp1:00435A3D                 mov     ecx, edi
 nsp1:00435A3F                 mov     eax, offset get_byte
 nsp1:00435A44                 int     3               ; Trap to Debugger
 nsp1:00435A45                 add     eax, 5A9h
 nsp1:00435A4A                 call    eax ; real_unpack ; edx=401000
 nsp1:00435A4A                                         ; ecx=436282
 nsp1:00435A4C                 pop     ebx
 nsp1:00435A4D                 pop     edx
 nsp1:00435A4E                 pop     ecx
 nsp1:00435A4F                 pop     edi
 nsp1:00435A50                 cmp     ecx, 0
 nsp1:00435A53                 jz      short loc_435A5A
 nsp1:00435A55                 add     ebx, 8
 nsp1:00435A58                 jmp     short loc_435A1F
 nsp1:00435A5A ; ---------------------------------------------------------------------------
 nsp1:00435A5A
 nsp1:00435A5A loc_435A5A:                             ; CODE XREF: start+34A07j
 nsp1:00435A5A                                         ; start+34A38j
 nsp1:00435A5A                 push    8000h
 
 */
 
 #if HAVE_CONFIG_H
 #include "clamav-config.h"
 #endif
 
 #include <stdlib.h>
 
 #include "clamav.h"
 #include "others.h"
 #include "rebuildpe.h"

 #include "execs.h"

 #include "unsp.h"
 
 
 /* real_unpack(start_of_stuff, dest, malloc, free); */

 uint32_t unspack(const char *start_of_stuff, char *dest, cli_ctx *ctx, uint32_t rva, uint32_t base, uint32_t ep, int file) {

   uint8_t c = *start_of_stuff;
   uint32_t i,firstbyte,tre,allocsz,tablesz,dsize,ssize;
   uint16_t *table;
   char *dst = dest;

   const char *src = start_of_stuff+0xd;

   struct cli_exe_section section;

   
   if (c>=0xe1) return 1;
 
   if (c>=0x2d) {
     firstbyte = i = c/0x2d;
     do {c+=0xd3;} while (--i);
   } else firstbyte = 0;
 
   if (c>=9) {
     allocsz = i = c/9;
     do {c+=0xf7;} while (--i);
   } else allocsz = 0;
   
   tre = c;
   i = allocsz;
   c = (tre+i)&0xff;
   tablesz = ((0x300<<c)+0x736)*sizeof(uint16_t);

 
   if(cli_checklimits("nspack", ctx, tablesz, 0, 0)!=CL_CLEAN)

     return 1; /* Should be ~15KB, if it's so big it's prolly just not nspacked */
     
   cli_dbgmsg("unsp: table size = %d\n", tablesz);

   if (!(table = cli_malloc(tablesz))) {
       cli_dbgmsg("unspack: Unable to allocate memory for table\n");
       return 1;
   }

   
   dsize = cli_readint32(start_of_stuff+9);
   ssize = cli_readint32(start_of_stuff+5);

   if (ssize <= 13) {
   	free(table);

   	return 1;

   }
 

   tre = very_real_unpack(table,tablesz,tre,allocsz,firstbyte,src,ssize,dst,dsize);
   free(table);
   if (tre) return 1;
 
   section.raw=0;
   section.rsz = dsize;
   section.vsz = dsize;
   section.rva = rva;

   return !cli_rebuildpe(dest, &section, 1, base, ep, 0, 0, file);

 }
 
 

 uint32_t very_real_unpack(uint16_t *table, uint32_t tablesz, uint32_t tre, uint32_t allocsz, uint32_t firstbyte, const char *src, uint32_t ssize, char *dst, uint32_t dsize) {

   struct UNSP read_struct;
   uint32_t i = (0x300<<((allocsz+tre)&0xff)) + 0x736;
 
   uint32_t previous_bit = 0;
   uint32_t unpacked_so_far = 0;
   uint32_t backbytes = 1;
   uint32_t oldbackbytes = 1;
   uint32_t old_oldbackbytes = 1;
   uint32_t old_old_oldbackbytes = 1;
 
   uint32_t damian = 0;
   uint32_t put = (1<<(allocsz&0xff))-1;
 
   uint32_t bielle = 0;
 
   firstbyte = (1<<(firstbyte&0xff))-1;
 
   if (tablesz < i*sizeof(uint16_t)) return 2;
 
   /* init table */
   while (i) table[--i]=0x400;
 
   /* table noinit */
 
   /* get_five - inlined */
   read_struct.error = 0;
   read_struct.oldval = 0;
   read_struct.src_curr = src;
   read_struct.bitmap = 0xffffffff;

   read_struct.src_end = src + ssize - 13;

   read_struct.table = (char *)table;
   read_struct.tablesz = tablesz;
 
   for ( i = 0; i<5 ; i++) read_struct.oldval = (read_struct.oldval<<8) | get_byte(&read_struct);
   if (read_struct.error) return 1;
   /* if (!dsize) return 0; - checked in pe.c */
 
 
   /* very_unpacking_loop */
 
   while (1) {
     uint32_t backsize = firstbyte&unpacked_so_far;
     uint32_t tpos;
     uint32_t temp = damian;
 
     if (read_struct.error) return 1; /* checked once per mainloop, keeps the code readable and it's still safe */
     
     if (!getbit_from_table(&table[(damian<<4) + backsize], &read_struct)) { /* no_mainbit */
 
       uint32_t shft = 8 - (tre&0xff);
       shft &= 0xff;
       tpos = (bielle>>shft) + ((put&unpacked_so_far)<<(tre&0xff));
       tpos *=3;
       tpos<<=8;
 
       if ((int32_t)damian>=4) { /* signed */
 	if ((int32_t)damian>=0xa) { /* signed */
 	  damian -= 6;
 	} else {
 	  damian -= 3;
 	}
       } else {
 	damian=0;
       }
 
       /* 44847E */
       if (previous_bit) {
 	if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], 1)) return 1;
 	ssize = (ssize&0xffffff00) | (uint8_t)dst[unpacked_so_far - backbytes]; /* FIXME! ssize is not static */
 	bielle = get_100_bits_from_tablesize(&table[tpos+0x736], &read_struct, ssize);
 	previous_bit=0;
       } else {
 	bielle = get_100_bits_from_table(&table[tpos+0x736], &read_struct);
       }
 
       /* unpack_one_byte - duplicated */
       if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far], 1)) return 1;
       dst[unpacked_so_far] = bielle;
       unpacked_so_far++;
       if (unpacked_so_far>=dsize) return 0;
       continue;
 
     } else { /* got_mainbit */
 
       bielle = previous_bit = 1;
 
       if (getbit_from_table(&table[damian+0xc0], &read_struct)) {
 	if (!getbit_from_table(&table[damian+0xcc], &read_struct)) {
 	  tpos = damian+0xf;
 	  tpos <<=4;
 	  tpos += backsize;
 	  if (!getbit_from_table(&table[tpos], &read_struct)) {
 	    if (!unpacked_so_far) return bielle; /* FIXME: WTF?! */
 	    
 	    damian = 2*((int32_t)damian>=7)+9; /* signed */
 	    if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], 1)) return 1;
 	    bielle = (uint8_t)dst[unpacked_so_far - backbytes];
 	    /* unpack_one_byte - real */
 	    dst[unpacked_so_far] = bielle;
 	    unpacked_so_far++;
 	    if (unpacked_so_far>=dsize) return 0;
 	    continue;
 	    
 	  } else { /* gotbit_tre */
 	    backsize = get_n_bits_from_tablesize(&table[0x534], &read_struct, backsize);
 	    damian = ((int32_t)damian>=7); /* signed */
 	    damian = ((damian-1) & 0xfffffffd)+0xb;
 	    /* jmp checkloop_and_backcopy (uses edx) */
 	  } /* gotbit_uno ends */
 	} else { /* gotbit_due */
 	  if (!getbit_from_table(&table[damian+0xd8], &read_struct)) {
 	    tpos = oldbackbytes;
 	  } else {
 	    if (!getbit_from_table(&table[damian+0xe4], &read_struct)) {
 	      tpos = old_oldbackbytes;
 	    } else {
 	      /* set_old_old_oldback */
 	      tpos = old_old_oldbackbytes;
 	      old_old_oldbackbytes = old_oldbackbytes;
 	    }
 	    /* set_old_oldback */
 	    old_oldbackbytes = oldbackbytes;
 	  }
 	  /* set_oldback */
 	  oldbackbytes = backbytes;
 	  backbytes = tpos;
 	  
 	  backsize = get_n_bits_from_tablesize(&table[0x534], &read_struct, backsize);
 	  damian = ((int32_t)damian>=7); /* signed */
 	  damian = ((damian-1) & 0xfffffffd)+0xb;
 	  /* jmp checkloop_and_backcopy (uses edx) */
 	} /* gotbit_due ends */
       } else { /* gotbit_uno */
 	
 	old_old_oldbackbytes = old_oldbackbytes;
 	old_oldbackbytes = oldbackbytes;
 	oldbackbytes = backbytes;
 	
 	damian = ((int32_t)damian>=7); /* signed */
 	damian = ((damian-1) & 0xfffffffd)+0xa;
 
 	backsize = get_n_bits_from_tablesize(&table[0x332], &read_struct, backsize);
 
 	tpos = ((int32_t)backsize>=4)?3:backsize; /* signed */
 	tpos<<=6;
 	tpos = get_n_bits_from_table(&table[0x1b0+tpos], 6, &read_struct);
 
 	if (tpos>=4) { /* signed */
 
 	  uint32_t s = tpos;
 	  s>>=1;
 	  s--;
 
 	  temp = (tpos & bielle) | 2;
 	  temp<<=(s&0xff);
 
 
 	  if ((int32_t)tpos<0xe) {
 	    temp += get_bb(&table[(temp-tpos)+0x2af], s, &read_struct);
 	  } else {
 	    s += 0xfffffffc;
 	    tpos = get_bitmap(&read_struct, s);
 	    tpos <<=4;
 	    temp += tpos;
 	    temp += get_bb(&table[0x322], 4, &read_struct);
 	  }
 	} else {
 	  /* gotbit_uno_out1 */
 	  backbytes = temp = tpos;
 	}
 	/* gotbit_uno_out2 */
 	backbytes = temp+1;
 	/* jmp checkloop_and_backcopy (uses edx) */
       } /* gotbit_uno ends */
 
       /* checkloop_and_backcopy */
       if (!backbytes) return 0; /* very_real_unpack_end */
       if (backbytes > unpacked_so_far) return bielle; /* FIXME: WTF?! */
 
       backsize +=2;
 
       if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far], backsize) ||
 	  !CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], backsize)
 	  ) {

 	cli_dbgmsg("%p %x %p %x\n", dst, dsize, &dst[unpacked_so_far], backsize);

 	return 1;
       }
       
       do {
 	dst[unpacked_so_far] = dst[unpacked_so_far - backbytes];
 	unpacked_so_far++;
       } while (--backsize && unpacked_so_far<dsize);
       bielle = (uint8_t)dst[unpacked_so_far - 1];
 
       if (unpacked_so_far>=dsize) return 0;
 
     } /* got_mainbit ends */
 
   } /* while true ends */
 }
 
 
 
 uint32_t get_byte(struct UNSP *read_struct) {
 
   uint32_t ret;
 
   if (read_struct->src_curr >= read_struct->src_end) {
     read_struct->error = 1;
     return 0xff;
   }
   ret = *(read_struct->src_curr);
   read_struct->src_curr++;
   return ret&0xff;
 }
 
 
 int getbit_from_table(uint16_t *intable, struct UNSP *read_struct) {
   
   uint32_t nval;
   if (!CLI_ISCONTAINED((char *)read_struct->table, read_struct->tablesz, (char *)intable, sizeof(uint16_t))) {
     read_struct->error = 1;
     return 0xff;
   }
   nval = *intable * (read_struct->bitmap>>0xb);
 
   if (read_struct->oldval<nval) { /* unsigned */
     uint32_t sval;
     read_struct->bitmap = nval;
     nval = *intable;
     sval = 0x800 - nval;

     sval = CLI_SRS((int32_t)sval,5); /* signed */

     sval += nval;
     *intable=sval;
     if (read_struct->bitmap<0x1000000) { /* unsigned */
       read_struct->oldval = (read_struct->oldval<<8) | get_byte(read_struct);
       read_struct->bitmap<<=8;
     }
     return 0;
   }
 
   read_struct->bitmap -= nval;
   read_struct->oldval -= nval;
 
   nval = *intable;
   nval -= (nval>>5); /* word, unsigned */
   *intable=nval;
 
   if (read_struct->bitmap<0x1000000) { /* unsigned */
     read_struct->oldval = (read_struct->oldval<<8) | get_byte(read_struct);
     read_struct->bitmap<<=8;
   }
 
   return 1;
 }
 
 
 uint32_t get_100_bits_from_tablesize(uint16_t *intable, struct UNSP *read_struct, uint32_t ssize) {
   
   uint32_t count = 1;
   
   while (count<0x100) {
     uint32_t lpos, tpos;
     lpos = ssize&0xff;
     ssize=(ssize&0xffffff00)|((lpos<<1)&0xff);
     lpos>>=7;
     tpos = lpos+1;
     tpos<<=8;
     tpos+=count;
     tpos = getbit_from_table(&intable[tpos], read_struct);
     count=(count*2)|tpos;
     if (lpos!=tpos) {
       /* second loop */
       while (count<0x100)
 	count = (count*2)|getbit_from_table(&intable[count], read_struct);
     }
   } 
   return count&0xff;
 }
 
 
 uint32_t get_100_bits_from_table(uint16_t *intable, struct UNSP *read_struct) {
   uint32_t count = 1;
   
   while (count<0x100)
     count = (count*2)|getbit_from_table(&intable[count], read_struct);
   return count&0xff;
 }
 
 
 uint32_t get_n_bits_from_table(uint16_t *intable, uint32_t bits, struct UNSP *read_struct) {
   uint32_t count = 1;
   uint32_t bitcounter;
 
   /*  if (bits) { always set! */
   bitcounter = bits;
   while (bitcounter--)
     count = count*2 + getbit_from_table(&intable[count], read_struct);
   /*  } */
   
   return count-(1<<(bits&0xff));
 }
 
 
 uint32_t get_n_bits_from_tablesize(uint16_t *intable, struct UNSP *read_struct, uint32_t backsize) {
   
   if (!getbit_from_table(intable, read_struct))
     return get_n_bits_from_table(&intable[(backsize<<3)+2], 3, read_struct);
   
   if (!getbit_from_table(&intable[1], read_struct))
     return 8+get_n_bits_from_table(&intable[(backsize<<3)+0x82], 3, read_struct);
 
   return 0x10+get_n_bits_from_table(&intable[0x102], 8, read_struct);
 }
 
 
 uint32_t get_bb(uint16_t *intable, uint32_t back, struct UNSP *read_struct) {
   uint32_t pos = 1;
   uint32_t bb = 0;
   uint32_t i;
 
   if ((int32_t)back<=0) /* signed */
     return 0;
   
   for (i=0;i<back;i++) {
     uint32_t bit = getbit_from_table(&intable[pos], read_struct);
     pos=(pos*2) + bit;
     bb|=(bit<<i);
   }
   return bb;
 }
 
 
 uint32_t get_bitmap(struct UNSP *read_struct, uint32_t bits) {
   uint32_t retv = 0;
 
   if ((int32_t)bits<=0) return 0; /* signed */
 
   while (bits--) {
     read_struct->bitmap>>=1; /* unsigned */
     retv<<=1;
     if (read_struct->oldval>=read_struct->bitmap) { /* unsigned */
       read_struct->oldval-=read_struct->bitmap;
       retv|=1;
     }
     if (read_struct->bitmap<0x1000000) {
       read_struct->bitmap<<=8;
       read_struct->oldval = (read_struct->oldval<<8) | get_byte(read_struct);
     }
   }
   return retv;
 }