@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2015 Cisco Systems, Inc. and/or its affiliates. All rights reserved.

+ *  Copyright (C) 2015, 2017 Cisco Systems, Inc. and/or its affiliates. All rights reserved.

  *  Copyright (C) 2007-2008 Sourcefire, Inc.

  *

  *  Authors: Alberto Wu

@@ -35,7 +35,6 @@

 ** [ A big fat thank to christoph for not letting me give up ]

 */

-

 /*

 ** TODO ( a fat one ):

 **

@@ -48,7 +47,6 @@

 **

 */

-

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

 #endif

@@ -65,451 +63,521 @@

 #include "packlibs.h"

 #include "spin.h"

-

-static char exec86(uint8_t aelle, uint8_t cielle, char *curremu, int *retval) {

-  int len = 0;

-  *retval=0;

-  while (len <0x24) {

-    uint8_t opcode = curremu[len], support;

-    len++;

-    switch (opcode) {

-      case 0xeb:

-        len++;

-      case 0x0a:

-        len++;

-      case 0x90:

-      case 0xf8:

-      case 0xf9:

-        break;

-

-      case 0x02: /* add al, cl */

-        aelle+=cielle;

-	len++;

-        break;

-      case 0x2a: /* sub al, cl */

-        aelle-=cielle;

-	len++;

-        break;

-      case 0x04: /* add al, ?? */

-        aelle+=curremu[len];

-	len++;

-        break;

-      case 0x2c: /* sub al, ?? */

-        aelle-=curremu[len];

-	len++;

-        break;

-      case 0x32: /* xor al, cl */

-        aelle^=cielle;

-	len++;

-        break;

-      case 0x34: /* xor al, ?? */

-        aelle^=curremu[len];

-	len++;

-        break;

-

-      case 0xfe: /* inc/dec al */

-        if ( curremu[len] == '\xc0' ) aelle++;

-	else aelle--;

-        len++;

-        break;

-

-      case 0xc0: /* ror/rol al, ?? */

-	support = curremu[len];

-        len++;

-        if ( support == 0xc0 ) CLI_ROL(aelle, curremu[len]);

-        else CLI_ROR(aelle, curremu[len]);

+static char exec86(uint8_t aelle, uint8_t cielle, char *curremu, int *retval)

+{

+    int len = 0;

+    *retval = 0;

+    while (len < 0x24)

+    {

+        uint8_t opcode = curremu[len], support;

         len++;

-        break;

-

-      default:

-        cli_dbgmsg("spin: bogus opcode %x\n", opcode);

-	*retval=1;

-	return aelle;

+        switch (opcode)

+        {

+        case 0xeb:

+            len++;

+        case 0x0a:

+            len++;

+        case 0x90:

+        case 0xf8:

+        case 0xf9:

+            break;

+

+        case 0x02: /* add al, cl */

+            aelle += cielle;

+            len++;

+            break;

+        case 0x2a: /* sub al, cl */

+            aelle -= cielle;

+            len++;

+            break;

+        case 0x04: /* add al, ?? */

+            aelle += curremu[len];

+            len++;

+            break;

+        case 0x2c: /* sub al, ?? */

+            aelle -= curremu[len];

+            len++;

+            break;

+        case 0x32: /* xor al, cl */

+            aelle ^= cielle;

+            len++;

+            break;

+        case 0x34: /* xor al, ?? */

+            aelle ^= curremu[len];

+            len++;

+            break;

+

+        case 0xfe: /* inc/dec al */

+            if (curremu[len] == '\xc0')

+                aelle++;

+            else

+                aelle--;

+            len++;

+            break;

+

+        case 0xc0: /* ror/rol al, ?? */

+            support = curremu[len];

+            len++;

+            if (support == 0xc0)

+                CLI_ROL(aelle, curremu[len]);

+            else

+                CLI_ROR(aelle, curremu[len]);

+            len++;

+            break;

+

+        default:

+            cli_dbgmsg("spin: bogus opcode %x\n", opcode);

+            *retval = 1;

+            return aelle;

+        }

+    }

+    if (len != 0x24 || curremu[len] != '\xaa')

+    {

+        cli_dbgmsg("spin: bad emucode\n");

+        *retval = 1;

     }

-  }

-  if ( len!=0x24 || curremu[len]!='\xaa' ) {

-    cli_dbgmsg("spin: bad emucode\n");

-    *retval=1;

-  }

-  return aelle;

+    return aelle;

 }

-

-static uint32_t summit (char *src, int size) 

+static uint32_t summit(char *src, int size)

 {

-  uint32_t eax=0xffffffff, ebx=0xffffffff;

-  int i;

-

-  while(size) {

-    eax ^= *src++<<8 & 0xff00;

-    eax = eax>>3 & 0x1fffffff;

-    for (i=0; i<4; i++) {

-      uint32_t swap;

-      eax ^= ebx>>8 & 0xff;

-      eax += 0x7801a108;

-      eax ^= ebx;

-      CLI_ROR(eax, ebx&0xff);

-      swap = eax;

-      eax = ebx;

-      ebx = swap;

+    uint32_t eax = 0xffffffff, ebx = 0xffffffff;

+    int i;

+

+    while (size)

+    {

+        eax ^= *src++ << 8 & 0xff00;

+        eax = eax >> 3 & 0x1fffffff;

+        for (i = 0; i < 4; i++)

+        {

+            uint32_t swap;

+            eax ^= ebx >> 8 & 0xff;

+            eax += 0x7801a108;

+            eax ^= ebx;

+            CLI_ROR(eax, ebx & 0xff);

+            swap = eax;

+            eax = ebx;

+            ebx = swap;

+        }

+        size--;

     }

-    size--; 

-  }

-  return ebx;

+    return ebx;

 }

+int unspin(char *src, int ssize, struct cli_exe_section *sections, int sectcnt, uint32_t nep, int desc, cli_ctx *ctx)

+{

+    char *curr, *emu, *ep, *spinned;

+    char **sects;

+    int blobsz = 0, j;

+    uint32_t key32, bitmap, bitman;

+    uint32_t len;

+    uint8_t key8;

+

+    cli_dbgmsg("in unspin\n");

+

+    if ((spinned = (char *)cli_malloc(sections[sectcnt].rsz)) == NULL)

+    {

+        cli_dbgmsg("spin: Unable to allocate memory for spinned\n");

+        return 1;

+    }

-int unspin(char *src, int ssize, struct cli_exe_section *sections, int sectcnt, uint32_t nep, int desc, cli_ctx *ctx) {

-  char *curr, *emu, *ep, *spinned;

-  char **sects;

-  int blobsz=0, j;

-  uint32_t key32, bitmap, bitman;

-  uint32_t len;

-  uint8_t key8;

-

-  cli_dbgmsg("in unspin\n");

-

-  if ((spinned = (char *) cli_malloc(sections[sectcnt].rsz)) == NULL ) {

-      cli_dbgmsg("spin: Unable to allocate memory for spinned\n");

-    return 1;

-  }

-

-  memcpy(spinned, src + sections[sectcnt].raw, sections[sectcnt].rsz); 

-  ep = spinned + nep - sections[sectcnt].rva;

-

-  curr = ep+0xdb;

-  if ( *curr != '\xbb' ) {

-    free(spinned);

-    cli_dbgmsg("spin: Not spinned or bad version\n");

-    return 1;

-  }

-  

-  key8 = (uint8_t)*++curr;

-  curr+=4;

-  if ( *curr != '\xb9' ) {

-    free(spinned);

-    cli_dbgmsg("spin: Not spinned or bad version\n");

-    return 1;

-  }

-

-  if ( (len = cli_readint32(curr+1)) != 0x11fe ) {

-    free(spinned);

-    cli_dbgmsg("spin: Not spinned or bad version\n");

-    return 1;

-  }

-

-  cli_dbgmsg("spin: Key8 is %x, Len is %x\n", key8, len);

-

-  if (!CLI_ISCONTAINED(spinned, sections[sectcnt].rsz, ep, len+0x1fe5-1)) {

-    free(spinned);

-    cli_dbgmsg("spin: len out of bounds, giving up\n");

-    return 1;

-  }

-

-  if ( ep[0x1e0]!='\xb8' )

-    cli_dbgmsg("spin: prolly not spinned, expect failure\n");

-  

-  if ( (cli_readint32(ep+0x1e1) & 0x00200000) )

-    cli_dbgmsg("spin: password protected, expect failure\n");

-

-  curr = ep+0x1fe5+len-1;

-  while ( len-- ) {

-    *curr=(*curr)^(key8--);

-    curr--;

-  }

-

-  if (!CLI_ISCONTAINED(spinned, sections[sectcnt].rsz, ep+0x3217, 4)) {

-    free(spinned);

-    cli_dbgmsg("spin: key out of bounds, giving up\n");

-    return 1;

-  }

-

-  curr = ep+0x26eb;

-  key32 = cli_readint32(curr);

-  if ( (len = cli_readint32(curr+5)) != 0x5a0) {

-    free(spinned);

-    cli_dbgmsg("spin: Not spinned or bad version\n");

-    return 1;

-  }

-

-  curr = ep+0x2d5;

-  cli_dbgmsg("spin: Key is %x, Len is %x\n", key32, len);

-

-  while ( len-- ) {

-    if ( key32 & 1 ) {

-      key32 = key32>>1;

-      key32 ^= 0x8c328834;

-    } else {

-      key32 = key32>>1;

+    memcpy(spinned, src + sections[sectcnt].raw, sections[sectcnt].rsz);

+    ep = spinned + nep - sections[sectcnt].rva;

+

+    curr = ep + 0xdb;

+    if (*curr != '\xbb')

+    {

+        free(spinned);

+        cli_dbgmsg("spin: Not spinned or bad version\n");

+        return 1;

     }

-    *curr = *curr ^ (key32 & 0xff);

-    curr++;

-  }

-

-  len = ssize - cli_readint32(ep+0x429); /* sub size, value */

-  if ( len >= (uint32_t)ssize ) {

-    free(spinned);

-    cli_dbgmsg("spin: crc out of bounds, giving up\n");

-    return 1;

-  }

-  key32 = cli_readint32(ep+0x3217) - summit(src,len);

-

-  memcpy(src + sections[sectcnt].raw, spinned, sections[sectcnt].rsz); 

-  free(spinned); /* done CRC'ing - can have a dirty buffer now */

-  ep = src + nep + sections[sectcnt].raw - sections[sectcnt].rva; /* Fix the helper */

-

-  if (!CLI_ISCONTAINED(src, ssize, ep+0x3207, 4)) { /* this one holds all ep based checks */

-    cli_dbgmsg("spin: key out of bounds, giving up\n");

-    return 1;

-  }

-  bitmap = cli_readint32(ep+0x3207);

-  cli_dbgmsg("spin: Key32 is %x - XORbitmap is %x\n", key32, bitmap);

-  

-  cli_dbgmsg("spin: Decrypting sects (xor)\n");

-  for (j=0; j<sectcnt; j++) {

-

-    if (bitmap&1) {

-      uint32_t size = sections[j].rsz;

-      char *ptr = src + sections[j].raw;

-      uint32_t keydup = key32;

-      

-      if (!CLI_ISCONTAINED(src, ssize, ptr, size)) {

-	cli_dbgmsg("spin: sect %d out of file, giving up\n", j);

-	return 1; /* FIXME: Already checked in pe.c? */

-      }

-

-      while (size--) {

-	if (! (keydup & 1)) {

-	  keydup = keydup>>1;

-	  keydup ^= 0xed43af31;

-	} else {

-	  keydup = keydup>>1;

-	}

-	*ptr = *ptr ^ (keydup & 0xff);

-	ptr++;

-      }

-    } 

-    bitmap = bitmap >>1;

-  }

-  

-  cli_dbgmsg("spin: done\n");

-

-  

-  curr = ep+0x644;

-  if ( (len = cli_readint32(curr)) != 0x180) {

-    cli_dbgmsg("spin: Not spinned or bad version\n");

-    return 1;

-  }

-

-  key32 = cli_readint32(curr+0x0c);

-  cli_dbgmsg("spin: Key is %x, Len is %x\n", key32, len);

-  curr = ep+0x28d3;

-

-  if (!CLI_ISCONTAINED(src, ssize, curr, len)) { /* always true but i may decide to remove the previous check */

-    cli_dbgmsg("spin: key out of bounds, giving up\n");

-    return 1;

-  }

-  while ( len-- ) {

-    if ( key32 & 1 ) {

-      key32 = key32>>1;

-      key32 ^= 0xed43af32;

-    } else {

-      key32 = key32>>1;

+

+    key8 = (uint8_t) * ++curr;

+    curr += 4;

+    if (*curr != '\xb9')

+    {

+        free(spinned);

+        cli_dbgmsg("spin: Not spinned or bad version\n");

+        return 1;

     }

-    *curr = *curr ^ (key32 & 0xff);

-    curr++;

-  }

-

-

-  curr = ep+0x28dd;

-  if ( (len = cli_readint32(curr)) != 0x1a1 ) {

-    cli_dbgmsg("spin: Not spinned or bad version\n");

-    return 1;

-  }

-

-  cli_dbgmsg("spin: POLY1 len is %x\n", len);

-  curr+=0xf; /* POLY1 */

-  emu = ep+0x6d4;

-  if (!CLI_ISCONTAINED(src, ssize, emu, len)) {

-    cli_dbgmsg("spin: poly1 out of bounds\n");

-    return 1;

-  }

-  while (len) {

-    int xcfailure=0;

-    *emu=exec86(*emu, len-- & 0xff, curr, &xcfailure); /* unlame POLY1 */

-    if (xcfailure) {

-      cli_dbgmsg("spin: cannot exec poly1\n");

-      return 1;

+

+    if ((len = cli_readint32(curr + 1)) != 0x11fe)

+    {

+        free(spinned);

+        cli_dbgmsg("spin: Not spinned or bad version\n");

+        return 1;

     }

-    emu++;

-  }

+    cli_dbgmsg("spin: Key8 is %x, Len is %x\n", key8, len);

-  bitmap = cli_readint32(ep+0x6f1);

-  cli_dbgmsg("spin: POLYbitmap is %x - decrypting sects (poly)\n", bitmap);

-  curr = ep+0x755;

+    if (!CLI_ISCONTAINED(spinned, sections[sectcnt].rsz, ep, len + 0x1fe5 - 1))

+    {

+        free(spinned);

+        cli_dbgmsg("spin: len out of bounds, giving up\n");

+        return 1;

+    }

-  for (j=0; j<sectcnt; j++) {

-    if (bitmap&1) {

-      uint32_t notthesamelen = sections[j].rsz;

+    if (ep[0x1e0] != '\xb8')

+        cli_dbgmsg("spin: prolly not spinned, expect failure\n");

-      emu = src + sections[j].raw;

+    if ((cli_readint32(ep + 0x1e1) & 0x00200000))

+        cli_dbgmsg("spin: password protected, expect failure\n");

-      if (!CLI_ISCONTAINED(src,ssize,curr,0x24)) { /* section bounds already checked twice now */

-	cli_dbgmsg("spin: poly1 emucode is out of file?\n");

-	return 1;

-      }

+    curr = ep + 0x1fe5 + len - 1;

+    while (len--)

+    {

+        *curr = (*curr) ^ (key8--);

+        curr--;

+    }

+

+    if (!CLI_ISCONTAINED(spinned, sections[sectcnt].rsz, ep + 0x3217, 4))

+    {

+        free(spinned);

+        cli_dbgmsg("spin: key out of bounds, giving up\n");

+        return 1;

+    }

+

+    curr = ep + 0x26eb;

+    key32 = cli_readint32(curr);

+    if ((len = cli_readint32(curr + 5)) != 0x5a0)

+    {

+        free(spinned);

+        cli_dbgmsg("spin: Not spinned or bad version\n");

+        return 1;

+    }

+

+    curr = ep + 0x2d5;

+    cli_dbgmsg("spin: Key is %x, Len is %x\n", key32, len);

+

+    while (len--)

+    {

+        if (key32 & 1)

+        {

+            key32 = key32 >> 1;

+            key32 ^= 0x8c328834;

+        }

+        else

+        {

+            key32 = key32 >> 1;

+        }

+        *curr = *curr ^ (key32 & 0xff);

+        curr++;

+    }

+

+    len = ssize - cli_readint32(ep + 0x429); /* sub size, value */

+    if (len >= (uint32_t)ssize)

+    {

+        free(spinned);

+        cli_dbgmsg("spin: crc out of bounds, giving up\n");

+        return 1;

+    }

+    key32 = cli_readint32(ep + 0x3217) - summit(src, len);

-      while (notthesamelen) {

-	int xcfailure=0;

-        *emu=exec86(*emu, notthesamelen-- & 0xff, curr, &xcfailure);

-	if (xcfailure) {

-	  cli_dbgmsg("spin: cannot exec section\n");

-	  return 1;

-	}

+    memcpy(src + sections[sectcnt].raw, spinned, sections[sectcnt].rsz);

+    free(spinned);                                                  /* done CRC'ing - can have a dirty buffer now */

+    ep = src + nep + sections[sectcnt].raw - sections[sectcnt].rva; /* Fix the helper */

+

+    if (!CLI_ISCONTAINED(src, ssize, ep + 0x3207, 4))

+    { /* this one holds all ep based checks */

+        cli_dbgmsg("spin: key out of bounds, giving up\n");

+        return 1;

+    }

+    bitmap = cli_readint32(ep + 0x3207);

+    cli_dbgmsg("spin: Key32 is %x - XORbitmap is %x\n", key32, bitmap);

+

+    cli_dbgmsg("spin: Decrypting sects (xor)\n");

+    for (j = 0; j < sectcnt; j++)

+    {

+

+        if (bitmap & 1)

+        {

+            uint32_t size = sections[j].rsz;

+            char *ptr = src + sections[j].raw;

+            uint32_t keydup = key32;

+

+            if (!CLI_ISCONTAINED(src, ssize, ptr, size))

+            {

+                cli_dbgmsg("spin: sect %d out of file, giving up\n", j);

+                return 1; /* FIXME: Already checked in pe.c? */

+            }

+

+            while (size--)

+            {

+                if (!(keydup & 1))

+                {

+                    keydup = keydup >> 1;

+                    keydup ^= 0xed43af31;

+                }

+                else

+                {

+                    keydup = keydup >> 1;

+                }

+                *ptr = *ptr ^ (keydup & 0xff);

+                ptr++;

+            }

+        }

+        bitmap = bitmap >> 1;

+    }

+

+    cli_dbgmsg("spin: done\n");

+

+    curr = ep + 0x644;

+    if ((len = cli_readint32(curr)) != 0x180)

+    {

+        cli_dbgmsg("spin: Not spinned or bad version\n");

+        return 1;

+    }

+

+    key32 = cli_readint32(curr + 0x0c);

+    cli_dbgmsg("spin: Key is %x, Len is %x\n", key32, len);

+    curr = ep + 0x28d3;

+

+    if (!CLI_ISCONTAINED(src, ssize, curr, len))

+    { /* always true but i may decide to remove the previous check */

+        cli_dbgmsg("spin: key out of bounds, giving up\n");

+        return 1;

+    }

+    while (len--)

+    {

+        if (key32 & 1)

+        {

+            key32 = key32 >> 1;

+            key32 ^= 0xed43af32;

+        }

+        else

+        {

+            key32 = key32 >> 1;

+        }

+        *curr = *curr ^ (key32 & 0xff);

+        curr++;

+    }

+

+    curr = ep + 0x28dd;

+    if ((len = cli_readint32(curr)) != 0x1a1)

+    {

+        cli_dbgmsg("spin: Not spinned or bad version\n");

+        return 1;

+    }

+

+    cli_dbgmsg("spin: POLY1 len is %x\n", len);

+    curr += 0xf; /* POLY1 */

+    emu = ep + 0x6d4;

+    if (!CLI_ISCONTAINED(src, ssize, emu, len))

+    {

+        cli_dbgmsg("spin: poly1 out of bounds\n");

+        return 1;

+    }

+    while (len)

+    {

+        int xcfailure = 0;

+        *emu = exec86(*emu, len-- & 0xff, curr, &xcfailure); /* unlame POLY1 */

+        if (xcfailure)

+        {

+            cli_dbgmsg("spin: cannot exec poly1\n");

+            return 1;

+        }

         emu++;

-      }

     }

-      bitmap = bitmap >>1;

-  }

-  

-  cli_dbgmsg("spin: done\n");

-

-  bitmap = cli_readint32(ep+0x3061);

-  bitman = bitmap;

-

-  /* FIXMELIMITS: possibly rewrite to use the limits api */

-  if(ctx->engine->maxfilesize) {

-    unsigned long int filesize = 0;

-    

-    for (j=0; j<sectcnt; j++) {

-      if (bitmap&1) {

-	if ( filesize > ctx->engine->maxfilesize || sections[j].vsz > ctx->engine->maxfilesize - filesize ) return 2;

-	filesize += sections[j].vsz;

-      }

-      bitmap>>=1;

+

+    bitmap = cli_readint32(ep + 0x6f1);

+    cli_dbgmsg("spin: POLYbitmap is %x - decrypting sects (poly)\n", bitmap);

+    curr = ep + 0x755;

+

+    for (j = 0; j < sectcnt; j++)

+    {

+        if (bitmap & 1)

+        {

+            uint32_t notthesamelen = sections[j].rsz;

+

+            emu = src + sections[j].raw;

+

+            if (!CLI_ISCONTAINED(src, ssize, curr, 0x24))

+            { /* section bounds already checked twice now */

+                cli_dbgmsg("spin: poly1 emucode is out of file?\n");

+                return 1;

+            }

+

+            while (notthesamelen)

+            {

+                int xcfailure = 0;

+                *emu = exec86(*emu, notthesamelen-- & 0xff, curr, &xcfailure);

+                if (xcfailure)

+                {

+                    cli_dbgmsg("spin: cannot exec section\n");

+                    return 1;

+                }

+                emu++;

+            }

+        }

+        bitmap = bitmap >> 1;

     }

-    

-    bitmap = bitman;

-  }

-

-  cli_dbgmsg("spin: Compression bitmap is %x\n", bitmap);

-  if ( (sects= (char **) cli_malloc(sectcnt*sizeof(char *))) == NULL ) {

-      cli_dbgmsg("spin: malloc(%lu) failed\n", sectcnt*sizeof(char *));

-    return 1;

-  }

-

-  len = 0;

-  for (j=0; j<sectcnt; j++) {

-    if (bitmap&1) {

-       if ( (sects[j] = (char *) cli_malloc(sections[j].vsz) ) == NULL ) {

-	 cli_dbgmsg("spin: malloc(%d) failed\n", sections[j].vsz);

-	 len = 1;

-	 break;

-       }

-       blobsz+=sections[j].vsz;

-       memset(sects[j], 0, sections[j].vsz);

-       cli_dbgmsg("spin: Growing sect%d: was %x will be %x\n", j, sections[j].rsz, sections[j].vsz);

-       if ( cli_unfsg(src + sections[j].raw, sects[j], sections[j].rsz, sections[j].vsz, NULL, NULL) == -1 ) {

-	 len++;

-         cli_dbgmsg("spin: Unpack failure\n");

-       }

-    } else {

-      blobsz+=sections[j].rsz;

-      sects[j] = src + sections[j].raw;

-      cli_dbgmsg("spin: Not growing sect%d\n", j);

+

+    cli_dbgmsg("spin: done\n");

+

+    bitmap = cli_readint32(ep + 0x3061);

+    bitman = bitmap;

+

+    /* FIXMELIMITS: possibly rewrite to use the limits api */

+    if (ctx->engine->maxfilesize)

+    {

+        unsigned long int filesize = 0;

+

+        for (j = 0; j < sectcnt; j++)

+        {

+            if (bitmap & 1)

+            {

+                if (filesize > ctx->engine->maxfilesize || sections[j].vsz > ctx->engine->maxfilesize - filesize)

+                    return 2;

+                filesize += sections[j].vsz;

+            }

+            bitmap >>= 1;

+        }

+

+        bitmap = bitman;

     }

-    bitmap>>=1;

-  }

-  

-  cli_dbgmsg("spin: decompression complete\n");

- 

-  if ( len ) {

-    int t;

-    for (t=0 ; t<j ; t++) {

-      if (bitman&1)

-	free(sects[t]);

-      bitman = bitman >>1 & 0x7fffffff;

+

+    cli_dbgmsg("spin: Compression bitmap is %x\n", bitmap);

+    if ((sects = (char **)cli_malloc(sectcnt * sizeof(char *))) == NULL)

+    {

+        cli_dbgmsg("spin: malloc(%lu) failed\n", sectcnt * sizeof(char *));

+        return 1;

     }

-    free(sects);

-    return 1;

-  }

+    len = 0;

+    for (j = 0; j < sectcnt; j++)

+    {

+        if (bitmap & 1)

+        {

+            if ((sects[j] = (char *)cli_malloc(sections[j].vsz)) == NULL)

+            {

+                cli_dbgmsg("spin: malloc(%d) failed\n", sections[j].vsz);

+                len = 1;

+                break;

+            }

+            blobsz += sections[j].vsz;

+            memset(sects[j], 0, sections[j].vsz);

+            cli_dbgmsg("spin: Growing sect%d: was %x will be %x\n", j, sections[j].rsz, sections[j].vsz);

+            if (cli_unfsg(src + sections[j].raw, sects[j], sections[j].rsz, sections[j].vsz, NULL, NULL) == -1)

+            {

+                len++;

+                cli_dbgmsg("spin: Unpack failure\n");

+            }

+        }

+        else

+        {

+            blobsz += sections[j].rsz;

+            sects[j] = src + sections[j].raw;

+            cli_dbgmsg("spin: Not growing sect%d\n", j);

+        }

+        bitmap >>= 1;

+    }

-  key32 = cli_readint32(ep+0x2fee);

-  if (key32) {

-    /*    len = cli_readint32(ep+0x2fc8); -- Using vsizes instead */

+    cli_dbgmsg("spin: decompression complete\n");

+

+    if (len)

+    {

+        int t;

+        for (t = 0; t < j; t++)

+        {

+            if (bitman & 1)

+                free(sects[t]);

+            bitman = bitman >> 1 & 0x7fffffff;

+        }

+        free(sects);

+        return 1;

+    }

-    for (j=0; j<sectcnt; j++) {

-      if (sections[j].rva <= key32 && key32-sections[j].rva < sections[j].vsz && CLI_ISCONTAINED(src + sections[j].raw, sections[j].rsz, src + sections[j].raw, key32 - sections[j].rva))

-	break;

+    key32 = cli_readint32(ep + 0x2fee);

+    if (key32)

+    {

+        /*    len = cli_readint32(ep+0x2fc8); -- Using vsizes instead */

+

+        for (j = 0; j < sectcnt; j++)

+        {

+            if (sections[j].rva <= key32 && key32 - sections[j].rva < sections[j].vsz && CLI_ISCONTAINED(src + sections[j].raw, sections[j].rsz, src + sections[j].raw, key32 - sections[j].rva))

+                break;

+        }

+

+        if (j != sectcnt && ((bitman & (1 << j)) == 0))

+        { /* FIXME: not really sure either the res sect is lamed or just compressed, but this'll save some major headakes */

+            cli_dbgmsg("spin: Resources (sect%d) appear to be compressed\n\tuncompressed offset %x, len %x\n\tcompressed offset %x, len %x\n", j, sections[j].rva, key32 - sections[j].rva, key32, sections[j].vsz - (key32 - sections[j].rva));

+

+            if ((curr = (char *)cli_malloc(sections[j].vsz)) != NULL)

+            {

+                memcpy(curr, src + sections[j].raw, key32 - sections[j].rva);                           /* Uncompressed part */

+                memset(curr + key32 - sections[j].rva, 0, sections[j].vsz - (key32 - sections[j].rva)); /* bzero */

+                if (cli_unfsg(src + sections[j].raw + key32 - sections[j].rva, curr + key32 - sections[j].rva, sections[j].rsz - (key32 - sections[j].rva), sections[j].vsz - (key32 - sections[j].rva), NULL, NULL))

+                {

+

+                    free(curr);

+                    cli_dbgmsg("spin: Failed to grow resources, continuing anyway\n");

+                    blobsz += sections[j].rsz;

+                }

+                else

+                {

+                    sects[j] = curr;

+                    bitman |= 1 << j;

+                    cli_dbgmsg("spin: Resources grown\n");

+                    blobsz += sections[j].vsz;

+                }

+            }

+            else

+            {

+                /* malloc failed but i'm too deep into this crap to quit without leaking more :( */

+                cli_dbgmsg("spin: memory allocation failed, continuing anyway\n");

+                blobsz += sections[j].rsz;

+            }

+        }

+        else

+        {

+            cli_dbgmsg("spin: No res?!\n");

+        }

     }

-    if (j!=sectcnt && ((bitman & (1<<j)) == 0)) { /* FIXME: not really sure either the res sect is lamed or just compressed, but this'll save some major headakes */

-      cli_dbgmsg("spin: Resources (sect%d) appear to be compressed\n\tuncompressed offset %x, len %x\n\tcompressed offset %x, len %x\n", j, sections[j].rva, key32 - sections[j].rva, key32, sections[j].vsz - (key32 - sections[j].rva));

-

-      if ( (curr=(char *)cli_malloc(sections[j].vsz)) != NULL ) {

-	memcpy(curr, src + sections[j].raw, key32 - sections[j].rva); /* Uncompressed part */

-	memset(curr + key32 - sections[j].rva, 0, sections[j].vsz - (key32 - sections[j].rva)); /* bzero */

-	if ( cli_unfsg(src + sections[j].raw + key32 - sections[j].rva, curr + key32 - sections[j].rva, sections[j].rsz - (key32 - sections[j].rva), sections[j].vsz - (key32 - sections[j].rva), NULL, NULL) ) {

-      

-	  free(curr);

-	  cli_dbgmsg("spin: Failed to grow resources, continuing anyway\n");

-	  blobsz+=sections[j].rsz;

-	} else {

-	  sects[j]=curr;

-	  bitman|=1<<j;

-	  cli_dbgmsg("spin: Resources grown\n");

-	  blobsz+=sections[j].vsz;

-	}

-      } else {

-	/* malloc failed but i'm too deep into this crap to quit without leaking more :( */

-          cli_dbgmsg("spin: memory allocation failed, continuing anyway\n");

-	blobsz+=sections[j].rsz;

-      }

-    } else {

-      cli_dbgmsg("spin: No res?!\n");

+    bitmap = bitman; /* save as a free() bitmap */

+

+    if ((ep = (char *)cli_malloc(blobsz)) != NULL)

+    {

+        struct cli_exe_section *rebhlp;

+        if ((rebhlp = (struct cli_exe_section *)cli_malloc(sizeof(struct cli_exe_section) * (sectcnt))) != NULL)

+        {

+            char *to = ep;

+            int retval = 0;

+

+            for (j = 0; j < sectcnt; j++)