/*

  *  Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
  *  Copyright (C) 2007-2013 Sourcefire, Inc.

  *
  *  Authors: Alberto Wu

  *
  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.

  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  *  MA 02110-1301, USA.
  */
 
 /*
 ** unsp.c
 **
 ** 11/10/2k6 - Merge started.
 **
 */
 
 /*
 ** Plays around with NsPack compressed executables
 **
 ** This piece of code is dedicated to Damian Put
 ** who I made a successful and wealthy man.
 **
 ** Damian, you owe me a pint!
 */
 
 /*
 ** TODO:
 **
 ** - Investigate the "unused" code in NsPack
 ** - Fetch all the nspacked samples from the zoo and run extensive testing
 ** - Add bound checks
 ** - Test against the zoo again
 ** - Perform regression testing against the full zoo 
 ** - check nested
 ** - look at the 64bit version (one of these days)
 **
 */
 
 /* 
 
    FIXME: clean this rubbish
 
 
 init_and_check_dll_loadflags();
 
 nsp1:004359FE                 add     edi, [ebp-28Dh]
 nsp1:00435A04                 mov     ebx, edi
 nsp1:00435A06                 cmp     dword ptr [edi], 0
 nsp1:00435A09                 jnz     short loc_435A15
 nsp1:00435A0B                 add     edi, 4
 nsp1:00435A0E                 mov     ecx, 0
 nsp1:00435A13                 jmp     short loc_435A2B
 nsp1:00435A15 ; ---------------------------------------------------------------------------
 nsp1:00435A15
 nsp1:00435A15 loc_435A15:                             ; CODE XREF: start+349EEj
 nsp1:00435A15                 mov     ecx, 1
 nsp1:00435A1A                 add     edi, [ebx]
 nsp1:00435A1C                 add     ebx, 4
 nsp1:00435A1F
 nsp1:00435A1F loc_435A1F:                             ; CODE XREF: start+34A3Dj
 nsp1:00435A1F                 cmp     dword ptr [ebx], 0
 nsp1:00435A22                 jz      short loc_435A5A
 nsp1:00435A24                 add     [ebx], edx
 nsp1:00435A26                 mov     esi, [ebx]
 nsp1:00435A28                 add     edi, [ebx+4]
 nsp1:00435A2B
 nsp1:00435A2B loc_435A2B:                             ; CODE XREF: start+349F8j
 nsp1:00435A2B                 push    edi
 nsp1:00435A2C                 push    ecx
 nsp1:00435A2D                 push    edx
 nsp1:00435A2E                 push    ebx
 nsp1:00435A2F                 push    dword ptr [ebp-1D1h] ; VirtualFree
 nsp1:00435A35                 push    dword ptr [ebp-1D5h] ; alloc
 nsp1:00435A3B                 mov     edx, esi
 nsp1:00435A3D                 mov     ecx, edi
 nsp1:00435A3F                 mov     eax, offset get_byte
 nsp1:00435A44                 int     3               ; Trap to Debugger
 nsp1:00435A45                 add     eax, 5A9h
 nsp1:00435A4A                 call    eax ; real_unpack ; edx=401000
 nsp1:00435A4A                                         ; ecx=436282
 nsp1:00435A4C                 pop     ebx
 nsp1:00435A4D                 pop     edx
 nsp1:00435A4E                 pop     ecx
 nsp1:00435A4F                 pop     edi
 nsp1:00435A50                 cmp     ecx, 0
 nsp1:00435A53                 jz      short loc_435A5A
 nsp1:00435A55                 add     ebx, 8
 nsp1:00435A58                 jmp     short loc_435A1F
 nsp1:00435A5A ; ---------------------------------------------------------------------------
 nsp1:00435A5A
 nsp1:00435A5A loc_435A5A:                             ; CODE XREF: start+34A07j
 nsp1:00435A5A                                         ; start+34A38j
 nsp1:00435A5A                 push    8000h
 
 */
 
 #if HAVE_CONFIG_H
 #include "clamav-config.h"
 #endif
 
 #include <stdlib.h>
 
 #include "clamav.h"
 #include "others.h"
 #include "rebuildpe.h"

 #include "execs.h"

 #include "unsp.h"
 
 /* real_unpack(start_of_stuff, dest, malloc, free); */

 uint32_t unspack(const char *start_of_stuff, char *dest, cli_ctx *ctx, uint32_t rva, uint32_t base, uint32_t ep, int file)
 {
     uint8_t c = *start_of_stuff;
     uint32_t i, firstbyte, tre, allocsz, tablesz, dsize, ssize;
     uint16_t *table;
     char *dst       = dest;
     const char *src = start_of_stuff + 0xd;
     struct cli_exe_section section;
 
     if (c >= 0xe1) return 1;
 
     if (c >= 0x2d) {
         firstbyte = i = c / 0x2d;
         do {
             c += 0xd3;
         } while (--i);
     } else
         firstbyte = 0;
 
     if (c >= 9) {
         allocsz = i = c / 9;
         do {
             c += 0xf7;
         } while (--i);
     } else
         allocsz = 0;
 
     tre     = c;
     i       = allocsz;
     c       = (tre + i) & 0xff;
     tablesz = ((0x300 << c) + 0x736) * sizeof(uint16_t);
 
     if (cli_checklimits("nspack", ctx, tablesz, 0, 0) != CL_CLEAN)
         return 1; /* Should be ~15KB, if it's so big it's prolly just not nspacked */
 
     cli_dbgmsg("unsp: table size = %d\n", tablesz);
     if (!(table = cli_malloc(tablesz))) {
         cli_dbgmsg("unspack: Unable to allocate memory for table\n");
         return 1;
     }

     dsize = cli_readint32(start_of_stuff + 9);
     ssize = cli_readint32(start_of_stuff + 5);
     if (ssize <= 13) {
         free(table);
         return 1;
     }

     tre = very_real_unpack(table, tablesz, tre, allocsz, firstbyte, src, ssize, dst, dsize);
     free(table);
     if (tre) return 1;

     section.raw = 0;
     section.rsz = dsize;
     section.vsz = dsize;
     section.rva = rva;
     return !cli_rebuildpe(dest, &section, 1, base, ep, 0, 0, file);
 }

 uint32_t very_real_unpack(uint16_t *table, uint32_t tablesz, uint32_t tre, uint32_t allocsz, uint32_t firstbyte, const char *src, uint32_t ssize, char *dst, uint32_t dsize)
 {
     struct UNSP read_struct;
     uint32_t i = (0x300 << ((allocsz + tre) & 0xff)) + 0x736;
 
     uint32_t previous_bit         = 0;
     uint32_t unpacked_so_far      = 0;
     uint32_t backbytes            = 1;
     uint32_t oldbackbytes         = 1;
     uint32_t old_oldbackbytes     = 1;
     uint32_t old_old_oldbackbytes = 1;
 
     uint32_t damian = 0;
     uint32_t put    = (1 << (allocsz & 0xff)) - 1;
 
     uint32_t bielle = 0;
 
     firstbyte = (1 << (firstbyte & 0xff)) - 1;
 
     if (tablesz < i * sizeof(uint16_t)) return 2;
 
     /* init table */
     while (i) table[--i] = 0x400;
 
     /* table noinit */
 
     /* get_five - inlined */
     read_struct.error    = 0;
     read_struct.oldval   = 0;
     read_struct.src_curr = src;
     read_struct.bitmap   = 0xffffffff;
     read_struct.src_end  = src + ssize - 13;
     read_struct.table    = (char *)table;
     read_struct.tablesz  = tablesz;
 
     for (i = 0; i < 5; i++) read_struct.oldval = (read_struct.oldval << 8) | get_byte(&read_struct);
     if (read_struct.error) return 1;
     /* if (!dsize) return 0; - checked in pe.c */
 
     /* very_unpacking_loop */
 
     while (1) {
         uint32_t backsize = firstbyte & unpacked_so_far;
         uint32_t tpos;
         uint32_t temp = damian;
 
         if (read_struct.error) return 1; /* checked once per mainloop, keeps the code readable and it's still safe */
 
         if (!getbit_from_table(&table[(damian << 4) + backsize], &read_struct)) { /* no_mainbit */
 
             uint32_t shft = 8 - (tre & 0xff);
             shft &= 0xff;
             tpos = (bielle >> shft) + ((put & unpacked_so_far) << (tre & 0xff));
             tpos *= 3;
             tpos <<= 8;
 
             if ((int32_t)damian >= 4) {       /* signed */
                 if ((int32_t)damian >= 0xa) { /* signed */
                     damian -= 6;
                 } else {
                     damian -= 3;
                 }
             } else {
                 damian = 0;
             }
 
             /* 44847E */
             if (previous_bit) {
                 if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], 1)) return 1;
                 ssize        = (ssize & 0xffffff00) | (uint8_t)dst[unpacked_so_far - backbytes]; /* FIXME! ssize is not static */
                 bielle       = get_100_bits_from_tablesize(&table[tpos + 0x736], &read_struct, ssize);
                 previous_bit = 0;
             } else {
                 bielle = get_100_bits_from_table(&table[tpos + 0x736], &read_struct);
             }
 
             /* unpack_one_byte - duplicated */
             if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far], 1)) return 1;
             dst[unpacked_so_far] = bielle;
             unpacked_so_far++;
             if (unpacked_so_far >= dsize) return 0;
             continue;
 
         } else { /* got_mainbit */
 
             bielle = previous_bit = 1;
 
             if (getbit_from_table(&table[damian + 0xc0], &read_struct)) {
                 if (!getbit_from_table(&table[damian + 0xcc], &read_struct)) {
                     tpos = damian + 0xf;
                     tpos <<= 4;
                     tpos += backsize;
                     if (!getbit_from_table(&table[tpos], &read_struct)) {
                         if (!unpacked_so_far) return bielle; /* FIXME: WTF?! */
 
                         damian = 2 * ((int32_t)damian >= 7) + 9; /* signed */
                         if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], 1)) return 1;
                         bielle = (uint8_t)dst[unpacked_so_far - backbytes];
                         /* unpack_one_byte - real */
                         dst[unpacked_so_far] = bielle;
                         unpacked_so_far++;
                         if (unpacked_so_far >= dsize) return 0;
                         continue;
 
                     } else { /* gotbit_tre */
                         backsize = get_n_bits_from_tablesize(&table[0x534], &read_struct, backsize);
                         damian   = ((int32_t)damian >= 7); /* signed */
                         damian   = ((damian - 1) & 0xfffffffd) + 0xb;
                         /* jmp checkloop_and_backcopy (uses edx) */
                     }    /* gotbit_uno ends */
                 } else { /* gotbit_due */
                     if (!getbit_from_table(&table[damian + 0xd8], &read_struct)) {
                         tpos = oldbackbytes;
                     } else {
                         if (!getbit_from_table(&table[damian + 0xe4], &read_struct)) {
                             tpos = old_oldbackbytes;
                         } else {
                             /* set_old_old_oldback */
                             tpos                 = old_old_oldbackbytes;
                             old_old_oldbackbytes = old_oldbackbytes;
                         }
                         /* set_old_oldback */
                         old_oldbackbytes = oldbackbytes;
                     }
                     /* set_oldback */
                     oldbackbytes = backbytes;
                     backbytes    = tpos;
 
                     backsize = get_n_bits_from_tablesize(&table[0x534], &read_struct, backsize);
                     damian   = ((int32_t)damian >= 7); /* signed */
                     damian   = ((damian - 1) & 0xfffffffd) + 0xb;
                     /* jmp checkloop_and_backcopy (uses edx) */
                 }    /* gotbit_due ends */
             } else { /* gotbit_uno */
 
                 old_old_oldbackbytes = old_oldbackbytes;
                 old_oldbackbytes     = oldbackbytes;
                 oldbackbytes         = backbytes;
 
                 damian = ((int32_t)damian >= 7); /* signed */
                 damian = ((damian - 1) & 0xfffffffd) + 0xa;
 
                 backsize = get_n_bits_from_tablesize(&table[0x332], &read_struct, backsize);
 
                 tpos = ((int32_t)backsize >= 4) ? 3 : backsize; /* signed */
                 tpos <<= 6;
                 tpos = get_n_bits_from_table(&table[0x1b0 + tpos], 6, &read_struct);
 
                 if (tpos >= 4) { /* signed */
 
                     uint32_t s = tpos;
                     s >>= 1;
                     s--;
 
                     temp = (tpos & bielle) | 2;
                     temp <<= (s & 0xff);
 
                     if ((int32_t)tpos < 0xe) {
                         temp += get_bb(&table[(temp - tpos) + 0x2af], s, &read_struct);
                     } else {
                         s += 0xfffffffc;
                         tpos = get_bitmap(&read_struct, s);
                         tpos <<= 4;
                         temp += tpos;
                         temp += get_bb(&table[0x322], 4, &read_struct);
                     }
                 } else {
                     /* gotbit_uno_out1 */
                     backbytes = temp = tpos;
                 }
                 /* gotbit_uno_out2 */
                 backbytes = temp + 1;
                 /* jmp checkloop_and_backcopy (uses edx) */
             } /* gotbit_uno ends */
 
             /* checkloop_and_backcopy */
             if (!backbytes) return 0;                       /* very_real_unpack_end */
             if (backbytes > unpacked_so_far) return bielle; /* FIXME: WTF?! */
 
             backsize += 2;
 
             if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far], backsize) ||
                 !CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], backsize)) {
                 cli_dbgmsg("%p %x %p %x\n", dst, dsize, &dst[unpacked_so_far], backsize);
                 return 1;
             }
 
             do {
                 dst[unpacked_so_far] = dst[unpacked_so_far - backbytes];
                 unpacked_so_far++;
             } while (--backsize && unpacked_so_far < dsize);
             bielle = (uint8_t)dst[unpacked_so_far - 1];
 
             if (unpacked_so_far >= dsize) return 0;
 
         } /* got_mainbit ends */
 
     } /* while true ends */
 }

 uint32_t get_byte(struct UNSP *read_struct)
 {

     uint32_t ret;

     if (read_struct->src_curr >= read_struct->src_end) {
         read_struct->error = 1;
         return 0xff;
     }
     ret = *(read_struct->src_curr);
     read_struct->src_curr++;
     return ret & 0xff;

 }
 

 int getbit_from_table(uint16_t *intable, struct UNSP *read_struct)
 {

     uint32_t nval;
     if (!CLI_ISCONTAINED((char *)read_struct->table, read_struct->tablesz, (char *)intable, sizeof(uint16_t))) {
         read_struct->error = 1;
         return 0xff;
     }
     nval = *intable * (read_struct->bitmap >> 0xb);
 
     if (read_struct->oldval < nval) { /* unsigned */
         uint32_t sval;
         read_struct->bitmap = nval;
         nval                = *intable;
         sval                = 0x800 - nval;
         sval                = CLI_SRS((int32_t)sval, 5); /* signed */
         sval += nval;
         *intable = sval;
         if (read_struct->bitmap < 0x1000000) { /* unsigned */
             read_struct->oldval = (read_struct->oldval << 8) | get_byte(read_struct);
             read_struct->bitmap <<= 8;
         }
         return 0;

     }
 

     read_struct->bitmap -= nval;
     read_struct->oldval -= nval;

     nval = *intable;
     nval -= (nval >> 5); /* word, unsigned */
     *intable = nval;

     if (read_struct->bitmap < 0x1000000) { /* unsigned */
         read_struct->oldval = (read_struct->oldval << 8) | get_byte(read_struct);
         read_struct->bitmap <<= 8;
     }

     return 1;

 }
 

 uint32_t get_100_bits_from_tablesize(uint16_t *intable, struct UNSP *read_struct, uint32_t ssize)
 {
 
     uint32_t count = 1;
 
     while (count < 0x100) {
         uint32_t lpos, tpos;
         lpos  = ssize & 0xff;
         ssize = (ssize & 0xffffff00) | ((lpos << 1) & 0xff);
         lpos >>= 7;
         tpos = lpos + 1;
         tpos <<= 8;
         tpos += count;
         tpos  = getbit_from_table(&intable[tpos], read_struct);
         count = (count * 2) | tpos;
         if (lpos != tpos) {
             /* second loop */
             while (count < 0x100)
                 count = (count * 2) | getbit_from_table(&intable[count], read_struct);
         }

     }

     return count & 0xff;

 }
 

 uint32_t get_100_bits_from_table(uint16_t *intable, struct UNSP *read_struct)
 {
     uint32_t count = 1;

     while (count < 0x100)
         count = (count * 2) | getbit_from_table(&intable[count], read_struct);
     return count & 0xff;

 }
 

 uint32_t get_n_bits_from_table(uint16_t *intable, uint32_t bits, struct UNSP *read_struct)
 {
     uint32_t count = 1;
     uint32_t bitcounter;

     /*  if (bits) { always set! */
     bitcounter = bits;
     while (bitcounter--)
         count = count * 2 + getbit_from_table(&intable[count], read_struct);
     /*  } */

     return count - (1 << (bits & 0xff));

 }
 

 uint32_t get_n_bits_from_tablesize(uint16_t *intable, struct UNSP *read_struct, uint32_t backsize)
 {

     if (!getbit_from_table(intable, read_struct))
         return get_n_bits_from_table(&intable[(backsize << 3) + 2], 3, read_struct);

     if (!getbit_from_table(&intable[1], read_struct))
         return 8 + get_n_bits_from_table(&intable[(backsize << 3) + 0x82], 3, read_struct);

     return 0x10 + get_n_bits_from_table(&intable[0x102], 8, read_struct);

 }
 

 uint32_t get_bb(uint16_t *intable, uint32_t back, struct UNSP *read_struct)
 {
     uint32_t pos = 1;
     uint32_t bb  = 0;
     uint32_t i;

     if ((int32_t)back <= 0) /* signed */
         return 0;

     for (i = 0; i < back; i++) {
         uint32_t bit = getbit_from_table(&intable[pos], read_struct);
         pos          = (pos * 2) + bit;
         bb |= (bit << i);

     }

     return bb;
 }
 
 uint32_t get_bitmap(struct UNSP *read_struct, uint32_t bits)
 {
     uint32_t retv = 0;
 
     if ((int32_t)bits <= 0) return 0; /* signed */
 
     while (bits--) {
         read_struct->bitmap >>= 1; /* unsigned */
         retv <<= 1;
         if (read_struct->oldval >= read_struct->bitmap) { /* unsigned */
             read_struct->oldval -= read_struct->bitmap;
             retv |= 1;
         }
         if (read_struct->bitmap < 0x1000000) {
             read_struct->bitmap <<= 8;
             read_struct->oldval = (read_struct->oldval << 8) | get_byte(read_struct);
         }

     }

     return retv;

 }