1 /*-
2 * Copyright (c) 2016 Kai Wang
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <assert.h>
28 #include <errno.h>
29
30 #include "_libpe.h"
31
32 ELFTC_VCSID("$Id: pe_rich.c 3312 2016-01-10 09:23:51Z kaiwang27 $");
33
34 PE_RichHdr *
pe_rich_header(PE * pe)35 pe_rich_header(PE *pe)
36 {
37
38 if (pe == NULL) {
39 errno = EINVAL;
40 return (NULL);
41 }
42
43 if (pe->pe_rh == NULL && pe->pe_stub_ex > 0 &&
44 (pe->pe_flags & LIBPE_F_LOAD_DOS_STUB) == 0) {
45 assert((pe->pe_flags & LIBPE_F_SPECIAL_FILE) == 0);
46 (void) libpe_read_msdos_stub(pe);
47 }
48
49 if (pe->pe_rh == NULL) {
50 errno = ENOENT;
51 return (NULL);
52 }
53
54 return (pe->pe_rh);
55 }
56
57 static uint32_t
rol32(uint32_t n,int c)58 rol32(uint32_t n, int c)
59 {
60
61 c &= 0x1f;
62
63 return ((n << c) | (n >> (0x20 - c)));
64 }
65
66 int
pe_rich_header_validate(PE * pe)67 pe_rich_header_validate(PE *pe)
68 {
69 PE_RichHdr *rh;
70 uint32_t cksum;
71 char *p;
72 int i, off;
73
74 if (pe_rich_header(pe) == NULL)
75 return (-1);
76
77 assert(pe->pe_rh_start != NULL);
78
79 /*
80 * Initial value of the checksum is the offset to the begin of
81 * the Rich header.
82 */
83 cksum = pe->pe_rh_start - pe->pe_stub;
84
85 /*
86 * Add the bytes before the Rich header to the checksum, rotated
87 * left by the offset.
88 */
89 for (p = pe->pe_stub; p < pe->pe_rh_start; p++) {
90 /* Skip dh_lfanew. */
91 off = p - pe->pe_stub;
92 if (off >= 0x3c && off < 0x40)
93 continue;
94 cksum += rol32((unsigned char) *p, off);
95 }
96
97 /* Add each compid rotated left by its count to the checksum. */
98 rh = pe->pe_rh;
99 for (i = 0; (uint32_t) i < rh->rh_total; i++)
100 cksum += rol32(rh->rh_compid[i], rh->rh_cnt[i]);
101
102 /* Validate the checksum with the XOR mask stored after "Rich". */
103 if (cksum == rh->rh_xor)
104 return (1);
105
106 return (0);
107 }
108