removed dosish file endings
This commit is contained in:
László Molnár
+298
-298
@@ -1,298 +1,298 @@
|
|||||||
/*
|
/*
|
||||||
; i386-win32.pe.S -- loader & decompressor for the w32/pe format
|
; i386-win32.pe.S -- loader & decompressor for the w32/pe format
|
||||||
;
|
;
|
||||||
; This file is part of the UPX executable compressor.
|
; This file is part of the UPX executable compressor.
|
||||||
;
|
;
|
||||||
; Copyright (C) 1996-2010 Markus Franz Xaver Johannes Oberhumer
|
; Copyright (C) 1996-2010 Markus Franz Xaver Johannes Oberhumer
|
||||||
; Copyright (C) 1996-2010 Laszlo Molnar
|
; Copyright (C) 1996-2010 Laszlo Molnar
|
||||||
; All Rights Reserved.
|
; All Rights Reserved.
|
||||||
;
|
;
|
||||||
; UPX and the UCL library are free software; you can redistribute them
|
; UPX and the UCL library are free software; you can redistribute them
|
||||||
; and/or modify them under the terms of the GNU General Public License as
|
; and/or modify them under the terms of the GNU General Public License as
|
||||||
; published by the Free Software Foundation; either version 2 of
|
; published by the Free Software Foundation; either version 2 of
|
||||||
; the License, or (at your option) any later version.
|
; the License, or (at your option) any later version.
|
||||||
;
|
;
|
||||||
; This program is distributed in the hope that it will be useful,
|
; This program is distributed in the hope that it will be useful,
|
||||||
; but WITHOUT ANY WARRANTY; without even the implied warranty of
|
; but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
; GNU General Public License for more details.
|
; GNU General Public License for more details.
|
||||||
;
|
;
|
||||||
; You should have received a copy of the GNU General Public License
|
; You should have received a copy of the GNU General Public License
|
||||||
; along with this program; see the file COPYING.
|
; along with this program; see the file COPYING.
|
||||||
; If not, write to the Free Software Foundation, Inc.,
|
; If not, write to the Free Software Foundation, Inc.,
|
||||||
; 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
; 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||||
;
|
;
|
||||||
; Markus F.X.J. Oberhumer Laszlo Molnar
|
; Markus F.X.J. Oberhumer Laszlo Molnar
|
||||||
; <markus@oberhumer.com> <ml1050@users.sourceforge.net>
|
; <markus@oberhumer.com> <ml1050@users.sourceforge.net>
|
||||||
;
|
;
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#define UPX102 1
|
#define UPX102 1
|
||||||
#include "arch/i386/macros.S"
|
#include "arch/i386/macros.S"
|
||||||
|
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
// ============= ENTRY POINT
|
// ============= ENTRY POINT
|
||||||
// =============
|
// =============
|
||||||
|
|
||||||
section PEISDLL1
|
section PEISDLL1
|
||||||
cmpb [esp + 8], 1
|
cmpb [esp + 8], 1
|
||||||
jnz reloc_end_jmp
|
jnz reloc_end_jmp
|
||||||
section PEMAIN01
|
section PEMAIN01
|
||||||
pusha
|
pusha
|
||||||
mov esi, offset start_of_compressed // relocated
|
mov esi, offset start_of_compressed // relocated
|
||||||
lea edi, [esi + start_of_uncompressed]
|
lea edi, [esi + start_of_uncompressed]
|
||||||
section PEICONS1
|
section PEICONS1
|
||||||
incw [edi + icon_offset]
|
incw [edi + icon_offset]
|
||||||
section PEICONS2
|
section PEICONS2
|
||||||
addw [edi + icon_offset], offset icon_delta
|
addw [edi + icon_offset], offset icon_delta
|
||||||
section PETLSHAK
|
section PETLSHAK
|
||||||
mov dword ptr [edi + tls_address], offset tls_value
|
mov dword ptr [edi + tls_address], offset tls_value
|
||||||
section PEMAIN02
|
section PEMAIN02
|
||||||
push edi
|
push edi
|
||||||
section PEMAIN03
|
section PEMAIN03
|
||||||
or ebp, -1
|
or ebp, -1
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
// ============= DECOMPRESSION
|
// ============= DECOMPRESSION
|
||||||
// =============
|
// =============
|
||||||
|
|
||||||
#include "arch/i386/nrv2b_d32.S"
|
#include "arch/i386/nrv2b_d32.S"
|
||||||
#include "arch/i386/nrv2d_d32.S"
|
#include "arch/i386/nrv2d_d32.S"
|
||||||
#include "arch/i386/nrv2e_d32.S"
|
#include "arch/i386/nrv2e_d32.S"
|
||||||
#include "arch/i386/lzma_d.S"
|
#include "arch/i386/lzma_d.S"
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
section PEMAIN10
|
section PEMAIN10
|
||||||
pop esi // load vaddr
|
pop esi // load vaddr
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
// ============= CALLTRICK
|
// ============= CALLTRICK
|
||||||
// =============
|
// =============
|
||||||
|
|
||||||
section PECTTPOS
|
section PECTTPOS
|
||||||
lea edi, [esi + filter_buffer_start]
|
lea edi, [esi + filter_buffer_start]
|
||||||
section PECTTNUL
|
section PECTTNUL
|
||||||
mov edi, esi
|
mov edi, esi
|
||||||
|
|
||||||
cjt32 esi
|
cjt32 esi
|
||||||
|
|
||||||
section ctok32.00
|
section ctok32.00
|
||||||
mov ecx, offset filter_length
|
mov ecx, offset filter_length
|
||||||
ctok32 esi, (offset filter_cto)
|
ctok32 esi, (offset filter_cto)
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
// ============= IMPORTS
|
// ============= IMPORTS
|
||||||
// =============
|
// =============
|
||||||
|
|
||||||
section PEIMPORT
|
section PEIMPORT
|
||||||
lea edi, [esi + compressed_imports]
|
lea edi, [esi + compressed_imports]
|
||||||
next_dll:
|
next_dll:
|
||||||
mov eax, [edi]
|
mov eax, [edi]
|
||||||
or eax, eax
|
or eax, eax
|
||||||
jzs imports_done
|
jzs imports_done
|
||||||
mov ebx, [edi+4] // iat
|
mov ebx, [edi+4] // iat
|
||||||
lea eax, [eax + esi + start_of_imports]
|
lea eax, [eax + esi + start_of_imports]
|
||||||
add ebx, esi
|
add ebx, esi
|
||||||
push eax
|
push eax
|
||||||
add edi, 8
|
add edi, 8
|
||||||
call [esi + LoadLibraryA]
|
call [esi + LoadLibraryA]
|
||||||
xchg eax, ebp
|
xchg eax, ebp
|
||||||
next_func:
|
next_func:
|
||||||
mov al, [edi]
|
mov al, [edi]
|
||||||
inc edi
|
inc edi
|
||||||
or al, al
|
or al, al
|
||||||
jz next_dll
|
jz next_dll
|
||||||
mov ecx, edi // something > 0
|
mov ecx, edi // something > 0
|
||||||
section PEIBYORD
|
section PEIBYORD
|
||||||
jnss byname
|
jnss byname
|
||||||
section PEK32ORD
|
section PEK32ORD
|
||||||
jpe not_kernel32
|
jpe not_kernel32
|
||||||
mov eax, [edi]
|
mov eax, [edi]
|
||||||
add edi, 4
|
add edi, 4
|
||||||
mov eax, [eax + esi + kernel32_ordinals]
|
mov eax, [eax + esi + kernel32_ordinals]
|
||||||
jmps next_imp
|
jmps next_imp
|
||||||
not_kernel32:
|
not_kernel32:
|
||||||
section PEIMORD1
|
section PEIMORD1
|
||||||
movzxw eax, word ptr [edi]
|
movzxw eax, word ptr [edi]
|
||||||
inc edi
|
inc edi
|
||||||
push eax
|
push eax
|
||||||
inc edi
|
inc edi
|
||||||
.byte 0xb9 // mov ecx,xxxx
|
.byte 0xb9 // mov ecx,xxxx
|
||||||
byname:
|
byname:
|
||||||
section PEIMPOR2
|
section PEIMPOR2
|
||||||
push edi
|
push edi
|
||||||
dec eax
|
dec eax
|
||||||
repne
|
repne
|
||||||
scasb
|
scasb
|
||||||
|
|
||||||
push ebp
|
push ebp
|
||||||
call [esi + GetProcAddress]
|
call [esi + GetProcAddress]
|
||||||
or eax, eax
|
or eax, eax
|
||||||
jz imp_failed
|
jz imp_failed
|
||||||
next_imp:
|
next_imp:
|
||||||
mov [ebx], eax
|
mov [ebx], eax
|
||||||
add ebx, 4
|
add ebx, 4
|
||||||
jmps next_func
|
jmps next_func
|
||||||
imp_failed:
|
imp_failed:
|
||||||
|
|
||||||
section PEIERDLL
|
section PEIERDLL
|
||||||
popa
|
popa
|
||||||
xor eax, eax
|
xor eax, eax
|
||||||
ret 0x0c
|
ret 0x0c
|
||||||
section PEIEREXE
|
section PEIEREXE
|
||||||
call [esi + ExitProcess]
|
call [esi + ExitProcess]
|
||||||
section PEIMDONE
|
section PEIMDONE
|
||||||
imports_done:
|
imports_done:
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
// ============= RELOCATION
|
// ============= RELOCATION
|
||||||
// =============
|
// =============
|
||||||
|
|
||||||
section PERELOC1
|
section PERELOC1
|
||||||
lea edi, [esi + start_of_relocs]
|
lea edi, [esi + start_of_relocs]
|
||||||
section PERELOC2
|
section PERELOC2
|
||||||
add edi, 4
|
add edi, 4
|
||||||
section PERELOC3
|
section PERELOC3
|
||||||
lea ebx, [esi - 4]
|
lea ebx, [esi - 4]
|
||||||
reloc32 edi, ebx, esi
|
reloc32 edi, ebx, esi
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
|
|
||||||
// FIXME: depends on that in PERELOC1 edi is set!!
|
// FIXME: depends on that in PERELOC1 edi is set!!
|
||||||
section PERLOHI0
|
section PERLOHI0
|
||||||
xchg edi, esi
|
xchg edi, esi
|
||||||
lea ecx, [edi + reloc_delt]
|
lea ecx, [edi + reloc_delt]
|
||||||
|
|
||||||
section PERELLO0
|
section PERELLO0
|
||||||
.byte 0xA9
|
.byte 0xA9
|
||||||
rello0:
|
rello0:
|
||||||
add [edi + eax], cx
|
add [edi + eax], cx
|
||||||
lodsd
|
lodsd
|
||||||
or eax, eax
|
or eax, eax
|
||||||
jnz rello0
|
jnz rello0
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
|
|
||||||
section PERELHI0
|
section PERELHI0
|
||||||
shr ecx, 16
|
shr ecx, 16
|
||||||
.byte 0xA9
|
.byte 0xA9
|
||||||
relhi0:
|
relhi0:
|
||||||
add [edi + eax], cx
|
add [edi + eax], cx
|
||||||
lodsd
|
lodsd
|
||||||
or eax, eax
|
or eax, eax
|
||||||
jnz relhi0
|
jnz relhi0
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
section PEDEPHAK
|
section PEDEPHAK
|
||||||
mov ebp, [esi + VirtualProtect]
|
mov ebp, [esi + VirtualProtect]
|
||||||
lea edi, [esi + vp_base]
|
lea edi, [esi + vp_base]
|
||||||
mov ebx, offset vp_size // 0x1000 or 0x2000
|
mov ebx, offset vp_size // 0x1000 or 0x2000
|
||||||
|
|
||||||
push eax // provide 4 bytes stack
|
push eax // provide 4 bytes stack
|
||||||
|
|
||||||
push esp // &lpflOldProtect on stack
|
push esp // &lpflOldProtect on stack
|
||||||
push 4 // PAGE_READWRITE
|
push 4 // PAGE_READWRITE
|
||||||
push ebx
|
push ebx
|
||||||
push edi
|
push edi
|
||||||
call ebp //VirtualProtect
|
call ebp //VirtualProtect
|
||||||
|
|
||||||
#if 0
|
#if 0
|
||||||
or eax, eax
|
or eax, eax
|
||||||
jz pedep9 // VirtualProtect failed
|
jz pedep9 // VirtualProtect failed
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
lea eax, [edi + swri]
|
lea eax, [edi + swri]
|
||||||
andb [eax], 0x7f // marks UPX0 non writeable
|
andb [eax], 0x7f // marks UPX0 non writeable
|
||||||
andb [eax + 0x28], 0x7f // marks UPX1 non writeable
|
andb [eax + 0x28], 0x7f // marks UPX1 non writeable
|
||||||
|
|
||||||
#if 0
|
#if 0
|
||||||
push esp
|
push esp
|
||||||
push 2 // PAGE_READONLY
|
push 2 // PAGE_READONLY
|
||||||
#else
|
#else
|
||||||
pop eax
|
pop eax
|
||||||
push eax
|
push eax
|
||||||
push esp
|
push esp
|
||||||
push eax // restore protection
|
push eax // restore protection
|
||||||
#endif
|
#endif
|
||||||
push ebx
|
push ebx
|
||||||
push edi
|
push edi
|
||||||
call ebp //;VirtualProtect
|
call ebp //;VirtualProtect
|
||||||
|
|
||||||
pedep9:
|
pedep9:
|
||||||
pop eax //;restore stack
|
pop eax //;restore stack
|
||||||
|
|
||||||
//;NEW: TLS callback support - Stefan Widmann
|
//;NEW: TLS callback support - Stefan Widmann
|
||||||
section PETLSC
|
section PETLSC
|
||||||
lea ebx, [esi + tls_module_base] //;load module base to ebx
|
lea ebx, [esi + tls_module_base] //;load module base to ebx
|
||||||
lea edi, [ebx + tls_handler_start + 1] //;load offset of handler
|
lea edi, [ebx + tls_handler_start + 1] //;load offset of handler
|
||||||
push edi
|
push edi
|
||||||
//;remove jump from TLS handler entry (overwrite displacement)
|
//;remove jump from TLS handler entry (overwrite displacement)
|
||||||
xor eax, eax
|
xor eax, eax
|
||||||
stosb
|
stosb
|
||||||
pop ecx
|
pop ecx
|
||||||
dec ecx
|
dec ecx
|
||||||
//;emulate callbacks like PE loader would have done
|
//;emulate callbacks like PE loader would have done
|
||||||
push eax //;0 - reserved
|
push eax //;0 - reserved
|
||||||
push 1 //;DLL_PROCESS_ATTACH
|
push 1 //;DLL_PROCESS_ATTACH
|
||||||
push ebx //;module base alias module handle alias hInstance alias ...
|
push ebx //;module base alias module handle alias hInstance alias ...
|
||||||
call ecx //;contains ptr to callback handler
|
call ecx //;contains ptr to callback handler
|
||||||
|
|
||||||
section PEMAIN20
|
section PEMAIN20
|
||||||
popa
|
popa
|
||||||
|
|
||||||
// clear the dirty stack
|
// clear the dirty stack
|
||||||
.macro clearstack128 tmp_reg
|
.macro clearstack128 tmp_reg
|
||||||
local loop
|
local loop
|
||||||
lea \tmp_reg, [esp - 128]
|
lea \tmp_reg, [esp - 128]
|
||||||
loop:
|
loop:
|
||||||
push 0
|
push 0
|
||||||
cmp esp, \tmp_reg
|
cmp esp, \tmp_reg
|
||||||
jnzs loop
|
jnzs loop
|
||||||
sub esp, -128
|
sub esp, -128
|
||||||
.endm
|
.endm
|
||||||
|
|
||||||
section CLEARSTACK
|
section CLEARSTACK
|
||||||
clearstack128 eax
|
clearstack128 eax
|
||||||
|
|
||||||
section PEMAIN21
|
section PEMAIN21
|
||||||
reloc_end_jmp:
|
reloc_end_jmp:
|
||||||
|
|
||||||
section PERETURN
|
section PERETURN
|
||||||
xor eax, eax
|
xor eax, eax
|
||||||
inc eax
|
inc eax
|
||||||
ret 0x0C
|
ret 0x0C
|
||||||
section PEDOJUMP
|
section PEDOJUMP
|
||||||
jmp original_entry
|
jmp original_entry
|
||||||
|
|
||||||
section PETLSC2
|
section PETLSC2
|
||||||
//;TLS_CALLBACK(hModule, reason, reserved)
|
//;TLS_CALLBACK(hModule, reason, reserved)
|
||||||
tls_handler_start:
|
tls_handler_start:
|
||||||
jmp end_of_tls_handler //;this jump is patched to EB 00 (jmp $+2) by stub
|
jmp end_of_tls_handler //;this jump is patched to EB 00 (jmp $+2) by stub
|
||||||
push esi
|
push esi
|
||||||
mov esi, offset tls_callbacks_ptr //;must be relocated
|
mov esi, offset tls_callbacks_ptr //;must be relocated
|
||||||
cld //;you never know, this code gets called by the PE loader
|
cld //;you never know, this code gets called by the PE loader
|
||||||
walk_tlsc_chain2:
|
walk_tlsc_chain2:
|
||||||
lodsd
|
lodsd
|
||||||
test eax, eax
|
test eax, eax
|
||||||
jz done_callbacks
|
jz done_callbacks
|
||||||
//;copy the stack frame, 3 arguments
|
//;copy the stack frame, 3 arguments
|
||||||
push 3
|
push 3
|
||||||
pop ecx
|
pop ecx
|
||||||
push_loop:
|
push_loop:
|
||||||
push dword ptr [esp + 0x10] //;4 bytes
|
push dword ptr [esp + 0x10] //;4 bytes
|
||||||
loop push_loop
|
loop push_loop
|
||||||
call eax
|
call eax
|
||||||
jmp walk_tlsc_chain2
|
jmp walk_tlsc_chain2
|
||||||
done_callbacks:
|
done_callbacks:
|
||||||
pop esi
|
pop esi
|
||||||
end_of_tls_handler:
|
end_of_tls_handler:
|
||||||
ret 0x0C
|
ret 0x0C
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
// ============= CUT HERE
|
// ============= CUT HERE
|
||||||
// =============
|
// =============
|
||||||
|
|
||||||
#include "include/header.S"
|
#include "include/header.S"
|
||||||
|
|
||||||
// vi:ts=8:et:nowrap
|
// vi:ts=8:et:nowrap
|
||||||
|
|||||||
Reference in New Issue
Block a user