From 963392a5ae02fb78c788e0ba07a516964c6919c7 Mon Sep 17 00:00:00 2001 From: John Reiser Date: Sat, 30 May 2020 13:54:11 -0700 Subject: [PATCH] De-compress (upx -d) for ELF pageholes modified: p_lx_elf.cpp --- src/p_lx_elf.cpp | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/src/p_lx_elf.cpp b/src/p_lx_elf.cpp index 83602668..2b7bafc4 100644 --- a/src/p_lx_elf.cpp +++ b/src/p_lx_elf.cpp @@ -4656,7 +4656,13 @@ void PackLinuxElf64::unpack(OutputFile *fo) break; } } - if (is_shlib + if (0x1000==get_te64(&phdri[0].p_filesz) // detect C_BASE style + && 0==get_te64(&phdri[1].p_offset) + && 0==get_te64(&phdri[0].p_offset) + && get_te64(&phdri[1].p_filesz) == get_te64(&phdri[1].p_memsz)) { + fi->seek(up4(get_te64(&phdr[1].p_memsz)), SEEK_SET); // past the loader + } + else if (is_shlib || ((unsigned)(get_te64(&ehdri.e_entry) - load_va) + up4(lsize) + ph.getPackHeaderSize() + sizeof(overlay_offset)) < up4(file_size)) { @@ -5708,7 +5714,13 @@ void PackLinuxElf32::unpack(OutputFile *fo) break; } } - if (is_shlib + if (0x1000==get_te32(&phdri[0].p_filesz) // detect C_BASE style + && 0==get_te32(&phdri[1].p_offset) + && 0==get_te32(&phdri[0].p_offset) + && get_te32(&phdri[1].p_filesz) == get_te32(&phdri[1].p_memsz)) { + fi->seek(up4(get_te32(&phdr[1].p_memsz)), SEEK_SET); // past the loader + } + else if (is_shlib || ((unsigned)(get_te32(&ehdri.e_entry) - load_va) + up4(lsize) + ph.getPackHeaderSize() + sizeof(overlay_offset)) < up4(file_size)) {