/*
* Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2007-2013 Sourcefire, Inc.
*
* Authors: Alberto Wu
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
/*
** unsp.c
**
** 11/10/2k6 - Merge started.
**
*/
/*
** Plays around with NsPack compressed executables
**
** This piece of code is dedicated to Damian Put
** who I made a successful and wealthy man.
**
** Damian, you owe me a pint!
*/
/*
** TODO:
**
** - Investigate the "unused" code in NsPack
** - Fetch all the nspacked samples from the zoo and run extensive testing
** - Add bound checks
** - Test against the zoo again
** - Perform regression testing against the full zoo
** - check nested
** - look at the 64bit version (one of these days)
**
*/
/*
FIXME: clean this rubbish
init_and_check_dll_loadflags();
nsp1:004359FE add edi, [ebp-28Dh]
nsp1:00435A04 mov ebx, edi
nsp1:00435A06 cmp dword ptr [edi], 0
nsp1:00435A09 jnz short loc_435A15
nsp1:00435A0B add edi, 4
nsp1:00435A0E mov ecx, 0
nsp1:00435A13 jmp short loc_435A2B
nsp1:00435A15 ; ---------------------------------------------------------------------------
nsp1:00435A15
nsp1:00435A15 loc_435A15: ; CODE XREF: start+349EEj
nsp1:00435A15 mov ecx, 1
nsp1:00435A1A add edi, [ebx]
nsp1:00435A1C add ebx, 4
nsp1:00435A1F
nsp1:00435A1F loc_435A1F: ; CODE XREF: start+34A3Dj
nsp1:00435A1F cmp dword ptr [ebx], 0
nsp1:00435A22 jz short loc_435A5A
nsp1:00435A24 add [ebx], edx
nsp1:00435A26 mov esi, [ebx]
nsp1:00435A28 add edi, [ebx+4]
nsp1:00435A2B
nsp1:00435A2B loc_435A2B: ; CODE XREF: start+349F8j
nsp1:00435A2B push edi
nsp1:00435A2C push ecx
nsp1:00435A2D push edx
nsp1:00435A2E push ebx
nsp1:00435A2F push dword ptr [ebp-1D1h] ; VirtualFree
nsp1:00435A35 push dword ptr [ebp-1D5h] ; alloc
nsp1:00435A3B mov edx, esi
nsp1:00435A3D mov ecx, edi
nsp1:00435A3F mov eax, offset get_byte
nsp1:00435A44 int 3 ; Trap to Debugger
nsp1:00435A45 add eax, 5A9h
nsp1:00435A4A call eax ; real_unpack ; edx=401000
nsp1:00435A4A ; ecx=436282
nsp1:00435A4C pop ebx
nsp1:00435A4D pop edx
nsp1:00435A4E pop ecx
nsp1:00435A4F pop edi
nsp1:00435A50 cmp ecx, 0
nsp1:00435A53 jz short loc_435A5A
nsp1:00435A55 add ebx, 8
nsp1:00435A58 jmp short loc_435A1F
nsp1:00435A5A ; ---------------------------------------------------------------------------
nsp1:00435A5A
nsp1:00435A5A loc_435A5A: ; CODE XREF: start+34A07j
nsp1:00435A5A ; start+34A38j
nsp1:00435A5A push 8000h
*/
#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif
#include <stdlib.h>
#include "clamav.h"
#include "others.h"
#include "rebuildpe.h"
#include "execs.h"
#include "unsp.h"
/* real_unpack(start_of_stuff, dest, malloc, free); */
uint32_t unspack(const char *start_of_stuff, char *dest, cli_ctx *ctx, uint32_t rva, uint32_t base, uint32_t ep, int file) {
uint8_t c = *start_of_stuff;
uint32_t i,firstbyte,tre,allocsz,tablesz,dsize,ssize;
uint16_t *table;
char *dst = dest;
const char *src = start_of_stuff+0xd;
struct cli_exe_section section;
if (c>=0xe1) return 1;
if (c>=0x2d) {
firstbyte = i = c/0x2d;
do {c+=0xd3;} while (--i);
} else firstbyte = 0;
if (c>=9) {
allocsz = i = c/9;
do {c+=0xf7;} while (--i);
} else allocsz = 0;
tre = c;
i = allocsz;
c = (tre+i)&0xff;
tablesz = ((0x300<<c)+0x736)*sizeof(uint16_t);
if(cli_checklimits("nspack", ctx, tablesz, 0, 0)!=CL_CLEAN)
return 1; /* Should be ~15KB, if it's so big it's prolly just not nspacked */
cli_dbgmsg("unsp: table size = %d\n", tablesz);
if (!(table = cli_malloc(tablesz))) {
cli_dbgmsg("unspack: Unable to allocate memory for table\n");
return 1;
}
dsize = cli_readint32(start_of_stuff+9);
ssize = cli_readint32(start_of_stuff+5);
if (ssize <= 13) {
free(table);
return 1;
}
tre = very_real_unpack(table,tablesz,tre,allocsz,firstbyte,src,ssize,dst,dsize);
free(table);
if (tre) return 1;
section.raw=0;
section.rsz = dsize;
section.vsz = dsize;
section.rva = rva;
return !cli_rebuildpe(dest, §ion, 1, base, ep, 0, 0, file);
}
uint32_t very_real_unpack(uint16_t *table, uint32_t tablesz, uint32_t tre, uint32_t allocsz, uint32_t firstbyte, const char *src, uint32_t ssize, char *dst, uint32_t dsize) {
struct UNSP read_struct;
uint32_t i = (0x300<<((allocsz+tre)&0xff)) + 0x736;
uint32_t previous_bit = 0;
uint32_t unpacked_so_far = 0;
uint32_t backbytes = 1;
uint32_t oldbackbytes = 1;
uint32_t old_oldbackbytes = 1;
uint32_t old_old_oldbackbytes = 1;
uint32_t damian = 0;
uint32_t put = (1<<(allocsz&0xff))-1;
uint32_t bielle = 0;
firstbyte = (1<<(firstbyte&0xff))-1;
if (tablesz < i*sizeof(uint16_t)) return 2;
/* init table */
while (i) table[--i]=0x400;
/* table noinit */
/* get_five - inlined */
read_struct.error = 0;
read_struct.oldval = 0;
read_struct.src_curr = src;
read_struct.bitmap = 0xffffffff;
read_struct.src_end = src + ssize - 13;
read_struct.table = (char *)table;
read_struct.tablesz = tablesz;
for ( i = 0; i<5 ; i++) read_struct.oldval = (read_struct.oldval<<8) | get_byte(&read_struct);
if (read_struct.error) return 1;
/* if (!dsize) return 0; - checked in pe.c */
/* very_unpacking_loop */
while (1) {
uint32_t backsize = firstbyte&unpacked_so_far;
uint32_t tpos;
uint32_t temp = damian;
if (read_struct.error) return 1; /* checked once per mainloop, keeps the code readable and it's still safe */
if (!getbit_from_table(&table[(damian<<4) + backsize], &read_struct)) { /* no_mainbit */
uint32_t shft = 8 - (tre&0xff);
shft &= 0xff;
tpos = (bielle>>shft) + ((put&unpacked_so_far)<<(tre&0xff));
tpos *=3;
tpos<<=8;
if ((int32_t)damian>=4) { /* signed */
if ((int32_t)damian>=0xa) { /* signed */
damian -= 6;
} else {
damian -= 3;
}
} else {
damian=0;
}
/* 44847E */
if (previous_bit) {
if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], 1)) return 1;
ssize = (ssize&0xffffff00) | (uint8_t)dst[unpacked_so_far - backbytes]; /* FIXME! ssize is not static */
bielle = get_100_bits_from_tablesize(&table[tpos+0x736], &read_struct, ssize);
previous_bit=0;
} else {
bielle = get_100_bits_from_table(&table[tpos+0x736], &read_struct);
}
/* unpack_one_byte - duplicated */
if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far], 1)) return 1;
dst[unpacked_so_far] = bielle;
unpacked_so_far++;
if (unpacked_so_far>=dsize) return 0;
continue;
} else { /* got_mainbit */
bielle = previous_bit = 1;
if (getbit_from_table(&table[damian+0xc0], &read_struct)) {
if (!getbit_from_table(&table[damian+0xcc], &read_struct)) {
tpos = damian+0xf;
tpos <<=4;
tpos += backsize;
if (!getbit_from_table(&table[tpos], &read_struct)) {
if (!unpacked_so_far) return bielle; /* FIXME: WTF?! */
damian = 2*((int32_t)damian>=7)+9; /* signed */
if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], 1)) return 1;
bielle = (uint8_t)dst[unpacked_so_far - backbytes];
/* unpack_one_byte - real */
dst[unpacked_so_far] = bielle;
unpacked_so_far++;
if (unpacked_so_far>=dsize) return 0;
continue;
} else { /* gotbit_tre */
backsize = get_n_bits_from_tablesize(&table[0x534], &read_struct, backsize);
damian = ((int32_t)damian>=7); /* signed */
damian = ((damian-1) & 0xfffffffd)+0xb;
/* jmp checkloop_and_backcopy (uses edx) */
} /* gotbit_uno ends */
} else { /* gotbit_due */
if (!getbit_from_table(&table[damian+0xd8], &read_struct)) {
tpos = oldbackbytes;
} else {
if (!getbit_from_table(&table[damian+0xe4], &read_struct)) {
tpos = old_oldbackbytes;
} else {
/* set_old_old_oldback */
tpos = old_old_oldbackbytes;
old_old_oldbackbytes = old_oldbackbytes;
}
/* set_old_oldback */
old_oldbackbytes = oldbackbytes;
}
/* set_oldback */
oldbackbytes = backbytes;
backbytes = tpos;
backsize = get_n_bits_from_tablesize(&table[0x534], &read_struct, backsize);
damian = ((int32_t)damian>=7); /* signed */
damian = ((damian-1) & 0xfffffffd)+0xb;
/* jmp checkloop_and_backcopy (uses edx) */
} /* gotbit_due ends */
} else { /* gotbit_uno */
old_old_oldbackbytes = old_oldbackbytes;
old_oldbackbytes = oldbackbytes;
oldbackbytes = backbytes;
damian = ((int32_t)damian>=7); /* signed */
damian = ((damian-1) & 0xfffffffd)+0xa;
backsize = get_n_bits_from_tablesize(&table[0x332], &read_struct, backsize);
tpos = ((int32_t)backsize>=4)?3:backsize; /* signed */
tpos<<=6;
tpos = get_n_bits_from_table(&table[0x1b0+tpos], 6, &read_struct);
if (tpos>=4) { /* signed */
uint32_t s = tpos;
s>>=1;
s--;
temp = (tpos & bielle) | 2;
temp<<=(s&0xff);
if ((int32_t)tpos<0xe) {
temp += get_bb(&table[(temp-tpos)+0x2af], s, &read_struct);
} else {
s += 0xfffffffc;
tpos = get_bitmap(&read_struct, s);
tpos <<=4;
temp += tpos;
temp += get_bb(&table[0x322], 4, &read_struct);
}
} else {
/* gotbit_uno_out1 */
backbytes = temp = tpos;
}
/* gotbit_uno_out2 */
backbytes = temp+1;
/* jmp checkloop_and_backcopy (uses edx) */
} /* gotbit_uno ends */
/* checkloop_and_backcopy */
if (!backbytes) return 0; /* very_real_unpack_end */
if (backbytes > unpacked_so_far) return bielle; /* FIXME: WTF?! */
backsize +=2;
if (!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far], backsize) ||
!CLI_ISCONTAINED(dst, dsize, &dst[unpacked_so_far - backbytes], backsize)
) {
cli_dbgmsg("%p %x %p %x\n", dst, dsize, &dst[unpacked_so_far], backsize);
return 1;
}
do {
dst[unpacked_so_far] = dst[unpacked_so_far - backbytes];
unpacked_so_far++;
} while (--backsize && unpacked_so_far<dsize);
bielle = (uint8_t)dst[unpacked_so_far - 1];
if (unpacked_so_far>=dsize) return 0;
} /* got_mainbit ends */
} /* while true ends */
}
uint32_t get_byte(struct UNSP *read_struct) {
uint32_t ret;
if (read_struct->src_curr >= read_struct->src_end) {
read_struct->error = 1;
return 0xff;
}
ret = *(read_struct->src_curr);
read_struct->src_curr++;
return ret&0xff;
}
int getbit_from_table(uint16_t *intable, struct UNSP *read_struct) {
uint32_t nval;
if (!CLI_ISCONTAINED((char *)read_struct->table, read_struct->tablesz, (char *)intable, sizeof(uint16_t))) {
read_struct->error = 1;
return 0xff;
}
nval = *intable * (read_struct->bitmap>>0xb);
if (read_struct->oldval<nval) { /* unsigned */
uint32_t sval;
read_struct->bitmap = nval;
nval = *intable;
sval = 0x800 - nval;
sval = CLI_SRS((int32_t)sval,5); /* signed */
sval += nval;
*intable=sval;
if (read_struct->bitmap<0x1000000) { /* unsigned */
read_struct->oldval = (read_struct->oldval<<8) | get_byte(read_struct);
read_struct->bitmap<<=8;
}
return 0;
}
read_struct->bitmap -= nval;
read_struct->oldval -= nval;
nval = *intable;
nval -= (nval>>5); /* word, unsigned */
*intable=nval;
if (read_struct->bitmap<0x1000000) { /* unsigned */
read_struct->oldval = (read_struct->oldval<<8) | get_byte(read_struct);
read_struct->bitmap<<=8;
}
return 1;
}
uint32_t get_100_bits_from_tablesize(uint16_t *intable, struct UNSP *read_struct, uint32_t ssize) {
uint32_t count = 1;
while (count<0x100) {
uint32_t lpos, tpos;
lpos = ssize&0xff;
ssize=(ssize&0xffffff00)|((lpos<<1)&0xff);
lpos>>=7;
tpos = lpos+1;
tpos<<=8;
tpos+=count;
tpos = getbit_from_table(&intable[tpos], read_struct);
count=(count*2)|tpos;
if (lpos!=tpos) {
/* second loop */
while (count<0x100)
count = (count*2)|getbit_from_table(&intable[count], read_struct);
}
}
return count&0xff;
}
uint32_t get_100_bits_from_table(uint16_t *intable, struct UNSP *read_struct) {
uint32_t count = 1;
while (count<0x100)
count = (count*2)|getbit_from_table(&intable[count], read_struct);
return count&0xff;
}
uint32_t get_n_bits_from_table(uint16_t *intable, uint32_t bits, struct UNSP *read_struct) {
uint32_t count = 1;
uint32_t bitcounter;
/* if (bits) { always set! */
bitcounter = bits;
while (bitcounter--)
count = count*2 + getbit_from_table(&intable[count], read_struct);
/* } */
return count-(1<<(bits&0xff));
}
uint32_t get_n_bits_from_tablesize(uint16_t *intable, struct UNSP *read_struct, uint32_t backsize) {
if (!getbit_from_table(intable, read_struct))
return get_n_bits_from_table(&intable[(backsize<<3)+2], 3, read_struct);
if (!getbit_from_table(&intable[1], read_struct))
return 8+get_n_bits_from_table(&intable[(backsize<<3)+0x82], 3, read_struct);
return 0x10+get_n_bits_from_table(&intable[0x102], 8, read_struct);
}
uint32_t get_bb(uint16_t *intable, uint32_t back, struct UNSP *read_struct) {
uint32_t pos = 1;
uint32_t bb = 0;
uint32_t i;
if ((int32_t)back<=0) /* signed */
return 0;
for (i=0;i<back;i++) {
uint32_t bit = getbit_from_table(&intable[pos], read_struct);
pos=(pos*2) + bit;
bb|=(bit<<i);
}
return bb;
}
uint32_t get_bitmap(struct UNSP *read_struct, uint32_t bits) {
uint32_t retv = 0;
if ((int32_t)bits<=0) return 0; /* signed */
while (bits--) {
read_struct->bitmap>>=1; /* unsigned */
retv<<=1;
if (read_struct->oldval>=read_struct->bitmap) { /* unsigned */
read_struct->oldval-=read_struct->bitmap;
retv|=1;
}
if (read_struct->bitmap<0x1000000) {
read_struct->bitmap<<=8;
read_struct->oldval = (read_struct->oldval<<8) | get_byte(read_struct);
}
}
return retv;
}