@@ -1,3 +1,19 @@

+Sun Nov 26 23:04:20 CET 2006 (acab)

+-----------------------------------

+  * libclamav: New PE parsing model

+		- Accurate virtual and raw size and offset calculations

+		- Proper parsing of executables with

+		  weird/handcrafted/uncommon headers

+		- Proper handling (or skipping) of ghost sections at various

+		  places in the code

+		- Rebuild improvements for various unpackers

+		- Adjusted alignment on rebuilt executables

+		- Proper handling of out of sections offsets

+		- Broken exe detection now mimics the XPSP2 loader (*)

+		- Lots of misc improvements and fixes

+		(*) Except for SizeOfImage check which is still to be

+		implemented

+

 Fri Nov 24 02:01:48 CET 2006 (tk)

 ---------------------------------

   * libclamav: don't call phishing_init() if not needed (bb#147),

@@ -47,7 +47,7 @@

 int unfsg_200(char *source, char *dest, int ssize, int dsize, uint32_t rva, uint32_t base, uint32_t ep, int file) {

   char *tsrc;

-  struct SECTION section; /* Yup, just one ;) */

+  struct cli_exe_section section; /* Yup, just one ;) */

   if ( cli_unfsg(source, dest, ssize, dsize, NULL, NULL) ) return -1;

@@ -55,13 +55,8 @@ int unfsg_200(char *source, char *dest, int ssize, int dsize, uint32_t rva, uint

   section.rsz = dsize;

   section.vsz = dsize;

   section.rva = rva;

-  if ( (tsrc = rebuildpe(dest, &section, 1, base, ep, 0, 0)) ) {

-    if (cli_writen(file, tsrc, 0x148+0x80+0x28+dsize)==-1) {

-      free(tsrc);

-      return 0;

-    }

-    free(tsrc);

-  } else {

+

+  if (!cli_rebuildpe(dest, &section, 1, base, ep, 0, 0, file)) {

     cli_dbgmsg("FSG: Rebuilding failed\n");

     return 0;

   }

@@ -69,7 +64,7 @@ int unfsg_200(char *source, char *dest, int ssize, int dsize, uint32_t rva, uint

 }

-int unfsg_133(char *source, char *dest, int ssize, int dsize, struct SECTION *sections, int sectcount, uint32_t base, uint32_t ep, int file) {

+int unfsg_133(char *source, char *dest, int ssize, int dsize, struct cli_exe_section *sections, int sectcount, uint32_t base, uint32_t ep, int file) {

   char *tsrc=source, *tdst=dest;

   int i, upd=1, offs=0, lastsz=dsize;

@@ -118,16 +113,9 @@ int unfsg_133(char *source, char *dest, int ssize, int dsize, struct SECTION *se

     cli_dbgmsg("FSG: .SECT%d RVA:%x VSize:%x ROffset: %x, RSize:% x\n", i, sections[i].rva, sections[i].vsz, sections[i].raw, sections[i].rsz);

   }

-  if ( (tsrc = rebuildpe(dest, sections, sectcount+1, base, ep, 0, 0)) ) {

-    if (cli_writen(file, tsrc, 0x148+0x80+0x28*(sectcount+1)+offs)==-1) {

-      free(tsrc);

-      return 0;

-    }

-    free(tsrc);

-  } else {

+  if (!cli_rebuildpe(dest, sections, sectcount+1, base, ep, 0, 0, file)) {

     cli_dbgmsg("FSG: Rebuilding failed\n");

     return 0;

   }

-

   return 1;

 }

@@ -21,10 +21,10 @@

 #define __FSG_H

 #include "cltypes.h"

-#include "rebuildpe.h"

+#include "execs.h"

 int unfsg_200(char *, char *, int, int, uint32_t, uint32_t, uint32_t, int);

-int unfsg_133(char *, char *, int , int, struct SECTION *, int, uint32_t, uint32_t, int);

+int unfsg_133(char *, char *, int , int, struct cli_exe_section *, int, uint32_t, uint32_t, int);

 #endif

@@ -301,7 +301,7 @@ static off_t cli_caloff(const char *offstr, struct cli_target_info *info, int fd

     } else if(info->status == 1 && offstr[0] == 'S') {

-	if(!strncmp(offstr, "SL", 2)) {

+	if(!strncmp(offstr, "SL", 2) && info->exeinfo.section[info->exeinfo.nsections - 1].rsz) {

 	    if(sscanf(offstr, "SL+%lu", &offset) != 1) {

 		*ret = -1;

@@ -317,7 +317,7 @@ static off_t cli_caloff(const char *offstr, struct cli_target_info *info, int fd

 		return 0;

 	    }

-	    if(n >= info->exeinfo.nsections) {

+	    if(n >= info->exeinfo.nsections || !info->exeinfo.section[n].rsz) {

 		*ret = -1;

 		return 0;

 	    }

@@ -46,7 +46,6 @@

 #include "suecrypt.h"

 #include "unsp.h"

 #include "scanners.h"

-#include "rebuildpe.h"

 #include "str.h"

 #include "execs.h"

 #include "md5.h"

@@ -78,13 +77,22 @@ struct offset_list {

     struct offset_list *next;

 };

-static uint32_t cli_rawaddr(uint32_t rva, struct pe_image_section_hdr *shp, uint16_t nos, unsigned int *err, uint32_t valign, uint32_t falign)

+static uint32_t cli_rawaddr(uint32_t rva, struct cli_exe_section *shp, uint16_t nos, unsigned int *err,	size_t fsize)

 {

 	int i, found = 0;

+	uint32_t ret;

+    if (rva<0x1000) { /* Out of section EP - mapped to imagebase+rva */

+        if (rva >= fsize) {

+	    *err=1;

+	    return 0;

+	}

+        *err=0;

+	return rva;

+    }

-    for(i = 0; i < nos; i++) {

-      if(PEALIGN(EC32(shp[i].VirtualAddress), valign) <= rva && PEALIGN(EC32(shp[i].VirtualAddress), valign) + PESALIGN(EC32(shp[i].SizeOfRawData), falign) > rva) {

+    for(i = nos-1; i >= 0; i--) {

+        if(shp[i].rsz && shp[i].rva <= rva && shp[i].rsz > rva - shp[i].rva) {

 	    found = 1;

 	    break;

 	}

@@ -95,31 +103,32 @@ static uint32_t cli_rawaddr(uint32_t rva, struct pe_image_section_hdr *shp, uint

 	return 0;

     }

+    ret = rva - shp[i].rva + shp[i].raw;

     *err = 0;

-    return rva - PEALIGN(EC32(shp[i].VirtualAddress), valign) + PEALIGN(EC32(shp[i].PointerToRawData), falign);

+    return ret;

 }

 static void xckriz(char **opcode, int *len, int checksize, int reg) {

-	while(*len>6) {

-		if (**opcode>='\x48' && **opcode<='\x4f' && **opcode!='\x4c') {

-			if ((char)(**opcode-reg)=='\x48') break;

-			(*len)--;

-			(*opcode)++;

-			continue;

-		}

-		if (**opcode>='\xb8' && **opcode<='\xbf' && **opcode!='\xbc') {

-			if (checksize && cli_readint32(*opcode+1)==0x0fd2) break;

-			(*len)-=5;

-			(*opcode)+=5;

-			continue;

-		}

-		if (**opcode=='\x81') {

-			(*len)-=6;

-			(*opcode)+=6;

-			continue;

-		}

-		break;

+    while(*len>6) {

+        if (**opcode>='\x48' && **opcode<='\x4f' && **opcode!='\x4c') {

+	    if ((char)(**opcode-reg)=='\x48') break;

+	    (*len)--;

+	    (*opcode)++;

+	    continue;

+	}

+	if (**opcode>='\xb8' && **opcode<='\xbf' && **opcode!='\xbc') {

+	    if (checksize && cli_readint32(*opcode+1)==0x0fd2) break;

+	    (*len)-=5;

+	    (*opcode)+=5;

+	    continue;

+	}

+	if (**opcode=='\x81') {

+	    (*len)-=6;

+	    (*opcode)+=6;

+	    continue;

 	}

+	break;

+    }

 }

@@ -177,30 +186,23 @@ static int cli_ddump(int desc, int offset, int size, const char *file)

 }

 */

-static unsigned char *cli_md5sect(int fd, uint32_t offset, uint32_t size)

+static unsigned int cli_md5sect(int fd, uint32_t offset, uint32_t size, unsigned char *digest)

 {

 	size_t bread, sum = 0;

 	off_t pos;

 	char buff[FILEBUFF];

-	unsigned char *digest;

 	MD5_CTX md5ctx;

     if((pos = lseek(fd, 0, SEEK_CUR)) == -1) {

 	cli_dbgmsg("cli_md5sect: Invalid descriptor %d\n", fd);

-	return NULL;

+	return 0;

     }

     if(lseek(fd, offset, SEEK_SET) == -1) {

 	cli_dbgmsg("cli_md5sect: lseek() failed\n");

 	lseek(fd, pos, SEEK_SET);

-	return NULL;

-    }

-

-    digest = cli_calloc(16, sizeof(char));

-    if(!digest) {

-	cli_errmsg("cli_md5sect: Can't allocate memory for digest\n");

-	return NULL;

+	return 0;

     }

     MD5_Init(&md5ctx);

@@ -217,7 +219,7 @@ static unsigned char *cli_md5sect(int fd, uint32_t offset, uint32_t size)

     MD5_Final(digest, &md5ctx);

     lseek(fd, pos, SEEK_SET);

-    return digest;

+    return 1;

 }

 int cli_scanpe(int desc, cli_ctx *ctx)

@@ -225,24 +227,30 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	uint16_t e_magic; /* DOS signature ("MZ") */

 	uint16_t nsections;

 	uint32_t e_lfanew; /* address of new exe header */

-	uint32_t ep; /* entry point (raw) */

+	uint32_t ep, vep; /* entry point (raw, virtual) */

 	uint8_t polipos = 0;

 	time_t timestamp;

 	struct pe_image_file_hdr file_hdr;

-	struct pe_image_optional_hdr32 optional_hdr32;

-	struct pe_image_optional_hdr64 optional_hdr64;

+	union {

+	    struct pe_image_optional_hdr64 opt64;

+	    struct pe_image_optional_hdr32 opt32;

+	} pe_opt;

+	struct pe_image_optional_hdr64 optional_hdr64 = pe_opt.opt64;

+	struct pe_image_optional_hdr32 optional_hdr32 = pe_opt.opt32;

 	struct pe_image_section_hdr *section_hdr;

 	struct cli_md5_node *md5_sect;

 	struct stat sb;

 	char sname[9], buff[4096], *tempfile;

-	unsigned char *ubuff, *md5_dig;

+	unsigned char *ubuff;

 	ssize_t bytes;

-	unsigned int i, found, upx_success = 0, min = 0, max = 0, err, broken = 0;

+	unsigned int i, found, upx_success = 0, min = 0, max = 0, err;

 	unsigned int ssize = 0, dsize = 0, dll = 0, pe_plus = 0;

 	int (*upxfn)(char *, uint32_t, char *, uint32_t *, uint32_t, uint32_t, uint32_t) = NULL;

 	char *src = NULL, *dest = NULL;

 	int ndesc, ret = CL_CLEAN;

 	size_t fsize;

+	uint32_t valign, falign;

+	struct cli_exe_section *exe_sections;

     if(cli_readn(desc, &e_magic, sizeof(e_magic)) != sizeof(e_magic)) {

@@ -394,7 +402,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     }

     nsections = EC16(file_hdr.NumberOfSections);

-    if(nsections < 1 || nsections > 99) {

+    if(nsections < 1 || nsections > 96) {

 	if(DETECT_BROKEN) {

 	    if(ctx->virname)

 		*ctx->virname = "Broken.Executable";

@@ -413,111 +421,123 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     cli_dbgmsg("SizeOfOptionalHeader: %x\n", EC16(file_hdr.SizeOfOptionalHeader));

-    if(EC16(file_hdr.SizeOfOptionalHeader) != sizeof(struct pe_image_optional_hdr32) && EC16(file_hdr.SizeOfOptionalHeader)!=0x148) {

-	if(EC16(file_hdr.SizeOfOptionalHeader) == sizeof(struct pe_image_optional_hdr64)) {

-	    pe_plus = 1;

-	} else {

-	    cli_dbgmsg("Incorrect value of SizeOfOptionalHeader\n");

-	    if(DETECT_BROKEN) {

-		if(ctx->virname)

-		    *ctx->virname = "Broken.Executable";

-		return CL_VIRUS;

-	    }

-	    return CL_CLEAN;

+    if (EC16(file_hdr.SizeOfOptionalHeader) < sizeof(struct pe_image_optional_hdr32)) {

+        cli_dbgmsg("SizeOfOptionalHeader too small\n");

+	if(DETECT_BROKEN) {

+	    if(ctx->virname)

+	        *ctx->virname = "Broken.Executable";

+	    return CL_VIRUS;

 	}

+	return CL_CLEAN;

     }

-    if(!pe_plus) { /* PE */

+    if(cli_readn(desc, &optional_hdr32, sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr32)) {

+        cli_dbgmsg("Can't read optional file header\n");

+	if(DETECT_BROKEN) {

+	    if(ctx->virname)

+	        *ctx->virname = "Broken.Executable";

+	    return CL_VIRUS;

+	}

+	return CL_CLEAN;

+    }

-	if(cli_readn(desc, &optional_hdr32, sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr32)) {

-	    cli_dbgmsg("Can't read optional file header\n");

+    /* This will be a chicken and egg problem until we drop 9x */

+    if(EC32(optional_hdr64.Magic)==PE32P_SIGNATURE) {

+        if(EC16(file_hdr.SizeOfOptionalHeader)!=sizeof(struct pe_image_optional_hdr64)) {

+	    /* FIXME: need to play around a bit more with xp64 */

+	    cli_dbgmsg("Incorrect SizeOfOptionalHeader for PE32+\n");

 	    if(DETECT_BROKEN) {

-		if(ctx->virname)

+	        if(ctx->virname)

 		    *ctx->virname = "Broken.Executable";

 		return CL_VIRUS;

 	    }

 	    return CL_CLEAN;

 	}

-	if (EC16(file_hdr.SizeOfOptionalHeader)==0x148) {

-	  cli_dbgmsg("Found long header\n");

-	  lseek(desc, (0x148-0xe0), SEEK_CUR); /* Seek to the end of the long header */

-	}

-

-	if(EC16(optional_hdr32.Magic) != PE32_SIGNATURE) {

+	pe_plus = 1;

+    } else {

+        /*

+	    either it's got a PE32_SIGNATURE or

+	    we enable win9x compatibility in that we don't honor magic (see bb#119)

+	    either way it's a 32bit thingy

+	*/

+        if(EC16(optional_hdr32.Magic) != PE32_SIGNATURE) {

 	    cli_warnmsg("Incorrect magic number in optional header\n");

 	    if(DETECT_BROKEN) {

-		if(ctx->virname)

+	        if(ctx->virname)

 		    *ctx->virname = "Broken.Executable";

 		return CL_VIRUS;

 	    }

 	}

+	cli_dbgmsg("9x compatibility mode\n");

+    }

+

+    if(!pe_plus) { /* PE */

+	if (EC16(file_hdr.SizeOfOptionalHeader)!=sizeof(struct pe_image_optional_hdr32)) {

+	    /* Seek to the end of the long header */

+	    lseek(desc, (EC16(file_hdr.SizeOfOptionalHeader)-sizeof(struct pe_image_optional_hdr32)), SEEK_CUR);

+	}

+

+	vep = EC32(optional_hdr32.AddressOfEntryPoint);

 	cli_dbgmsg("File format: PE\n");

 	cli_dbgmsg("MajorLinkerVersion: %d\n", optional_hdr32.MajorLinkerVersion);

 	cli_dbgmsg("MinorLinkerVersion: %d\n", optional_hdr32.MinorLinkerVersion);

-	cli_dbgmsg("SizeOfCode: %d\n", EC32(optional_hdr32.SizeOfCode));

-	cli_dbgmsg("SizeOfInitializedData: %d\n", EC32(optional_hdr32.SizeOfInitializedData));

-	cli_dbgmsg("SizeOfUninitializedData: %d\n", EC32(optional_hdr32.SizeOfUninitializedData));

-	cli_dbgmsg("AddressOfEntryPoint: 0x%x\n", EC32(optional_hdr32.AddressOfEntryPoint));

+	cli_dbgmsg("SizeOfCode: 0x%x\n", EC32(optional_hdr32.SizeOfCode));

+	cli_dbgmsg("SizeOfInitializedData: 0x%x\n", EC32(optional_hdr32.SizeOfInitializedData));

+	cli_dbgmsg("SizeOfUninitializedData: 0x%x\n", EC32(optional_hdr32.SizeOfUninitializedData));

+	cli_dbgmsg("AddressOfEntryPoint: 0x%x\n", vep);

 	cli_dbgmsg("BaseOfCode: 0x%x\n", EC32(optional_hdr32.BaseOfCode));

-	cli_dbgmsg("SectionAlignment: %d\n", EC32(optional_hdr32.SectionAlignment));

-	cli_dbgmsg("FileAlignment: %d\n", EC32(optional_hdr32.FileAlignment));

+	cli_dbgmsg("SectionAlignment: 0x%x\n", EC32(optional_hdr32.SectionAlignment));

+	cli_dbgmsg("FileAlignment: 0x%x\n", EC32(optional_hdr32.FileAlignment));

 	cli_dbgmsg("MajorSubsystemVersion: %d\n", EC16(optional_hdr32.MajorSubsystemVersion));

 	cli_dbgmsg("MinorSubsystemVersion: %d\n", EC16(optional_hdr32.MinorSubsystemVersion));

-	cli_dbgmsg("SizeOfImage: %d\n", EC32(optional_hdr32.SizeOfImage));

-	cli_dbgmsg("SizeOfHeaders: %d\n", EC32(optional_hdr32.SizeOfHeaders));

+	cli_dbgmsg("SizeOfImage: 0x%x\n", EC32(optional_hdr32.SizeOfImage));

+	cli_dbgmsg("SizeOfHeaders: 0x%x\n", EC32(optional_hdr32.SizeOfHeaders));

 	cli_dbgmsg("NumberOfRvaAndSizes: %d\n", EC32(optional_hdr32.NumberOfRvaAndSizes));

     } else { /* PE+ */

-

-	if(cli_readn(desc, &optional_hdr64, sizeof(struct pe_image_optional_hdr64)) != sizeof(struct pe_image_optional_hdr64)) {

-	    cli_dbgmsg("Can't optional file header\n");

+        /* read the remaining part of the header */

+        if(cli_readn(desc, &optional_hdr32 + 1, sizeof(struct pe_image_optional_hdr64) - sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr64) - sizeof(struct pe_image_optional_hdr32)) {

+	    cli_dbgmsg("Can't read optional file header\n");

 	    if(DETECT_BROKEN) {

-		if(ctx->virname)

+	        if(ctx->virname)

 		    *ctx->virname = "Broken.Executable";

 		return CL_VIRUS;

 	    }

 	    return CL_CLEAN;

 	}

-	if(EC16(optional_hdr64.Magic) != PE32P_SIGNATURE) {

-	    cli_warnmsg("Incorrect magic number in optional header\n");

-	    if(DETECT_BROKEN) {

-		if(ctx->virname)

-		    *ctx->virname = "Broken.Executable";

-		return CL_VIRUS;

-	    }

-	}

+	vep = EC32(optional_hdr64.AddressOfEntryPoint);

 	cli_dbgmsg("File format: PE32+\n");

 	cli_dbgmsg("MajorLinkerVersion: %d\n", optional_hdr64.MajorLinkerVersion);

 	cli_dbgmsg("MinorLinkerVersion: %d\n", optional_hdr64.MinorLinkerVersion);

-	cli_dbgmsg("SizeOfCode: %d\n", EC32(optional_hdr64.SizeOfCode));

-	cli_dbgmsg("SizeOfInitializedData: %d\n", EC32(optional_hdr64.SizeOfInitializedData));

-	cli_dbgmsg("SizeOfUninitializedData: %d\n", EC32(optional_hdr64.SizeOfUninitializedData));

-	cli_dbgmsg("AddressOfEntryPoint: 0x%x\n", EC32(optional_hdr64.AddressOfEntryPoint));

+	cli_dbgmsg("SizeOfCode: 0x%x\n", EC32(optional_hdr64.SizeOfCode));

+	cli_dbgmsg("SizeOfInitializedData: 0x%x\n", EC32(optional_hdr64.SizeOfInitializedData));

+	cli_dbgmsg("SizeOfUninitializedData: 0x%x\n", EC32(optional_hdr64.SizeOfUninitializedData));

+	cli_dbgmsg("AddressOfEntryPoint: 0x%x\n", vep);

 	cli_dbgmsg("BaseOfCode: 0x%x\n", EC32(optional_hdr64.BaseOfCode));

-	cli_dbgmsg("SectionAlignment: %d\n", EC32(optional_hdr64.SectionAlignment));

-	cli_dbgmsg("FileAlignment: %d\n", EC32(optional_hdr64.FileAlignment));

+	cli_dbgmsg("SectionAlignment: 0x%x\n", EC32(optional_hdr64.SectionAlignment));

+	cli_dbgmsg("FileAlignment: 0x%x\n", EC32(optional_hdr64.FileAlignment));

 	cli_dbgmsg("MajorSubsystemVersion: %d\n", EC16(optional_hdr64.MajorSubsystemVersion));

 	cli_dbgmsg("MinorSubsystemVersion: %d\n", EC16(optional_hdr64.MinorSubsystemVersion));

-	cli_dbgmsg("SizeOfImage: %d\n", EC32(optional_hdr64.SizeOfImage));

-	cli_dbgmsg("SizeOfHeaders: %d\n", EC32(optional_hdr64.SizeOfHeaders));

+	cli_dbgmsg("SizeOfImage: 0x%x\n", EC32(optional_hdr64.SizeOfImage));

+	cli_dbgmsg("SizeOfHeaders: 0x%x\n", EC32(optional_hdr64.SizeOfHeaders));

 	cli_dbgmsg("NumberOfRvaAndSizes: %d\n", EC32(optional_hdr64.NumberOfRvaAndSizes));

     }

     if (DETECT_BROKEN && (!(pe_plus?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment)) || (pe_plus?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment))%0x1000)) {

-      cli_dbgmsg("Bad virtual alignemnt\n");

-      if(ctx->virname)

-	*ctx->virname = "Broken.Executable";

-      return CL_VIRUS;

+        cli_dbgmsg("Bad virtual alignemnt\n");

+        if(ctx->virname)

+	    *ctx->virname = "Broken.Executable";

+	return CL_VIRUS;

     }

     if (DETECT_BROKEN && (!(pe_plus?EC32(optional_hdr64.FileAlignment):EC32(optional_hdr32.FileAlignment)) || (pe_plus?EC32(optional_hdr64.FileAlignment):EC32(optional_hdr32.FileAlignment))%0x200)) {

-      cli_dbgmsg("Bad file alignemnt\n");

-      if(ctx->virname)

-	*ctx->virname = "Broken.Executable";

-      return CL_VIRUS;

+        cli_dbgmsg("Bad file alignemnt\n");

+	if(ctx->virname)

+	    *ctx->virname = "Broken.Executable";

+	return CL_VIRUS;

     }

     switch(pe_plus ? EC16(optional_hdr64.Subsystem) : EC16(optional_hdr32.Subsystem)) {

@@ -574,33 +594,60 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	return CL_EMEM;

     }

-    for(i = 0; i < nsections; i++) {

+    exe_sections = (struct cli_exe_section *) cli_calloc(nsections, sizeof(struct cli_exe_section));

+    

+    if(!exe_sections) {

+	cli_dbgmsg("Can't allocate memory for section headers\n");

+	free(section_hdr);

+	return CL_EMEM;

+    }

-	if(cli_readn(desc, &section_hdr[i], sizeof(struct pe_image_section_hdr)) != sizeof(struct pe_image_section_hdr)) {

-	    cli_dbgmsg("Can't read section header\n");

-	    cli_dbgmsg("Possibly broken PE file\n");

-	    free(section_hdr);

-	    if(DETECT_BROKEN) {

-		if(ctx->virname)

-		    *ctx->virname = "Broken.Executable";

-		return CL_VIRUS;

-	    }

-	    return CL_CLEAN;

+    valign = (pe_plus)?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment);

+    falign = (pe_plus)?EC32(optional_hdr64.FileAlignment):EC32(optional_hdr32.FileAlignment);

+

+    if(cli_readn(desc, section_hdr, sizeof(struct pe_image_section_hdr)*nsections) != (int)(nsections*sizeof(struct pe_image_section_hdr))) {

+        cli_dbgmsg("Can't read section header\n");

+	cli_dbgmsg("Possibly broken PE file\n");

+	free(section_hdr);

+	free(exe_sections);

+	if(DETECT_BROKEN) {

+	    if(ctx->virname)

+		*ctx->virname = "Broken.Executable";

+	    return CL_VIRUS;

+	}

+	return CL_CLEAN;

+    }

+    

+    for(i = 0; falign!=0x200 && i<nsections; i++) {

+	/* file alignment fallback mode - blah */

+	if (section_hdr[i].SizeOfRawData && EC32(section_hdr[i].PointerToRawData)%falign && !(EC32(section_hdr[i].PointerToRawData)%0x200)) {

+	    cli_dbgmsg("Found misaligned section, using 0x200\n");

+	    falign = 0x200;

 	}

+    }

+    for(i = 0; i < nsections; i++) {

 	strncpy(sname, (char *) section_hdr[i].Name, 8);

 	sname[8] = 0;

+	exe_sections[i].rva = PEALIGN(EC32(section_hdr[i].VirtualAddress), valign);

+	exe_sections[i].vsz = PESALIGN(EC32(section_hdr[i].VirtualSize), valign);

+	exe_sections[i].raw = PEALIGN(EC32(section_hdr[i].PointerToRawData), falign);

+	exe_sections[i].rsz = PESALIGN(EC32(section_hdr[i].SizeOfRawData), falign);

+	if (exe_sections[i].rsz && fsize>exe_sections[i].raw && !CLI_ISCONTAINED(0, (uint32_t) fsize, exe_sections[i].raw, exe_sections[i].rsz))

+	    exe_sections[i].rsz = fsize - exe_sections[i].raw;

+	

 	cli_dbgmsg("Section %d\n", i);

 	cli_dbgmsg("Section name: %s\n", sname);

-	cli_dbgmsg("VirtualSize: %d\n", EC32(section_hdr[i].VirtualSize));

-	cli_dbgmsg("VirtualAddress: 0x%x\n", EC32(section_hdr[i].VirtualAddress));

-	cli_dbgmsg("SizeOfRawData: %d\n", EC32(section_hdr[i].SizeOfRawData));

-	cli_dbgmsg("PointerToRawData: 0x%x (%d)\n", EC32(section_hdr[i].PointerToRawData), EC32(section_hdr[i].PointerToRawData));

+	cli_dbgmsg("Section data (from headers - in memory)\n");

+	cli_dbgmsg("VirtualSize: 0x%x 0x%x\n", EC32(section_hdr[i].VirtualSize), exe_sections[i].vsz);

+	cli_dbgmsg("VirtualAddress: 0x%x 0x%x\n", EC32(section_hdr[i].VirtualAddress), exe_sections[i].rva);

+	cli_dbgmsg("SizeOfRawData: 0x%x 0x%x\n", EC32(section_hdr[i].SizeOfRawData), exe_sections[i].rsz);

+	cli_dbgmsg("PointerToRawData: 0x%x 0x%x\n", EC32(section_hdr[i].PointerToRawData), exe_sections[i].raw);

 	if(EC32(section_hdr[i].Characteristics) & 0x20) {

 	    cli_dbgmsg("Section contains executable code\n");

-	    if(EC32(section_hdr[i].VirtualSize) < EC32(section_hdr[i].SizeOfRawData)) {

+	    if(exe_sections[i].vsz < exe_sections[i].rsz) {

 		cli_dbgmsg("Section contains free space\n");

 		/*

 		cli_dbgmsg("Dumping %d bytes\n", section_hdr.SizeOfRawData - section_hdr.VirtualSize);

@@ -618,79 +665,81 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	cli_dbgmsg("------------------------------------\n");

-	if (DETECT_BROKEN && EC32(section_hdr[i].VirtualAddress)%((pe_plus)?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment))) { /* Bad virtual alignment */

+	if (DETECT_BROKEN && EC32(section_hdr[i].VirtualAddress)%valign) { /* Bad virtual alignment */

 	    cli_dbgmsg("VirtualAddress is misaligned\n");

 	    if(ctx->virname)

 	        *ctx->virname = "Broken.Executable";

 	    free(section_hdr);

+	    free(exe_sections);

 	    return CL_VIRUS;

 	}

-	if (EC32(section_hdr[i].SizeOfRawData)) { /* Don't bother with virtual only sections */

-	    if(!CLI_ISCONTAINED2(0, (uint32_t) fsize, EC32(section_hdr[i].PointerToRawData), EC32(section_hdr[i].SizeOfRawData)) || EC32(section_hdr[i].PointerToRawData) > fsize) {

-	        cli_dbgmsg("Possibly broken PE file - Section %d out of file (Offset@ %d, Rsize %d, Total filesize %d)\n", i, EC32(section_hdr[i].PointerToRawData), EC32(section_hdr[i].SizeOfRawData), fsize);

-		  if(DETECT_BROKEN) {

-		      if(ctx->virname)

-			  *ctx->virname = "Broken.Executable";

-		      free(section_hdr);

-		      return CL_VIRUS;

-		  }

-		  broken = 1;

-

-	    } else {

-	        /* check MD5 section sigs */

-	        md5_sect = ctx->engine->md5_sect;

-		while(md5_sect && md5_sect->size < EC32(section_hdr[i].SizeOfRawData))

-		    md5_sect = md5_sect->next;

-

-		if(md5_sect && md5_sect->size == EC32(section_hdr[i].SizeOfRawData)) {

-		    md5_dig = cli_md5sect(desc, EC32(section_hdr[i].PointerToRawData), EC32(section_hdr[i].SizeOfRawData));

-		    if(!md5_dig) {

-		        cli_errmsg("PE: Can't calculate MD5 for section %d\n", i);

-		    } else {

-		        while(md5_sect && md5_sect->size == EC32(section_hdr[i].SizeOfRawData)) {

-			    if(!memcmp(md5_dig, md5_sect->md5, 16)) {

-			        if(ctx->virname)

-				    *ctx->virname = md5_sect->virname;

-				free(md5_dig);

-				free(section_hdr);

-				return CL_VIRUS;

-			    }

-			    md5_sect = md5_sect->next;

+	if (exe_sections[i].rsz) { /* Don't bother with virtual only sections */

+	    unsigned char md5_dig[16];

+	    if (exe_sections[i].raw >= fsize) { /* really broken */

+	        cli_dbgmsg("Broken PE file - Section %d starts beyond the end of file (Offset@ %d, Total filesize %d)\n", i, exe_sections[i].raw, fsize);

+		free(section_hdr);

+		free(exe_sections);

+		if(DETECT_BROKEN) {

+		    if(ctx->virname)

+		        *ctx->virname = "Broken.Executable";

+		    return CL_VIRUS;

+		}

+		return CL_CLEAN; /* no ninjas to see here! move along! */

+	    }

+	    

+	    /* check MD5 section sigs */

+	    md5_sect = ctx->engine->md5_sect;

+	    while(md5_sect && md5_sect->size < exe_sections[i].rsz)

+	        md5_sect = md5_sect->next;

+

+	    if(md5_sect && md5_sect->size == exe_sections[i].rsz) {

+	        if(!cli_md5sect(desc, exe_sections[i].raw, exe_sections[i].rsz, md5_dig)) {

+		    cli_errmsg("PE: Can't calculate MD5 for section %d\n", i);

+		} else {

+		    while(md5_sect && md5_sect->size == exe_sections[i].rsz) {

+		        if(!memcmp(md5_dig, md5_sect->md5, 16)) {

+			    if(ctx->virname)

+			        *ctx->virname = md5_sect->virname;

+			    free(section_hdr);

+			    free(exe_sections);

+			    return CL_VIRUS;

 			}

-			free(md5_dig);

+			md5_sect = md5_sect->next;

 		    }

 		}

 	    }

 	}

 	if(!i) {

-	    if (DETECT_BROKEN && EC32(section_hdr[i].VirtualAddress)!=((pe_plus)?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment))) { /* Bad first section RVA */

+	    if (DETECT_BROKEN && EC32(section_hdr[i].VirtualAddress)!=valign) { /* Bad first section RVA */

 	        cli_dbgmsg("First section is in the wrong place\n");

 	        if(ctx->virname)

 		    *ctx->virname = md5_sect->virname;

 		free(section_hdr);

+		free(exe_sections);

 		return CL_VIRUS;

 	    }

-	    min = EC32(section_hdr[i].VirtualAddress);

-	    max = EC32(section_hdr[i].VirtualAddress) + EC32(section_hdr[i].SizeOfRawData);

+	    min = exe_sections[i].rva;

+	    max = exe_sections[i].rva + exe_sections[i].rsz;

 	} else {

-	    if (DETECT_BROKEN && EC32(section_hdr[i].VirtualAddress)-EC32(section_hdr[i-1].VirtualAddress)!=PESALIGN(EC32(section_hdr[i-1].VirtualSize), ((pe_plus)?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment)))) { /* No holes, no overlapping, no virtual disorder */

+	    if (DETECT_BROKEN && EC32(section_hdr[i].VirtualAddress)-EC32(section_hdr[i-1].VirtualAddress)!= exe_sections[i-1].vsz) { /* No holes, no overlapping, no virtual disorder */

 	        cli_dbgmsg("Virtually misplaced section (wrong order, overlapping, non contiguous)\n");

 	        if(ctx->virname)

 		    *ctx->virname = md5_sect->virname;

 		free(section_hdr);

+		free(exe_sections);

 		return CL_VIRUS;

 	    }

-	    if(EC32(section_hdr[i].VirtualAddress) < min)

-		min = EC32(section_hdr[i].VirtualAddress);

+	    if(exe_sections[i].rva < min)

+	        min = exe_sections[i].rva;

-	    if(EC32(section_hdr[i].VirtualAddress) + EC32(section_hdr[i].SizeOfRawData) > max)

-		max = EC32(section_hdr[i].VirtualAddress) + EC32(section_hdr[i].SizeOfRawData);

+	    if(exe_sections[i].rva + exe_sections[i].rsz > max)

+	        max = exe_sections[i].rva + exe_sections[i].rsz;

 	}

 	if(SCAN_ALGO && !strlen(sname)) {

-	    if(EC32(section_hdr[i].VirtualSize) > 40000 && EC32(section_hdr[i].VirtualSize) < 70000) {

+	    if(exe_sections[i].vsz > 40000 && exe_sections[i].vsz < 70000) {

 		if(EC32(section_hdr[i].Characteristics) == 0xe0000060) {

 		    polipos = i;

 		}

@@ -699,16 +748,10 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     }

-

-

-    if(pe_plus)

-	ep = EC32(optional_hdr64.AddressOfEntryPoint);

-    else

-	ep = EC32(optional_hdr32.AddressOfEntryPoint);

-

-    if(ep >= min && !(ep = cli_rawaddr(ep, section_hdr, nsections, &err, 0, 0)) && err) {

-	cli_dbgmsg("Possibly broken PE file\n");

+    if(!(ep = cli_rawaddr(vep, exe_sections, nsections, &err, fsize)) && err) {

+	cli_dbgmsg("EntryPoint out of file\n");

 	free(section_hdr);

+	free(exe_sections);

 	if(DETECT_BROKEN) {

 	    if(ctx->virname)

 		*ctx->virname = "Broken.Executable";

@@ -721,13 +764,14 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     if(pe_plus) { /* Do not continue for PE32+ files */

 	free(section_hdr);

+	free(exe_sections);

 	return CL_CLEAN;

     }

     /* Attempt to detect some popular polymorphic viruses */

     /* W32.Parite.B */

-    if(SCAN_ALGO && !dll && ep == EC32(section_hdr[nsections - 1].PointerToRawData)) {

+    if(SCAN_ALGO && !dll && ep == exe_sections[nsections - 1].raw) {

 	lseek(desc, ep, SEEK_SET);

 	if(cli_readn(desc, buff, 4096) == 4096) {

 		const char *pt = cli_memstr(buff, 4040, "\x47\x65\x74\x50\x72\x6f\x63\x41\x64\x64\x72\x65\x73\x73\x00", 15);

@@ -738,6 +782,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		if(((dw1 = cli_readint32(pt)) ^ (dw2 = cli_readint32(pt + 4))) == 0x505a4f && ((dw1 = cli_readint32(pt + 8)) ^ (dw2 = cli_readint32(pt + 12))) == 0xffffb && ((dw1 = cli_readint32(pt + 16)) ^ (dw2 = cli_readint32(pt + 20))) == 0xb8) {

 		    *ctx->virname = "W32.Parite.B";

 		    free(section_hdr);

+		    free(exe_sections);

 		    return CL_VIRUS;

 		}

 	    }

@@ -745,7 +790,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     }

     /* Kriz */

-    if(SCAN_ALGO && CLI_ISCONTAINED(EC32(section_hdr[nsections - 1].PointerToRawData), EC32(section_hdr[nsections - 1].SizeOfRawData), ep, 0x0fd2)) {

+    if(SCAN_ALGO && CLI_ISCONTAINED(exe_sections[nsections - 1].raw, exe_sections[nsections - 1].rsz, ep, 0x0fd2)) {

 	cli_dbgmsg("in kriz\n");

 	lseek(desc, ep, SEEK_SET);

 	if(cli_readn(desc, buff, 200) == 200) {

@@ -800,6 +845,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 			}

 			*ctx->virname = "Win32.Kriz";

 			free(section_hdr);

+			free(exe_sections);

 			return CL_VIRUS;

 		}

 	}

@@ -820,6 +866,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		if(cli_memstr(buff, 4091, "\xe8\x2c\x61\x00\x00", 5)) {

 		    *ctx->virname = "W32.Magistr.A";

 		    free(section_hdr);

+		    free(exe_sections);

 		    return CL_VIRUS;

 		} 

 	    }

@@ -832,6 +879,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		if(cli_memstr(buff, 4091, "\xe8\x04\x72\x00\x00", 5)) {

 		    *ctx->virname = "W32.Magistr.B";

 		    free(section_hdr);

+		    free(exe_sections);

 		    return CL_VIRUS;

 		} 

 	    }

@@ -840,7 +888,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     /* W32.Polipos.A */

    if(polipos && !dll && nsections > 2 && nsections < 13 && e_lfanew <= 0x800 && (EC16(optional_hdr32.Subsystem) == 2 || EC16(optional_hdr32.Subsystem) == 3) && EC16(file_hdr.Machine) == 0x14c && optional_hdr32.SizeOfStackReserve >= 0x80000) {

-		uint32_t remaining = EC32(section_hdr[0].SizeOfRawData);

+		uint32_t remaining = exe_sections[0].rsz;

 		uint32_t chunk = sizeof(buff);

 		uint32_t val, shift, raddr, total = 0;

 		const char *jpt;

@@ -852,23 +900,24 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	if(remaining < chunk)

 	    chunk = remaining;

-	lseek(desc, EC32(section_hdr[0].PointerToRawData), SEEK_SET);

+	lseek(desc, exe_sections[0].raw, SEEK_SET);

 	while((bytes = cli_readn(desc, buff, chunk)) > 0) {

 	    shift = 0;

-	    while(bytes - 5 > shift) {

+	    while((uint32_t)bytes - 5 > shift) {

 		jpt = buff + shift;

 		if(*jpt!='\xe9' && *jpt!='\xe8') {

 		    shift++;

 		    continue;

 		}

 		val = cli_readint32(jpt + 1);

-		val += 5 + EC32(section_hdr[0].VirtualAddress) + total + shift;

-		raddr = cli_rawaddr(val, section_hdr, nsections, &err, 0, 0);

+		val += 5 + exe_sections[0].rva + total + shift;

+		raddr = cli_rawaddr(val, exe_sections, nsections, &err, fsize);

-		if(!err && (raddr >= EC32(section_hdr[polipos].PointerToRawData) && raddr < EC32(section_hdr[polipos].PointerToRawData) + EC32(section_hdr[polipos].SizeOfRawData)) && (!offlist || (raddr != offlist->offset))) {

+		if(!err && (raddr >= exe_sections[polipos].raw && raddr < exe_sections[polipos].raw + exe_sections[polipos].rsz) && (!offlist || (raddr != offlist->offset))) {

 		    offnode = (struct offset_list *) cli_malloc(sizeof(struct offset_list));

 		    if(!offnode) {

 			free(section_hdr);

+			free(exe_sections);

 			while(offlist) {

 			    offnode = offlist;

 			    offlist = offlist->next;

@@ -925,33 +974,30 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	if(ret == CL_VIRUS) {

 	    free(section_hdr);

+	    free(exe_sections);

 	    return CL_VIRUS;

 	}

     }

-    if(broken) {

-	free(section_hdr);

-	return CL_CLEAN;

-    }

-

 #ifdef CL_EXPERIMENTAL

     /* SUE */

-    if(nsections > 2 && EC32(optional_hdr32.AddressOfEntryPoint) == EC32(section_hdr[nsections - 1].VirtualAddress) && EC32(section_hdr[nsections - 1].SizeOfRawData) > 0x350 && EC32(section_hdr[nsections - 1].SizeOfRawData) < 0x292+0x350+1000) {

+    if(nsections > 2 && vep == exe_sections[nsections - 1].rva && exe_sections[nsections - 1].rsz > 0x350 && exe_sections[nsections - 1].rsz < 0x292+0x350+1000) {

       char *sue=buff+0x74;

       uint32_t key;

       if(lseek(desc, ep-4, SEEK_SET) == -1) {

-	cli_dbgmsg("SUE: lseek() failed - EP out of file\n");

+	cli_dbgmsg("SUE: lseek() failed\n");

 	free(section_hdr);

+	free(exe_sections);

 	return CL_EIO;

       }

-      if((unsigned int) cli_readn(desc, buff, EC32(section_hdr[nsections - 1].SizeOfRawData)+4) == EC32(section_hdr[nsections - 1].SizeOfRawData)+4) {

+      if((unsigned int) cli_readn(desc, buff, exe_sections[nsections - 1].rsz+4) == exe_sections[nsections - 1].rsz+4) {

 	found=0;

-	while(CLI_ISCONTAINED(buff+4, EC32(section_hdr[nsections - 1].SizeOfRawData), sue, 4*3)) {

+	while(CLI_ISCONTAINED(buff+4, exe_sections[nsections - 1].rsz, sue, 4*3)) {

 	  if((cli_readint32(sue)^cli_readint32(sue+4))==0x5c41090e && (cli_readint32(sue)^cli_readint32(sue+8))==0x021e0145) {

 	    found=1;

 	    key=(cli_readint32(sue)^0x6e72656b);

@@ -960,28 +1006,31 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	  sue++;

 	}

 	cli_dbgmsg("SUE: key(%x) found @%x\n", key, sue-buff);

-	if (found && CLI_ISCONTAINED(buff, EC32(section_hdr[nsections - 1].SizeOfRawData), sue-0x74, 0xbe) &&

-	    (sue=sudecrypt(desc, fsize, section_hdr, nsections-1, sue, key, cli_readint32(buff), e_lfanew))) {

+	if (found && CLI_ISCONTAINED(buff, exe_sections[nsections - 1].rsz, sue-0x74, 0xbe) &&

+	    (sue=sudecrypt(desc, fsize, exe_sections, nsections-1, sue, key, cli_readint32(buff), e_lfanew))) {

 	  if(!(tempfile = cli_gentemp(NULL))) {

 	    free(sue);

 	    free(section_hdr);

+	    free(exe_sections);

 	    return CL_EMEM;

 	  }

-	  

+

 	  if((ndesc = open(tempfile, O_RDWR|O_CREAT|O_TRUNC|O_BINARY, S_IRWXU)) < 0) {

 	    cli_dbgmsg("sue: Can't create file %s\n", tempfile);

 	    free(tempfile);

 	    free(sue);

 	    free(section_hdr);

+	    free(exe_sections);

 	    return CL_EIO;

 	  }

-	  if((unsigned int) write(ndesc, sue, ep) != ep) {

+	  if((unsigned int) cli_writen(ndesc, sue, ep) != ep) {

 	    cli_dbgmsg("sue: Can't write %d bytes\n", ep);

 	    close(ndesc);

 	    free(tempfile);

 	    free(sue);

 	    free(section_hdr);

+	    free(exe_sections);

 	    return CL_EIO;

 	  }

@@ -995,6 +1044,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	  if(cli_magic_scandesc(ndesc, ctx) == CL_VIRUS) {

 	    free(section_hdr);

+	    free(exe_sections);

 	    close(ndesc);

 	    if(!cli_leavetemps_flag)

 	      unlink(tempfile);

@@ -1029,6 +1079,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	if(lseek(desc, ep, SEEK_SET) == -1) {

 	    cli_dbgmsg("UPX/FSG: lseek() failed\n");

 	    free(section_hdr);

+	    free(exe_sections);

 	    return CL_EIO;

 	}

@@ -1036,6 +1087,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	    cli_dbgmsg("UPX/FSG: Can't read 168 bytes at 0x%x (%d)\n", ep, ep);

 	    cli_dbgmsg("UPX/FSG: Broken or not UPX/FSG compressed file\n");

             free(section_hdr);

+	    free(exe_sections);

 	    return CL_CLEAN;

 	}

@@ -1043,8 +1095,8 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	    /* FSG v2.0 support - thanks to aCaB ! */

-	    ssize = EC32(section_hdr[i + 1].SizeOfRawData);

-	    dsize = EC32(section_hdr[i].VirtualSize);

+	    ssize = exe_sections[i + 1].rsz;

+	    dsize = exe_sections[i].vsz;