metasm 1.0.1 → 1.0.2

data/{lib/metasm → metasm}/encode.rb

@@ -271,7 +271,16 @@ class Expression
 	def encode(type, endianness, backtrace=nil)
 		case val = reduce
 		when Integer; EncodedData.new Expression.encode_imm(val, type, endianness, backtrace)
-		else          EncodedData.new([0].pack('C')*(INT_SIZE[type]/8), :reloc => {0 => Relocation.new(self, type, endianness, backtrace)})
+		else
+			str = case INT_SIZE[type]
+			      when  8; "\0"
+			      when 16; "\0\0"
+			      when 32; "\0\0\0\0"
+			      when 64; "\0\0\0\0\0\0\0\0"
+			      else [0].pack('C')*(INT_SIZE[type]/8)
+			      end
+			str = str.force_encoding('BINARY') if str.respond_to?(:force_encoding)
+			EncodedData.new(str, :reloc => {0 => Relocation.new(self, type, endianness, backtrace)})
 		end
 	end
 

data/{lib/metasm → metasm}/exe_format/a_out.rb

@@ -58,7 +58,7 @@ class AOut < ExeFormat
 	class Relocation < SerialStruct
 		word :address
 		bitfield :word, 0 => :symbolnum, 24 => :pcrel, 25 => :length,
- 			27 => :extern, 28 => :baserel, 29 => :jmptable, 30 => :relative, 31 => :rtcopy
+			27 => :extern, 28 => :baserel, 29 => :jmptable, 30 => :relative, 31 => :rtcopy
 		fld_enum :length, 0 => 1, 1 => 2, 2 => 4, 3 => 8
 		fld_default :length, 4
 	end
@@ -68,7 +68,7 @@ class AOut < ExeFormat
 		bitfield :byte, 0 => :extern, 1 => :type, 5 => :stab
 		byte :other
 		half :desc
- 		word :value
+		word :value
 		attr_accessor :name
 
 		def decode(aout, strings=nil)
@@ -93,6 +93,9 @@ class AOut < ExeFormat
 	def encode_byte(w) Expression[w].encode(:u8 , @endianness) end
 	def encode_half(w) Expression[w].encode(:u16, @endianness) end
 	def encode_word(w) Expression[w].encode(:u32, @endianness) end
+	def sizeof_byte ; 1 ; end
+	def sizeof_half ; 2 ; end
+	def sizeof_word ; 4 ; end
 
 	def initialize(cpu = nil)
 		@endianness = cpu ? cpu.endianness : :little
@@ -119,11 +122,11 @@ class AOut < ExeFormat
 
 		@data = EncodedData.new << @encoded.read(@header.data)
 
-		textrel = @encoded.read @header.trsz
-		datarel = @encoded.read @header.drsz
-		syms    = @encoded.read @header.syms
-		strings = @encoded.read
 		# TODO
+		#textrel = @encoded.read @header.trsz
+		#datarel = @encoded.read @header.drsz
+		#syms    = @encoded.read @header.syms
+		#strings = @encoded.read
 	end
 
 	def encode

data/{lib/metasm → metasm}/exe_format/autoexe.rb

@@ -58,6 +58,7 @@ register_signature("\xca\xfe\xba\xbe") { UniversalBinary }
 register_signature("dex\n") { DEX }
 register_signature("dey\n") { DEY }
 register_signature("\xfa\x70\x0e\x1f") { FatELF }
+register_signature("\x50\x4b\x03\x04") { ZIP }
 register_signature('Metasm.dasm') { Disassembler }
 
 # replacement for AutoExe where #load defaults to a Shellcode of the specified CPU

data/{lib/metasm → metasm}/exe_format/bflt.rb

@@ -9,6 +9,7 @@ require 'metasm/decode'
 
 module Metasm
 # BFLT is the binary flat format used by the uClinux
+# from examining a v4 binary, it looks like the header is discarded and the file is mapped from 0x40 to memory address 0 (wrt relocations)
 class Bflt < ExeFormat
 	MAGIC = 'bFLT'
 	FLAGS = { 1 => 'RAM', 2 => 'GOTPIC', 4 => 'GZIP' }
@@ -29,13 +30,20 @@ class Bflt < ExeFormat
 			when MAGIC
 			else raise InvalidExeFormat, "Bad bFLT signature #@magic"
 			end
+
+			if @rev >= 0x01000000 and (@rev & 0x00f0ffff) == 0
+				puts "Bflt: probable wrong endianness, retrying" if $VERBOSE
+				exe.endianness = { :big => :little, :little => :big }[exe.endianness]
+				exe.encoded.ptr -= 4*16
+				super(exe)
+			end
 		end
 
 		def set_default_values(exe)
 			@magic ||= MAGIC
 			@rev ||= 4
 			@entry ||= 0x40
-			@data_start ||= @entry + exe.text.length if exe.text
+			@data_start ||= 0x40 + exe.text.length if exe.text
 			@data_end ||= @data_start + exe.data.data.length if exe.data
 			@bss_end ||= @data_start + exe.data.length if exe.data
 			@stack_size ||= 0x1000
@@ -49,7 +57,9 @@ class Bflt < ExeFormat
 
 	def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end
 	def encode_word(w) Expression[w].encode(:u32, @endianness) end
+	def sizeof_word ; 4 ; end
 
+	attr_accessor :endianness
 	def initialize(cpu = nil)
 		@endianness = cpu ? cpu.endianness : :little
 		@header = Header.new
@@ -61,17 +71,17 @@ class Bflt < ExeFormat
 	def decode_header
 		@encoded.ptr = 0
 		@header.decode(self)
+		@encoded.add_export(new_label('entrypoint'), @header.entry)
 	end
 
 	def decode
 		decode_header
 
-		@encoded.ptr = @header.entry
-		@text = EncodedData.new << @encoded.read(@header.data_start - @header.entry)
-		@data = EncodedData.new << @encoded.read(@header.data_end - @header.data_start)
-		@data.virtsize += (@header.bss_end - @header.data_end)
+		@text = @encoded[0x40...@header.data_start]
+		@data = @encoded[@header.data_start...@header.data_end]
+		@data.virtsize += @header.bss_end - @header.data_end
 
-		if @header.flags.include? 'GZIP'
+		if @header.flags.include?('GZIP')
 			# TODO gzip
 			raise 'bFLT decoder: gzip format not supported'
 		end
@@ -79,7 +89,7 @@ class Bflt < ExeFormat
 		@reloc = []
 		@encoded.ptr = @header.reloc_start
 		@header.reloc_count.times { @reloc << decode_word }
-		if @header.version == 2
+		if @header.rev == 2
 			@reloc.map! { |r| r & 0x3fff_ffff }
 		end
 
@@ -87,32 +97,29 @@ class Bflt < ExeFormat
 	end
 
 	def decode_interpret_relocs
+		textsz = @header.data_start-0x40
 		@reloc.each { |r|
 			# where the reloc is
-			if r >= @header.entry and r < @header.data_start
+			if r < textsz
 				section = @text
-				base = @header.entry
-			elsif r >= @header.data_start and r < @header.data_end
-				section = @data
-				base = @header.data_start
+				off = section.ptr = r
 			else
-				puts "out of bounds reloc at #{Expression[r]}" if $VERBOSE
-				next
+				section = @data
+				off = section.ptr = r-textsz
 			end
 
 			# what it points to
-			section.ptr = r-base
 			target = decode_word(section)
-			if target >= @header.entry and target < @header.data_start
-				target = label_at(@text, target - @header.entry, "xref_#{Expression[target]}")
-			elsif target >= @header.data_start and target < @header.bss_end
-				target = label_at(@data, target - @header.data_start, "xref_#{Expression[target]}")
+			if target < textsz
+				target = label_at(@text, target, "xref_#{Expression[target]}")
+			elsif target < @header.bss_end-0x40
+				target = label_at(@data, target-textsz, "xref_#{Expression[target]}")
 			else
-				puts "out of bounds reloc target at #{Expression[r]}" if $VERBOSE
+				puts "out of bounds reloc target #{Expression[target]} at #{Expression[r]}" if $VERBOSE
 				next
 			end
 
-			@text.reloc[r-base] = Relocation.new(Expression[target], :u32, @endianness)
+			section.reloc[off] = Relocation.new(Expression[target], :u32, @endianness)
 		}
 	end
 
@@ -127,8 +134,8 @@ class Bflt < ExeFormat
 
 		@encoded = EncodedData.new
 		@encoded << @header.encode(self)
-		
-		binding = @text.binding(@header.entry).merge(@data.binding(@header.data_start))
+
+		binding = @text.binding(0x40).merge(@data.binding(@header.data_start))
 		@encoded << @text << @data.data
 		@encoded.fixup! binding
 		@encoded.reloc.clear
@@ -143,7 +150,7 @@ class Bflt < ExeFormat
 		mapaddr = new_label('mapaddr')
 		binding = @text.binding(mapaddr).merge(@data.binding(mapaddr))
 		[@text, @data].each { |section|
-			base = @header.entry || 0x40
+			base = 0x40	# XXX maybe 0 ?
 			base = @header.data_start || base+@text.length if section == @data
 			section.reloc.each { |o, r|
 				if r.endianness == @endianness and [:u32, :a32, :i32].include? r.type and
@@ -167,7 +174,16 @@ class Bflt < ExeFormat
 		case instr.raw.downcase
 		when '.text'; @cursource = @textsrc
 		when '.data'; @cursource = @datasrc
-		# entrypoint is the 1st byte of .text
+		when '.entrypoint'
+			# ".entrypoint <somelabel/expression>" or ".entrypoint" (here)
+			@lexer.skip_space
+			if tok = @lexer.nexttok and tok.type == :string
+				raise instr if not entrypoint = Expression.parse(@lexer)
+			else
+				entrypoint = new_label('entrypoint')
+				@cursource << Label.new(entrypoint, instr.backtrace.dup)
+			end
+			@header.entry = entrypoint
 		else super(instr)
 		end
 	end
@@ -181,9 +197,23 @@ class Bflt < ExeFormat
 		self
 	end
 
+	def get_default_entrypoints
+		['entrypoint']
+	end
+
 	def each_section
-		yield @text, @header.entry
-		yield @data, @header.data_start
+		yield @text, 0
+		yield @data, @header.data_start - @header.entry
+	end
+
+	def section_info
+		[['.text', 0, @text.length, 'rx'],
+		 ['.data', @header.data_addr-0x40, @data.data.length, 'rw'],
+		 ['.bss',  @header.data_end-0x40,  @data.length-@data.data.length, 'rw']]
+	end
+
+	def module_symbols
+		['entrypoint', @header.entry-0x40]
 	end
 end
 end

data/{lib/metasm → metasm}/exe_format/coff.rb

@@ -81,7 +81,7 @@ class COFF < ExeFormat
 		11 => 'UNION_MEMBER', 12 => 'UNION_TAG', 13 => 'TYPEDEF', 14 => 'UNDEF_STATIC',
 		15 => 'ENUM_TAG', 16 => 'ENUM_MEMBER', 17 => 'REG_PARAM', 18 => 'BIT_FIELD',
 		100 => 'BLOCK', 101 => 'FUNCTION', 102 => 'END_STRUCT',
-	       	103 => 'FILE', 104 => 'SECTION', 105 => 'WEAK_EXT',
+		103 => 'FILE', 104 => 'SECTION', 105 => 'WEAK_EXT',
 	}
 
 	DEBUG_TYPE = { 0 => 'UNKNOWN', 1 => 'COFF', 2 => 'CODEVIEW', 3 => 'FPO', 4 => 'MISC',
@@ -140,7 +140,7 @@ class COFF < ExeFormat
 		bytes :link_ver_maj, :link_ver_min
 		words :code_size, :data_size, :udata_size, :entrypoint, :base_of_code
 		# base_of_data does not exist in 64-bit
-		new_field(:base_of_data, lambda { |exe, hdr| exe.decode_word if exe.bitsize != 64 }, lambda { |exe, hdr, val| exe.encode_word(val) if exe.bitsize != 64 }, 0)
+		new_field(:base_of_data, lambda { |exe, hdr| exe.decode_word if exe.bitsize != 64 }, lambda { |exe, hdr, val| exe.encode_word(val) if exe.bitsize != 64 }, lambda { |exe, hdr| exe.bitsize != 64 ? 4 : 0 }, 0)
 		# NT-specific fields
 		xword :image_base
 		words :sect_align, :file_align
@@ -264,7 +264,7 @@ class COFF < ExeFormat
 
 	class TLSDirectory < SerialStruct
 		xwords :start_va, :end_va, :index_addr, :callback_p
- 		words :zerofill_sz, :characteristics
+		words :zerofill_sz, :characteristics
 
 		attr_accessor :callbacks
 	end
@@ -413,6 +413,11 @@ class COFF < ExeFormat
 	end
 
 	def shortname; 'coff'; end
+
+	def sizeof_byte ; 1 ; end
+	def sizeof_half ; 2 ; end
+	def sizeof_word ; 4 ; end
+	def sizeof_xword ; @bitsize == 32 ? 4 : 8 ; end
 end
 
 # the COFF archive file format
@@ -448,6 +453,9 @@ class COFFArchive < ExeFormat
 	def member(name)
 		@members.find { |m| m.name == name }
 	end
+
+	def sizeof_half ; 2 ; end
+	def sizeof_word ; 4 ; end
 end
 end
 

data/{lib/metasm → metasm}/exe_format/coff_decode.rb

@@ -17,13 +17,15 @@ class COFF
 		# decodes a COFF optional header from coff.cursection
 		# also decodes directories in coff.directory
 		def decode(coff)
-			return set_default_values(coff) if coff.header.size_opthdr == 0
+			return set_default_values(coff) if coff.header.size_opthdr == 0 and not coff.header.characteristics.include?('EXECUTABLE_IMAGE')
+			off = coff.curencoded.ptr
 			super(coff)
+			nrva = (coff.header.size_opthdr - (coff.curencoded.ptr - off)) / 8
+			nrva = @numrva if nrva < 0
 
-			nrva = @numrva
-			if @numrva > DIRECTORIES.length
-				puts "W: COFF: Invalid directories count #{@numrva}" if $VERBOSE
-				nrva = DIRECTORIES.length
+			if nrva > DIRECTORIES.length or nrva != @numrva
+				puts "W: COFF: Weird directories count #{@numrva}" if $VERBOSE
+				nrva = DIRECTORIES.length if nrva > DIRECTORIES.length
 			end
 
 			coff.directory = {}
@@ -171,17 +173,17 @@ class COFF
 	end
 
 	class ResourceDirectory
-		def decode(coff, edata = coff.curencoded, startptr = edata.ptr)
+		def decode(coff, edata = coff.curencoded, startptr = edata.ptr, maxdepth=3)
 			super(coff, edata)
 
 			@entries = []
 
 			nrnames = @nr_names if $DEBUG
 			(@nr_names+@nr_id).times {
- 				e = Entry.new
+				e = Entry.new
 
- 				e_id = coff.decode_word(edata)
- 				e_ptr = coff.decode_word(edata)
+				e_id = coff.decode_word(edata)
+				e_ptr = coff.decode_word(edata)
 
 				if not e_id.kind_of? Integer or not e_ptr.kind_of? Integer
 					puts 'W: COFF: relocs in the rsrc directory?' if $VERBOSE
@@ -213,10 +215,12 @@ class COFF
 					e.subdir_p = e_ptr & 0x7fff_ffff
 					if startptr + e.subdir_p >= edata.length
 						puts 'W: COFF: invalid resource structure: directory too far' if $VERBOSE
-					else
+					elsif maxdepth > 0
 						edata.ptr = startptr + e.subdir_p
 						e.subdir = ResourceDirectory.new
-						e.subdir.decode coff, edata, startptr
+						e.subdir.decode coff, edata, startptr, maxdepth-1
+					else
+						puts 'W: COFF: recursive resource section' if $VERBOSE
 					end
 				else
 					e.dataentry_p = e_ptr
@@ -244,7 +248,8 @@ class COFF
 
 			decode_tllv = lambda { |ed, state|
 				sptr = ed.ptr
-				len, vlen, type = coff.decode_half(ed), coff.decode_half(ed), coff.decode_half(ed)
+				len, vlen = coff.decode_half(ed), coff.decode_half(ed)
+				coff.decode_half(ed)	# type
 				tagname = ''
 				while c = coff.decode_half(ed) and c != 0
 					tagname << (c&255)
@@ -273,7 +278,7 @@ class COFF
 				when :str
 					val = ed.read(vlen*2).unpack('v*')
 					val.pop if val[-1] == 0
-					val = val.pack('C*') if val.all? { |c_| c_ > 0 and  c_ < 256 } 
+					val = val.pack('C*') if val.all? { |c_| c_ > 0 and  c_ < 256 }
 					vers[tagname] = val
 				when :var
 					val = ed.read(vlen).unpack('V*')
@@ -426,8 +431,7 @@ class COFF
 	def sect_at_rva(rva)
 		return if not rva or rva <= 0
 		if sections and not @sections.empty?
-			valign = lambda { |l| EncodedData.align_size(l, @optheader.sect_align) }
-			if s = @sections.find { |s_| s_.virtaddr <= rva and s_.virtaddr + valign[s_.virtsize] > rva }
+			if s = @sections.find { |s_| s_.virtaddr <= rva and s_.virtaddr + EncodedData.align_size((s_.virtsize == 0 ? s_.rawsize : s_.virtsize), @optheader.sect_align) > rva }
 				s.encoded.ptr = rva - s.virtaddr
 				@cursection = s
 			elsif rva < @sections.map { |s_| s_.virtaddr }.min
@@ -479,7 +483,7 @@ class COFF
 	end
 
 	def each_section
-		if @header.size_opthdr == 0
+		if @header.size_opthdr == 0 and not @header.characteristics.include?('EXECUTABLE_IMAGE')
 			@sections.each { |s|
 				next if not s.encoded
 				l = new_label(s.name)
@@ -490,7 +494,9 @@ class COFF
 		end
 		base = @optheader.image_base
 		base = 0 if not base.kind_of? Integer
-		yield @encoded[0, @optheader.headers_size], base
+		sz = @optheader.headers_size
+		sz = EncodedData.align_size(@optheader.image_size, 4096) if @sections.empty?
+		yield @encoded[0, sz], base
 		@sections.each { |s| yield s.encoded, base + s.virtaddr }
 	end
 
@@ -566,8 +572,10 @@ class COFF
 	# decodes a section content (allows simpler LoadedPE override)
 	def decode_section_body(s)
 		raw = EncodedData.align_size(s.rawsize, @optheader.file_align)
-		virt = EncodedData.align_size(s.virtsize, @optheader.sect_align)
+		virt = s.virtsize
 		virt = raw = s.rawsize if @header.size_opthdr == 0
+		virt = raw if virt == 0
+		virt = EncodedData.align_size(virt, @optheader.sect_align)
 		s.encoded = @encoded[s.rawaddr, [raw, virt].min] || EncodedData.new
 		s.encoded.virtsize = virt
 	end
@@ -634,8 +642,13 @@ class COFF
 		if ct = @directory['certificate_table']
 			@certificates = []
 			@cursection = self
+			if ct[0] > @encoded.length or ct[1] > @encoded.length - ct[0]
+				puts "W: COFF: invalid certificate_table #{'0x%X+0x%0X' % ct}" if $VERBOSE
+				ct = [ct[0], 1]
+			end
 			@encoded.ptr = ct[0]
 			off_end = ct[0]+ct[1]
+			off_end = @encoded.length if off_end > @encoded.length
 			while @encoded.ptr < off_end
 				certlen = decode_word
 				certrev = decode_half
@@ -704,6 +717,25 @@ class COFF
 		end
 	end
 
+	def decode_reloc_amd64(r)
+		case r.type
+		when 'ABSOLUTE'
+		when 'HIGHLOW'
+			addr = decode_word
+			if s = sect_at_va(addr)
+				label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+				Metasm::Relocation.new(Expression[label], :u32, @endianness)
+			end
+		when 'DIR64'
+			addr = decode_xword
+			if s = sect_at_va(addr)
+				label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+				Metasm::Relocation.new(Expression[label], :u64, @endianness)
+			end
+		else puts "W: COFF: Unsupported amd64 relocation #{r.inspect}" if $VERBOSE
+		end
+	end
+
 	def decode_debug
 		if dd = @directory['debug'] and sect_at_rva(dd[0])
 			@debug = []
@@ -719,11 +751,11 @@ class COFF
 	def decode_tls
 		if @directory['tls_table'] and sect_at_rva(@directory['tls_table'][0])
 			@tls = TLSDirectory.decode(self)
-		       	if s = sect_at_va(@tls.callback_p)
+			if s = sect_at_va(@tls.callback_p)
 				s.encoded.add_export 'tls_callback_table'
 				@tls.callbacks.each_with_index { |cb, i|
 					@tls.callbacks[i] = curencoded.add_export "tls_callback_#{i}" if sect_at_rva(cb)
-			       	}
+				}
 			end
 		end
 	end
@@ -815,6 +847,7 @@ class COFFArchive
 			ar.encoded.ptr += 1 if @size & 1 == 1
 		end
 
+		# TODO XXX are those actually used ?
 		def decode_half ; @encoded.decode_imm(:u16, :big) end
 		def decode_word ; @encoded.decode_imm(:u32, :big) end