/src/clamav/libclamav/mew.c

Source (jump to first uncovered line)
/*
 *  Copyright (C) 2013-2023 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
 *  Copyright (C) 2007-2013 Sourcefire, Inc.
 *
 *  Authors: Michal 'GiM' Spadlinski
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License version 2 as
 *  published by the Free Software Foundation.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 *  MA 02110-1301, USA.
 */

/*
 * lzma.c
 *
 * o2:28:18 CEST 2oo6-25-o6     - initial 0xA4/0x536
 * oo:29:4o CEST 2oo6-26-o6     - 0x1cd/0x536 [+0x129]
 * o2:13:19 CEST 2oo6-o1-o7, 2oo6-3o-o6 - 0x536/0x536
 *
 */

#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif

#include <stdio.h>
#ifdef HAVE_STDLIB_H
#include <stdlib.h>
#endif
#ifdef HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
#ifdef HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#ifdef HAVE_STRING_H
#include <string.h>
#endif

#include "clamav.h"
#include "pe.h"
#include "others.h"
#include "mew.h"
#include "packlibs.h"
#include "rebuildpe.h"

#define EC32(x) le32_to_host(x) /* Convert little endian to host */
#define CE32(x) be32_to_host(x) /* Convert big endian to host */
#define PEALIGN(o, a) (((a)) ? (((o) / (a)) * (a)) : (o))
#define PESALIGN(o, a) (((a)) ? (((o) / (a) + ((o) % (a) != 0)) * (a)) : (o))

/* modifies all parameters */
/* northfox does this shitty way,
 * this should be done with just a bswap
 */
static const char *lzma_bswap_4861dc(struct lzmastate *p, const char *old_edx)
{
    /* dumb_dump_start
         *

        old_edx was 'uint32_t *' before and in mew_lzma there was
        &new_edx where new_edx = var1C

        uint32_t loc_esi, loc_edi;
        uint8_t *loc_eax;

        p->p2 = loc_esi = 0;
        p->p0 = loc_eax = (uint8_t *)*old_edx;
        *old_edx = 5;
        do {
                loc_esi = p->p2 << 8;
                loc_edi = *(uint8_t *)((loc_eax)++);
                loc_esi |= loc_edi;
                (*old_edx)--;
                p->p2 = loc_esi;
        } while (*old_edx);
        p->p0 = loc_eax;
        p->p1 = 0xffffffff;

        * dumb_dump_end
        */

    /* XXX, mine replacement */
    p->p2 = EC32(CE32(((uint32_t)cli_readint32(old_edx + 1))));
    p->p1 = 0xffffffff;
    p->p0 = old_edx + 5;

    return p->p0;
}

static uint32_t lzma_486248(struct lzmastate *p, const char **old_ecx, char *src, uint32_t size)
{
    uint32_t loc_esi, loc_edi, loc_eax, loc_ecx, ret;
    if (!CLI_ISCONTAINED(src, size, *old_ecx, 4) || !CLI_ISCONTAINED(src, size, p->p0, 1))
        return 0xffffffff;
    loc_esi = p->p1;
    loc_eax = loc_esi >> 0xb;
    loc_ecx = cli_readint32(*old_ecx);
    ret     = loc_ecx & 0xffff;
    (loc_eax) *= ret;
    loc_edi = p->p2;
    if (loc_edi < loc_eax) {
        /* 48625f */
        p->p1   = loc_eax;
        loc_esi = ret;
        loc_edi = ((int32_t)(0x800 - ret) >> 5) + ((loc_eax & 0xffff0000) | ret);
        /* signed<-sar, &|<-mov ax, [ecx] */
        loc_ecx = (loc_ecx & 0xffff0000) | (loc_edi & 0xffff);
        cli_writeint32(*old_ecx, loc_ecx);

        ret = 0;
    } else {
        /* 48629e */
        loc_esi -= loc_eax;
        loc_edi -= loc_eax;
        p->p1   = loc_esi;
        p->p2   = loc_edi;
        loc_eax = (loc_eax & 0xffff0000) | ret;
        loc_esi = (loc_esi & 0xffff0000) | (ret >> 5);
        loc_eax -= loc_esi;

        loc_ecx = (loc_ecx & 0xffff0000) | (loc_eax & 0xffff);
        cli_writeint32(*old_ecx, loc_ecx);

        ret = 1;
    }
    loc_eax = p->p1;
    if (loc_eax < 0x1000000) {
        *old_ecx = p->p0;
        loc_edi  = (*(uint8_t *)(p->p0));
        loc_esi  = ((p->p2) << 8) | loc_edi;
        (*old_ecx)++;
        loc_eax <<= 8;
        p->p2 = loc_esi;
        p->p1 = loc_eax;
        p->p0 = *old_ecx;
    }
    return ret;
}

static uint32_t lzma_48635C(uint8_t znaczek, const char **old_ecx, struct lzmastate *p, uint32_t *retval, char *src, uint32_t size)
{
    uint32_t loc_esi = (znaczek & 0xff) >> 7, /* msb */
        loc_ebx, ret;
    const char *loc_edi;
    znaczek <<= 1;
    ret      = loc_esi << 9;
    loc_edi  = *old_ecx;
    *old_ecx = loc_edi + ret + 0x202;
    if ((ret = lzma_486248(p, old_ecx, src, size)) == 0xffffffff)
        return 0xffffffff;
    loc_ebx = ret | 2;

    while (loc_esi == ret) {
        if (loc_ebx >= 0x100) {
            ret     = (ret & 0xffffff00) | (loc_ebx & 0xff);
            *retval = ret;
            return 0;
        }
        loc_esi = (znaczek & 0xff) >> 7;
        znaczek <<= 1;
        ret      = ((loc_esi + 1) << 8) + loc_ebx;
        *old_ecx = loc_edi + ret * 2;
        if ((ret = lzma_486248(p, old_ecx, src, size)) == 0xffffffff)
            return 0xffffffff;
        loc_ebx += loc_ebx;
        loc_ebx |= ret;
    }
    loc_esi = 0x100;
    while (loc_ebx < loc_esi) {
        loc_ebx += loc_ebx;
        *old_ecx = loc_edi + loc_ebx;
        if ((ret = lzma_486248(p, old_ecx, src, size)) == 0xffffffff)
            return 0xffffffff;
        loc_ebx |= ret;
    }
    ret     = (ret & 0xffffff00) | (loc_ebx & 0xff);
    *retval = ret;
    return 0;
}

static uint32_t lzma_4862e0(struct lzmastate *p, const char **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
    uint32_t loc_ebx, loc_esi, stack_ecx, ret;
    const char *loc_edi;

    loc_ebx = *old_edx;
    ret     = 1;
    loc_edi = *old_ecx;
    if (loc_ebx && !(loc_ebx & 0x80000000)) {
        /* loc_4862f1 */
        stack_ecx = loc_ebx;
        do {
            loc_esi  = ret + ret;
            *old_ecx = loc_edi + loc_esi;
            if ((ret = lzma_486248(p, old_ecx, src, size)) == 0xffffffff)
                return 0xffffffff;
            ret += loc_esi;
            stack_ecx--;
        } while (stack_ecx);
    }
    /* loc_48630b */
    /* unneeded
     *old_ecx = (uint8_t *)loc_ebx;
     */

    *old_edx = 1 << (loc_ebx & 0xff);
    ret -= *old_edx;
    *retval = ret;
    return 0;
}

/* old_edx - write only */
static uint32_t lzma_4863da(uint32_t var0, struct lzmastate *p, const char **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
    uint32_t ret;
    const char *loc_esi = *old_ecx;

    if ((ret = lzma_486248(p, old_ecx, src, size)) == 0xffffffff)
        return -1;
    if (ret) {
        /* loc_4863ff */
        *old_ecx = loc_esi + 2;
        if ((ret = lzma_486248(p, old_ecx, src, size)) == 0xffffffff)
            return -1;
        if (ret) {
            /* loc_486429 */
            *old_edx = 8;
            *old_ecx = loc_esi + 0x204;
            if (lzma_4862e0(p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
                return -1;
            ret += 0x10;
        } else {
            /* loc_48640e */
            ret      = var0 << 4;
            *old_edx = 3;
            *old_ecx = loc_esi + 0x104 + ret;
            if (lzma_4862e0(p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
                return -1;
            ret += 0x8;
        }
    } else {
        /* loc_4863e9 */
        ret      = var0 << 4;
        *old_edx = 3;
        *old_ecx = loc_esi + 0x4 + ret;
        if (lzma_4862e0(p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
            return -1;
    }
    *retval = ret;
    return 0;
}

static uint32_t lzma_486204(struct lzmastate *p, uint32_t old_edx, uint32_t *retval, char *src, uint32_t size)
{
    uint32_t loc_esi, loc_edi, loc_ebx, loc_eax;
    const char *loc_edx;
    loc_esi = p->p1;
    loc_edi = p->p2;
    loc_eax = 0;
    if (old_edx && !(old_edx & 0x80000000)) {
        /* loc_4866212 */
        loc_ebx = old_edx;
        do {
            loc_esi >>= 1;
            loc_eax <<= 1;
            if (loc_edi >= loc_esi) {
                loc_edi -= loc_esi;
                loc_eax |= 1;
            }
            /* loc_486222 */
            if (loc_esi < 0x1000000) {
                if (!CLI_ISCONTAINED(src, size, p->p0, 1))
                    return 0xffffffff;
                loc_edx = p->p0;
                loc_edi <<= 8;
                loc_esi <<= 8;
                loc_edi |= (*loc_edx) & 0xff; /* movzx ebp, byte ptr [edx] */
                p->p0 = ++loc_edx;
            }
            loc_ebx--;
        } while (loc_ebx);
    }
    p->p2   = loc_edi;
    p->p1   = loc_esi;
    *retval = loc_eax;
    return 0;
}

static uint32_t lzma_48631a(struct lzmastate *p, const char **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
    uint32_t copy1, copy2;
    uint32_t loc_esi, loc_edi, ret;
    const char *loc_ebx;

    copy1    = *old_edx;
    loc_edi  = 0;
    loc_ebx  = *old_ecx;
    *old_edx = 1;
    copy2    = (uint32_t)loc_edi;

    if (copy1 <= (uint32_t)loc_edi) {
        *retval = copy2;
        return 0;
    }

    do {
        loc_esi  = *old_edx + *old_edx;
        *old_ecx = loc_esi + loc_ebx;
        if ((ret = lzma_486248(p, old_ecx, src, size)) == 0xffffffff)
            return 0xffffffff;
        /* unneeded *old_ecx  = loc_edi; */
        *old_edx = loc_esi + ret;
        /* ret <<= (uint32_t)(*old_ecx)&0xff; */
        ret <<= (loc_edi & 0xff);
        copy2 |= ret;
        loc_edi++;
    } while (loc_edi < copy1);

    *retval = copy2;
    return 0;
}

int mew_lzma(char *orgsource, const char *buf, uint32_t size_sum, uint32_t vma, uint32_t special)
{
    uint32_t var08, var0C, var10, var14, var20, var24, var28, var34;
    struct lzmastate var40;
    uint32_t new_eax, new_edx, temp;
    int i, mainloop;

    char var1;
    const char *source = buf;
    char *dest, *new_ebx;
    const char *new_ecx, *var0C_ecxcopy;
    const char *var2C;
    char *pushed_esi       = NULL;
    const char *pushed_ebx = NULL;
    uint32_t pushed_edx    = 0;

    uint32_t loc_esi, loc_edi;
    uint8_t *var18;

    if (special) {
        pushed_edx = cli_readint32(source);
        source += 4;
    }
    temp = cli_readint32(source) - vma;
    source += 4;
    if (!special) pushed_ebx = source;
    new_ebx = orgsource + temp;

    do {
        mainloop = 1;
        do {
            /* loc_486450 */
            if (!special) {
                source = pushed_ebx;
                if (!CLI_ISCONTAINED(orgsource, size_sum, source, 16))
                    return -1;

                if (cli_readint32(source) == 0) {
                    return 0;
                }
            } else {
                if (!CLI_ISCONTAINED(orgsource, size_sum, source, 12))
                    return -1;
            }

            var28 = cli_readint32(source);
            source += 4;
            temp  = cli_readint32(source) - vma;
            var18 = (uint8_t *)(orgsource + temp);
            if (special) pushed_esi = orgsource + temp;
            source += 4;
            temp = cli_readint32(source);
            source += 5; /* yes, five */
            var2C = source;
            source += temp;
            if (special)
                pushed_ebx = source;
            else
                pushed_ebx = source;
            var1 = 0;
            dest = new_ebx;

            if (!CLI_ISCONTAINED(orgsource, size_sum, dest, 0x6E6C))
                return -1;
            for (i = 0; i < 0x1b9b; i++) {
                cli_writeint32(dest, 0x4000400);
                dest += 4;
            }
            loc_esi = 0;
            var08 = var20 = 0;
            loc_edi       = 1;
            var14 = var10 = var24 = 1;

            if (!CLI_ISCONTAINED(orgsource, size_sum, var2C, 5))
                return -1;
            lzma_bswap_4861dc(&var40, var2C);
            new_edx = 0;
        } while (var28 <= loc_esi); /* source = 0 */

        cli_dbgmsg("MEWlzma: entering do while loop\n");
        do {
            /* loc_4864a5 */
            new_eax = var08 & 3;
            new_ecx = (((loc_esi << 4) + new_eax) * 2) + new_ebx;
            var0C   = new_eax;
            if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
                return -1;
            if (new_eax) {
                /* loc_486549 */
                new_ecx = new_ebx + loc_esi * 2 + 0x180;
                var20   = 1;
                /* eax=1 */
                if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
                    return -1;
                if (new_eax != 1) {
                    /* loc_486627 */
                    var24 = var10;
                    var10 = var14;
                    /* xor eax,eax; cmp esi, 7; setnl al; dec eax; add eax, 0Ah */
                    /* new_eax = (((loc_esi >= 7)-1)&0xFFFFFFFD) + 0xA; */
                    new_eax = loc_esi >= 7 ? 10 : 7;
                    new_ecx = new_ebx + 0x664;
                    var14   = loc_edi;
                    loc_esi = new_eax;
                    if (lzma_4863da(var0C, &var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
                        return -1;
                    var0C = new_eax;
                    if (var0C >= 4)
                        new_eax = 3;

                    /* loc_486662 */
                    new_edx = 6;
                    new_eax <<= 7;
                    new_ecx = new_eax + new_ebx + 0x360;
                    if (lzma_4862e0(&var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
                        return -1;
                    if (new_eax < 4) {
                        /* loc_4866ca */
                        loc_edi = new_eax;
                    } else {
                        /* loc_48667d */
                        uint32_t loc_ecx;
                        loc_ecx = ((int32_t)new_eax >> 1) - 1; /* sar */
                        loc_edi = ((new_eax & 1) | 2) << (loc_ecx & 0xff);
                        if (new_eax >= 0xe) {
                            /* loc_4866ab */
                            new_edx = loc_ecx - 4;
                            if (lzma_486204(&var40, new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
                                return -1;
                            loc_edi += new_eax << 4;

                            new_edx = 4;
                            new_ecx = new_ebx + 0x644;
                        } else {
                            /* loc_486691 */
                            new_edx = loc_ecx;
                            loc_ecx = loc_edi - new_eax;
                            new_ecx = new_ebx + loc_ecx * 2 + 0x55e;
                        }
                        /* loc_4866a2 */
                        if (lzma_48631a(&var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
                            return -1;
                        loc_edi += new_eax;
                    }
                    loc_edi++;
                } else {
                    /* loc_486568 */
                    new_ecx = new_ebx + loc_esi * 2 + 0x198;
                    if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
                        return -1;
                    if (new_eax) {
                        /* loc_4865bd */
                        new_ecx = new_ebx + loc_esi * 2 + 0x1B0;
                        if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
                            return -1;
                        if (new_eax) {
                            /* loc_4865d2 */
                            new_ecx = new_ebx + loc_esi * 2 + 0x1C8;
                            if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
                                return -1;
                            if (new_eax) {
                                /* loc_4865ea */
                                new_eax = var24;
                                var24   = var10;
                            } else {
                                /* loc_4865e5 */
                                new_eax = var10;
                            }
                            /* loc_4865f3 */
                            var10 = var14;
                        } else {
                            /* loc_4865cd */
                            new_eax = var14;
                        }
                        /* loc_4865f9 */
                        var14   = loc_edi;
                        loc_edi = new_eax;
                    } else {
                        /* loc_48657e */
                        new_eax = ((loc_esi + 0xf) << 4) + var0C;
                        new_ecx = new_ebx + new_eax * 2;
                        if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
                            return -1;
                        if (!new_eax) {
                            uint32_t loc_ecx;
                            /* loc_486593 */
                            loc_ecx = var08;
                            loc_ecx -= loc_edi;
                            /* loc_esi = ((((loc_esi >= 7)-1)&0xFFFFFFFE) + 0xB); */
                            loc_esi = loc_esi >= 7 ? 11 : 9;
                            if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + loc_ecx, 1))
                                return -1;
                            var1    = *(var18 + loc_ecx);
                            loc_ecx = (loc_ecx & 0xffffff00) | var1;
                            /* loc_4865af */
                            new_edx = var08++;
                            if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_edx, 1))
                                return -1;
                            *(var18 + new_edx) = loc_ecx & 0xff;

                            /* loc_4866fe */
                            new_eax = var08;
                            continue; /* !!! */
                        }
                    }
                    /* loc_4865fe */
                    new_ecx = new_ebx + 0xa68;
                    if (lzma_4863da(var0C, &var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
                        return -1;
                    var0C = new_eax;
                    /* new_eax = (((loc_esi >= 7)-1)&0xFFFFFFFD) + 0xB; */
                    new_eax = loc_esi >= 7 ? 11 : 8;
                    loc_esi = new_eax;
                }
                /* loc_4866cd */
                if (!loc_edi) {
                    break;
                } else {
                    var0C += 2;
                    new_ecx = (char *)var18;
                    new_edx = new_eax = var08;
                    new_eax -= loc_edi;
                    if (((var0C < var28 - new_edx) &&
                         (!CLI_ISCONTAINED(orgsource, size_sum, (char *)(new_ecx + new_eax), var0C) ||
                          !CLI_ISCONTAINED(orgsource, size_sum, (char *)(new_ecx + new_edx), var0C))) ||
                        (!CLI_ISCONTAINED(orgsource, size_sum, (char *)(new_ecx + new_eax), var28 - new_edx) ||
                         !CLI_ISCONTAINED(orgsource, size_sum, (char *)(new_ecx + new_edx), var28 - new_edx)))
                        return -1;
                    do {
                        var1                            = *(uint8_t *)(new_ecx + new_eax);
                        *(uint8_t *)(new_ecx + new_edx) = var1;

                        new_edx++;
                        new_eax++;
                        var0C--;
                        if (var0C <= 0)
                            break;
                    } while (new_edx < var28);
                    var08 = new_edx;
                }
            } else {
                /* loc_4864C8 */
                new_eax       = (((var1 & 0xff) >> 4) * 3) << 9;
                new_ecx       = new_eax + new_ebx + 0xe6c;
                var0C_ecxcopy = new_ecx;
                if (loc_esi >= 4) {
                    /* loc_4864e8 */
                    if (loc_esi >= 10)
                        loc_esi -= 6;
                    else
                        loc_esi -= 3;

                } else {
                    /* loc_4864e4 */
                    loc_esi = 0;
                }

                if (var20 == 0) {
                    /* loc_48651D */
                    new_eax = 1;
                    do {
                        /* loc_486525 */
                        /*new_ecx = var0C_ecxcopy;*/
                        new_eax += new_eax;
                        new_ecx += new_eax;
                        var34 = new_eax;
                        if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
                            return -1;
                        new_eax |= var34;
                        /* loc_486522 */
                        /* keeping it here instead of at the top
                         * seems to work faster
                         */
                        if (new_eax < 0x100) {
                            new_ecx = var0C_ecxcopy;
                        }
                    } while (new_eax < 0x100);
                    /* loc_48653e */
                    var1 = (uint8_t)(new_eax & 0xff);
                } else {
                    int t;
                    /* loc_4864FB */
                    new_eax = var08 - loc_edi;
                    if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_eax, 1))
                        return -1;
                    t       = *(var18 + new_eax);
                    new_eax = (new_eax & 0xffffff00) | t;

                    if (lzma_48635C(t, &new_ecx, &var40, &new_eax, orgsource, size_sum) == 0xffffffff)
                        return -1;
                    var20 = 0;
                    var1  = new_eax & 0xff;
                }

                /* loc_486541 */

                /* unneeded: new_ecx = (new_ecx&0xffffff00) | var1; */

                /* loc_4865af */
                new_edx = var08++;

                if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_edx, 1))
                    return -1;
                *(var18 + new_edx) = var1;
            }
            /* loc_4866fe */
            new_eax = var08;
        } while (new_eax < var28);

        while (special) {
            uint32_t loc_ecx;
            /* let's fix calls */
            cli_dbgmsg("MEWlen: %08x ? %08x\n", new_edx, pushed_edx);

            if (pushed_edx < 5 || !CLI_ISCONTAINED(orgsource, size_sum, pushed_esi, pushed_edx))
                return 0; /* No point in full failing just because we can't fixxup the calls */

            for (loc_ecx = 0; loc_ecx < pushed_edx - 5; loc_ecx++) {
                /* 0xe8, 0xe9 call opcodes */
                if (pushed_esi[loc_ecx] == '\xe8' || pushed_esi[loc_ecx] == '\xe9') {
                    char *adr = (char *)(pushed_esi + loc_ecx + 1);

                    cli_writeint32(adr, EC32(CE32((uint32_t)cli_readint32(adr))) - loc_ecx - 1);
                    loc_ecx += 4;
                }
            }
            return 0; /*pushed_edx;*/
        }
    } while (mainloop);

    return 0xbadc0de;
}

/* UPack lzma */

/* compare with 486248 */
uint32_t lzma_upack_esi_00(struct lzmastate *p, char *old_ecx, char *bb, uint32_t bl)
{
    uint32_t loc_eax, ret, loc_edi;
    loc_eax = p->p1 >> 0xb;
    if (!CLI_ISCONTAINED(bb, bl, old_ecx, 4) || !CLI_ISCONTAINED(bb, bl, p->p0, 4)) {
        if (!CLI_ISCONTAINED(bb, bl, old_ecx, 4))
            cli_dbgmsg("contain error! %p %08x ecx: %p [%p]\n", bb, bl, old_ecx, bb + bl);
        else
            cli_dbgmsg("contain error! %p %08x p0: %p [%p]\n", bb, bl, p->p0, bb + bl);
        return 0xffffffff;
    }
    ret = cli_readint32(old_ecx);
    loc_eax *= ret;
    loc_edi = cli_readint32((char *)p->p0);
    loc_edi = EC32(CE32(loc_edi)); /* bswap */
    loc_edi -= p->p2;
    if (loc_edi < loc_eax) {
        p->p1   = loc_eax;
        loc_eax = (0x800 - ret) >> 5;
        cli_writeint32(old_ecx, cli_readint32(old_ecx) + loc_eax);
        ret = 0;
    } else {
        p->p2 += loc_eax;
        p->p1 -= loc_eax;
        loc_eax = ret >> 5;
        cli_writeint32(old_ecx, cli_readint32(old_ecx) - loc_eax);
        ret = 1;
    }
    if (((p->p1) & 0xff000000) == 0) {
        p->p2 <<= 8;
        p->p1 <<= 8;
        p->p0++;
    }
    return ret;
}

/* compare with lzma_4862e0 */
/* lzma_upack_esi_4c 0x1 as eax!
 */
uint32_t lzma_upack_esi_50(struct lzmastate *p, uint32_t old_eax, uint32_t old_ecx, char **old_edx, char *old_ebp, uint32_t *retval, char *bs, uint32_t bl)
{
    uint32_t loc_eax = old_eax, ret;

    do {
        *old_edx = old_ebp + (loc_eax << 2);
        if ((ret = lzma_upack_esi_00(p, *old_edx, bs, bl)) == 0xffffffff)
            return 0xffffffff;
        loc_eax += loc_eax;
        loc_eax += ret;
    } while (loc_eax < old_ecx);

    *retval = loc_eax - old_ecx;
    return 0;
}

uint32_t lzma_upack_esi_54(struct lzmastate *p, uint32_t old_eax, uint32_t *old_ecx, char **old_edx, uint32_t *retval, char *bs, uint32_t bl)
{
    uint32_t ret, loc_eax = old_eax;

    *old_ecx = ((*old_ecx) & 0xffffff00) | 8;
    ret      = lzma_upack_esi_00(p, *old_edx, bs, bl);
    *old_edx = ((*old_edx) + 4);
    loc_eax  = (loc_eax & 0xffffff00) | 1;
    if (ret) {
        ret = lzma_upack_esi_00(p, *old_edx, bs, bl);
        loc_eax |= 8; /* mov al, 9 */
        if (ret) {
            *old_ecx <<= 5;
            loc_eax = 0x11; /* mov al, 11 */
        }
    }
    ret = loc_eax;
    if (lzma_upack_esi_50(p, 1, *old_ecx, old_edx, *old_edx + (loc_eax << 2), &loc_eax, bs, bl) == 0xffffffff)
        return 0xffffffff;

    *retval = ret + loc_eax;
    return 0;
}

/**
 * @brief   Unpack MEW 11 packed PE file
 *
 * @param src     buffer to unpack
 * @param off     offset of diff
 * @param ssize   pe section size
 * @param dsize   diff size
 * @param base    OPTIONAL_HEADER32.ImageBase
 * @param vadd    RVA of pe section
 * @param uselzma   Bool - use LZMA
 * @param filedesc  File descriptor
 * @return int    Returns -1 on failure, 1 on success.
 */
int unmew11(char *src, uint32_t off, uint32_t ssize, uint32_t dsize, uint32_t base, uint32_t vadd, int uselzma, int filedesc)
{
    uint32_t entry_point, newedi, loc_ds = dsize, loc_ss = ssize;
    char *source     = NULL;
    const char *lesi = NULL;
    char *ledi;
    const char *f1;
    char *f2;
    int i;
    struct cli_exe_section *section = NULL;
    uint32_t vma                    = base + vadd;
    uint32_t size_sum               = ssize + dsize;

    /* Guard against integer overflows */
    if (base + vadd < base) {
        cli_dbgmsg("MEW: base (%08x) + PE section RVA (%08x) exceeds max size of unsigned int (%08x)\n",
                   base, vadd, UINT32_MAX);
        return -1;
    }
    if (ssize + dsize < ssize) {
        cli_dbgmsg("MEW: section size (%08x) + diff size (%08x) exceeds max size of unsigned int (%08x)\n",
                   ssize, dsize, UINT32_MAX);
        return -1;
    }
    if (((size_t)(src + off) < (size_t)(src)) ||
        ((size_t)(src + off) < (size_t)(off))) {
        cli_dbgmsg("MEW: Buffer pointer (%08zx) + offset (%08zx) exceeds max size of pointer (%08lx)\n",
                   (size_t)src, (size_t)off, SIZE_MAX);
        return -1;
    }

    /* Ensure that off + required data exists within buffer */
    if (!CLI_ISCONTAINED(src, size_sum, src + off, 12)) {
        cli_dbgmsg("MEW: Data reference exceeds size of provided buffer.\n");
        return -1;
    }

    source = src + dsize + off;
    lesi   = source + 12;

    entry_point = cli_readint32(source + 4);
    newedi      = cli_readint32(source + 8);
    ledi        = src + (newedi - vma);
    loc_ds      = size_sum - (newedi - vma);

    i = 0;
    loc_ss -= 12;
    loc_ss -= off;
    while (1) {
        cli_dbgmsg("MEW unpacking section %d (%p->%p)\n", i, lesi, ledi);
        if (!CLI_ISCONTAINED(src, size_sum, lesi, loc_ss) || !CLI_ISCONTAINED(src, size_sum, ledi, loc_ds)) {
            cli_dbgmsg("Possibly programmer error or hand-crafted PE file, report to clamav team\n");
            if (section != NULL)
                free(section);
            return -1;
        }
        if (unmew(lesi, ledi, loc_ss, loc_ds, &f1, &f2)) {
            free(section);
            return -1;
        }

        /* we don't need last section in sections since this is information for fixing imptbl */
        if (!CLI_ISCONTAINED(src, size_sum, f1, 4)) {
            free(section);
            return -1;
        }

        /* XXX */
        loc_ss -= (f1 + 4 - lesi);
        lesi = f1 + 4;

        ledi   = src + (cli_readint32(f1) - vma);
        loc_ds = size_sum - (cli_readint32(f1) - vma);

        if (!uselzma) {
            uint32_t val = PESALIGN(f2 - src, 0x1000);
            void *newsect;

            if (i && val < section[i].raw) {
                cli_dbgmsg("MEW: WTF - please report\n");
                free(section);
                return -1;
            }

            if (!(newsect = cli_realloc(section, (i + 2) * sizeof(struct cli_exe_section)))) {
                cli_dbgmsg("MEW: Out of memory\n");
                free(section);
                return -1;
            }

            section            = (struct cli_exe_section *)newsect;
            section[0].raw     = 0;
            section[0].rva     = vadd;
            section[i + 1].raw = val;
            section[i + 1].rva = val + vadd;
            section[i].rsz = section[i].vsz = ((i) ? (val - section[i].raw) : val);

            /*
             * bb#11212 - alternate fix, buffer is aligned
             * must validate that sections do not intersect with source
             * or, in other words, exceed the specified size of destination
             */
            if (section[i].raw + section[i].rsz > dsize) {
                cli_dbgmsg("MEW: Section %i [%d, %d] exceeds destination size %u\n",
                           i, section[i].raw, section[i].raw + section[i].rsz, dsize);
                free(section);
                return -1;
            }
        }
        i++;

        if (!cli_readint32(f1))
            break;
    }

    /* LZMA stuff */
    if (uselzma) {
        free(section);

        /* put everything in one section */
        i = 1;
        if (!CLI_ISCONTAINED(src, size_sum, src + uselzma + 8, 1)) {
            cli_dbgmsg("MEW: couldn't access lzma 'special' tag\n");
            return -1;
        }
        /* 0x50 -> push eax */
        cli_dbgmsg("MEW: lzma %swas used, unpacking\n", (*(src + uselzma + 8) == '\x50') ? "special " : "");
        if (!CLI_ISCONTAINED(src, size_sum, f1 + 4, 20 + 4 + 5)) {
            cli_dbgmsg("MEW: lzma initialization data not available!\n");
            return -1;
        }

        if (mew_lzma(src, f1 + 4, size_sum, vma, *(src + uselzma + 8) == '\x50')) {
            return -1;
        }
        loc_ds = PESALIGN(loc_ds, 0x1000);

        section = cli_calloc(1, sizeof(struct cli_exe_section));
        if (!section) {
            cli_dbgmsg("MEW: Out of memory\n");
            return -1;
        }

        section[0].raw = 0;
        section[0].rva = vadd;
        section[0].rsz = section[0].vsz = dsize;
    }
    if (!cli_rebuildpe_align(src, section, i, base, entry_point - base, 0, 0, filedesc, 0x1000)) {
        cli_dbgmsg("MEW: Rebuilding failed\n");
        free(section);
        return -1;
    }
    free(section);
    return 1;
}

Coverage Report

Created: 2023-12-08 06:48