/*
* Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2007-2013 Sourcefire, Inc.
*
* Authors: Michal 'GiM' Spadlinski
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
/*
* lzma.c
*
* o2:28:18 CEST 2oo6-25-o6 - initial 0xA4/0x536
* oo:29:4o CEST 2oo6-26-o6 - 0x1cd/0x536 [+0x129]
* o2:13:19 CEST 2oo6-o1-o7, 2oo6-3o-o6 - 0x536/0x536
*
*/
#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif
#include <stdio.h>
#ifdef HAVE_STDLIB_H
#include <stdlib.h>
#endif
#ifdef HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
#ifdef HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#ifdef HAVE_STRING_H
#include <string.h>
#endif
#include "clamav.h"
#include "pe.h"
#include "others.h"
#include "mew.h"
#include "packlibs.h"
#include "rebuildpe.h"
#define EC32(x) le32_to_host(x) /* Convert little endian to host */
#define CE32(x) be32_to_host(x) /* Convert big endian to host */
#define PEALIGN(o,a) (((a))?(((o)/(a))*(a)):(o))
#define PESALIGN(o,a) (((a))?(((o)/(a)+((o)%(a)!=0))*(a)):(o))
/* modifies all parameters */
/* northfox does this shitty way,
* this should be done with just a bswap
*/
static const char *lzma_bswap_4861dc(struct lzmastate *p, const char *old_edx)
{
/* dumb_dump_start
*
old_edx was 'uint32_t *' before and in mew_lzma there was
&new_edx where new_edx = var1C
uint32_t loc_esi, loc_edi;
uint8_t *loc_eax;
p->p2 = loc_esi = 0;
p->p0 = loc_eax = (uint8_t *)*old_edx;
*old_edx = 5;
do {
loc_esi = p->p2 << 8;
loc_edi = *(uint8_t *)((loc_eax)++);
loc_esi |= loc_edi;
(*old_edx)--;
p->p2 = loc_esi;
} while (*old_edx);
p->p0 = loc_eax;
p->p1 = 0xffffffff;
* dumb_dump_end
*/
/* XXX, mine replacement */
p->p2 = EC32(CE32(((uint32_t)cli_readint32(old_edx + 1))));
p->p1 = 0xffffffff;
p->p0 = old_edx + 5;
return p->p0;
}
static uint32_t lzma_486248 (struct lzmastate *p,const char **old_ecx, char *src, uint32_t size)
{
uint32_t loc_esi, loc_edi, loc_eax, loc_ecx, ret;
if (!CLI_ISCONTAINED(src, size, *old_ecx, 4) || !CLI_ISCONTAINED(src, size, p->p0, 1))
return 0xffffffff;
loc_esi = p->p1;
loc_eax = loc_esi >> 0xb;
loc_ecx = cli_readint32(*old_ecx);
ret = loc_ecx&0xffff;
(loc_eax) *= ret;
loc_edi = p->p2;
if (loc_edi < loc_eax)
{
/* 48625f */
p->p1 = loc_eax;
loc_esi = ret;
loc_edi = ((int32_t)(0x800 - ret) >> 5) + ((loc_eax&0xffff0000) | ret);
/* signed<-sar, &|<-mov ax, [ecx] */
loc_ecx = (loc_ecx&0xffff0000)|(loc_edi&0xffff);
cli_writeint32(*old_ecx, loc_ecx);
ret = 0;
} else {
/* 48629e */
loc_esi -= loc_eax;
loc_edi -= loc_eax;
p->p1 = loc_esi;
p->p2 = loc_edi;
loc_eax = (loc_eax & 0xffff0000) | ret;
loc_esi = (loc_esi & 0xffff0000) | (ret >> 5);
loc_eax -= loc_esi;
loc_ecx = (loc_ecx&0xffff0000)|(loc_eax&0xffff);
cli_writeint32(*old_ecx, loc_ecx);
ret = 1;
}
loc_eax = p->p1;
if (loc_eax < 0x1000000)
{
*old_ecx = p->p0;
loc_edi = (*(uint8_t *)(p->p0));
loc_esi = ((p->p2) << 8) | loc_edi;
(*old_ecx)++;
loc_eax <<= 8;
p->p2 = loc_esi;
p->p1 = loc_eax;
p->p0 = *old_ecx;
}
return ret;
}
static uint32_t lzma_48635C(uint8_t znaczek, const char **old_ecx, struct lzmastate *p, uint32_t *retval, char *src, uint32_t size)
{
uint32_t loc_esi = (znaczek&0xff) >> 7, /* msb */
loc_ebx, ret;
const char *loc_edi;
znaczek <<= 1;
ret = loc_esi << 9;
loc_edi = *old_ecx;
*old_ecx = loc_edi + ret + 0x202;
if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
return 0xffffffff;
loc_ebx = ret | 2;
while (loc_esi == ret)
{
if (loc_ebx >= 0x100)
{
ret = (ret&0xffffff00) | (loc_ebx&0xff);
*retval = ret;
return 0;
}
loc_esi = (znaczek&0xff) >> 7;
znaczek <<= 1;
ret = ((loc_esi + 1) << 8) + loc_ebx;
*old_ecx = loc_edi + ret*2;
if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
return 0xffffffff;
loc_ebx += loc_ebx;
loc_ebx |= ret;
}
loc_esi = 0x100;
while (loc_ebx < loc_esi)
{
loc_ebx += loc_ebx;
*old_ecx = loc_edi + loc_ebx;
if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
return 0xffffffff;
loc_ebx |= ret;
}
ret = (ret&0xffffff00) | (loc_ebx&0xff);
*retval = ret;
return 0;
}
static uint32_t lzma_4862e0 (struct lzmastate *p, const char **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
uint32_t loc_ebx, loc_esi, stack_ecx, ret;
const char *loc_edi;
loc_ebx = *old_edx;
ret = 1;
loc_edi = *old_ecx;
if (loc_ebx && !(loc_ebx&0x80000000))
{
/* loc_4862f1 */
stack_ecx = loc_ebx;
do {
loc_esi = ret+ret;
*old_ecx = loc_edi + loc_esi;
if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
return 0xffffffff;
ret += loc_esi;
stack_ecx--;
} while (stack_ecx);
}
/* loc_48630b */
/* unneeded
*old_ecx = (uint8_t *)loc_ebx;
*/
*old_edx = 1 << (loc_ebx&0xff);
ret -= *old_edx;
*retval = ret;
return 0;
}
/* old_edx - write only */
static uint32_t lzma_4863da (uint32_t var0, struct lzmastate *p, const char **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
uint32_t ret;
const char *loc_esi = *old_ecx;
if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
return -1;
if (ret)
{
/* loc_4863ff */
*old_ecx = loc_esi+2;
if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
return -1;
if (ret)
{
/* loc_486429 */
*old_edx = 8;
*old_ecx = loc_esi + 0x204;
if (lzma_4862e0 (p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
return -1;
ret += 0x10;
} else {
/* loc_48640e */
ret = var0 << 4;
*old_edx = 3;
*old_ecx = loc_esi + 0x104 + ret;
if (lzma_4862e0 (p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
return -1;
ret += 0x8;
}
} else {
/* loc_4863e9 */
ret = var0 << 4;
*old_edx = 3;
*old_ecx = loc_esi + 0x4 + ret;
if (lzma_4862e0 (p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
return -1;
}
*retval = ret;
return 0;
}
static uint32_t lzma_486204 (struct lzmastate *p, uint32_t old_edx, uint32_t *retval, char *src, uint32_t size)
{
uint32_t loc_esi, loc_edi, loc_ebx, loc_eax;
const char *loc_edx;
loc_esi = p->p1;
loc_edi = p->p2;
loc_eax = 0;
if (old_edx && !(old_edx&0x80000000))
{
/* loc_4866212 */
loc_ebx = old_edx;
do {
loc_esi >>= 1;
loc_eax <<= 1;
if (loc_edi >= loc_esi)
{
loc_edi -= loc_esi;
loc_eax |= 1;
}
/* loc_486222 */
if (loc_esi < 0x1000000)
{
if (!CLI_ISCONTAINED(src, size, p->p0, 1))
return 0xffffffff;
loc_edx = p->p0;
loc_edi <<= 8;
loc_esi <<= 8;
loc_edi |= (*loc_edx)&0xff; /* movzx ebp, byte ptr [edx] */
p->p0 = ++loc_edx;
}
loc_ebx--;
} while (loc_ebx);
}
p->p2 = loc_edi;
p->p1 = loc_esi;
*retval = loc_eax;
return 0;
}
static uint32_t lzma_48631a (struct lzmastate *p, const char **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
uint32_t copy1, copy2;
uint32_t loc_esi, loc_edi, ret;
const char *loc_ebx;
copy1 = *old_edx;
loc_edi = 0;
loc_ebx = *old_ecx;
*old_edx = 1;
copy2 = (uint32_t)loc_edi;
if (copy1 <= (uint32_t)loc_edi)
{
*retval = copy2;
return 0;
}
do {
loc_esi = *old_edx + *old_edx;
*old_ecx = loc_esi + loc_ebx;
if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
return 0xffffffff;
/* unneeded *old_ecx = loc_edi; */
*old_edx = loc_esi + ret;
/* ret <<= (uint32_t)(*old_ecx)&0xff; */
ret <<= (loc_edi&0xff);
copy2 |= ret;
loc_edi++;
} while (loc_edi < copy1);
*retval = copy2;
return 0;
}
int mew_lzma(char *orgsource, const char *buf, uint32_t size_sum, uint32_t vma, uint32_t special)
{
uint32_t var08, var0C, var10, var14, var20, var24, var28, var34;
struct lzmastate var40;
uint32_t new_eax, new_edx, temp;
int i, mainloop;
char var1, var30;
const char *source = buf;
char *dest, *new_ebx;
const char *new_ecx, *var0C_ecxcopy;
const char *var2C;
char *pushed_esi = NULL;
const char *pushed_ebx = NULL;
uint32_t pushed_edx=0;
uint32_t loc_esi, loc_edi;
uint8_t *var18;
if (special)
{
pushed_edx = cli_readint32(source);
source += 4;
}
temp = cli_readint32(source) - vma;
source += 4;
if (!special) pushed_ebx = source;
new_ebx = orgsource + temp;
do {
mainloop = 1;
do {
/* loc_486450 */
if (!special)
{
source = pushed_ebx;
if (!CLI_ISCONTAINED(orgsource, size_sum, source, 16))
return -1;
if (cli_readint32(source) == 0)
{
return 0;
}
} else {
if (!CLI_ISCONTAINED(orgsource, size_sum, source, 12))
return -1;
}
var28 = cli_readint32 (source);
source += 4;
temp = cli_readint32 (source) - vma;
var18 = (uint8_t *)(orgsource + temp);
if (special) pushed_esi = orgsource + temp;
source += 4;
temp = cli_readint32 (source);
source += 5; /* yes, five */
var2C = source;
source += temp;
if (special) pushed_ebx = source;
else pushed_ebx = source;
var1 = 0;
dest = new_ebx;
if(!CLI_ISCONTAINED(orgsource, size_sum, dest, 0x6E6C))
return -1;
for (i=0; i<0x1b9b; i++)
{
cli_writeint32(dest, 0x4000400);
dest += 4;
}
loc_esi = 0;
var08 = var20 = 0;
loc_edi = 1;
var14 = var10 = var24 = 1;
if(!CLI_ISCONTAINED(orgsource, size_sum, var2C, 5))
return -1;
lzma_bswap_4861dc(&var40, var2C);
new_edx = 0;
} while (var28 <= loc_esi); /* source = 0 */
cli_dbgmsg("MEWlzma: entering do while loop\n");
do {
/* loc_4864a5 */
new_eax = var08 & 3;
new_ecx = (((loc_esi << 4) + new_eax)*2) + new_ebx;
var0C = new_eax;
if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
return -1;
if (new_eax)
{
/* loc_486549 */
new_ecx = new_ebx + loc_esi*2 + 0x180;
var20 = 1;
/* eax=1 */
if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
return -1;
if (new_eax != 1)
{
/* loc_486627 */
var24 = var10;
var10 = var14;
/* xor eax,eax; cmp esi, 7; setnl al; dec eax; add eax, 0Ah */
/* new_eax = (((loc_esi >= 7)-1)&0xFFFFFFFD) + 0xA; */
new_eax = loc_esi>=7 ? 10:7;
new_ecx = new_ebx + 0x664;
var14 = loc_edi;
loc_esi = new_eax;
if (lzma_4863da (var0C, &var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
return -1;
var0C = new_eax;
if (var0C >= 4)
new_eax = 3;
/* loc_486662 */
new_edx = 6;
new_eax <<= 7;
new_ecx = new_eax + new_ebx + 0x360;
if (lzma_4862e0 (&var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
return -1;
if (new_eax < 4)
{
/* loc_4866ca */
loc_edi = new_eax;
} else {
/* loc_48667d */
uint32_t loc_ecx;
loc_ecx = ((int32_t)new_eax >> 1)-1; /* sar */
loc_edi = ((new_eax&1)|2) << (loc_ecx&0xff);
if (new_eax >= 0xe)
{
/* loc_4866ab */
new_edx = loc_ecx - 4;
if (lzma_486204 (&var40, new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
return -1;
loc_edi += new_eax << 4;
new_edx = 4;
new_ecx = new_ebx + 0x644;
} else {
/* loc_486691 */
new_edx = loc_ecx;
loc_ecx = loc_edi - new_eax;
new_ecx = new_ebx + loc_ecx*2 + 0x55e;
}
/* loc_4866a2 */
if (lzma_48631a (&var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
return -1;
loc_edi += new_eax;
}
loc_edi++;
} else {
/* loc_486568 */
new_ecx = new_ebx + loc_esi*2 + 0x198;
if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
return -1;
if (new_eax)
{
/* loc_4865bd */
new_ecx = new_ebx + loc_esi*2 + 0x1B0;
if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
return -1;
if (new_eax)
{
/* loc_4865d2 */
new_ecx = new_ebx + loc_esi*2 + 0x1C8;
if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
return -1;
if (new_eax) {
/* loc_4865ea */
new_eax = var24;
var24 = var10;
} else {
/* loc_4865e5 */
new_eax = var10;
}
/* loc_4865f3 */
var10 = var14;
} else {
/* loc_4865cd */
new_eax = var14;
}
/* loc_4865f9 */
var14 = loc_edi;
loc_edi = new_eax;
} else {
/* loc_48657e */
new_eax = ((loc_esi + 0xf) << 4) + var0C;
new_ecx = new_ebx + new_eax*2;
if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
return -1;
if (!new_eax) {
uint32_t loc_ecx;
/* loc_486593 */
loc_ecx = var08;
loc_ecx -= loc_edi;
/* loc_esi = ((((loc_esi >= 7)-1)&0xFFFFFFFE) + 0xB); */
loc_esi = loc_esi>=7 ? 11:9;
if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + loc_ecx, 1))
return -1;
var1 = *(var18 + loc_ecx);
loc_ecx = (loc_ecx&0xffffff00) | var1;
/* loc_4865af */
new_edx = var08++;
if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_edx, 1))
return -1;
*(var18 + new_edx) = loc_ecx & 0xff;
/* loc_4866fe */
new_eax = var08;
continue; /* !!! */
}
}
/* loc_4865fe */
new_ecx = new_ebx + 0xa68;
if (lzma_4863da (var0C, &var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
return -1;
var0C = new_eax;
/* new_eax = (((loc_esi >= 7)-1)&0xFFFFFFFD) + 0xB; */
new_eax = loc_esi>=7 ? 11:8;
loc_esi = new_eax;
}
/* loc_4866cd */
if (!loc_edi)
{
break;
} else {
var0C += 2;
new_ecx = (char *)var18;
new_edx = new_eax = var08;
new_eax -= loc_edi;
if ( ((var0C < var28 - new_edx) &&
(!CLI_ISCONTAINED(orgsource, size_sum, (char*)(new_ecx + new_eax), var0C) ||
!CLI_ISCONTAINED(orgsource, size_sum, (char*)(new_ecx + new_edx), var0C))) ||
(!CLI_ISCONTAINED(orgsource, size_sum, (char*)(new_ecx + new_eax), var28 - new_edx) ||
!CLI_ISCONTAINED(orgsource, size_sum, (char*)(new_ecx + new_edx), var28 - new_edx)) )
return -1;
do {
var1 = *(uint8_t *)(new_ecx + new_eax);
*(uint8_t *)(new_ecx + new_edx) = var1;
new_edx++;
new_eax++;
var0C--;
if (var0C <= 0)
break;
} while (new_edx < var28);
var08 = new_edx;
}
} else {
/* loc_4864C8 */
new_eax = (((var1 & 0xff) >> 4)*3) << 9;
new_ecx = new_eax + new_ebx + 0xe6c;
var0C_ecxcopy = new_ecx;
if (loc_esi >= 4)
{
/* loc_4864e8 */
if (loc_esi >= 10)
loc_esi -= 6;
else
loc_esi -= 3;
} else {
/* loc_4864e4 */
loc_esi = 0;
}
if (var20 == 0) {
/* loc_48651D */
new_eax = 1;
do {
/* loc_486525 */
/*new_ecx = var0C_ecxcopy;*/
new_eax += new_eax;
new_ecx += new_eax;
var34 = new_eax;
if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
return -1;
new_eax |= var34;
/* loc_486522 */
/* keeping it here instead of at the top
* seems to work faster
*/
if (new_eax < 0x100)
{
new_ecx = var0C_ecxcopy;
}
} while (new_eax < 0x100);
/* loc_48653e */
var1 = (uint8_t)(new_eax & 0xff);
} else {
int t;
/* loc_4864FB */
new_eax = var08 - loc_edi;
if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_eax, 1))
return -1;
t = *(var18+new_eax);
new_eax = (new_eax&0xffffff00) | t;
var30 = t;
if (lzma_48635C (t, &new_ecx, &var40, &new_eax, orgsource, size_sum) == 0xffffffff)
return -1;
var20 = 0;
var1 = new_eax&0xff;
}
/* loc_486541 */
/* unneeded: new_ecx = (new_ecx&0xffffff00) | var1; */
/* loc_4865af */
new_edx = var08++;
if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_edx, 1))
return -1;
*(var18 + new_edx) = var1;
}
/* loc_4866fe */
new_eax = var08;
} while (new_eax < var28);
while(special) {
uint32_t loc_ecx;
/* let's fix calls */
cli_dbgmsg("MEWlen: %08x ? %08x\n", new_edx, pushed_edx);
if (pushed_edx < 5 || !CLI_ISCONTAINED(orgsource, size_sum, pushed_esi, pushed_edx))
return 0; /* No point in full failing just because we can't fixxup the calls */
for(loc_ecx = 0; loc_ecx < pushed_edx - 5; loc_ecx++) {
/* 0xe8, 0xe9 call opcodes */
if (pushed_esi[loc_ecx] == '\xe8' || pushed_esi[loc_ecx] == '\xe9')
{
char *adr = (char *)(pushed_esi + loc_ecx + 1);
cli_writeint32(adr, EC32(CE32((uint32_t)cli_readint32(adr)))-loc_ecx-1);
loc_ecx += 4;
}
}
return 0; /*pushed_edx;*/
}
} while (mainloop);
return 0xbadc0de;
}
/* UPack lzma */
/* compare with 486248 */
uint32_t lzma_upack_esi_00(struct lzmastate *p, char *old_ecx, char *bb, uint32_t bl)
{
uint32_t loc_eax, ret, loc_edi;
loc_eax = p->p1 >> 0xb;
if (!CLI_ISCONTAINED(bb, bl, old_ecx, 4) || !CLI_ISCONTAINED(bb, bl, p->p0, 4))
{
if (!CLI_ISCONTAINED(bb, bl, old_ecx, 4))
cli_dbgmsg("contain error! %p %08x ecx: %p [%p]\n", bb, bl, old_ecx,bb+bl);
else
cli_dbgmsg("contain error! %p %08x p0: %p [%p]\n", bb, bl, p->p0,bb+bl);
return 0xffffffff;
}
ret = cli_readint32(old_ecx);
loc_eax *= ret;
loc_edi = cli_readint32((char *)p->p0);
loc_edi = EC32(CE32(loc_edi)); /* bswap */
loc_edi -= p->p2;
if (loc_edi < loc_eax)
{
p->p1 = loc_eax;
loc_eax = (0x800 - ret) >> 5;
cli_writeint32(old_ecx, cli_readint32(old_ecx) + loc_eax);
ret = 0;
} else {
p->p2 += loc_eax;
p->p1 -= loc_eax;
loc_eax = ret >> 5;
cli_writeint32(old_ecx, cli_readint32(old_ecx) - loc_eax);
ret = 1;
}
if(((p->p1)&0xff000000) == 0)
{
p->p2 <<= 8;
p->p1 <<= 8;
p->p0++;
}
return ret;
}
/* compare with lzma_4862e0 */
/* lzma_upack_esi_4c 0x1 as eax!
*/
uint32_t lzma_upack_esi_50(struct lzmastate *p, uint32_t old_eax, uint32_t old_ecx, char **old_edx, char *old_ebp, uint32_t *retval, char *bs, uint32_t bl)
{
uint32_t loc_eax = old_eax, ret;
do {
*old_edx = old_ebp + (loc_eax<<2);
if ((ret = lzma_upack_esi_00(p, *old_edx, bs, bl)) == 0xffffffff)
return 0xffffffff;
loc_eax += loc_eax;
loc_eax += ret;
} while (loc_eax < old_ecx);
*retval = loc_eax - old_ecx;
return 0;
}
uint32_t lzma_upack_esi_54(struct lzmastate *p, uint32_t old_eax, uint32_t *old_ecx, char **old_edx, uint32_t *retval, char *bs, uint32_t bl)
{
uint32_t ret, loc_eax = old_eax;
*old_ecx = ((*old_ecx)&0xffffff00)|8;
ret = lzma_upack_esi_00 (p, *old_edx, bs, bl);
*old_edx = ((*old_edx) + 4);
loc_eax = (loc_eax&0xffffff00)|1;
if (ret)
{
ret = lzma_upack_esi_00 (p, *old_edx, bs, bl);
loc_eax |= 8; /* mov al, 9 */
if (ret)
{
*old_ecx <<= 5;
loc_eax = 0x11; /* mov al, 11 */
}
}
ret = loc_eax;
if (lzma_upack_esi_50(p, 1, *old_ecx, old_edx, *old_edx + (loc_eax << 2), &loc_eax, bs, bl) == 0xffffffff)
return 0xffffffff;
*retval = ret + loc_eax;
return 0;
}
/**
* @brief Unpack MEW 11 packed PE file
*
* @param src buffer to unpack
* @param off offset of diff
* @param ssize pe section size
* @param dsize diff size
* @param base OPTIONAL_HEADER32.ImageBase
* @param vadd RVA of pe section
* @param uselzma Bool - use LZMA
* @param filedesc File descriptor
* @return int Returns -1 on failure, 1 on success.
*/
int unmew11(char *src, uint32_t off, uint32_t ssize, uint32_t dsize, uint32_t base, uint32_t vadd, int uselzma, int filedesc)
{
uint32_t entry_point, newedi, loc_ds=dsize, loc_ss=ssize;
char *source = NULL;
const char *lesi = NULL;
char *ledi;
const char *f1;
char *f2;
int i;
struct cli_exe_section *section = NULL;
uint32_t vma = base + vadd;
uint32_t size_sum = ssize + dsize;
/* Guard against integer overflows */
if (base + vadd < base) {
cli_dbgmsg("MEW: base (%08x) + PE section RVA (%08x) exceeds max size of unsigned int (%08x)\n",
base, vadd, UINT32_MAX);
return -1;
}
if (ssize + dsize < ssize) {
cli_dbgmsg("MEW: section size (%08x) + diff size (%08x) exceeds max size of unsigned int (%08x)\n",
ssize, dsize, UINT32_MAX);
return -1;
}
if (((size_t)(src + off) < (size_t)(src)) ||
((size_t)(src + off) < (size_t)(off)))
{
cli_dbgmsg("MEW: Buffer pointer (%08zx) + offset (%08zx) exceeds max size of pointer (%08lx)\n",
(size_t)src, (size_t)off, SIZE_MAX);
return -1;
}
/* Ensure that off + required data exists within buffer */
if (!CLI_ISCONTAINED(src, size_sum, src + off, 12)) {
cli_dbgmsg("MEW: Data reference exceeds size of provided buffer.\n");
return -1;
}
source = src + dsize + off;
lesi = source + 12;
entry_point = cli_readint32(source + 4);
newedi = cli_readint32(source + 8);
ledi = src + (newedi - vma);
loc_ds = size_sum - (newedi - vma);
i = 0;
loc_ss -= 12;
loc_ss -= off;
while (1)
{
cli_dbgmsg("MEW unpacking section %d (%p->%p)\n", i, lesi, ledi);
if (!CLI_ISCONTAINED(src, size_sum, lesi, loc_ss) || !CLI_ISCONTAINED(src, size_sum, ledi, loc_ds))
{
cli_dbgmsg("Possibly programmer error or hand-crafted PE file, report to clamav team\n");
if (section != NULL)
free(section);
return -1;
}
if (unmew(lesi, ledi, loc_ss, loc_ds, &f1, &f2))
{
free(section);
return -1;
}
/* we don't need last section in sections since this is information for fixing imptbl */
if (!CLI_ISCONTAINED(src, size_sum, f1, 4))
{
free(section);
return -1;
}
/* XXX */
loc_ss -= (f1+4-lesi);
lesi = f1+4;
ledi = src + (cli_readint32(f1) - vma);
loc_ds = size_sum - (cli_readint32(f1) - vma);
if (!uselzma)
{
uint32_t val = PESALIGN(f2 - src, 0x1000);
void *newsect;
if (i && val < section[i].raw) {
cli_dbgmsg("MEW: WTF - please report\n");
free(section);
return -1;
}
if (!(newsect=cli_realloc(section, (i+2)*sizeof(struct cli_exe_section)))) {
cli_dbgmsg("MEW: Out of memory\n");
free(section);
return -1;
}
section = (struct cli_exe_section *)newsect;
section[0].raw = 0;
section[0].rva = vadd;
section[i+1].raw = val;
section[i+1].rva = val + vadd;
section[i].rsz = section[i].vsz = ((i)?(val - section[i].raw):val);
/*
* bb#11212 - alternate fix, buffer is aligned
* must validate that sections do not intersect with source
* or, in other words, exceed the specified size of destination
*/
if (section[i].raw + section[i].rsz > dsize) {
cli_dbgmsg("MEW: Section %i [%d, %d] exceeds destination size %u\n",
i, section[i].raw, section[i].raw+section[i].rsz, dsize);
free(section);
return -1;
}
}
i++;
if (!cli_readint32(f1))
break;
}
/* LZMA stuff */
if (uselzma) {
free(section);
/* put everything in one section */
i = 1;
if (!CLI_ISCONTAINED(src, size_sum, src+uselzma+8, 1))
{
cli_dbgmsg("MEW: couldn't access lzma 'special' tag\n");
return -1;
}
/* 0x50 -> push eax */
cli_dbgmsg("MEW: lzma %swas used, unpacking\n", (*(src + uselzma+8) == '\x50')?"special ":"");
if (!CLI_ISCONTAINED(src, size_sum, f1+4, 20 + 4 + 5))
{
cli_dbgmsg("MEW: lzma initialization data not available!\n");
return -1;
}
if(mew_lzma(src, f1+4, size_sum, vma, *(src + uselzma+8) == '\x50'))
{
return -1;
}
loc_ds=PESALIGN(loc_ds, 0x1000);
section = cli_calloc(1, sizeof(struct cli_exe_section));
if(!section) {
cli_dbgmsg("MEW: Out of memory\n");
return -1;
}
section[0].raw = 0; section[0].rva = vadd;
section[0].rsz = section[0].vsz = dsize;
}
if (!cli_rebuildpe_align(src, section, i, base, entry_point - base, 0, 0, filedesc, 0x1000))
{
cli_dbgmsg("MEW: Rebuilding failed\n");
free(section);
return -1;
}
free(section);
return 1;
}