1 /*- 2 * Copyright (c) 2016 Kai Wang 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <assert.h> 28 #include <errno.h> 29 30 #include "_libpe.h" 31 32 ELFTC_VCSID("$Id: pe_rich.c 3312 2016-01-10 09:23:51Z kaiwang27 $"); 33 34 PE_RichHdr * 35 pe_rich_header(PE *pe) 36 { 37 38 if (pe == NULL) { 39 errno = EINVAL; 40 return (NULL); 41 } 42 43 if (pe->pe_rh == NULL && pe->pe_stub_ex > 0 && 44 (pe->pe_flags & LIBPE_F_LOAD_DOS_STUB) == 0) { 45 assert((pe->pe_flags & LIBPE_F_SPECIAL_FILE) == 0); 46 (void) libpe_read_msdos_stub(pe); 47 } 48 49 if (pe->pe_rh == NULL) { 50 errno = ENOENT; 51 return (NULL); 52 } 53 54 return (pe->pe_rh); 55 } 56 57 static uint32_t 58 rol32(uint32_t n, int c) 59 { 60 61 c &= 0x1f; 62 63 return ((n << c) | (n >> (0x20 - c))); 64 } 65 66 int 67 pe_rich_header_validate(PE *pe) 68 { 69 PE_RichHdr *rh; 70 uint32_t cksum; 71 char *p; 72 int i, off; 73 74 if (pe_rich_header(pe) == NULL) 75 return (-1); 76 77 assert(pe->pe_rh_start != NULL); 78 79 /* 80 * Initial value of the checksum is the offset to the begin of 81 * the Rich header. 82 */ 83 cksum = pe->pe_rh_start - pe->pe_stub; 84 85 /* 86 * Add the bytes before the Rich header to the checksum, rotated 87 * left by the offset. 88 */ 89 for (p = pe->pe_stub; p < pe->pe_rh_start; p++) { 90 /* Skip dh_lfanew. */ 91 off = p - pe->pe_stub; 92 if (off >= 0x3c && off < 0x40) 93 continue; 94 cksum += rol32((unsigned char) *p, off); 95 } 96 97 /* Add each compid rotated left by its count to the checksum. */ 98 rh = pe->pe_rh; 99 for (i = 0; (uint32_t) i < rh->rh_total; i++) 100 cksum += rol32(rh->rh_compid[i], rh->rh_cnt[i]); 101 102 /* Validate the checksum with the XOR mask stored after "Rich". */ 103 if (cksum == rh->rh_xor) 104 return (1); 105 106 return (0); 107 } 108