amd64: stub uses new strategy
modified: stub/src/amd64-linux.elf-entry.S modified: stub/src/amd64-linux.elf-fold.S modified: p_lx_elf.cpp also .h, .bin.dump, .map
This commit is contained in:
John Reiser
@@ -1173,54 +1173,6 @@ void
|
|||||||
PackLinuxElf64amd::defineSymbols(Filter const *ft)
|
PackLinuxElf64amd::defineSymbols(Filter const *ft)
|
||||||
{
|
{
|
||||||
PackLinuxElf64::defineSymbols(ft);
|
PackLinuxElf64::defineSymbols(ft);
|
||||||
|
|
||||||
// We want to know if compressed data, plus stub, plus a couple pages,
|
|
||||||
// will fit below the uncompressed program in memory. But we don't
|
|
||||||
// know the final total compressed size yet, so use the uncompressed
|
|
||||||
// size (total over all PT_LOAD64) as an upper bound.
|
|
||||||
unsigned len = 0; // XXX: 4GB
|
|
||||||
upx_uint64_t lo_va_user = ~0ull; // infinity
|
|
||||||
for (int j= e_phnum; --j>=0; ) {
|
|
||||||
if (PT_LOAD64 == get_te32(&phdri[j].p_type)) {
|
|
||||||
len += (unsigned)get_te64(&phdri[j].p_filesz);
|
|
||||||
upx_uint64_t const va = get_te64(&phdri[j].p_vaddr);
|
|
||||||
if (va < lo_va_user) {
|
|
||||||
lo_va_user = va;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
lsize = /*getLoaderSize()*/ 64 * 1024; // XXX: upper bound; avoid circularity
|
|
||||||
upx_uint64_t lo_va_stub = get_te64(&elfout.phdr[0].p_vaddr);
|
|
||||||
upx_uint64_t adrm;
|
|
||||||
unsigned lenm;
|
|
||||||
unsigned lenu;
|
|
||||||
len += (7&-lsize) + lsize;
|
|
||||||
const upx_uint64_t my_page_size = 4096u;
|
|
||||||
const upx_uint64_t my_page_mask = 0u - my_page_size;
|
|
||||||
is_big = (lo_va_user < (lo_va_stub + len + 2 * my_page_size));
|
|
||||||
if (is_pie || (is_big /*&& ehdri.ET_EXEC==get_te16(&ehdri.e_type)*/)) {
|
|
||||||
// .e_entry is set later by PackLinuxElf64::updateLoader
|
|
||||||
set_te64( &elfout.ehdr.e_entry,
|
|
||||||
get_te64(&elfout.ehdr.e_entry) + lo_va_user - lo_va_stub);
|
|
||||||
set_te64(&elfout.phdr[0].p_vaddr, lo_va_user);
|
|
||||||
set_te64(&elfout.phdr[0].p_paddr, lo_va_user);
|
|
||||||
lo_va_stub = lo_va_user;
|
|
||||||
adrm = getbrk(phdri, e_phnum) - lo_va_user;
|
|
||||||
lenm = my_page_size + len;
|
|
||||||
lenu = my_page_size + len;
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
adrm = len;
|
|
||||||
lenm = my_page_size;
|
|
||||||
lenu = my_page_size + len;
|
|
||||||
}
|
|
||||||
adrm = my_page_mask & (~my_page_mask + adrm); // round up to page boundary
|
|
||||||
|
|
||||||
linker->defineSymbol("LENU", lenu); // len for unmap
|
|
||||||
linker->defineSymbol("LENM", lenm); // len for map
|
|
||||||
linker->defineSymbol("ADRM", adrm); // offset from &Elf64_Ehdr
|
|
||||||
|
|
||||||
//linker->dumpSymbols(); // debug
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static const
|
static const
|
||||||
|
|||||||
+597
-629
File diff suppressed because it is too large
Load Diff
+118
-119
@@ -1,5 +1,5 @@
|
|||||||
/* amd64-linux.elf-fold.h
|
/* amd64-linux.elf-fold.h
|
||||||
created from amd64-linux.elf-fold.bin, 2050 (0x802) bytes
|
created from amd64-linux.elf-fold.bin, 2042 (0x7fa) bytes
|
||||||
|
|
||||||
This file is part of the UPX executable compressor.
|
This file is part of the UPX executable compressor.
|
||||||
|
|
||||||
@@ -31,20 +31,20 @@
|
|||||||
*/
|
*/
|
||||||
|
|
||||||
|
|
||||||
#define STUB_AMD64_LINUX_ELF_FOLD_SIZE 2050
|
#define STUB_AMD64_LINUX_ELF_FOLD_SIZE 2042
|
||||||
#define STUB_AMD64_LINUX_ELF_FOLD_ADLER32 0xb09b0569
|
#define STUB_AMD64_LINUX_ELF_FOLD_ADLER32 0xc1fc053c
|
||||||
#define STUB_AMD64_LINUX_ELF_FOLD_CRC32 0x523d8b2c
|
#define STUB_AMD64_LINUX_ELF_FOLD_CRC32 0x0ce68681
|
||||||
|
|
||||||
unsigned char stub_amd64_linux_elf_fold[2050] = {
|
unsigned char stub_amd64_linux_elf_fold[2042] = {
|
||||||
/* 0x0000 */ 127, 69, 76, 70, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
/* 0x0000 */ 127, 69, 76, 70, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
||||||
/* 0x0010 */ 2, 0, 62, 0, 1, 0, 0, 0,188, 0, 16, 0, 0, 0, 0, 0,
|
/* 0x0010 */ 2, 0, 62, 0, 1, 0, 0, 0,188, 0, 16, 0, 0, 0, 0, 0,
|
||||||
/* 0x0020 */ 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
/* 0x0020 */ 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
||||||
/* 0x0030 */ 0, 0, 0, 0, 64, 0, 56, 0, 2, 0, 0, 0, 0, 0, 0, 0,
|
/* 0x0030 */ 0, 0, 0, 0, 64, 0, 56, 0, 2, 0, 0, 0, 0, 0, 0, 0,
|
||||||
/* 0x0040 */ 1, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
/* 0x0040 */ 1, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
||||||
/* 0x0050 */ 0, 0, 16, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0,
|
/* 0x0050 */ 0, 0, 16, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0,
|
||||||
/* 0x0060 */ 2, 8, 0, 0, 0, 0, 0, 0, 4, 8, 0, 0, 0, 0, 0, 0,
|
/* 0x0060 */ 250, 7, 0, 0, 0, 0, 0, 0,252, 7, 0, 0, 0, 0, 0, 0,
|
||||||
/* 0x0070 */ 0, 0, 16, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0,
|
/* 0x0070 */ 0, 0, 16, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0,
|
||||||
/* 0x0080 */ 2, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
/* 0x0080 */ 250, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
||||||
/* 0x0090 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
/* 0x0090 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
||||||
/* 0x00a0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0,
|
/* 0x00a0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0,
|
||||||
/* 0x00b0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,232, 89, 0, 0,
|
/* 0x00b0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,232, 89, 0, 0,
|
||||||
@@ -53,116 +53,115 @@ unsigned char stub_amd64_linux_elf_fold[2050] = {
|
|||||||
/* 0x00e0 */ 47, 72, 57,206,115, 50, 86, 94,172, 60,128,114, 10, 60,143,119,
|
/* 0x00e0 */ 47, 72, 57,206,115, 50, 86, 94,172, 60,128,114, 10, 60,143,119,
|
||||||
/* 0x00f0 */ 6,128,126,254, 15,116, 6, 44,232, 60, 1,119,228, 72, 57,206,
|
/* 0x00f0 */ 6,128,126,254, 15,116, 6, 44,232, 60, 1,119,228, 72, 57,206,
|
||||||
/* 0x0100 */ 115, 22, 86,173, 40,208,117,223, 95, 15,200, 41,248, 1,216,171,
|
/* 0x0100 */ 115, 22, 86,173, 40,208,117,223, 95, 15,200, 41,248, 1,216,171,
|
||||||
/* 0x0110 */ 72, 57,206,115, 3,172,235,223, 91,195, 91, 72,141, 67, 15, 80,
|
/* 0x0110 */ 72, 57,206,115, 3,172,235,223, 91,195, 91, 65, 86, 65, 87, 72,
|
||||||
/* 0x0120 */ 72,137,230, 72,129,236, 0, 16, 0, 0, 84, 95,106, 7, 89,243,
|
/* 0x0120 */ 141, 67, 15, 80, 72,137,230, 72,129,236, 0, 16, 0, 0, 84, 95,
|
||||||
/* 0x0130 */ 72,165, 72,131, 62, 0, 72,165,117,248, 73,137,254, 72,171, 72,
|
/* 0x0130 */ 106, 9, 89,243, 72,165, 72,131, 62, 0, 72,165,117,248, 73,137,
|
||||||
/* 0x0140 */ 131, 62, 0, 72,165,117,248, 73,137,252, 72,131, 62, 0, 72,165,
|
/* 0x0140 */ 254, 72,171, 72,131, 62, 0, 72,165,117,248, 73,137,252, 72,131,
|
||||||
/* 0x0150 */ 72,165,117,246, 73,137,255, 73,137,245, 77, 41,252,106, 89,186,
|
/* 0x0150 */ 62, 0, 72,165, 72,165,117,246, 73,137,255, 73,137,245, 77, 41,
|
||||||
/* 0x0160 */ 255, 15, 0, 0, 87, 94, 83, 95, 88, 15, 5,133,192,121, 5, 83,
|
/* 0x0160 */ 252,186,255, 15, 0, 0, 87, 94, 83, 95,106, 89, 88, 15, 5,133,
|
||||||
/* 0x0170 */ 94,106, 14, 88,145,253, 73,141,125,255,176, 0,170, 72,141,116,
|
/* 0x0170 */ 192,121, 5, 83, 94,106, 14, 88,145,253, 73,141,125,255,176, 0,
|
||||||
/* 0x0180 */ 14,255,243,164, 72,131,239, 3,199, 7, 32, 32, 32, 61, 73,137,
|
/* 0x0180 */ 170, 72,141,116, 14,255,243,164, 72,131,239, 3,199, 7, 32, 32,
|
||||||
/* 0x0190 */ 62, 72,131,231,248, 76,137,249, 72, 41,225,137,200, 49,248,131,
|
/* 0x0190 */ 32, 61, 73,137, 62, 72,131,231,248, 76,137,249, 72, 41,225,137,
|
||||||
/* 0x01a0 */ 224, 8, 72, 41,199, 73,137,254, 72,131,239, 8, 73,141,119,248,
|
/* 0x01a0 */ 200, 49,248,131,224, 8, 72, 41,199, 73,137,254, 72,131,239, 8,
|
||||||
/* 0x01b0 */ 72,193,233, 3,243, 72,165, 72,141,103, 8,252, 75,141, 12, 38,
|
/* 0x01b0 */ 73,141,119,248, 72,193,233, 3,243, 72,165, 72,141,103, 8,252,
|
||||||
/* 0x01c0 */ 65, 89, 94, 95, 72,139, 68, 36, 16, 72,129,236, 0, 8, 0, 0,
|
/* 0x01c0 */ 75,141, 12, 38, 65, 89, 94, 95, 88, 72,129,236, 0, 8, 0, 0,
|
||||||
/* 0x01d0 */ 72,137,226, 73,137,232, 80,232,227, 4, 0, 0, 80, 93, 90, 72,
|
/* 0x01d0 */ 80, 72,137,226, 73,137,232,232,219, 4, 0, 0, 72,129,196, 8,
|
||||||
/* 0x01e0 */ 129,196, 0, 8, 0, 0,106, 2, 41,246, 83, 95, 88, 15, 5,147,
|
/* 0x01e0 */ 8, 0, 0, 72,137, 68, 36, 24, 91, 69, 41,201, 65,137,216,106,
|
||||||
/* 0x01f0 */ 106, 9, 69, 41,201, 65,137,216,106, 2, 65, 90,106, 1, 90,190,
|
/* 0x01f0 */ 2, 65, 90,106, 1, 90,190, 0, 16, 0, 0,106, 0, 95,106, 9,
|
||||||
/* 0x0200 */ 0, 16, 0, 0,106, 0, 95, 88, 15, 5,106, 3,137,223, 88, 15,
|
/* 0x0200 */ 88, 15, 5,137,223,106, 3, 88, 15, 5, 95, 94,106, 11, 88, 65,
|
||||||
/* 0x0210 */ 5, 94, 95, 89, 85,106, 11, 88, 65,255,102,248,176, 9, 73,137,
|
/* 0x0210 */ 255,102,248,176, 9, 73,137,202, 15,182,192, 15, 5, 72, 61, 0,
|
||||||
/* 0x0220 */ 202, 15,182,192, 15, 5, 72, 61, 0,240,255,255,114, 4, 72,131,
|
/* 0x0220 */ 240,255,255,114, 4, 72,131,200,255,195,176, 60,235, 2,176, 12,
|
||||||
/* 0x0230 */ 200,255,195,176, 60,235, 2,176, 12,235, 2,176, 3,235, 2,176,
|
/* 0x0230 */ 235, 2,176, 3,235, 2,176, 2,235, 2,176, 11,235, 2,176, 10,
|
||||||
/* 0x0240 */ 2,235, 2,176, 11,235, 2,176, 10,235, 2,176, 1,235, 2,176,
|
/* 0x0240 */ 235, 2,176, 1,235, 2,176, 0,235,206, 0, 0, 81, 72, 57, 23,
|
||||||
/* 0x0250 */ 0,235,206, 0, 81, 72, 57, 23, 76,139, 71, 8, 72,141, 74,255,
|
/* 0x0250 */ 76,139, 71, 8, 72,141, 74,255,115, 10,191,127, 0, 0, 0,232,
|
||||||
/* 0x0260 */ 115, 10,191,127, 0, 0, 0,232,199,255,255,255, 72,131,249,255,
|
/* 0x0260 */ 198,255,255,255, 72,131,249,255,116, 17, 65, 15,182, 0, 72,255,
|
||||||
/* 0x0270 */ 116, 17, 65, 15,182, 0, 72,255,201, 73,255,192,136, 6, 72,255,
|
/* 0x0270 */ 201, 73,255,192,136, 6, 72,255,198,235,233, 72, 1, 87, 8, 72,
|
||||||
/* 0x0280 */ 198,235,233, 72, 1, 87, 8, 72, 41, 23, 88,195, 65, 85, 73,137,
|
/* 0x0280 */ 41, 23, 88,195, 65, 85, 73,137,213, 65, 84, 73,137,204, 85, 72,
|
||||||
/* 0x0290 */ 213, 65, 84, 73,137,204, 85, 72,137,253, 83, 72,137,243, 72,131,
|
/* 0x0290 */ 137,253, 83, 72,137,243, 72,131,236, 40, 72,131, 62, 0, 15,132,
|
||||||
/* 0x02a0 */ 236, 40, 72,131, 62, 0, 15,132,230, 0, 0, 0, 72,141,116, 36,
|
/* 0x02a0 */ 230, 0, 0, 0, 72,141,116, 36, 16,186, 12, 0, 0, 0, 72,137,
|
||||||
/* 0x02b0 */ 16,186, 12, 0, 0, 0, 72,137,239,232,150,255,255,255,139, 68,
|
/* 0x02b0 */ 239,232,150,255,255,255,139, 68, 36, 16,139,116, 36, 20,133,192,
|
||||||
/* 0x02c0 */ 36, 16,139,116, 36, 20,133,192,117, 21,129,254, 85, 80, 88, 33,
|
/* 0x02c0 */ 117, 21,129,254, 85, 80, 88, 33,117, 17, 72,131,125, 0, 0, 15,
|
||||||
/* 0x02d0 */ 117, 17, 72,131,125, 0, 0, 15,132,181, 0, 0, 0,235, 4,133,
|
/* 0x02d0 */ 132,181, 0, 0, 0,235, 4,133,246,117, 10,191,127, 0, 0, 0,
|
||||||
/* 0x02e0 */ 246,117, 10,191,127, 0, 0, 0,232, 70,255,255,255, 57,198,119,
|
/* 0x02e0 */ 232, 69,255,255,255, 57,198,119,242,137,194, 72, 59, 19,119,235,
|
||||||
/* 0x02f0 */ 242,137,194, 72, 59, 19,119,235, 57,198, 72,139, 67, 8,115,108,
|
/* 0x02f0 */ 57,198, 72,139, 67, 8,115,108, 72,137, 84, 36, 8, 72,139,125,
|
||||||
/* 0x0300 */ 72,137, 84, 36, 8, 72,139,125, 8, 72,141, 76, 36, 8, 68,139,
|
/* 0x0300 */ 8, 72,141, 76, 36, 8, 68,139, 68, 36, 24, 72,137,194, 65,255,
|
||||||
/* 0x0310 */ 68, 36, 24, 72,137,194, 65,255,213,133,192,117,198,139, 68, 36,
|
/* 0x0310 */ 213,133,192,117,198,139, 68, 36, 16, 72,139,116, 36, 8, 72, 57,
|
||||||
/* 0x0320 */ 16, 72,139,116, 36, 8, 72, 57,198,117,184, 15,182, 76, 36, 25,
|
/* 0x0320 */ 198,117,184, 15,182, 76, 36, 25,132,201, 15,149,194, 49,192, 77,
|
||||||
/* 0x0330 */ 132,201, 15,149,194, 49,192, 77,133,228, 15,149,192,133,194,116,
|
/* 0x0330 */ 133,228, 15,149,192,133,194,116, 29, 72,129,254, 0, 2, 0, 0,
|
||||||
/* 0x0340 */ 29, 72,129,254, 0, 2, 0, 0,119, 5, 72, 57, 51,117, 15, 15,
|
/* 0x0340 */ 119, 5, 72, 57, 51,117, 15, 15,182, 84, 36, 26, 15,182,201, 72,
|
||||||
/* 0x0350 */ 182, 84, 36, 26, 15,182,201, 72,139,123, 8, 65,255,212,139, 68,
|
/* 0x0350 */ 139,123, 8, 65,255,212,139, 68, 36, 20, 72, 1, 69, 8, 72, 41,
|
||||||
/* 0x0360 */ 36, 20, 72, 1, 69, 8, 72, 41, 69, 0,235, 13,137,242, 72,137,
|
/* 0x0360 */ 69, 0,235, 13,137,242, 72,137,239, 72,137,198,232,219,254,255,
|
||||||
/* 0x0370 */ 239, 72,137,198,232,219,254,255,255,139, 84, 36, 16, 72,139, 3,
|
/* 0x0370 */ 255,139, 84, 36, 16, 72,139, 3, 72, 1, 83, 8, 72, 41,208, 72,
|
||||||
/* 0x0380 */ 72, 1, 83, 8, 72, 41,208, 72,133,192, 72,137, 3,233, 20,255,
|
/* 0x0380 */ 133,192, 72,137, 3,233, 20,255,255,255, 72,131,196, 40, 91, 93,
|
||||||
/* 0x0390 */ 255,255, 72,131,196, 40, 91, 93, 65, 92, 65, 93,195, 72,133,255,
|
/* 0x0390 */ 65, 92, 65, 93,195, 72,133,255, 73,137,208,116, 41, 72,139, 7,
|
||||||
/* 0x03a0 */ 73,137,208,116, 41, 72,139, 7,137,241, 72, 57,200,116, 17, 72,
|
/* 0x03a0 */ 137,241, 72, 57,200,116, 17, 72,255,200, 15,148,194, 49,192,133,
|
||||||
/* 0x03b0 */ 255,200, 15,148,194, 49,192,133,246, 15,149,192,133,194,116, 8,
|
/* 0x03b0 */ 246, 15,149,192,133,194,116, 8, 72,137, 15, 76,137, 71, 8,195,
|
||||||
/* 0x03c0 */ 72,137, 15, 76,137, 71, 8,195, 72,131,199, 16,235,215,195, 65,
|
/* 0x03c0 */ 72,131,199, 16,235,215,195, 65, 87,184, 0, 0, 0, 0, 73,137,
|
||||||
/* 0x03d0 */ 87,184, 0, 0, 0, 0, 73,137,255, 65, 86, 65, 85, 65, 84, 73,
|
/* 0x03d0 */ 255, 65, 86, 65, 85, 65, 84, 73,137,252, 85, 83, 72,131,236,104,
|
||||||
/* 0x03e0 */ 137,252, 85, 83, 72,131,236,104, 76, 3,103, 32,102,131,127, 16,
|
/* 0x03e0 */ 76, 3,103, 32,102,131,127, 16, 3,137, 84, 36, 60, 15,183, 87,
|
||||||
/* 0x03f0 */ 3,137, 84, 36, 60, 15,183, 87, 56, 72,137, 76, 36, 48,185, 16,
|
/* 0x03f0 */ 56, 72,137, 76, 36, 48,185, 16, 0, 0, 0, 72,137,116, 36, 64,
|
||||||
/* 0x0400 */ 0, 0, 0, 72,137,116, 36, 64, 76,137, 68, 36, 40, 76,137, 76,
|
/* 0x0400 */ 76,137, 68, 36, 40, 76,137, 76, 36, 32, 15, 68,200, 76,137,230,
|
||||||
/* 0x0410 */ 36, 32, 15, 68,200, 76,137,230, 72,131,205,255, 49,219,131,193,
|
/* 0x0410 */ 72,131,205,255, 49,219,131,193, 34,255,202,120, 33,131, 62, 1,
|
||||||
/* 0x0420 */ 34,255,202,120, 33,131, 62, 1,117, 22, 72,139, 70, 16, 72, 57,
|
/* 0x0420 */ 117, 22, 72,139, 70, 16, 72, 57,232, 72, 15, 66,232, 72, 3, 70,
|
||||||
/* 0x0430 */ 232, 72, 15, 66,232, 72, 3, 70, 40, 72, 57,195, 72, 15, 66,216,
|
/* 0x0430 */ 40, 72, 57,195, 72, 15, 66,216, 72,131,198, 56,235,219, 72,129,
|
||||||
/* 0x0440 */ 72,131,198, 56,235,219, 72,129,229, 0,240,255,255, 49,210, 69,
|
/* 0x0440 */ 229, 0,240,255,255, 49,210, 69, 49,201, 72, 41,235, 65,131,200,
|
||||||
/* 0x0450 */ 49,201, 72, 41,235, 65,131,200,255, 72,137,239, 72,129,195,255,
|
/* 0x0450 */ 255, 72,137,239, 72,129,195,255, 15, 0, 0, 72,129,227, 0,240,
|
||||||
/* 0x0460 */ 15, 0, 0, 72,129,227, 0,240,255,255, 72,137,222,232,170,253,
|
/* 0x0460 */ 255,255, 72,137,222,232,169,253,255,255, 72,141, 20, 24, 72, 41,
|
||||||
/* 0x0470 */ 255,255, 72,141, 20, 24, 72, 41,232,102, 65,131,127, 56, 0, 72,
|
/* 0x0470 */ 232,102, 65,131,127, 56, 0, 72,137, 68, 36, 24,199, 68, 36, 20,
|
||||||
/* 0x0480 */ 137, 68, 36, 24,199, 68, 36, 20, 0, 0, 0, 0, 72,137, 84, 36,
|
/* 0x0480 */ 0, 0, 0, 0, 72,137, 84, 36, 72, 15,132,240, 1, 0, 0, 72,
|
||||||
/* 0x0490 */ 72, 15,132,240, 1, 0, 0, 72,131,124, 36, 64, 0,116, 37, 65,
|
/* 0x0490 */ 131,124, 36, 64, 0,116, 37, 65,131, 60, 36, 6,117, 30, 72,139,
|
||||||
/* 0x04a0 */ 131, 60, 36, 6,117, 30, 72,139, 84, 36, 24, 73, 3, 84, 36, 16,
|
/* 0x04a0 */ 84, 36, 24, 73, 3, 84, 36, 16,190, 3, 0, 0, 0, 72,139,124,
|
||||||
/* 0x04b0 */ 190, 3, 0, 0, 0, 72,139,124, 36, 48,232,222,254,255,255,233,
|
/* 0x04b0 */ 36, 48,232,222,254,255,255,233,172, 1, 0, 0, 65,131, 60, 36,
|
||||||
/* 0x04c0 */ 172, 1, 0, 0, 65,131, 60, 36, 1, 15,133,161, 1, 0, 0, 72,
|
/* 0x04c0 */ 1, 15,133,161, 1, 0, 0, 72,131,124, 36, 64, 0,116, 77, 73,
|
||||||
/* 0x04d0 */ 131,124, 36, 64, 0,116, 77, 73,131,124, 36, 8, 0,117, 69, 72,
|
/* 0x04d0 */ 131,124, 36, 8, 0,117, 69, 72,139, 84, 36, 24, 73, 3, 84, 36,
|
||||||
/* 0x04e0 */ 139, 84, 36, 24, 73, 3, 84, 36, 16,190, 3, 0, 0, 0, 73, 3,
|
/* 0x04e0 */ 16,190, 3, 0, 0, 0, 73, 3, 87, 32, 72,139,124, 36, 48,232,
|
||||||
/* 0x04f0 */ 87, 32, 72,139,124, 36, 48,232,161,254,255,255, 73, 15,183, 87,
|
/* 0x04f0 */ 161,254,255,255, 73, 15,183, 87, 56, 72,139,124, 36, 48,190, 5,
|
||||||
/* 0x0500 */ 56, 72,139,124, 36, 48,190, 5, 0, 0, 0,232,141,254,255,255,
|
/* 0x0500 */ 0, 0, 0,232,141,254,255,255, 73, 15,183, 87, 54, 72,139,124,
|
||||||
/* 0x0510 */ 73, 15,183, 87, 54, 72,139,124, 36, 48,190, 4, 0, 0, 0,232,
|
/* 0x0510 */ 36, 48,190, 4, 0, 0, 0,232,121,254,255,255, 72,139, 68, 36,
|
||||||
/* 0x0520 */ 121,254,255,255, 72,139, 68, 36, 24, 73, 3, 68, 36, 16, 65,190,
|
/* 0x0520 */ 24, 73, 3, 68, 36, 16, 65,190, 64, 98, 81,115, 65,139, 76, 36,
|
||||||
/* 0x0530 */ 64, 98, 81,115, 65,139, 76, 36, 4, 65,131,200,255, 73,139, 84,
|
/* 0x0530 */ 4, 65,131,200,255, 73,139, 84, 36, 32, 72,137,197, 72,137, 68,
|
||||||
/* 0x0540 */ 36, 32, 72,137,197, 72,137, 68, 36, 88, 73,139, 68, 36, 40,131,
|
/* 0x0540 */ 36, 88, 73,139, 68, 36, 40,131,225, 7, 72,137,235, 72,137, 84,
|
||||||
/* 0x0550 */ 225, 7, 72,137,235, 72,137, 84, 36, 80,193,225, 2,129,227,255,
|
/* 0x0550 */ 36, 80,193,225, 2,129,227,255, 15, 0, 0, 72, 1,232, 65,211,
|
||||||
/* 0x0560 */ 15, 0, 0, 72, 1,232, 65,211,238, 72, 41,221, 72,137, 68, 36,
|
/* 0x0560 */ 238, 72, 41,221, 72,137, 68, 36, 8, 73,139, 68, 36, 8, 65,131,
|
||||||
/* 0x0570 */ 8, 73,139, 68, 36, 8, 65,131,230, 7, 76,141, 44, 26,185, 50,
|
/* 0x0570 */ 230, 7, 76,141, 44, 26,185, 50, 0, 0, 0, 72, 41,216, 72,131,
|
||||||
/* 0x0580 */ 0, 0, 0, 72, 41,216, 72,131,124, 36, 64, 0,117, 7, 68,139,
|
/* 0x0580 */ 124, 36, 64, 0,117, 7, 68,139, 68, 36, 60,177, 18, 68,137,242,
|
||||||
/* 0x0590 */ 68, 36, 60,177, 18, 68,137,242, 73,137,193, 76,137,238,131,202,
|
/* 0x0590 */ 73,137,193, 76,137,238,131,202, 2, 72,131,124, 36, 64, 0, 72,
|
||||||
/* 0x05a0 */ 2, 72,131,124, 36, 64, 0, 72,137,239, 65, 15, 68,214,232,105,
|
/* 0x05a0 */ 137,239, 65, 15, 68,214,232,104,252,255,255, 72, 57,197,117,121,
|
||||||
/* 0x05b0 */ 252,255,255, 72, 57,197,117,121, 72,131,124, 36, 64, 0,116, 25,
|
/* 0x05b0 */ 72,131,124, 36, 64, 0,116, 25, 72,139, 76, 36, 32, 72,139, 84,
|
||||||
/* 0x05c0 */ 72,139, 76, 36, 32, 72,139, 84, 36, 40, 72,141,116, 36, 80, 72,
|
/* 0x05c0 */ 36, 40, 72,141,116, 36, 80, 72,139,124, 36, 64,232,179,252,255,
|
||||||
/* 0x05d0 */ 139,124, 36, 64,232,179,252,255,255, 76,137,235, 72,247,219,129,
|
/* 0x05d0 */ 255, 76,137,235, 72,247,219,129,227,255, 15, 0, 0, 65,246,198,
|
||||||
/* 0x05e0 */ 227,255, 15, 0, 0, 65,246,198, 2,116, 13, 74,141,124, 45, 0,
|
/* 0x05e0 */ 2,116, 13, 74,141,124, 45, 0, 49,192, 72,137,217,252,243,170,
|
||||||
/* 0x05f0 */ 49,192, 72,137,217,252,243,170, 72,131,124, 36, 64, 0,116, 59,
|
/* 0x05f0 */ 72,131,124, 36, 64, 0,116, 59, 73,131,124, 36, 8, 0,117, 23,
|
||||||
/* 0x0600 */ 73,131,124, 36, 8, 0,117, 23, 72,139,124, 36, 48, 72,141, 85,
|
/* 0x0600 */ 72,139,124, 36, 48, 72,141, 85, 12,199, 69, 12, 15, 5,195,144,
|
||||||
/* 0x0610 */ 12,199, 69, 12, 15, 5,195,144, 49,246,232,126,253,255,255, 68,
|
/* 0x0610 */ 49,246,232,126,253,255,255, 68,137,242, 76,137,238, 72,137,239,
|
||||||
/* 0x0620 */ 137,242, 76,137,238, 72,137,239,232, 26,252,255,255,133,192,116,
|
/* 0x0620 */ 232, 25,252,255,255,133,192,116, 10,191,127, 0, 0, 0,232,247,
|
||||||
/* 0x0630 */ 10,191,127, 0, 0, 0,232,248,251,255,255, 73,141, 68, 29, 0,
|
/* 0x0630 */ 251,255,255, 73,141, 68, 29, 0, 72, 1,197, 72, 59,108, 36, 8,
|
||||||
/* 0x0640 */ 72, 1,197, 72, 59,108, 36, 8,115, 38, 72, 41,108, 36, 8, 69,
|
/* 0x0640 */ 115, 38, 72, 41,108, 36, 8, 69, 49,201, 65,131,200,255, 72,139,
|
||||||
/* 0x0650 */ 49,201, 65,131,200,255, 72,139,116, 36, 8,185, 50, 0, 0, 0,
|
/* 0x0650 */ 116, 36, 8,185, 50, 0, 0, 0, 68,137,242, 72,137,239,232,176,
|
||||||
/* 0x0660 */ 68,137,242, 72,137,239,232,177,251,255,255, 72, 57,197,117,193,
|
/* 0x0660 */ 251,255,255, 72, 57,197,117,193,255, 68, 36, 20, 65, 15,183, 71,
|
||||||
/* 0x0670 */ 255, 68, 36, 20, 65, 15,183, 71, 56, 73,131,196, 56, 57, 68, 36,
|
/* 0x0670 */ 56, 73,131,196, 56, 57, 68, 36, 20, 15,140, 16,254,255,255, 72,
|
||||||
/* 0x0680 */ 20, 15,140, 16,254,255,255, 72,131,188, 36,160, 0, 0, 0, 0,
|
/* 0x0680 */ 131,188, 36,160, 0, 0, 0, 0,116, 16, 72,139, 68, 36, 24, 72,
|
||||||
/* 0x0690 */ 116, 16, 72,139, 68, 36, 24, 72,139,148, 36,160, 0, 0, 0, 72,
|
/* 0x0690 */ 139,148, 36,160, 0, 0, 0, 72,137, 2, 73,139, 87, 24, 72, 1,
|
||||||
/* 0x06a0 */ 137, 2, 73,139, 87, 24, 72, 1, 84, 36, 24, 72,139, 68, 36, 24,
|
/* 0x06a0 */ 84, 36, 24, 72,139, 68, 36, 24, 72,131,196,104, 91, 93, 65, 92,
|
||||||
/* 0x06b0 */ 72,131,196,104, 91, 93, 65, 92, 65, 93, 65, 94, 65, 95,195, 65,
|
/* 0x06b0 */ 65, 93, 65, 94, 65, 95,195, 65, 87, 65, 86, 73,137,206, 49,201,
|
||||||
/* 0x06c0 */ 87, 65, 86, 73,137,206, 49,201, 65, 85, 65, 84, 77,137,204, 85,
|
/* 0x06c0 */ 65, 85, 65, 84, 77,137,204, 85, 72,137,213, 76,141,109, 64, 83,
|
||||||
/* 0x06d0 */ 72,137,213, 76,141,109, 64, 83, 76,137,195, 72,131,236, 72,139,
|
/* 0x06d0 */ 76,137,195, 72,131,236, 72,139, 7, 72,137,124, 36, 24, 72,137,
|
||||||
/* 0x06e0 */ 7, 72,137,124, 36, 24, 72,137,116, 36, 16, 72,137,124, 36, 40,
|
/* 0x06e0 */ 116, 36, 16, 72,137,124, 36, 40, 72,137,116, 36, 32, 72,141,124,
|
||||||
/* 0x06f0 */ 72,137,116, 36, 32, 72,141,124, 36, 16, 72,141,116, 36, 48, 72,
|
/* 0x06f0 */ 36, 16, 72,141,116, 36, 48, 72,137, 84, 36, 56, 76,137,194, 72,
|
||||||
/* 0x0700 */ 137, 84, 36, 56, 76,137,194, 72,137, 68, 36, 48,232,123,251,255,
|
/* 0x0700 */ 137, 68, 36, 48,232,123,251,255,255, 72,141,132, 36,128, 0, 0,
|
||||||
/* 0x0710 */ 255, 72,141,132, 36,128, 0, 0, 0, 72,137, 68, 36, 8, 65, 83,
|
/* 0x0710 */ 0, 72,137, 68, 36, 8, 65, 83, 77,137,225, 49,210, 73,137,216,
|
||||||
/* 0x0720 */ 77,137,225, 49,210, 73,137,216, 72,141,116, 36, 40, 80, 76,137,
|
/* 0x0720 */ 72,141,116, 36, 40, 80, 76,137,241, 72,137,239, 69, 49,255,232,
|
||||||
/* 0x0730 */ 241, 72,137,239, 69, 49,255,232,147,252,255,255,190, 9, 0, 0,
|
/* 0x0730 */ 147,252,255,255,190, 9, 0, 0, 0, 72,137,194, 76,137,247, 73,
|
||||||
/* 0x0740 */ 0, 72,137,194, 76,137,247, 73,137,196,232, 78,252,255,255,102,
|
/* 0x0740 */ 137,196,232, 78,252,255,255,102,131,125, 56, 0, 65, 89, 65, 90,
|
||||||
/* 0x0750 */ 131,125, 56, 0, 65, 89, 65, 90, 15,132,146, 0, 0, 0, 65,131,
|
/* 0x0750 */ 15,132,146, 0, 0, 0, 65,131,125, 0, 3,117,119, 72,139, 68,
|
||||||
/* 0x0760 */ 125, 0, 3,117,119, 72,139, 68, 36, 8, 49,210, 49,246, 72,139,
|
/* 0x0760 */ 36, 8, 49,210, 49,246, 72,139, 56, 73, 3,125, 16,232,196,250,
|
||||||
/* 0x0770 */ 56, 73, 3,125, 16,232,197,250,255,255,133,192,137,195,120, 23,
|
/* 0x0770 */ 255,255,133,192,137,195,120, 23,186, 0, 4, 0, 0, 72,137,238,
|
||||||
/* 0x0780 */ 186, 0, 4, 0, 0, 72,137,238,137,199,232,192,250,255,255, 72,
|
/* 0x0780 */ 137,199,232,191,250,255,255, 72, 61, 0, 4, 0, 0,116, 10,191,
|
||||||
/* 0x0790 */ 61, 0, 4, 0, 0,116, 10,191,127, 0, 0, 0,232,146,250,255,
|
/* 0x0790 */ 127, 0, 0, 0,232,145,250,255,255, 65, 80,255,116, 36, 16, 69,
|
||||||
/* 0x07a0 */ 255, 65, 80,255,116, 36, 16, 69, 49,201, 69, 49,192, 49,201,137,
|
/* 0x07a0 */ 49,201, 69, 49,192, 49,201,137,218, 49,246, 72,137,239,232, 20,
|
||||||
/* 0x07b0 */ 218, 49,246, 72,137,239,232, 20,252,255,255, 73,137,196, 72,139,
|
/* 0x07b0 */ 252,255,255, 73,137,196, 72,139, 68, 36, 24,190, 7, 0, 0, 0,
|
||||||
/* 0x07c0 */ 68, 36, 24,190, 7, 0, 0, 0, 76,137,247, 72,139, 16,232,202,
|
/* 0x07c0 */ 76,137,247, 72,139, 16,232,202,251,255,255,137,223,232, 96,250,
|
||||||
/* 0x07d0 */ 251,255,255,137,223,232, 97,250,255,255, 94, 95, 15,183, 69, 56,
|
/* 0x07d0 */ 255,255, 94, 95, 15,183, 69, 56, 65,255,199, 73,131,197, 56, 65,
|
||||||
/* 0x07e0 */ 65,255,199, 73,131,197, 56, 65, 57,199, 15,130,110,255,255,255,
|
/* 0x07e0 */ 57,199, 15,130,110,255,255,255, 72,131,196, 72, 76,137,224, 91,
|
||||||
/* 0x07f0 */ 72,131,196, 72, 76,137,224, 91, 93, 65, 92, 65, 93, 65, 94, 65,
|
/* 0x07f0 */ 93, 65, 92, 65, 93, 65, 94, 65, 95,195
|
||||||
/* 0x0800 */ 95,195
|
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -66,11 +66,14 @@ M_NRV2E_LE32=8
|
|||||||
|
|
||||||
|
|
||||||
section ELFMAINX
|
section ELFMAINX
|
||||||
|
sz_pack2= .-4
|
||||||
_start: .globl _start
|
_start: .globl _start
|
||||||
|
//// nop; int3 # uncomment for debugging
|
||||||
|
push %rax // space for entry address
|
||||||
call main // push &decompress
|
call main // push &decompress
|
||||||
ret_main:
|
|
||||||
|
|
||||||
/* Returns 0 on success; non-zero on failure. */
|
/* Returns 0 on success; non-zero on failure. */
|
||||||
|
f_exp: // shorter name
|
||||||
decompress: // (uchar const *src, size_t lsrc, uchar *dst, u32 &ldst, uint method)
|
decompress: // (uchar const *src, size_t lsrc, uchar *dst, u32 &ldst, uint method)
|
||||||
|
|
||||||
/* Arguments according to calling convention */
|
/* Arguments according to calling convention */
|
||||||
@@ -190,8 +193,11 @@ eof:
|
|||||||
ret
|
ret
|
||||||
|
|
||||||
/* These from /usr/include/asm-x86_64/unistd.h */
|
/* These from /usr/include/asm-x86_64/unistd.h */
|
||||||
__NR_write = 1
|
__NR_exit= 60
|
||||||
__NR_exit = 60
|
__NR_mmap= 9
|
||||||
|
__NR_mprotect= 10
|
||||||
|
__NR_open= 2
|
||||||
|
__NR_write= 1
|
||||||
|
|
||||||
msg_SELinux:
|
msg_SELinux:
|
||||||
push $ L71 - L70; pop %arg3 // length
|
push $ L71 - L70; pop %arg3 // length
|
||||||
@@ -212,94 +218,89 @@ die:
|
|||||||
push $ __NR_exit; pop %rax
|
push $ __NR_exit; pop %rax
|
||||||
syscall
|
syscall
|
||||||
|
|
||||||
/* Decompress the rest of this loader, and jump to it.
|
// Decompress the rest of this loader, and jump to it.
|
||||||
Map a page to hold the decompressed bytes. Logically this could
|
unfold: // IN: rbp= &f_exp; rsp/ &O_BINFO,fd,%entry
|
||||||
be done by setting .p_memsz for our first PT_LOAD. But as of 2005-11-09,
|
|
||||||
linux 2.6.14 only does ".bss expansion" on the PT_LOAD that describes the
|
|
||||||
highest address. [I regard this as a bug, and it makes the kernel's
|
|
||||||
fs/binfmt_elf.c complicated, buggy, and insecure.] For us, that is the 2nd
|
|
||||||
PT_LOAD, which is the only way that linux allows to set the brk() for the
|
|
||||||
uncompressed program. [This is a significant kernel misfeature.]
|
|
||||||
*/
|
|
||||||
unfold: // enter: %rbp= &decompress === &ret_main
|
|
||||||
pop %rsi // &O_BINFO
|
pop %rsi // &O_BINFO
|
||||||
lodsl; xchg %eax,%edx // O_BINFO
|
lodsl; movl %eax,%r14d // O_BINFO
|
||||||
push %rsi; pop %rbx // &b_info of folded decompressor
|
push %rsi; pop %rbx // &b_info of folded decompressor
|
||||||
lea -4-(ret_main - _start)(%rbp),%rax // &sz_pack2
|
lodsl; xchg %eax,%edx; add %rbx,%rdx // .sz_unc; last of unfolded
|
||||||
movl (%rax),%r15d // sz_pack2: length before stub
|
lodsl; xchg %eax,%r13d; lodsl; add %rsi,%r13 // .sz_cpr; last of folded
|
||||||
subq %r15,%rax // ADRU= &Elf64_Ehdr of this stub (ET_DYN)
|
|
||||||
push %rax // "slide" for ET_DYN
|
|
||||||
subl %edx,%r15d // LENX for upx_main
|
|
||||||
lea (%rax,%rdx),%rcx // ADRX= &b_info of user program for upx_main
|
|
||||||
|
|
||||||
section ELFMAINZu
|
lea sz_pack2 - f_exp(%rbp),%rcx // &sz_pack2
|
||||||
|
movl (%rcx),%r15d // sz_pack2: length before stub
|
||||||
|
subq %r15,%rcx // elfaddr= &Elf64_Ehdr of this stub
|
||||||
|
subl %r14d,%r15d // LENX= sz_pack2 - O_BINFO
|
||||||
|
pop %rdi // fd
|
||||||
|
subq %rcx,%rdx; push %rdx // LENU
|
||||||
|
push %rax // %ADRU
|
||||||
|
subq %rcx,%r13 // LENF
|
||||||
|
push %rdi // fd
|
||||||
|
push %rcx // elfaddr
|
||||||
|
|
||||||
/* Load the addresses and lengths.
|
// Reserve space fo input file and unfolded stub.
|
||||||
XXX: 2GB Note that PUSH $imm32 sign-extends to 64 bits.
|
subq %arg6,%arg6 // 0 offset
|
||||||
XXX: 4GB Note that MOVL $imm32,reg zero-extends to 64-bits.
|
orl $-1,%arg5l // fd
|
||||||
(Use an temporary register to obtain 4GB range on PUSH constant.)
|
push $MAP_PRIVATE|MAP_ANONYMOUS; pop %sys4
|
||||||
*/
|
push %rdx; pop %arg2 // len
|
||||||
|
push $PROT_READ|PROT_WRITE; pop %arg3
|
||||||
|
subl %arg1l,%arg1l // 0; kernel chooses addr
|
||||||
|
push $__NR_mmap; pop %rax; syscall
|
||||||
|
addq %rax,%r14 // + O_BINFO = ADRX
|
||||||
|
movq %rax,2*8(%rsp) // ADRU
|
||||||
|
|
||||||
#if 1
|
// Duplicate the input data.
|
||||||
/* INFO: newer gas versions (correctly) encode the "push $IMMEDIATE" into
|
xchgq %rax,%arg1 // same address
|
||||||
a R_X86_64_32S instead of R_X86_64_32 relocation type.
|
//subq %arg6,%arg6 // 0 offset
|
||||||
Avoid that until tested.
|
movl 1*8(%rsp),%arg5l // fd
|
||||||
*/
|
push $MAP_PRIVATE|MAP_FIXED; pop %sys4
|
||||||
push %rax // ADRU for unmap in fold; updated later
|
//push $PROT_READ|PROT_WRITE; pop %arg3
|
||||||
.byte 0x68; .int LENU // push $ LENU (R_X86_64_32)
|
movq %r13,%arg2 // len
|
||||||
#else
|
push $__NR_mmap; pop %rax; syscall
|
||||||
push %rax // ADRU for unmap in fold; updated later
|
|
||||||
push $ LENU // for unmap in fold
|
|
||||||
#endif
|
|
||||||
push %rcx // ADRX for upx_main; updated later
|
|
||||||
push %r15 // LENX for upx_main
|
|
||||||
|
|
||||||
/* Get some pages. If small, then get 1 page located just after the end
|
// Remember new f_exp region for PROT_EXEC.
|
||||||
of the first PT_LOAD of the compressed program. This will still be below
|
movq 3*8(%rsp),%rdx // LENU
|
||||||
all of the uncompressed program. If large (>=3 MiB uncompressed), then enough
|
pop %rcx; push %rcx // elfaddr
|
||||||
to duplicate the entire compressed PT_LOAD, plus 1 page, located just after
|
addq %rax,%rdx // new last of unfoded
|
||||||
the brk() of the _un_compressed program. The address and length are pre-
|
subq %rcx,%rax // new - old
|
||||||
calculated by PackLinuxElf64amd::defineSymbols().
|
movq %rax,%r12 // relocation constant
|
||||||
*/
|
addq %rbp,%rax; push %rax // P_10 new f_exp
|
||||||
lea ADRM(%rax),%rdi // dst for mmap and copy
|
andq $PAGE_MASK,%rax; push %rax // P_11 address
|
||||||
push $ PROT_READ | PROT_WRITE | PROT_EXEC; pop %arg3
|
subq %rax,%rdx; push %rdx // P_12 length
|
||||||
movl $ LENM,%esi // XXX: 4GB
|
|
||||||
push $ MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS; pop %sys4
|
|
||||||
subl %arg5l,%arg5l //; subl %arg6l,%arg6l // MAP_ANON ==> ignore offset
|
|
||||||
push $ SYS_mmap; pop %rax
|
|
||||||
syscall // %rax= result; trashes %rcx,%r11 only
|
|
||||||
cmpq %rax,%rdi; jne msg_SELinux
|
|
||||||
cmpq $4096,%rsi; jna L80 // only 1 page: no move required
|
|
||||||
|
|
||||||
movq 3*8(%rsp),%rsi // ADRU src for copy
|
// Unfold
|
||||||
push %rdi; pop %rdx // ADRM
|
movq %rbx,%rsi
|
||||||
subq %rsi,%rdx // (ADRM - ADRU) == relocation amount
|
lodsl; push %rax; movq %rsp,%arg4 // P_13 .sz_unc; &dstlen
|
||||||
addq %rdx,%rbp // update &decompress
|
lea (%rbx,%r12),%arg3 // dst= new unfold
|
||||||
addq %rdx,1*8(%rsp) // update ADRX
|
movq %arg3,%r13 // execute here
|
||||||
addq %rdx,3*8(%rsp) // update ADRU
|
lodsl; push %rax // P_14 tmp= .sz_cpr
|
||||||
push %rbx; pop %rcx // [&b_info] beyond end of decompressor
|
lodsl; xchg %eax,%arg5l // .b_method
|
||||||
subq %rsi,%rcx // byte length
|
movq %rsi,%arg1 // src
|
||||||
shrq $3,%rcx // qwords to copy
|
pop %arg2 // P_14 srclen
|
||||||
cld
|
call *%rbp // old f_exp
|
||||||
rep; movsq
|
pop %ecx // P_13 toss .sz_unc
|
||||||
xchgq %rax,%rdi
|
|
||||||
L80:
|
// PROT_EXEC
|
||||||
/* Decompress the folded part of this stub, then execute it. */
|
pop %arg2 // P_12 length
|
||||||
push %rbx; pop %arg2 // &b_info
|
pop %arg1 // P_11 addr
|
||||||
push %rax // ret_addr after decompression
|
pop %rbp // P_10 new f_exp
|
||||||
push %rax; pop %arg3 // dst for unfolding
|
push $PROT_READ|PROT_EXEC; pop %arg3
|
||||||
lodsl; push %rax // allocate slot on stack
|
push $__NR_mprotect; pop %rax; syscall
|
||||||
push %rsp; pop %arg4 // &len_dst ==> used by lzma for EOF
|
|
||||||
lodsl; xchgl %eax,%arg1l // sz_cpr XXX: 4GB
|
// Use the copy.
|
||||||
lodsl; movzbl %al,%arg5l // b_method
|
// %r14= ADRX; %r15= LENX;
|
||||||
xchg %arg1,%arg2
|
// rsp/ elfaddr,fd,ADRU,LENU,%entry
|
||||||
call *%rbp // decompress
|
jmp *%r13
|
||||||
pop %rcx // discard len_dst
|
|
||||||
ret
|
proc_self_exe:
|
||||||
|
.asciz "/proc/self/exe"
|
||||||
|
|
||||||
main:
|
main:
|
||||||
//// nop; int3 # uncomment for debugging
|
pop %rbp // &f_exp
|
||||||
pop %rbp // &decompress
|
lea proc_self_exe(%rip),%arg1
|
||||||
|
sub %arg2l,%arg2l // O_RDONLY
|
||||||
|
push $__NR_open; pop %rax
|
||||||
|
syscall
|
||||||
|
push %rax // save fd
|
||||||
call unfold
|
call unfold
|
||||||
.long O_BINFO // offset of b_info for .text
|
.long O_BINFO // offset of b_info for .text
|
||||||
// { b_info={sz_unc, sz_cpr, {4 char}}, folded_loader...}
|
// { b_info={sz_unc, sz_cpr, {4 char}}, folded_loader...}
|
||||||
|
|||||||
@@ -66,11 +66,10 @@ __NR_brk= 12
|
|||||||
__NR_exit= 60
|
__NR_exit= 60
|
||||||
__NR_readlink= 89
|
__NR_readlink= 89
|
||||||
|
|
||||||
/* In:
|
// IN:
|
||||||
cld
|
// %rbp= f_exp; %r14= ADRX; %r15= LENX;
|
||||||
%rbp= &decompress
|
// rsp/ elfaddr,fd,ADRU,LENU,%entry, argc,argv,0,envp,0,auxv,0,strings
|
||||||
%rsp= &{LENX,ADRX,LENU,ADRU,slide,argc,argv...,0,env...,0,auxv...,0...,strings}
|
|
||||||
*/
|
|
||||||
fold_begin:
|
fold_begin:
|
||||||
//// int3 // DEBUG only
|
//// int3 // DEBUG only
|
||||||
call L90 # push &L90a
|
call L90 # push &L90a
|
||||||
@@ -80,11 +79,13 @@ L90b:
|
|||||||
#include "arch/amd64/bxx.S"
|
#include "arch/amd64/bxx.S"
|
||||||
L90:
|
L90:
|
||||||
pop %rbx # L90a
|
pop %rbx # L90a
|
||||||
|
push %r14 // ADRX
|
||||||
|
push %r15 // LENX
|
||||||
lea L90b - L90a(%rbx),%rax; push %rax # &amdbxx: f_unfilter
|
lea L90b - L90a(%rbx),%rax; push %rax # &amdbxx: f_unfilter
|
||||||
mov %rsp,%rsi
|
mov %rsp,%rsi
|
||||||
sub $PATH_MAX,%rsp
|
sub $PATH_MAX,%rsp
|
||||||
push %rsp; pop %rdi
|
push %rsp; pop %rdi
|
||||||
push $7; pop %rcx; rep movsq # f_unfilter,LENX,ADRX,LENU,ADRU,slide,argc
|
push $9; pop %rcx; rep movsq # f_unfilter,LENX,ADRX,elfaddr,fd,ADRU,LENU,%entry,argc
|
||||||
0:
|
0:
|
||||||
cmpq $0,(%rsi); movsq; jne 0b # move past argv
|
cmpq $0,(%rsi); movsq; jne 0b # move past argv
|
||||||
movq %rdi,%r14 # remember &new_env[0]
|
movq %rdi,%r14 # remember &new_env[0]
|
||||||
@@ -98,17 +99,16 @@ L90:
|
|||||||
mov %rsi,%r13 # beginning of strings
|
mov %rsi,%r13 # beginning of strings
|
||||||
sub %r15,%r12 # -length of auxv
|
sub %r15,%r12 # -length of auxv
|
||||||
|
|
||||||
push $ __NR_readlink
|
|
||||||
movl $-1+ PATH_MAX,%arg3l # buflen
|
movl $-1+ PATH_MAX,%arg3l # buflen
|
||||||
push %rdi; pop %arg2 #buffer
|
push %rdi; pop %arg2 #buffer
|
||||||
push %rbx; pop %arg1 # "/proc/self/exe"
|
push %rbx; pop %arg1 # "/proc/self/exe"
|
||||||
pop %rax; syscall; testl %eax,%eax; jns 0f
|
push $ __NR_readlink; pop %rax; syscall; testl %eax,%eax; jns 0f
|
||||||
// readlink() failed. Set the result equal to the argument.
|
// readlink() failed. Set the result equal to the argument.
|
||||||
push %rbx; pop %arg2 # result= "/proc/self/exe"
|
push %rbx; pop %arg2 # result= "/proc/self/exe"
|
||||||
push $-1+ (L90b - L90a); pop %rax
|
push $-1+ (L90b - L90a); pop %rax
|
||||||
0:
|
0:
|
||||||
xchg %eax,%ecx # %ecx= byte count
|
xchg %eax,%ecx # %ecx= byte count
|
||||||
std
|
std
|
||||||
lea -1(%r13),%rdi # dst last byte
|
lea -1(%r13),%rdi # dst last byte
|
||||||
movb $0,%al; stosb # terminate
|
movb $0,%al; stosb # terminate
|
||||||
lea -1(%arg2,%rcx),%rsi # src last byte
|
lea -1(%arg2,%rcx),%rsi # src last byte
|
||||||
@@ -129,49 +129,42 @@ L90:
|
|||||||
lea -8(%r15),%rsi # &last qword of old auxv
|
lea -8(%r15),%rsi # &last qword of old auxv
|
||||||
shr $3,%rcx; rep movsq
|
shr $3,%rcx; rep movsq
|
||||||
lea 8(%rdi),%rsp
|
lea 8(%rdi),%rsp
|
||||||
cld
|
cld
|
||||||
|
|
||||||
lea (%r14,%r12),%arg4 # &new Elf64_auxv
|
lea (%r14,%r12),%arg4 # &new Elf64_auxv
|
||||||
pop %arg6 # f_unfilter
|
pop %arg6 # f_unfilter
|
||||||
pop %arg2 # LENX
|
pop %arg2 # LENX
|
||||||
pop %arg1 # ADRX
|
pop %arg1 # ADRX
|
||||||
mov 2*8(%rsp),%rax // slide
|
|
||||||
|
|
||||||
|
pop %rax # elfaddr
|
||||||
subq $ OVERHEAD,%rsp
|
subq $ OVERHEAD,%rsp
|
||||||
|
push %rax #elfaddr
|
||||||
|
|
||||||
movq %rsp,%arg3 # &ELf64_Ehdr temporary space
|
movq %rsp,%arg3 # &ELf64_Ehdr temporary space
|
||||||
movq %rbp,%arg5 # &decompress: f_expand
|
movq %rbp,%arg5 # &decompress: f_expand
|
||||||
pushq %rax // reloc
|
|
||||||
call upx_main # Out: %rax= entry
|
call upx_main # Out: %rax= entry
|
||||||
/* entry= upx_main(b_info *arg1, total_size arg2, Elf64_Ehdr *arg3,
|
/* entry= upx_main(b_info *arg1, total_size arg2, Elf64_Ehdr *arg3,
|
||||||
Elf32_Auxv_t *arg4, f_decompr arg5, f_unfilter arg6,
|
Elf32_Auxv_t *arg4, f_decompr arg5, f_unfilter arg6,
|
||||||
Elf64_Addr reloc )
|
Elf64_Addr elfaddr )
|
||||||
*/
|
*/
|
||||||
push %rax; pop %rbp # entry
|
addq $1*8+OVERHEAD,%rsp # toss elfaddr, too
|
||||||
popq %rdx # reloc
|
movq %rax,3*8(%rsp) # entry
|
||||||
addq $OVERHEAD,%rsp
|
pop %rbx # fd
|
||||||
|
|
||||||
push $__NR_open
|
// Map 1 page of /proc/self/exe so that it does not disappear.
|
||||||
sub %arg2l,%arg2l # O_RDONLY
|
|
||||||
push %rbx; pop %arg1 # "/proc/self/exe"
|
|
||||||
pop %rax; syscall; xchg %eax,%ebx # %ebx= fd
|
|
||||||
|
|
||||||
push $__NR_mmap
|
|
||||||
sub %arg6l,%arg6l # 0 offset
|
sub %arg6l,%arg6l # 0 offset
|
||||||
mov %ebx,%arg5l
|
mov %ebx,%arg5l # fd
|
||||||
push $MAP_PRIVATE; pop %sys4 # BEWARE: %sys4
|
push $MAP_PRIVATE; pop %sys4 # BEWARE: %sys4
|
||||||
push $PROT_READ; pop %arg3
|
push $PROT_READ; pop %arg3
|
||||||
mov $PAGE_SIZE,%arg2l
|
mov $PAGE_SIZE,%arg2l
|
||||||
push $0; pop %arg1
|
push $0; pop %arg1
|
||||||
pop %rax; syscall
|
push $__NR_mmap; pop %rax; syscall
|
||||||
|
|
||||||
push $__NR_close
|
|
||||||
mov %ebx,%edi # fd
|
mov %ebx,%edi # fd
|
||||||
pop %rax; syscall
|
push $__NR_close; pop %rax; syscall
|
||||||
|
|
||||||
pop %arg2 # LENU
|
|
||||||
pop %arg1 # ADRU
|
pop %arg1 # ADRU
|
||||||
pop %rcx # slide [unused]
|
pop %arg2 # LENU
|
||||||
push %rbp # &entry
|
|
||||||
push $ __NR_munmap; pop %rax
|
push $ __NR_munmap; pop %rax
|
||||||
jmp *-8(%r14) # goto: syscall; ret
|
jmp *-8(%r14) # goto: syscall; ret
|
||||||
|
|
||||||
|
|||||||
@@ -2,25 +2,23 @@ file format elf64-x86-64
|
|||||||
|
|
||||||
Sections:
|
Sections:
|
||||||
Idx Name Size VMA LMA File off Algn Flags
|
Idx Name Size VMA LMA File off Algn Flags
|
||||||
0 ELFMAINX 0000000d 0000000000000000 0000000000000000 00000040 2**0 CONTENTS, RELOC, READONLY
|
0 ELFMAINX 0000000e 0000000000000000 0000000000000000 00000040 2**0 CONTENTS, RELOC, READONLY
|
||||||
1 NRV_HEAD 00000066 0000000000000000 0000000000000000 0000004d 2**0 CONTENTS, READONLY
|
1 NRV_HEAD 00000066 0000000000000000 0000000000000000 0000004e 2**0 CONTENTS, READONLY
|
||||||
2 NRV2E 000000b7 0000000000000000 0000000000000000 000000b3 2**0 CONTENTS, RELOC, READONLY
|
2 NRV2E 000000b7 0000000000000000 0000000000000000 000000b4 2**0 CONTENTS, RELOC, READONLY
|
||||||
3 NRV2D 0000009e 0000000000000000 0000000000000000 0000016a 2**0 CONTENTS, RELOC, READONLY
|
3 NRV2D 0000009e 0000000000000000 0000000000000000 0000016b 2**0 CONTENTS, RELOC, READONLY
|
||||||
4 NRV2B 00000090 0000000000000000 0000000000000000 00000208 2**0 CONTENTS, RELOC, READONLY
|
4 NRV2B 00000090 0000000000000000 0000000000000000 00000209 2**0 CONTENTS, RELOC, READONLY
|
||||||
5 LZMA_ELF00 00000064 0000000000000000 0000000000000000 00000298 2**0 CONTENTS, RELOC, READONLY
|
5 LZMA_ELF00 00000064 0000000000000000 0000000000000000 00000299 2**0 CONTENTS, RELOC, READONLY
|
||||||
6 LZMA_DEC10 000009f7 0000000000000000 0000000000000000 000002fc 2**0 CONTENTS, READONLY
|
6 LZMA_DEC10 000009f7 0000000000000000 0000000000000000 000002fd 2**0 CONTENTS, READONLY
|
||||||
7 LZMA_DEC20 000009f7 0000000000000000 0000000000000000 00000cf3 2**0 CONTENTS, READONLY
|
7 LZMA_DEC20 000009f7 0000000000000000 0000000000000000 00000cf4 2**0 CONTENTS, READONLY
|
||||||
8 LZMA_DEC30 00000014 0000000000000000 0000000000000000 000016ea 2**0 CONTENTS, READONLY
|
8 LZMA_DEC30 00000014 0000000000000000 0000000000000000 000016eb 2**0 CONTENTS, READONLY
|
||||||
9 NRV_TAIL 00000000 0000000000000000 0000000000000000 000016fe 2**0 CONTENTS, READONLY
|
9 NRV_TAIL 00000000 0000000000000000 0000000000000000 000016ff 2**0 CONTENTS, READONLY
|
||||||
10 ELFMAINY 0000003a 0000000000000000 0000000000000000 000016fe 2**0 CONTENTS, RELOC, READONLY
|
10 ELFMAINY 0000003a 0000000000000000 0000000000000000 000016ff 2**0 CONTENTS, RELOC, READONLY
|
||||||
11 ELFMAINZ 00000028 0000000000000000 0000000000000000 00001738 2**0 CONTENTS, READONLY
|
11 ELFMAINZ 000000e1 0000000000000000 0000000000000000 00001739 2**0 CONTENTS, RELOC, READONLY
|
||||||
12 ELFMAINZu 0000007d 0000000000000000 0000000000000000 00001760 2**0 CONTENTS, RELOC, READONLY
|
|
||||||
SYMBOL TABLE:
|
SYMBOL TABLE:
|
||||||
0000000000000000 l d NRV_HEAD 0000000000000000 NRV_HEAD
|
0000000000000000 l d NRV_HEAD 0000000000000000 NRV_HEAD
|
||||||
0000000000000000 l d LZMA_DEC30 0000000000000000 LZMA_DEC30
|
0000000000000000 l d LZMA_DEC30 0000000000000000 LZMA_DEC30
|
||||||
0000000000000000 l d ELFMAINY 0000000000000000 ELFMAINY
|
0000000000000000 l d ELFMAINY 0000000000000000 ELFMAINY
|
||||||
0000000000000000 l d ELFMAINZ 0000000000000000 ELFMAINZ
|
0000000000000000 l d ELFMAINZ 0000000000000000 ELFMAINZ
|
||||||
0000000000000000 l d ELFMAINZu 0000000000000000 ELFMAINZu
|
|
||||||
0000000000000000 l d ELFMAINX 0000000000000000 ELFMAINX
|
0000000000000000 l d ELFMAINX 0000000000000000 ELFMAINX
|
||||||
0000000000000000 l d NRV2E 0000000000000000 NRV2E
|
0000000000000000 l d NRV2E 0000000000000000 NRV2E
|
||||||
0000000000000000 l d NRV2D 0000000000000000 NRV2D
|
0000000000000000 l d NRV2D 0000000000000000 NRV2D
|
||||||
@@ -30,14 +28,11 @@ SYMBOL TABLE:
|
|||||||
0000000000000000 l d LZMA_DEC20 0000000000000000 LZMA_DEC20
|
0000000000000000 l d LZMA_DEC20 0000000000000000 LZMA_DEC20
|
||||||
0000000000000000 l d NRV_TAIL 0000000000000000 NRV_TAIL
|
0000000000000000 l d NRV_TAIL 0000000000000000 NRV_TAIL
|
||||||
0000000000000000 g ELFMAINX 0000000000000000 _start
|
0000000000000000 g ELFMAINX 0000000000000000 _start
|
||||||
0000000000000000 *UND* 0000000000000000 LENU
|
|
||||||
0000000000000000 *UND* 0000000000000000 ADRM
|
|
||||||
0000000000000000 *UND* 0000000000000000 LENM
|
|
||||||
0000000000000000 *UND* 0000000000000000 O_BINFO
|
0000000000000000 *UND* 0000000000000000 O_BINFO
|
||||||
|
|
||||||
RELOCATION RECORDS FOR [ELFMAINX]:
|
RELOCATION RECORDS FOR [ELFMAINX]:
|
||||||
OFFSET TYPE VALUE
|
OFFSET TYPE VALUE
|
||||||
0000000000000001 R_X86_64_PC32 ELFMAINZu+0x000000000000006f
|
0000000000000002 R_X86_64_PC32 ELFMAINZ+0x00000000000000c4
|
||||||
|
|
||||||
RELOCATION RECORDS FOR [NRV2E]:
|
RELOCATION RECORDS FOR [NRV2E]:
|
||||||
OFFSET TYPE VALUE
|
OFFSET TYPE VALUE
|
||||||
@@ -62,11 +57,6 @@ RELOCATION RECORDS FOR [ELFMAINY]:
|
|||||||
OFFSET TYPE VALUE
|
OFFSET TYPE VALUE
|
||||||
0000000000000018 R_X86_64_PC32 ELFMAINZ+0xfffffffffffffffc
|
0000000000000018 R_X86_64_PC32 ELFMAINZ+0xfffffffffffffffc
|
||||||
|
|
||||||
RELOCATION RECORDS FOR [ELFMAINZu]:
|
RELOCATION RECORDS FOR [ELFMAINZ]:
|
||||||
OFFSET TYPE VALUE
|
OFFSET TYPE VALUE
|
||||||
0000000000000002 R_X86_64_32 LENU
|
00000000000000dd R_X86_64_32 O_BINFO
|
||||||
000000000000000c R_X86_64_32S ADRM
|
|
||||||
0000000000000014 R_X86_64_32 LENM
|
|
||||||
0000000000000075 R_X86_64_PC32 ELFMAINZ+0x000000000000000d
|
|
||||||
0000000000000079 R_X86_64_32 O_BINFO
|
|
||||||
0000000000000029 R_X86_64_PC32 ELFMAINY+0x000000000000000d
|
|
||||||
|
|||||||
@@ -8,33 +8,33 @@ Linker script and memory map
|
|||||||
|
|
||||||
0x00000000001000bc . = ((0x100000 + SIZEOF_HEADERS) + 0xc)
|
0x00000000001000bc . = ((0x100000 + SIZEOF_HEADERS) + 0xc)
|
||||||
|
|
||||||
.text 0x00000000001000bc 0x748
|
.text 0x00000000001000bc 0x740
|
||||||
*(.text)
|
*(.text)
|
||||||
.text 0x00000000001000bc 0x197 tmp/amd64-linux.elf-fold.o
|
.text 0x00000000001000bc 0x18e tmp/amd64-linux.elf-fold.o
|
||||||
0x0000000000100243 munmap
|
0x000000000010023a munmap
|
||||||
0x000000000010021c mmap
|
0x0000000000100213 mmap
|
||||||
0x000000000010024b write
|
0x0000000000100242 write
|
||||||
0x000000000010024f read
|
0x0000000000100246 read
|
||||||
0x0000000000100233 exit
|
0x000000000010022a exit
|
||||||
0x0000000000100237 brk
|
0x000000000010022e brk
|
||||||
0x000000000010023f open
|
0x0000000000100236 open
|
||||||
0x0000000000100247 mprotect
|
0x000000000010023e mprotect
|
||||||
0x000000000010023b close
|
0x0000000000100232 close
|
||||||
*fill* 0x0000000000100253 0x1 00
|
*fill* 0x000000000010024a 0x2 00
|
||||||
.text 0x0000000000100254 0x5ae tmp/amd64-linux.elf-main.o
|
.text 0x000000000010024c 0x5ae tmp/amd64-linux.elf-main.o
|
||||||
0x00000000001006bf upx_main
|
0x00000000001006b7 upx_main
|
||||||
*(.data)
|
*(.data)
|
||||||
*fill* 0x0000000000100802 0x2 00
|
*fill* 0x00000000001007fa 0x2 00
|
||||||
.data 0x0000000000100804 0x0 tmp/amd64-linux.elf-fold.o
|
.data 0x00000000001007fc 0x0 tmp/amd64-linux.elf-fold.o
|
||||||
.data 0x0000000000100804 0x0 tmp/amd64-linux.elf-main.o
|
.data 0x00000000001007fc 0x0 tmp/amd64-linux.elf-main.o
|
||||||
|
|
||||||
.data
|
.data
|
||||||
|
|
||||||
.bss 0x0000000000100804 0x0
|
.bss 0x00000000001007fc 0x0
|
||||||
.bss 0x0000000000100804 0x0 tmp/amd64-linux.elf-fold.o
|
.bss 0x00000000001007fc 0x0 tmp/amd64-linux.elf-fold.o
|
||||||
.bss 0x0000000000100804 0x0 tmp/amd64-linux.elf-main.o
|
.bss 0x00000000001007fc 0x0 tmp/amd64-linux.elf-main.o
|
||||||
|
|
||||||
.rela.dyn 0x0000000000100808 0x0
|
.rela.dyn 0x0000000000100800 0x0
|
||||||
.rela.text 0x0000000000000000 0x0 tmp/amd64-linux.elf-fold.o
|
.rela.text 0x0000000000000000 0x0 tmp/amd64-linux.elf-fold.o
|
||||||
LOAD tmp/amd64-linux.elf-fold.o
|
LOAD tmp/amd64-linux.elf-fold.o
|
||||||
LOAD tmp/amd64-linux.elf-main.o
|
LOAD tmp/amd64-linux.elf-main.o
|
||||||
|
|||||||
Reference in New Issue
Block a user