/*

Copyright (c) 2014-2015. The YARA Authors. All Rights Reserved.

Redistribution and use in source and binary forms, with or without modification,

are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this

list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,

this list of conditions and the following disclaimer in the documentation and/or

other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its contributors

may be used to endorse or promote products derived from this software without

specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND

ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR

ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON

ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include <stdio.h>

#include <string.h>

#include <yara/dotnet.h>

#include <yara/endian.h>

#include <yara/integers.h>

#include <yara/mem.h>

#include <yara/pe.h>

#include <yara/pe_utils.h>

#include <yara/strutils.h>

#include <yara/utils.h>

PIMAGE_NT_HEADERS32 pe_get_header(const uint8_t* data, size_t data_size)

{

  PIMAGE_DOS_HEADER mz_header;

  PIMAGE_NT_HEADERS32 pe_header;

  size_t headers_size = 0;

  if (data_size < sizeof(IMAGE_DOS_HEADER))

    return NULL;

  mz_header = (PIMAGE_DOS_HEADER) data;

  if (yr_le16toh(mz_header->e_magic) != IMAGE_DOS_SIGNATURE)

    return NULL;

  if (yr_le32toh(mz_header->e_lfanew) < 0)

    return NULL;

  headers_size = yr_le32toh(mz_header->e_lfanew) +

                 sizeof(pe_header->Signature) + sizeof(IMAGE_FILE_HEADER);

  if (data_size < headers_size)

    return NULL;

  pe_header = (PIMAGE_NT_HEADERS32) (data + yr_le32toh(mz_header->e_lfanew));

  if (yr_le32toh(pe_header->Signature) != IMAGE_NT_SIGNATURE)

    return NULL;

  if (data_size < headers_size + sizeof(IMAGE_OPTIONAL_HEADER32))

    return NULL;

  if (pe_header->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)

    headers_size += sizeof(IMAGE_OPTIONAL_HEADER64);

  else

    headers_size += sizeof(IMAGE_OPTIONAL_HEADER32);

  if (data_size < headers_size)

    return NULL;

  return pe_header;

}

PIMAGE_DATA_DIRECTORY pe_get_directory_entry(PE* pe, int entry)

{

  // In theory, `entry` should be lower than NumberOfRvaAndSizes, however,

  // we don't enforce it because some PE files have a NumberOfRvaAndSizes

  // values lower than the actual number of directory entries. For example,

  // file 0aa527fd26c8e7fa7f3476b6d7eb8f22c071ff4c0fd3ed3797fa90ceb80f24ce

  // has NumberOfRvaAndSizes set to 0, but it actually has directory

  // entries. If we are overly strict here, and only parse entries which are

  // less than NumberOfRvaAndSizes, we run the risk of missing otherwise

  // perfectly valid files (valid in the sense that they can be parsed, even

  // if they are not valid for the Windows loader).

  PIMAGE_DATA_DIRECTORY result = &OptionalHeader(pe, DataDirectory)[entry];

  // Check that directory is in file

  if (!struct_fits_in_pe(pe, result, IMAGE_DATA_DIRECTORY))

    return NULL;

  return result;

}

int64_t pe_rva_to_offset(PE* pe, uint64_t rva)

{

  PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(pe->header);

  DWORD lowest_section_rva = 0xffffffff;

  DWORD section_rva = 0;

  DWORD section_offset = 0;

  DWORD section_raw_size = 0;

  int64_t result;

  int i = 0;

  int alignment = 0;

  int rest = 0;

  while (i < yr_min(

                 yr_le16toh(pe->header->FileHeader.NumberOfSections),

                 MAX_PE_SECTIONS))

  {

    if (struct_fits_in_pe(pe, section, IMAGE_SECTION_HEADER))

    {

      if (lowest_section_rva > yr_le32toh(section->VirtualAddress))

      {

        lowest_section_rva = yr_le32toh(section->VirtualAddress);

      }

      // In theory, we should use the section's virtual size while

      // checking if some RVA is within the section. In most cases

      // the virtual size is greater than the raw data size, but that's

      // not always the case. So we use the larger of the two values.

      //

      // Example:

      // db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984

      uint32_t virtualSize = yr_max(

          yr_le32toh(section->Misc.VirtualSize),

          yr_le32toh(section->SizeOfRawData));

      if (rva >= yr_le32toh(section->VirtualAddress) &&

          rva - yr_le32toh(section->VirtualAddress) < virtualSize &&

          section_rva <= yr_le32toh(section->VirtualAddress))

      {

        // Round section_offset

        //

        // Rounding everything less than 0x200 to 0 as discussed in

        // https://code.google.com/archive/p/corkami/wikis/PE.wiki#PointerToRawData

        // does not work for PE32_FILE from the test suite and for

        // some tinype samples where File Alignment = 4

        // (http://www.phreedom.org/research/tinype/).

        //

        // If FileAlignment is >= 0x200, it is apparently ignored (see

        // Ero Carreras's pefile.py, PE.adjust_FileAlignment).

        alignment = yr_min(

            yr_le32toh(OptionalHeader(pe, FileAlignment)), 0x200);

        section_rva = yr_le32toh(section->VirtualAddress);

        section_offset = yr_le32toh(section->PointerToRawData);

        section_raw_size = yr_le32toh(section->SizeOfRawData);

        if (alignment)

        {

          rest = section_offset % alignment;

          if (rest)

            section_offset -= rest;

        }

        // For multi-section images, real pointer to raw data is aligned down to

        // sector size

        if (yr_le32toh(OptionalHeader(pe, SectionAlignment)) >= PE_PAGE_SIZE)

          section_offset = section_offset & ~(PE_SECTOR_SIZE - 1);

      }

      section++;

      i++;

    }

    else

    {

      return -1;

    }

  }

  // Everything before the first section seems to get mapped straight

  // relative to ImageBase.

  if (rva < lowest_section_rva)

  {

    section_rva = 0;

    section_offset = 0;

    section_raw_size = (DWORD) pe->data_size;

  }

  // Many sections, have a raw (on disk) size smaller than their in-memory size.

  // Check for rva's that map to this sparse space, and therefore have no valid

  // associated file offset.

  if ((rva - section_rva) >= section_raw_size)

    return -1;

  result = section_offset + (rva - section_rva);

  // Check that the offset fits within the file.

  if (result >= pe->data_size)

    return -1;

  return result;

}

#if !HAVE_TIMEGM

#if HAVE__MKGMTIME

#define timegm _mkgmtime

#else

#include <time.h>

static bool is_leap(unsigned int year)

{

  year += 1900;

  return (year % 4) == 0 && ((year % 100) != 0 || (year % 400) == 0);

}

time_t timegm(struct tm* tm)

{

  static const unsigned ndays[2][12] = {

      {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31},

      {31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}};

  time_t res = 0;

  int i;

  for (i = 70; i < tm->tm_year; ++i) res += is_leap(i) ? 366 : 365;

  for (i = 0; i < tm->tm_mon; ++i) res += ndays[is_leap(tm->tm_year)][i];

  res += tm->tm_mday - 1;

  res *= 24;

  res += tm->tm_hour;

  res *= 60;

  res += tm->tm_min;

  res *= 60;

  res += tm->tm_sec;

  return res;

}

#endif  // HAVE__MKGMTIME

#endif  // !HAVE_TIMEGM

// These ordinals are taken from pefile. If a lookup fails attempt to return

// "ordN" and if that fails, return NULL. The caller is responsible for freeing

// the returned string.

char* ord_lookup(char* dll, uint16_t ord)

{

  char name[64];

  name[0] = '\0';

  if (strncasecmp(dll, "WS2_32.dll", 10) == 0 ||

      strncasecmp(dll, "wsock32.dll", 11) == 0)

  {

    switch (ord)

    {

    case 1:

      sprintf(name, "accept");

      break;

    case 2:

      sprintf(name, "bind");

      break;

    case 3:

      sprintf(name, "closesocket");

      break;

    case 4:

      sprintf(name, "connect");

      break;

    case 5:

      sprintf(name, "getpeername");

      break;

    case 6:

      sprintf(name, "getsockname");

      break;

    case 7:

      sprintf(name, "getsockopt");

      break;

    case 8:

      sprintf(name, "htonl");

      break;

    case 9:

      sprintf(name, "htons");

      break;

    case 10:

      sprintf(name, "ioctlsocket");

      break;

    case 11:

      sprintf(name, "inet_addr");

      break;

    case 12:

      sprintf(name, "inet_ntoa");

      break;

    case 13:

      sprintf(name, "listen");

      break;

    case 14:

      sprintf(name, "ntohl");

      break;

    case 15:

      sprintf(name, "ntohs");

      break;

    case 16:

      sprintf(name, "recv");

      break;

    case 17:

      sprintf(name, "recvfrom");

      break;

    case 18:

      sprintf(name, "select");

      break;

    case 19:

      sprintf(name, "send");

      break;

    case 20:

      sprintf(name, "sendto");

      break;

    case 21:

      sprintf(name, "setsockopt");

      break;

    case 22:

      sprintf(name, "shutdown");

      break;

    case 23:

      sprintf(name, "socket");

      break;

    case 24:

      sprintf(name, "GetAddrInfoW");

      break;

    case 25:

      sprintf(name, "GetNameInfoW");

      break;

    case 26:

      sprintf(name, "WSApSetPostRoutine");

      break;

    case 27:

      sprintf(name, "FreeAddrInfoW");

      break;

    case 28:

      sprintf(name, "WPUCompleteOverlappedRequest");

      break;

    case 29:

      sprintf(name, "WSAAccept");

      break;

    case 30:

      sprintf(name, "WSAAddressToStringA");

      break;

    case 31:

      sprintf(name, "WSAAddressToStringW");

      break;

    case 32:

      sprintf(name, "WSACloseEvent");

      break;

    case 33:

      sprintf(name, "WSAConnect");

      break;

    case 34:

      sprintf(name, "WSACreateEvent");

      break;

    case 35:

      sprintf(name, "WSADuplicateSocketA");

      break;

    case 36:

      sprintf(name, "WSADuplicateSocketW");

      break;

    case 37:

      sprintf(name, "WSAEnumNameSpaceProvidersA");

      break;

    case 38:

      sprintf(name, "WSAEnumNameSpaceProvidersW");

      break;

    case 39:

      sprintf(name, "WSAEnumNetworkEvents");

      break;

    case 40:

      sprintf(name, "WSAEnumProtocolsA");

      break;

    case 41:

      sprintf(name, "WSAEnumProtocolsW");

      break;

    case 42:

      sprintf(name, "WSAEventSelect");

      break;

    case 43:

      sprintf(name, "WSAGetOverlappedResult");

      break;

    case 44:

      sprintf(name, "WSAGetQOSByName");

      break;

    case 45:

      sprintf(name, "WSAGetServiceClassInfoA");

      break;

    case 46:

      sprintf(name, "WSAGetServiceClassInfoW");

      break;

    case 47:

      sprintf(name, "WSAGetServiceClassNameByClassIdA");

      break;

    case 48:

      sprintf(name, "WSAGetServiceClassNameByClassIdW");

      break;

    case 49:

      sprintf(name, "WSAHtonl");

      break;

    case 50:

      sprintf(name, "WSAHtons");

      break;

    case 51:

      sprintf(name, "gethostbyaddr");

      break;

    case 52:

      sprintf(name, "gethostbyname");

      break;

    case 53:

      sprintf(name, "getprotobyname");

      break;

    case 54:

      sprintf(name, "getprotobynumber");

      break;

    case 55:

      sprintf(name, "getservbyname");

      break;

    case 56:

      sprintf(name, "getservbyport");

      break;

    case 57:

      sprintf(name, "gethostname");

      break;

    case 58:

      sprintf(name, "WSAInstallServiceClassA");

      break;

    case 59:

      sprintf(name, "WSAInstallServiceClassW");

      break;

    case 60:

      sprintf(name, "WSAIoctl");

      break;

    case 61:

      sprintf(name, "WSAJoinLeaf");

      break;

    case 62:

      sprintf(name, "WSALookupServiceBeginA");

      break;

    case 63:

      sprintf(name, "WSALookupServiceBeginW");

      break;

    case 64:

      sprintf(name, "WSALookupServiceEnd");

      break;

    case 65:

      sprintf(name, "WSALookupServiceNextA");

      break;

    case 66:

      sprintf(name, "WSALookupServiceNextW");

      break;

    case 67:

      sprintf(name, "WSANSPIoctl");

      break;

    case 68:

      sprintf(name, "WSANtohl");

      break;

    case 69:

      sprintf(name, "WSANtohs");

      break;

    case 70:

      sprintf(name, "WSAProviderConfigChange");

      break;

    case 71:

      sprintf(name, "WSARecv");

      break;

    case 72:

      sprintf(name, "WSARecvDisconnect");

      break;

    case 73:

      sprintf(name, "WSARecvFrom");

      break;

    case 74:

      sprintf(name, "WSARemoveServiceClass");

      break;

    case 75:

      sprintf(name, "WSAResetEvent");

      break;

    case 76:

      sprintf(name, "WSASend");

      break;

    case 77:

      sprintf(name, "WSASendDisconnect");

      break;

    case 78:

      sprintf(name, "WSASendTo");

      break;

    case 79:

      sprintf(name, "WSASetEvent");

      break;

    case 80:

      sprintf(name, "WSASetServiceA");

      break;

    case 81:

      sprintf(name, "WSASetServiceW");

      break;

    case 82:

      sprintf(name, "WSASocketA");

      break;

    case 83:

      sprintf(name, "WSASocketW");

      break;

    case 84:

      sprintf(name, "WSAStringToAddressA");

      break;

    case 85:

      sprintf(name, "WSAStringToAddressW");

      break;

    case 86:

      sprintf(name, "WSAWaitForMultipleEvents");

      break;

    case 87:

      sprintf(name, "WSCDeinstallProvider");

      break;

    case 88:

      sprintf(name, "WSCEnableNSProvider");

      break;

    case 89:

      sprintf(name, "WSCEnumProtocols");

      break;

    case 90:

      sprintf(name, "WSCGetProviderPath");

      break;

    case 91:

      sprintf(name, "WSCInstallNameSpace");

      break;

    case 92:

      sprintf(name, "WSCInstallProvider");

      break;

    case 93:

      sprintf(name, "WSCUnInstallNameSpace");

      break;

    case 94:

      sprintf(name, "WSCUpdateProvider");

      break;

    case 95:

      sprintf(name, "WSCWriteNameSpaceOrder");

      break;

    case 96:

      sprintf(name, "WSCWriteProviderOrder");

      break;

    case 97:

      sprintf(name, "freeaddrinfo");

      break;

    case 98:

      sprintf(name, "getaddrinfo");

      break;

    case 99:

      sprintf(name, "getnameinfo");

      break;

    case 101:

      sprintf(name, "WSAAsyncSelect");

      break;

    case 102:

      sprintf(name, "WSAAsyncGetHostByAddr");

      break;

    case 103:

      sprintf(name, "WSAAsyncGetHostByName");

      break;

    case 104:

      sprintf(name, "WSAAsyncGetProtoByNumber");

      break;

    case 105:

      sprintf(name, "WSAAsyncGetProtoByName");

      break;

    case 106:

      sprintf(name, "WSAAsyncGetServByPort");

      break;

    case 107:

      sprintf(name, "WSAAsyncGetServByName");

      break;

    case 108:

      sprintf(name, "WSACancelAsyncRequest");

      break;

    case 109:

      sprintf(name, "WSASetBlockingHook");

      break;

    case 110:

      sprintf(name, "WSAUnhookBlockingHook");

      break;

    case 111:

      sprintf(name, "WSAGetLastError");

      break;

    case 112:

      sprintf(name, "WSASetLastError");

      break;

    case 113:

      sprintf(name, "WSACancelBlockingCall");

      break;

    case 114:

      sprintf(name, "WSAIsBlocking");

      break;

    case 115:

      sprintf(name, "WSAStartup");

      break;

    case 116:

      sprintf(name, "WSACleanup");

      break;

    case 151:

      sprintf(name, "__WSAFDIsSet");

      break;

    case 500:

      sprintf(name, "WEP");

      break;

    default:

      break;

    }

  }

  else if (strncasecmp(dll, "oleaut32.dll", 12) == 0)

  {

    switch (ord)

    {

    case 2:

      sprintf(name, "SysAllocString");

      break;

    case 3:

      sprintf(name, "SysReAllocString");

      break;

    case 4:

      sprintf(name, "SysAllocStringLen");

      break;

    case 5:

      sprintf(name, "SysReAllocStringLen");

      break;

    case 6:

      sprintf(name, "SysFreeString");

      break;

    case 7:

      sprintf(name, "SysStringLen");

      break;

    case 8:

      sprintf(name, "VariantInit");

      break;

    case 9:

      sprintf(name, "VariantClear");

      break;

    case 10:

      sprintf(name, "VariantCopy");

      break;

    case 11:

      sprintf(name, "VariantCopyInd");

      break;

    case 12:

      sprintf(name, "VariantChangeType");

      break;

    case 13:

      sprintf(name, "VariantTimeToDosDateTime");

      break;

    case 14:

      sprintf(name, "DosDateTimeToVariantTime");

      break;

    case 15:

      sprintf(name, "SafeArrayCreate");

      break;

    case 16:

      sprintf(name, "SafeArrayDestroy");

      break;

    case 17:

      sprintf(name, "SafeArrayGetDim");

      break;

    case 18:

      sprintf(name, "SafeArrayGetElemsize");

      break;

    case 19:

      sprintf(name, "SafeArrayGetUBound");

      break;

    case 20:

      sprintf(name, "SafeArrayGetLBound");

      break;

    case 21:

      sprintf(name, "SafeArrayLock");

      break;

    case 22:

      sprintf(name, "SafeArrayUnlock");

      break;

    case 23:

      sprintf(name, "SafeArrayAccessData");

      break;

    case 24:

      sprintf(name, "SafeArrayUnaccessData");

      break;

    case 25:

      sprintf(name, "SafeArrayGetElement");

      break;

    case 26:

      sprintf(name, "SafeArrayPutElement");

      break;

    case 27:

      sprintf(name, "SafeArrayCopy");

      break;

    case 28:

      sprintf(name, "DispGetParam");

      break;

    case 29:

      sprintf(name, "DispGetIDsOfNames");

      break;

    case 30:

      sprintf(name, "DispInvoke");

      break;

    case 31:

      sprintf(name, "CreateDispTypeInfo");

      break;

    case 32:

      sprintf(name, "CreateStdDispatch");

      break;

    case 33:

      sprintf(name, "RegisterActiveObject");

      break;

    case 34:

      sprintf(name, "RevokeActiveObject");

      break;

    case 35:

      sprintf(name, "GetActiveObject");

      break;

    case 36:

      sprintf(name, "SafeArrayAllocDescriptor");

      break;

    case 37:

      sprintf(name, "SafeArrayAllocData");

      break;

    case 38:

      sprintf(name, "SafeArrayDestroyDescriptor");

      break;

    case 39:

      sprintf(name, "SafeArrayDestroyData");

      break;

    case 40:

      sprintf(name, "SafeArrayRedim");

      break;

    case 41:

      sprintf(name, "SafeArrayAllocDescriptorEx");

      break;

    case 42:

      sprintf(name, "SafeArrayCreateEx");

      break;

    case 43:

      sprintf(name, "SafeArrayCreateVectorEx");

      break;

    case 44:

      sprintf(name, "SafeArraySetRecordInfo");

      break;

    case 45:

      sprintf(name, "SafeArrayGetRecordInfo");

      break;

    case 46:

      sprintf(name, "VarParseNumFromStr");

      break;

    case 47:

      sprintf(name, "VarNumFromParseNum");

      break;

    case 48:

      sprintf(name, "VarI2FromUI1");

      break;

    case 49:

      sprintf(name, "VarI2FromI4");

      break;

    case 50:

      sprintf(name, "VarI2FromR4");

      break;

    case 51:

      sprintf(name, "VarI2FromR8");

      break;

    case 52:

      sprintf(name, "VarI2FromCy");

      break;

    case 53:

      sprintf(name, "VarI2FromDate");

      break;

    case 54:

      sprintf(name, "VarI2FromStr");

      break;

    case 55:

      sprintf(name, "VarI2FromDisp");

      break;

    case 56:

      sprintf(name, "VarI2FromBool");

      break;

    case 57:

      sprintf(name, "SafeArraySetIID");

      break;

    case 58:

      sprintf(name, "VarI4FromUI1");

      break;

    case 59:

      sprintf(name, "VarI4FromI2");

      break;

    case 60:

      sprintf(name, "VarI4FromR4");

      break;

    case 61:

      sprintf(name, "VarI4FromR8");

      break;

    case 62:

      sprintf(name, "VarI4FromCy");

      break;

    case 63:

      sprintf(name, "VarI4FromDate");

      break;

    case 64:

      sprintf(name, "VarI4FromStr");

      break;

    case 65:

      sprintf(name, "VarI4FromDisp");

      break;

    case 66:

      sprintf(name, "VarI4FromBool");

      break;

    case 67:

      sprintf(name, "SafeArrayGetIID");

      break;

    case 68:

      sprintf(name, "VarR4FromUI1");

      break;

    case 69:

      sprintf(name, "VarR4FromI2");

      break;

    case 70:

      sprintf(name, "VarR4FromI4");

      break;

    case 71:

      sprintf(name, "VarR4FromR8");

      break;

    case 72:

      sprintf(name, "VarR4FromCy");

      break;

    case 73:

      sprintf(name, "VarR4FromDate");

      break;

    case 74:

      sprintf(name, "VarR4FromStr");

      break;

    case 75:

      sprintf(name, "VarR4FromDisp");

      break;

    case 76:

      sprintf(name, "VarR4FromBool");

      break;

    case 77:

      sprintf(name, "SafeArrayGetVartype");

      break;

    case 78:

      sprintf(name, "VarR8FromUI1");

      break;

    case 79:

      sprintf(name, "VarR8FromI2");

      break;

    case 80:

      sprintf(name, "VarR8FromI4");

      break;

    case 81:

      sprintf(name, "VarR8FromR4");

      break;

    case 82:

      sprintf(name, "VarR8FromCy");

      break;

    case 83:

      sprintf(name, "VarR8FromDate");

      break;

    case 84:

      sprintf(name, "VarR8FromStr");

      break;

    case 85:

      sprintf(name, "VarR8FromDisp");

      break;

    case 86:

      sprintf(name, "VarR8FromBool");

      break;

    case 87:

      sprintf(name, "VarFormat");

      break;

    case 88:

      sprintf(name, "VarDateFromUI1");

      break;

    case 89:

      sprintf(name, "VarDateFromI2");

      break;

    case 90:

      sprintf(name, "VarDateFromI4");

      break;

    case 91:

      sprintf(name, "VarDateFromR4");

      break;

    case 92:

      sprintf(name, "VarDateFromR8");

      break;

    case 93:

      sprintf(name, "VarDateFromCy");

      break;

    case 94:

      sprintf(name, "VarDateFromStr");

      break;

    case 95:

      sprintf(name, "VarDateFromDisp");

      break;

    case 96: