/*

  *  Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
  *  Copyright (C) 2007-2013 Sourcefire, Inc.

  *
  *  Authors: Alberto Wu

  *
  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.

  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software

  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  *  MA 02110-1301, USA.

  */
 
 /*
 ** spin.c
 ** 
 ** 19/07/2k5 - Finally started coding something
 ** 21/07/2k5 - Works, started clearing the mess
 ** 31/07/2k5 - Porting to libclamav
 */
 
 /*
 ** Unpacks pespin v1.1
 **
 ** Funny thing to reverse
 **
 ** [ A big fat thank to christoph for not letting me give up ]
 */
 
 /*
 ** TODO ( a fat one ):
 **
 ** OEP restore and unhijacking
 ** code redir handling (at least near OEP)
 ** passwd protection (didn't really look at it)
 **
 ** All this stuff really needs a way better emu and a hell of unlaming
 ** ATM not worth the effort... and pespin v1.3 is out :@
 **
 */
 
 #if HAVE_CONFIG_H
 #include "clamav-config.h"
 #endif
 
 #include <stdlib.h>
 #include <string.h>
 

 #include "clamav.h"

 #include "pe.h"
 #include "rebuildpe.h"

 #include "execs.h"

 #include "others.h"

 #include "packlibs.h"

 #include "spin.h"

 static char exec86(uint8_t aelle, uint8_t cielle, char *curremu, int *retval)
 {
     int len = 0;
     *retval = 0;

     while (len < 0x24) {

         uint8_t opcode = curremu[len], support;

         len++;

         switch (opcode) {
             case 0xeb:
                 len++;
             case 0x0a:
                 len++;
             case 0x90:
             case 0xf8:
             case 0xf9:
                 break;
 
             case 0x02: /* add al, cl */
                 aelle += cielle;
                 len++;
                 break;
             case 0x2a: /* sub al, cl */
                 aelle -= cielle;
                 len++;
                 break;
             case 0x04: /* add al, ?? */
                 aelle += curremu[len];
                 len++;
                 break;
             case 0x2c: /* sub al, ?? */
                 aelle -= curremu[len];
                 len++;
                 break;
             case 0x32: /* xor al, cl */
                 aelle ^= cielle;
                 len++;
                 break;
             case 0x34: /* xor al, ?? */
                 aelle ^= curremu[len];
                 len++;
                 break;
 
             case 0xfe: /* inc/dec al */
                 if (curremu[len] == '\xc0')
                     aelle++;
                 else
                     aelle--;
                 len++;
                 break;
 
             case 0xc0: /* ror/rol al, ?? */
                 support = curremu[len];
                 len++;
                 if (support == 0xc0)
                     CLI_ROL(aelle, curremu[len]);
                 else
                     CLI_ROR(aelle, curremu[len]);
                 len++;
                 break;
 
             default:
                 cli_dbgmsg("spin: bogus opcode %x\n", opcode);
                 *retval = 1;
                 return aelle;

         }
     }

     if (len != 0x24 || curremu[len] != '\xaa') {

         cli_dbgmsg("spin: bad emucode\n");
         *retval = 1;

     }

     return aelle;

 }
 

 static uint32_t summit(char *src, int size)

 {

     uint32_t eax = 0xffffffff, ebx = 0xffffffff;
     int i;
 

     while (size) {

         eax ^= *src++ << 8 & 0xff00;
         eax = eax >> 3 & 0x1fffffff;

         for (i = 0; i < 4; i++) {

             uint32_t swap;
             eax ^= ebx >> 8 & 0xff;
             eax += 0x7801a108;
             eax ^= ebx;
             CLI_ROR(eax, ebx & 0xff);
             swap = eax;

             eax  = ebx;
             ebx  = swap;

         }
         size--;

     }

     return ebx;

 }
 

 int unspin(char *src, int ssize, struct cli_exe_section *sections, int sectcnt, uint32_t nep, int desc, cli_ctx *ctx)
 {
     char *curr, *emu, *ep, *spinned;
     char **sects;
     int blobsz = 0, j;
     uint32_t key32, bitmap, bitman;
     uint32_t len;
     uint8_t key8;
 
     cli_dbgmsg("in unspin\n");
 

     if ((spinned = (char *)cli_malloc(sections[sectcnt].rsz)) == NULL) {

         cli_dbgmsg("spin: Unable to allocate memory for spinned\n");
         return 1;
     }

     memcpy(spinned, src + sections[sectcnt].raw, sections[sectcnt].rsz);
     ep = spinned + nep - sections[sectcnt].rva;
 
     curr = ep + 0xdb;

     if (*curr != '\xbb') {

         free(spinned);
         cli_dbgmsg("spin: Not spinned or bad version\n");
         return 1;

     }

 
     key8 = (uint8_t) * ++curr;
     curr += 4;

     if (*curr != '\xb9') {

         free(spinned);
         cli_dbgmsg("spin: Not spinned or bad version\n");
         return 1;

     }

     if ((len = cli_readint32(curr + 1)) != 0x11fe) {

         free(spinned);
         cli_dbgmsg("spin: Not spinned or bad version\n");
         return 1;

     }

     cli_dbgmsg("spin: Key8 is %x, Len is %x\n", key8, len);

     if (!CLI_ISCONTAINED(spinned, sections[sectcnt].rsz, ep, len + 0x1fe5 - 1)) {

         free(spinned);
         cli_dbgmsg("spin: len out of bounds, giving up\n");
         return 1;
     }

     if (ep[0x1e0] != '\xb8')
         cli_dbgmsg("spin: prolly not spinned, expect failure\n");

     if ((cli_readint32(ep + 0x1e1) & 0x00200000))
         cli_dbgmsg("spin: password protected, expect failure\n");

     curr = ep + 0x1fe5 + len - 1;

     while (len--) {

         *curr = (*curr) ^ (key8--);
         curr--;
     }
 

     if (!CLI_ISCONTAINED(spinned, sections[sectcnt].rsz, ep + 0x3217, 4)) {

         free(spinned);
         cli_dbgmsg("spin: key out of bounds, giving up\n");
         return 1;
     }
 

     curr  = ep + 0x26eb;

     key32 = cli_readint32(curr);

     if ((len = cli_readint32(curr + 5)) != 0x5a0) {

         free(spinned);
         cli_dbgmsg("spin: Not spinned or bad version\n");
         return 1;
     }
 
     curr = ep + 0x2d5;
     cli_dbgmsg("spin: Key is %x, Len is %x\n", key32, len);
 

     while (len--) {
         if (key32 & 1) {

             key32 = key32 >> 1;
             key32 ^= 0x8c328834;

         } else {

             key32 = key32 >> 1;
         }
         *curr = *curr ^ (key32 & 0xff);
         curr++;
     }
 
     len = ssize - cli_readint32(ep + 0x429); /* sub size, value */

     if (len >= (uint32_t)ssize) {

         free(spinned);
         cli_dbgmsg("spin: crc out of bounds, giving up\n");
         return 1;
     }
     key32 = cli_readint32(ep + 0x3217) - summit(src, len);

     memcpy(src + sections[sectcnt].raw, spinned, sections[sectcnt].rsz);
     free(spinned);                                                  /* done CRC'ing - can have a dirty buffer now */
     ep = src + nep + sections[sectcnt].raw - sections[sectcnt].rva; /* Fix the helper */
 

     if (!CLI_ISCONTAINED(src, ssize, ep + 0x3207, 4)) { /* this one holds all ep based checks */

         cli_dbgmsg("spin: key out of bounds, giving up\n");
         return 1;
     }
     bitmap = cli_readint32(ep + 0x3207);
     cli_dbgmsg("spin: Key32 is %x - XORbitmap is %x\n", key32, bitmap);
 
     cli_dbgmsg("spin: Decrypting sects (xor)\n");

     for (j = 0; j < sectcnt; j++) {

         if (bitmap & 1) {
             uint32_t size   = sections[j].rsz;
             char *ptr       = src + sections[j].raw;

             uint32_t keydup = key32;
 

             if (!CLI_ISCONTAINED(src, ssize, ptr, size)) {

                 cli_dbgmsg("spin: sect %d out of file, giving up\n", j);
                 return 1; /* FIXME: Already checked in pe.c? */
             }
 

             while (size--) {
                 if (!(keydup & 1)) {

                     keydup = keydup >> 1;
                     keydup ^= 0xed43af31;

                 } else {

                     keydup = keydup >> 1;
                 }
                 *ptr = *ptr ^ (keydup & 0xff);
                 ptr++;
             }
         }
         bitmap = bitmap >> 1;
     }
 
     cli_dbgmsg("spin: done\n");
 
     curr = ep + 0x644;

     if ((len = cli_readint32(curr)) != 0x180) {

         cli_dbgmsg("spin: Not spinned or bad version\n");
         return 1;
     }
 
     key32 = cli_readint32(curr + 0x0c);
     cli_dbgmsg("spin: Key is %x, Len is %x\n", key32, len);
     curr = ep + 0x28d3;
 

     if (!CLI_ISCONTAINED(src, ssize, curr, len)) { /* always true but i may decide to remove the previous check */

         cli_dbgmsg("spin: key out of bounds, giving up\n");
         return 1;
     }

     while (len--) {
         if (key32 & 1) {

             key32 = key32 >> 1;
             key32 ^= 0xed43af32;

         } else {

             key32 = key32 >> 1;
         }
         *curr = *curr ^ (key32 & 0xff);
         curr++;
     }
 
     curr = ep + 0x28dd;

     if ((len = cli_readint32(curr)) != 0x1a1) {

         cli_dbgmsg("spin: Not spinned or bad version\n");
         return 1;
     }
 
     cli_dbgmsg("spin: POLY1 len is %x\n", len);
     curr += 0xf; /* POLY1 */
     emu = ep + 0x6d4;

     if (!CLI_ISCONTAINED(src, ssize, emu, len)) {

         cli_dbgmsg("spin: poly1 out of bounds\n");
         return 1;
     }

     while (len) {

         int xcfailure = 0;

         *emu          = exec86(*emu, len-- & 0xff, curr, &xcfailure); /* unlame POLY1 */
         if (xcfailure) {

             cli_dbgmsg("spin: cannot exec poly1\n");
             return 1;
         }

         emu++;
     }

 
     bitmap = cli_readint32(ep + 0x6f1);
     cli_dbgmsg("spin: POLYbitmap is %x - decrypting sects (poly)\n", bitmap);
     curr = ep + 0x755;
 

     for (j = 0; j < sectcnt; j++) {
         if (bitmap & 1) {

             uint32_t notthesamelen = sections[j].rsz;
 
             emu = src + sections[j].raw;
 

             if (!CLI_ISCONTAINED(src, ssize, curr, 0x24)) { /* section bounds already checked twice now */

                 cli_dbgmsg("spin: poly1 emucode is out of file?\n");
                 return 1;
             }
 

             while (notthesamelen) {

                 int xcfailure = 0;

                 *emu          = exec86(*emu, notthesamelen-- & 0xff, curr, &xcfailure);
                 if (xcfailure) {

                     cli_dbgmsg("spin: cannot exec section\n");
                     return 1;
                 }
                 emu++;
             }
         }
         bitmap = bitmap >> 1;

     }

 
     cli_dbgmsg("spin: done\n");
 
     bitmap = cli_readint32(ep + 0x3061);
     bitman = bitmap;
 
     /* FIXMELIMITS: possibly rewrite to use the limits api */

     if (ctx->engine->maxfilesize) {

         unsigned long int filesize = 0;
 

         for (j = 0; j < sectcnt; j++) {
             if (bitmap & 1) {

                 if (filesize > ctx->engine->maxfilesize || sections[j].vsz > ctx->engine->maxfilesize - filesize)
                     return 2;
                 filesize += sections[j].vsz;
             }
             bitmap >>= 1;
         }
 
         bitmap = bitman;

     }

 
     cli_dbgmsg("spin: Compression bitmap is %x\n", bitmap);

     if ((sects = (char **)cli_malloc(sectcnt * sizeof(char *))) == NULL) {

         cli_dbgmsg("spin: malloc(%zu) failed\n", (size_t)sectcnt * sizeof(char *));

         return 1;

     }

     len = 0;

     for (j = 0; j < sectcnt; j++) {
         if (bitmap & 1) {
             if ((sects[j] = (char *)cli_malloc(sections[j].vsz)) == NULL) {

                 cli_dbgmsg("spin: malloc(%u) failed\n", sections[j].vsz);

                 len = 1;
                 break;
             }
             blobsz += sections[j].vsz;
             memset(sects[j], 0, sections[j].vsz);
             cli_dbgmsg("spin: Growing sect%d: was %x will be %x\n", j, sections[j].rsz, sections[j].vsz);

             if (cli_unfsg(src + sections[j].raw, sects[j], sections[j].rsz, sections[j].vsz, NULL, NULL) == -1) {

                 len++;
                 cli_dbgmsg("spin: Unpack failure\n");
             }

         } else {

             blobsz += sections[j].rsz;
             sects[j] = src + sections[j].raw;
             cli_dbgmsg("spin: Not growing sect%d\n", j);
         }
         bitmap >>= 1;
     }

     cli_dbgmsg("spin: decompression complete\n");
 

     if (len) {

         int t;

         for (t = 0; t < j; t++) {

             if (bitman & 1)
                 free(sects[t]);
             bitman = bitman >> 1 & 0x7fffffff;
         }
         free(sects);
         return 1;
     }

     key32 = cli_readint32(ep + 0x2fee);

     if (key32) {

         /*    len = cli_readint32(ep+0x2fc8); -- Using vsizes instead */
 

         for (j = 0; j < sectcnt; j++) {

             if (sections[j].rva <= key32 && key32 - sections[j].rva < sections[j].vsz && CLI_ISCONTAINED(src + sections[j].raw, sections[j].rsz, src + sections[j].raw, key32 - sections[j].rva))
                 break;
         }
 

         if (j != sectcnt && ((bitman & (1 << j)) == 0)) { /* FIXME: not really sure either the res sect is lamed or just compressed, but this'll save some major headaches */

             cli_dbgmsg("spin: Resources (sect%d) appear to be compressed\n\tuncompressed offset %x, len %x\n\tcompressed offset %x, len %x\n", j, sections[j].rva, key32 - sections[j].rva, key32, sections[j].vsz - (key32 - sections[j].rva));
 

             if ((curr = (char *)cli_malloc(sections[j].vsz)) != NULL) {

                 memcpy(curr, src + sections[j].raw, key32 - sections[j].rva);                           /* Uncompressed part */
                 memset(curr + key32 - sections[j].rva, 0, sections[j].vsz - (key32 - sections[j].rva)); /* bzero */

                 if (cli_unfsg(src + sections[j].raw + key32 - sections[j].rva, curr + key32 - sections[j].rva, sections[j].rsz - (key32 - sections[j].rva), sections[j].vsz - (key32 - sections[j].rva), NULL, NULL)) {

 
                     free(curr);
                     cli_dbgmsg("spin: Failed to grow resources, continuing anyway\n");
                     blobsz += sections[j].rsz;

                 } else {

                     sects[j] = curr;
                     bitman |= 1 << j;
                     cli_dbgmsg("spin: Resources grown\n");
                     blobsz += sections[j].vsz;
                 }

             } else {

                 /* malloc failed but i'm too deep into this crap to quit without leaking more :( */
                 cli_dbgmsg("spin: memory allocation failed, continuing anyway\n");
                 blobsz += sections[j].rsz;
             }

         } else {

             cli_dbgmsg("spin: No res?!\n");
         }

     }
 

     bitmap = bitman; /* save as a free() bitmap */
 

     if ((ep = (char *)cli_malloc(blobsz)) != NULL) {

         struct cli_exe_section *rebhlp;

         if ((rebhlp = (struct cli_exe_section *)cli_malloc(sizeof(struct cli_exe_section) * (sectcnt))) != NULL) {
             char *to   = ep;

             int retval = 0;
 

             for (j = 0; j < sectcnt; j++) {

                 rebhlp[j].raw = (j > 0) ? (rebhlp[j - 1].raw + rebhlp[j - 1].rsz) : 0;
                 rebhlp[j].rsz = (bitmap & 1) ? sections[j].vsz : sections[j].rsz;
                 rebhlp[j].rva = sections[j].rva;
                 rebhlp[j].vsz = sections[j].vsz;
 
                 memcpy(to, sects[j], rebhlp[j].rsz);
                 to += rebhlp[j].rsz;
                 if (bitmap & 1)
                     free(sects[j]);
                 bitmap = bitmap >> 1;
             }
 

             if (!cli_rebuildpe(ep, rebhlp, sectcnt, 0x400000, 0x1000, 0, 0, desc)) { /* can't be bothered fixing those values: the rebuilt exe is completely broken anyway. */

                 cli_dbgmsg("spin: Cannot write unpacked file\n");
                 retval = 1;
             }
             free(rebhlp);
             free(ep);
             free(sects);
             return retval;
         }
         free(ep);

     }

 
     cli_dbgmsg("spin: free bitmap is %x\n", bitman);

     for (j = 0; j < sectcnt; j++) {

         if (bitmap & 1)
             free(sects[j]);
         bitman = bitman >> 1 & 0x7fffffff;

     }

     free(sects);
     return 1; /* :( */

 }