...
|
...
|
@@ -331,10 +331,6 @@ static void cli_parseres_special(uint32_t base, uint32_t rva, struct F_MAP *map,
|
331
|
331
|
return;
|
332
|
332
|
rawaddr += named*8; /* skip named */
|
333
|
333
|
/* this is just used in a heuristic detection, so don't give error on failure */
|
334
|
|
- if (!entry) {
|
335
|
|
- cli_dbgmsg("cli_parseres_special: failed to allocate memory for resource directory:%lu\n", (unsigned long)entries);
|
336
|
|
- return;
|
337
|
|
- }
|
338
|
334
|
if(!(entry = fmap_need_off(map, rawaddr+16, entries*8))) {
|
339
|
335
|
cli_dbgmsg("cli_parseres_special: failed to read resource directory at:%lu\n", (unsigned long)rawaddr+16);
|
340
|
336
|
return;
|
...
|
...
|
@@ -1722,15 +1718,9 @@ int cli_scanpe(cli_ctx *ctx)
|
1722
|
1722
|
return CL_CLEAN;
|
1723
|
1723
|
}
|
1724
|
1724
|
|
1725
|
|
- if((src = (char *) cli_malloc(ssize)) == NULL) {
|
1726
|
|
- free(exe_sections);
|
1727
|
|
- return CL_EMEM;
|
1728
|
|
- }
|
1729
|
|
-
|
1730
|
1725
|
if(!exe_sections[i + 1].raw || !(src = fmap_need_off_once(map, exe_sections[i + 1].raw, ssize))) {
|
1731
|
1726
|
cli_dbgmsg("UPX: Can't read raw data of section %d\n", i+1);
|
1732
|
1727
|
free(exe_sections);
|
1733
|
|
- free(dest);
|
1734
|
1728
|
return CL_EREAD;
|
1735
|
1729
|
}
|
1736
|
1730
|
|
...
|
...
|
@@ -1739,7 +1729,6 @@ int cli_scanpe(cli_ctx *ctx)
|
1739
|
1739
|
return CL_EMEM;
|
1740
|
1740
|
}
|
1741
|
1741
|
|
1742
|
|
-
|
1743
|
1742
|
/* try to detect UPX code */
|
1744
|
1743
|
if(cli_memstr(UPX_NRV2B, 24, epbuff + 0x69, 13) || cli_memstr(UPX_NRV2B, 24, epbuff + 0x69 + 8, 13)) {
|
1745
|
1744
|
cli_dbgmsg("UPX: Looks like a NRV2B decompression routine\n");
|