jory/upx
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

i386 filters 0x46 and 0x49 are the same

Browse Source 
modified:   filter/filter_impl.cpp
	modified:   stub/src/arch/i386/bxx.S
This commit is contained in:
John Reiser 2024-07-20 11:24:25 -07:00
parent d097218a45
commit 6a1e70bf40
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/filter/filter_impl.cpp
View File

@ -204,6 +204,7 @@
{ 0x36, 6, 0x00ffffff, f_ctoj32_e8e9_bswap_le, u_ctoj32_e8e9_bswap_le, s_ctoj32_e8e9_bswap_le },
// 32-bit calltrick with jmp, optional jcc; runtime can unfilter more than one block
// 2024-07-18 Note: two tags for the same filter
{ 0x46, 6, 0x00ffffff, f_ctok32_e8e9_bswap_le, u_ctok32_e8e9_bswap_le, s_ctok32_e8e9_bswap_le },
{ 0x49, 6, 0x00ffffff, f_ctok32_e8e9_bswap_le, u_ctok32_e8e9_bswap_le, s_ctok32_e8e9_bswap_le },

11
src/stub/src/arch/i386/bxx.S
View File

@ -29,7 +29,16 @@
i386bxx: # (*f_unf)(xo->buf, out_len, h.b_cto8, h.b_ftid);
#ifndef NO_METHOD_CHECK
cmpl $0x49,4*NBPW(%esp); jne ckend0 # filter: JMP, CALL, 6-byte Jxx
// 2024-07-18 Filter 0x49 and 0x46 are the same! src/filter/filter_impl.cpp:
// // 32-bit calltrick with jmp, optional jcc; runtime can unfilter more than one block
// { 0x46, 6, 0x00ffffff, f_ctok32_e8e9_bswap_le, u_ctok32_e8e9_bswap_le, s_ctok32_e8e9_bswap_le },
// { 0x49, 6, 0x00ffffff, f_ctok32_e8e9_bswap_le, u_ctok32_e8e9_bswap_le, s_ctok32_e8e9_bswap_le },
//
mov 4*NBPW(%esp),%eax
cmpl $0x49,%eax; je cktop
cmpl $0x46,%eax; je cktop
jmp ckend0
cktop:
#endif
push %ebp; movl %esp,%ebp
push %ebx # C-language saved regs