Rev 4429 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed
| Rev 4429 | Rev 5116 | ||
|---|---|---|---|
| Line 22... | Line 22... | ||
| 22 | test eax, eax |
22 | test eax, eax |
| 23 | jz .fail |
23 | jz .fail |
| Line 24... | Line 24... | ||
| 24 | 24 | ||
| Line -... | Line 25... | ||
| - | 25 | mov [image], eax |
|
| - | 26 | ||
| - | 27 | mov edx, [eax+STRIPPED_PE_HEADER.SizeOfImage] |
|
| - | 28 | ; mov cl, [eax+STRIPPED_PE_HEADER.Subsystem] |
|
| - | 29 | cmp word [eax], STRIPPED_PE_SIGNATURE |
|
| 25 | mov [image], eax |
30 | jz @f |
| - | 31 | ||
| - | 32 | mov edx, [eax+60] |
|
| Line -... | Line 33... | ||
| - | 33 | ; mov cl, [eax+5Ch+edx] |
|
| - | 34 | mov edx, [eax+80+edx] |
|
| - | 35 | ||
| - | 36 | @@: |
|
| 26 | 37 | mov [entry], 0 |
|
| 27 | mov edx, [eax+60] |
38 | ; cmp cl, 1 |
| 28 | 39 | ; jnz .cleanup |
|
| Line 29... | Line 40... | ||
| 29 | stdcall kernel_alloc, [eax+80+edx] |
40 | stdcall kernel_alloc, edx |
| Line -... | Line 41... | ||
| - | 41 | test eax, eax |
|
| 30 | test eax, eax |
42 | jz .cleanup |
| - | 43 | ||
| - | 44 | mov [base], eax |
|
| - | 45 | ||
| Line 31... | Line 46... | ||
| 31 | jz .cleanup |
46 | push ebx ebp |
| 32 | 47 | mov ebx, [image] |
|
| 33 | mov [base], eax |
48 | mov ebp, eax |
| Line 46... | Line 61... | ||
| 46 | .fail: |
61 | .fail: |
| 47 | xor eax, eax |
62 | xor eax, eax |
| 48 | ret |
63 | ret |
| 49 | endp |
64 | endp |
| Line 50... | Line -... | ||
| 50 | - | ||
| 51 | DWORD equ dword |
- | |
| 52 | PTR equ |
- | |
| 53 | - | ||
| 54 | align 4 |
65 | |
| 55 | map_PE: ;stdcall base:dword, image:dword |
- | |
| 56 | cld |
- | |
| 57 | push ebp |
66 | map_PE: ;ebp=base:dword, ebx=image:dword |
| 58 | push edi |
67 | push edi |
| - | 68 | push esi |
|
| - | 69 | sub esp, .locals_size |
|
| - | 70 | virtual at esp |
|
| - | 71 | .numsections dd ? |
|
| - | 72 | .import_names dd ? |
|
| 59 | push esi |
73 | .import_targets dd ? |
| - | 74 | .peheader dd ? |
|
| - | 75 | .bad_import dd ? |
|
| - | 76 | .import_idx dd ? |
|
| - | 77 | .import_descr dd ? |
|
| - | 78 | .relocs_rva dd ? |
|
| - | 79 | .relocs_size dd ? |
|
| - | 80 | .section_header_size dd ? |
|
| 60 | push ebx |
81 | .AddressOfEntryPoint dd ? |
| - | 82 | .ImageBase dd ? |
|
| - | 83 | .locals_size = $ - esp |
|
| 61 | sub esp, 60 |
84 | end virtual |
| 62 | mov ebx, DWORD PTR [esp+84] |
85 | cmp word [ebx], STRIPPED_PE_SIGNATURE |
| - | 86 | jz .stripped |
|
| 63 | mov ebp, DWORD PTR [esp+80] |
87 | |
| - | 88 | mov edx, ebx |
|
| - | 89 | add edx, [ebx+60] |
|
| - | 90 | movzx eax, word [edx+6] |
|
| - | 91 | mov [.numsections], eax |
|
| - | 92 | mov eax, [edx+40] |
|
| - | 93 | mov [.AddressOfEntryPoint], eax |
|
| - | 94 | mov eax, [edx+52] |
|
| - | 95 | mov [.ImageBase], eax |
|
| - | 96 | mov ecx, [edx+84] |
|
| - | 97 | mov [.section_header_size], 40 |
|
| - | 98 | mov eax, [edx+128] |
|
| - | 99 | mov [.import_descr], eax |
|
| - | 100 | mov eax, [edx+160] |
|
| - | 101 | mov [.relocs_rva], eax |
|
| - | 102 | mov eax, [edx+164] |
|
| - | 103 | mov [.relocs_size], eax |
|
| - | 104 | add edx, 256 |
|
| - | 105 | ||
| - | 106 | jmp .common |
|
| - | 107 | .stripped: |
|
| - | 108 | mov eax, [ebx+STRIPPED_PE_HEADER.AddressOfEntryPoint] |
|
| - | 109 | mov [.AddressOfEntryPoint], eax |
|
| - | 110 | mov eax, [ebx+STRIPPED_PE_HEADER.ImageBase] |
|
| - | 111 | mov [.ImageBase], eax |
|
| - | 112 | movzx eax, [ebx+STRIPPED_PE_HEADER.NumberOfSections] |
|
| - | 113 | mov [.numsections], eax |
|
| - | 114 | movzx ecx, [ebx+STRIPPED_PE_HEADER.NumberOfRvaAndSizes] |
|
| - | 115 | xor eax, eax |
|
| - | 116 | mov [.relocs_rva], eax |
|
| - | 117 | mov [.relocs_size], eax |
|
| - | 118 | test ecx, ecx |
|
| - | 119 | jz @f |
|
| - | 120 | mov eax, [ebx+sizeof.STRIPPED_PE_HEADER+SPE_DIRECTORY_IMPORT*8] |
|
| - | 121 | @@: |
|
| - | 122 | mov [.import_descr], eax |
|
| - | 123 | cmp ecx, SPE_DIRECTORY_BASERELOC |
|
| - | 124 | jbe @f |
|
| - | 125 | mov eax, [ebx+sizeof.STRIPPED_PE_HEADER+SPE_DIRECTORY_BASERELOC*8] |
|
| - | 126 | mov [.relocs_rva], eax |
|
| - | 127 | mov eax, [ebx+sizeof.STRIPPED_PE_HEADER+SPE_DIRECTORY_BASERELOC*8+4] |
|
| - | 128 | mov [.relocs_size], eax |
|
| - | 129 | @@: |
|
| - | 130 | mov [.section_header_size], 28 |
|
| - | 131 | lea edx, [ebx+ecx*8+sizeof.STRIPPED_PE_HEADER+8] |
|
| - | 132 | mov ecx, [ebx+STRIPPED_PE_HEADER.SizeOfHeaders] |
|
| - | 133 | ||
| 64 | mov edx, ebx |
134 | .common: |
| 65 | mov esi, ebx |
- | |
| 66 | add edx, DWORD PTR [ebx+60] |
135 | mov esi, ebx |
| 67 | mov edi, ebp |
- | |
| 68 | mov DWORD PTR [esp+32], edx |
- | |
| 69 | mov ecx, DWORD PTR [edx+84] |
- | |
| 70 | 136 | mov edi, ebp |
|
| 71 | shr ecx, 2 |
137 | shr ecx, 2 |
| Line 72... | Line -... | ||
| 72 | rep movsd |
- | |
| 73 | 138 | rep movsd |
|
| 74 | movzx eax, WORD PTR [edx+6] |
139 | |
| 75 | mov DWORD PTR [esp+36], 0 |
140 | cmp [.numsections], 0 |
| 76 | mov DWORD PTR [esp+16], eax |
- | |
| 77 | jmp L2 |
141 | jz .nosections |
| 78 | L3: |
142 | .copy_sections: |
| 79 | mov eax, DWORD PTR [edx+264] |
143 | mov eax, [edx+8] |
| 80 | test eax, eax |
144 | test eax, eax |
| 81 | je L4 |
145 | je .no_section_data |
| 82 | mov esi, ebx |
146 | mov esi, ebx |
| 83 | mov edi, ebp |
147 | mov edi, ebp |
| 84 | add esi, DWORD PTR [edx+268] |
148 | add esi, [edx+12] |
| Line 85... | Line 149... | ||
| 85 | mov ecx, eax |
149 | mov ecx, eax |
| 86 | add edi, DWORD PTR [edx+260] |
150 | add edi, [edx+4] |
| 87 | 151 | ||
| Line 88... | Line 152... | ||
| 88 | add ecx, 3 |
152 | add ecx, 3 |
| 89 | shr ecx, 2 |
153 | shr ecx, 2 |
| 90 | rep movsd |
154 | rep movsd |
| 91 | 155 | ||
| 92 | L4: |
156 | .no_section_data: |
| 93 | mov ecx, DWORD PTR [edx+256] |
157 | mov ecx, [edx] |
| 94 | cmp ecx, eax |
158 | cmp ecx, eax |
| Line 95... | Line 159... | ||
| 95 | jbe L6 |
159 | jbe .no_section_fill |
| 96 | sub ecx, eax |
160 | sub ecx, eax |
| Line 97... | Line -... | ||
| 97 | add eax, DWORD PTR [edx+260] |
- | |
| 98 | lea edi, [eax+ebp] |
161 | add eax, [edx+4] |
| 99 | 162 | lea edi, [eax+ebp] |
|
| 100 | xor eax, eax |
- | |
| 101 | rep stosb |
163 | |
| 102 | 164 | xor eax, eax |
|
| 103 | L6: |
165 | rep stosb |
| 104 | inc DWORD PTR [esp+36] |
- | |
| 105 | add edx, 40 |
166 | |
| 106 | L2: |
167 | .no_section_fill: |
| 107 | mov esi, DWORD PTR [esp+16] |
- | |
| 108 | cmp DWORD PTR [esp+36], esi |
168 | add edx, [.section_header_size] |
| 109 | jne L3 |
169 | dec [.numsections] |
| 110 | mov edi, DWORD PTR [esp+32] |
170 | jnz .copy_sections |
| 111 | cmp DWORD PTR [edi+164], 0 |
171 | .nosections: |
| 112 | je L9 |
172 | cmp [.relocs_size], 0 |
| 113 | pushd [edi+164] |
173 | je .no_relocations |
| 114 | mov esi, ebp |
174 | mov esi, ebp |
| 115 | mov ecx, ebp |
- | |
| 116 | sub esi, DWORD PTR [edi+52] |
175 | mov ecx, ebp |
| 117 | add ecx, DWORD PTR [edi+160] |
176 | sub esi, [.ImageBase] |
| 118 | mov eax, esi |
177 | add ecx, [.relocs_rva] |
| 119 | shr eax, 16 |
178 | .relocs_block: |
| 120 | mov DWORD PTR [esp+16], eax |
179 | mov edi, [ecx] |
| 121 | L12: |
180 | add edi, ebp |
| 122 | mov eax, [ecx+4] |
181 | mov ebx, [ecx+4] |
| 123 | sub [esp], eax |
182 | add ecx, 8 |
| - | 183 | sub [.relocs_size], ebx |
|
| 124 | lea ebx, [eax-8] |
184 | sub ebx, 8 |
| 125 | xor edi, edi |
185 | shr ebx, 1 |
| 126 | shr ebx, 1 |
186 | jz .relocs_next_block |
| 127 | jmp L13 |
- | |
| 128 | L14: |
- | |
| 129 | movzx eax, WORD PTR [ecx+8+edi*2] |
- | |
| 130 | mov edx, eax |
187 | .one_reloc: |
| 131 | shr eax, 12 |
- | |
| 132 | and edx, 4095 |
- | |
| 133 | add edx, DWORD PTR [ecx] |
188 | movzx eax, word [ecx] |
| 134 | cmp ax, 2 |
- | |
| 135 | je L17 |
- | |
| 136 | cmp ax, 3 |
- | |
| 137 | je L18 |
- | |
| 138 | dec ax |
- | |
| 139 | jne L15 |
189 | add ecx, 2 |
| 140 | mov eax, DWORD PTR [esp+16] |
190 | mov edx, eax |
| 141 | add WORD PTR [edx+ebp], ax |
191 | shr eax, 12 |
| 142 | L17: |
- | |
| 143 | add WORD PTR [edx+ebp], si |
192 | and edx, 4095 |
| 144 | L18: |
193 | cmp eax, 3 |
| 145 | add DWORD PTR [edx+ebp], esi |
- | |
| 146 | L15: |
- | |
| 147 | inc edi |
194 | jne @f |
| 148 | L13: |
195 | add [edx+edi], esi |
| 149 | cmp edi, ebx |
196 | @@: |
| 150 | jne L14 |
- | |
| 151 | add ecx, DWORD PTR [ecx+4] |
- | |
| 152 | L11: |
197 | dec ebx |
| 153 | cmp dword [esp], 0 |
198 | jnz .one_reloc |
| 154 | jg L12 |
199 | .relocs_next_block: |
| 155 | pop eax |
- | |
| 156 | L9: |
200 | cmp [.relocs_size], 0 |
| 157 | mov edx, DWORD PTR [esp+32] |
201 | jg .relocs_block |
| 158 | cmp DWORD PTR [edx+132], 0 |
- | |
| 159 | je L20 |
- | |
| 160 | mov eax, ebp |
202 | .no_relocations: |
| 161 | add eax, DWORD PTR [edx+128] |
203 | cmp [.import_descr], 0 |
| 162 | mov DWORD PTR [esp+40], 0 |
204 | je .no_imports |
| 163 | add eax, 20 |
205 | add [.import_descr], ebp |
| 164 | mov DWORD PTR [esp+56], eax |
206 | mov [.bad_import], 0 |
| 165 | L22: |
207 | .import_block: |
| 166 | mov ecx, DWORD PTR [esp+56] |
- | |
| 167 | cmp DWORD PTR [ecx-16], 0 |
- | |
| 168 | jne L23 |
- | |
| 169 | cmp DWORD PTR [ecx-8], 0 |
- | |
| 170 | je L25 |
- | |
| 171 | L23: |
- | |
| 172 | mov edi, DWORD PTR [__exports+32] |
- | |
| 173 | mov esi, DWORD PTR [__exports+28] |
208 | mov ecx, [.import_descr] |
| 174 | mov eax, DWORD PTR [esp+56] |
- | |
| 175 | mov DWORD PTR [esp+20], edi |
209 | cmp dword [ecx+4], 0 |
| 176 | add edi, OS_BASE |
210 | jne @f |
| 177 | add esi, OS_BASE |
211 | cmp dword [ecx+12], 0 |
| 178 | mov DWORD PTR [esp+44], esi |
212 | je .done_imports |
| 179 | mov ecx, DWORD PTR [eax-4] |
213 | @@: |
| 180 | mov DWORD PTR [esp+48], edi |
214 | mov edx, dword [ecx] |
| 181 | mov edx, DWORD PTR [eax-20] |
215 | mov ecx, dword [ecx+16] |
| 182 | test edx, edx |
216 | test edx, edx |
| 183 | jnz @f |
217 | jnz @f |
| 184 | mov edx, ecx |
218 | mov edx, ecx |
| 185 | @@: |
219 | @@: |
| 186 | mov DWORD PTR [esp+52], 0 |
220 | mov [.import_idx], 0 |
| 187 | add ecx, ebp |
221 | add ecx, ebp |
| 188 | add edx, ebp |
222 | add edx, ebp |
| 189 | mov DWORD PTR [esp+24], edx |
- | |
| 190 | mov DWORD PTR [esp+28], ecx |
- | |
| 191 | L26: |
223 | mov [.import_names], edx |
| - | 224 | mov [.import_targets], ecx |
|
| 192 | mov esi, DWORD PTR [esp+52] |
225 | .import_func: |
| 193 | mov edi, DWORD PTR [esp+24] |
226 | mov esi, [.import_idx] |
| 194 | mov eax, DWORD PTR [edi+esi*4] |
227 | mov edi, [.import_names] |
| 195 | test eax, eax |
228 | mov eax, [edi+esi*4] |
| 196 | je L27 |
229 | test eax, eax |
| 197 | test eax, eax |
230 | je .next_import_block |
| 198 | js L27 |
231 | js .next_import_block |
| 199 | lea edi, [ebp+eax] |
- | |
| 200 | mov eax, DWORD PTR [esp+28] |
232 | lea edi, [ebp+eax] |
| 201 | mov DWORD PTR [eax+esi*4], 0 |
233 | mov eax, [.import_targets] |
| 202 | lea esi, [edi+2] |
234 | mov dword [eax+esi*4], 0 |
| 203 | push eax |
235 | lea esi, [edi+2] |
| 204 | push 32 |
236 | movzx ebx, word [edi] |
| 205 | movzx eax, WORD PTR [edi] |
237 | push 32 |
| 206 | mov edx, DWORD PTR [esp+56] |
- | |
| 207 | mov eax, DWORD PTR [edx+eax*4] |
- | |
| 208 | add eax, OS_BASE |
238 | mov ecx, [__exports+32] |
| 209 | push eax |
239 | mov eax, [ecx+OS_BASE+ebx*4] |
| 210 | push esi |
240 | add eax, OS_BASE |
| 211 | call strncmp |
- | |
| 212 | pop ebx |
241 | push eax |
| 213 | xor ebx, ebx |
242 | push esi |
| 214 | test eax, eax |
243 | call strncmp |
| 215 | jne L32 |
244 | test eax, eax |
| 216 | jmp L30 |
245 | jz .import_func_found |
| 217 | L33: |
246 | xor ebx, ebx |
| 218 | push ecx |
247 | .import_func_candidate: |
| 219 | push 32 |
248 | push 32 |
| 220 | mov ecx, DWORD PTR [esp+28] |
- | |
| 221 | mov eax, DWORD PTR [ecx+OS_BASE+ebx*4] |
249 | mov ecx, [__exports+32] |
| 222 | add eax, OS_BASE |
- | |
| 223 | push eax |
- | |
| 224 | push esi |
- | |
| 225 | call strncmp |
- | |
| 226 | pop edx |
- | |
| 227 | test eax, eax |
250 | mov eax, [ecx+OS_BASE+ebx*4] |
| 228 | jne L34 |
- | |
| 229 | mov esi, DWORD PTR [esp+44] |
- | |
| 230 | mov edx, DWORD PTR [esp+52] |
- | |
| 231 | mov ecx, DWORD PTR [esp+28] |
251 | add eax, OS_BASE |
| 232 | mov eax, DWORD PTR [esi+ebx*4] |
- | |
| 233 | add eax, OS_BASE |
252 | push eax |
| 234 | mov DWORD PTR [ecx+edx*4], eax |
- | |
| 235 | jmp L36 |
- | |
| 236 | L34: |
253 | push esi |
| 237 | inc ebx |
- | |
| Line 238... | Line 254... | ||
| 238 | L32: |
254 | call strncmp |
| 239 | cmp ebx, DWORD PTR [__exports+24] |
255 | test eax, eax |
| 240 | jb L33 |
256 | je .import_func_found |
| 241 | L36: |
257 | inc ebx |
| 242 | cmp ebx, DWORD PTR [__exports+24] |
258 | cmp ebx, [__exports+24] |
| 243 | jne L37 |
259 | jb .import_func_candidate |
| Line 244... | Line 260... | ||
| 244 | 260 | ||
| 245 | mov esi, msg_unresolved |
261 | mov esi, msg_unresolved |
| 246 | call sys_msg_board_str |
- | |
| 247 | lea esi, [edi+2] |
262 | call sys_msg_board_str |
| 248 | call sys_msg_board_str |
263 | lea esi, [edi+2] |
| 249 | mov esi, msg_CR |
264 | call sys_msg_board_str |
| 250 | call sys_msg_board_str |
265 | mov esi, msg_CR |
| 251 | 266 | call sys_msg_board_str |
|
| 252 | mov DWORD PTR [esp+40], 1 |
267 | |
| 253 | jmp L37 |
268 | mov [.bad_import], 1 |
| 254 | L30: |
269 | jmp .next_import_func |
| 255 | movzx eax, WORD PTR [edi] |
270 | .import_func_found: |
| 256 | mov esi, DWORD PTR [esp+44] |
271 | mov esi, [__exports+28] |
| 257 | mov edi, DWORD PTR [esp+52] |
272 | mov edx, [.import_idx] |
| 258 | mov edx, DWORD PTR [esp+28] |
273 | mov ecx, [.import_targets] |
| 259 | mov eax, DWORD PTR [esi+eax*4] |
274 | mov eax, [esi+OS_BASE+ebx*4] |
| 260 | add eax, OS_BASE |
275 | add eax, OS_BASE |
| 261 | mov DWORD PTR [edx+edi*4], eax |
276 | mov [ecx+edx*4], eax |
| 262 | L37: |
277 | .next_import_func: |
| 263 | inc DWORD PTR [esp+52] |
278 | inc [.import_idx] |
| 264 | jmp L26 |
279 | jmp .import_func |
| 265 | L27: |
- | |
| 266 | add DWORD PTR [esp+56], 20 |
280 | .next_import_block: |
| 267 | jmp L22 |
281 | add [.import_descr], 20 |
| 268 | L25: |
282 | jmp .import_block |
| 269 | xor eax, eax |
283 | .done_imports: |
| 270 | cmp DWORD PTR [esp+40], 0 |
- | |
| 271 | jne L40 |
284 | xor eax, eax |
| 272 | L20: |
285 | cmp [.bad_import], 0 |
| 273 | mov ecx, DWORD PTR [esp+32] |
- | |
| 274 | mov eax, ebp |
286 | jne @f |