1 /*-
2 * Copyright (c) 2015 Kai Wang
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <assert.h>
28 #include <errno.h>
29 #include <stdlib.h>
30 #include <string.h>
31
32 #include "_libpe.h"
33
34 ELFTC_VCSID("$Id: libpe_rich.c 3312 2016-01-10 09:23:51Z kaiwang27 $");
35
36 static char *
memfind(char * s,const char * find,size_t slen,size_t flen)37 memfind(char *s, const char *find, size_t slen, size_t flen)
38 {
39 int i;
40
41 if (slen == 0 || flen == 0 || flen > slen)
42 return (NULL);
43
44 for (i = 0; (size_t) i <= slen - flen; i++) {
45 if (s[i] != find[0])
46 continue;
47 if (flen == 1)
48 return (&s[i]);
49 if (memcmp(&s[i + 1], &find[1], flen - 1) == 0)
50 return (&s[i]);
51 }
52
53 return (NULL);
54 }
55
56 int
libpe_parse_rich_header(PE * pe)57 libpe_parse_rich_header(PE *pe)
58 {
59 PE_RichHdr *rh;
60 char *p, *r, *s;
61 uint32_t x;
62 int found, i;
63
64 assert(pe->pe_stub != NULL && pe->pe_stub_ex > 0);
65
66 /* Search for the "Rich" keyword to locate the Rich header. */
67 s = pe->pe_stub + sizeof(PE_DosHdr);
68 r = memfind(s, PE_RICH_TEXT, pe->pe_stub_ex, 4);
69 if (r == NULL || r + 8 > s + pe->pe_stub_ex) {
70 errno = ENOENT;
71 return (-1);
72 }
73
74 if ((rh = calloc(1, sizeof(*rh))) == NULL) {
75 errno = ENOMEM;
76 return (-1);
77 }
78
79 rh->rh_xor = le32dec(r + 4); /* Retrieve the "XOR mask" */
80
81 /*
82 * Search for the hidden keyword "DanS" by XOR the dwords before
83 * the "Rich" keyword with the XOR mask.
84 */
85 found = 0;
86 for (p = r - 4; p >= s; p -= 4) {
87 x = le32dec(p) ^ rh->rh_xor;
88 if (x == PE_RICH_HIDDEN) {
89 found = 1;
90 break;
91 }
92 }
93 if (!found) {
94 free(rh);
95 errno = ENOENT;
96 return (-1);
97 }
98
99 /*
100 * Found the "DanS" keyword, which is the start of the Rich header.
101 * The next step is to skip the first 16 bytes (DanS, XOR mask,
102 * XOR mask, XOR mask) and read the (compid,cnt) tuples.
103 */
104 pe->pe_rh_start = p;
105 p += 16;
106 rh->rh_total = (r - p) / 8;
107 if ((rh->rh_compid = malloc(rh->rh_total * sizeof(*rh->rh_compid))) ==
108 NULL) {
109 free(rh);
110 errno = ENOMEM;
111 return (-1);
112 }
113 if ((rh->rh_cnt = malloc(rh->rh_total * sizeof(*rh->rh_cnt))) ==
114 NULL) {
115 free(rh->rh_compid);
116 free(rh);
117 errno = ENOMEM;
118 return (-1);
119 }
120 for (i = 0; (uint32_t) i < rh->rh_total; i++, p += 8) {
121 rh->rh_compid[i] = le32dec(p) ^ rh->rh_xor;
122 rh->rh_cnt[i] = le32dec(p + 4) ^ rh->rh_xor;
123 }
124
125 pe->pe_rh = rh;
126
127 return (0);
128 }
129