📄 i386-darwin.macho-entry.s
字号:
/*; i386-darwin.macho-entry.S -- program entry point & decompressor (i386 Mach-o);; This file is part of the UPX executable compressor.;; Copyright (C) 1996-2007 Markus Franz Xaver Johannes Oberhumer; Copyright (C) 1996-2007 Laszlo Molnar; Copyright (C) 2000-2007 John F. Reiser; All Rights Reserved.;; UPX and the UCL library are free software; you can redistribute them; and/or modify them under the terms of the GNU General Public License as; published by the Free Software Foundation; either version 2 of; the License, or (at your option) any later version.;; This program is distributed in the hope that it will be useful,; but WITHOUT ANY WARRANTY; without even the implied warranty of; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the; GNU General Public License for more details.;; You should have received a copy of the GNU General Public License; along with this program; see the file COPYING.; If not, write to the Free Software Foundation, Inc.,; 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.;; Markus F.X.J. Oberhumer Laszlo Molnar; <mfx@users.sourceforge.net> <ml1050@users.sourceforge.net>;; John F. Reiser; <jreiser@users.sourceforge.net>;*/#include "arch/i386/macros.S"/*************************************************************************// program entry point// see glibc/sysdeps/i386/elf/start.S**************************************************************************/section LEXEC000_start: .globl _start//// int3/*;; How to debug this code: Uncomment the 'int3' breakpoint instruction above.;; Build the stubs and upx. Compress a testcase, such as a copy of /bin/date.;; Invoke gdb, and give a 'run' command. Define a single-step macro such as;; define g;; stepi;; x/i $pc;; end;; and a step-over macro such as;; define h;; x/2i $pc;; tbreak *$_;; continue;; x/i $pc;; end;; Step through the code; remember that <Enter> repeats the previous command.;;*/ call main // push address of decompress subroutinedecompress:// /*************************************************************************// // C callable decompressor// **************************************************************************/// /* Offsets to parameters, allowing for {pusha + call} */#define O_INP (8*4 +1*4)#define O_INS (8*4 +2*4)#define O_OUTP (8*4 +3*4)#define O_OUTS (8*4 +4*4)#define O_PARAM (8*4 +5*4)#define INP dword ptr [esp+O_INP]#define INS dword ptr [esp+O_INS]#define OUTP dword ptr [esp+O_OUTP]#define OUTS dword ptr [esp+O_OUTS]#define PARM dword ptr [esp+O_PARAM]section LEXEC009 //; empty section for commonality with l_lx_exec86.asmsection LEXEC010 pusha // cld mov esi, INP mov edi, OUTP or ebp, -1//;; align 8#include "arch/i386/nrv2b_d32.S"#include "arch/i386/nrv2d_d32.S"#include "arch/i386/nrv2e_d32.S"#include "arch/i386/lzma_d.S"section LEXEC015 // eax is 0 from decompressor code //xor eax, eax ; return code// check compressed size mov edx, INP add edx, INS cmp esi, edx jz .ok dec eax.ok:// write back the uncompressed size sub edi, OUTP mov edx, OUTS mov [edx], edi mov [7*4 + esp], eax popa ret ctojr32 ctok32 edi, dl cit32 edisection LEXEC017 popa retsection LEXEC020#define PAGE_SIZE ( 1<<12)sz_b_info= 12 sz_unc= 0 sz_cpr= 4 b_method= 8// Decompress the rest of this loader, and jump to it.unfold: pop esi // &{ b_info:{sz_unc, sz_cpr, 4{byte}}, compressed_data...} mov eax,[sz_cpr + esi] lea edx,[sz_b_info + eax + esi] push edx // &destination cld lodsd push eax // sz_uncompressed (maximum dstlen for lzma) mov ecx,esp // save &dstlen push eax // space for 5th param push ecx // &dstlen push edx // &dst lodsd push eax // sz_compressed (srclen) lodsd mov [4*3 + esp],eax // last 4 bytes of b_info push esi // &compressed_data call ebp // decompress(&src, srclen, &dst, &dstlen, b_info.misc) add esp, (5+1)*4 // (5+1) args to decompress ret // &destinationmain: pop ebp // &decompress lea ebx,[-4+ _start - decompress + ebp] // &total_length call unfold // compressed fold_elf86 follows// vi:ts=8:et:nowrap
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -