992a898076
This format has several advantages: * The CONFIG block need not be moved. * The entire compressed image (depacker and payload) need not be moved another time before the UPX depacker's own operation. * The CONFIG block always lives at 00602h, and the kernel need not be aware whether it was compressed for detecting which CONFIG block to use. * Support for compressed images beyond 64 KiB for free. (The assembly define TEST_FILL_INIT_TEXT can be passed in NASMENV to test this support with 32 KiB of LFSR output.) * A subsequent commit will shorten the stub to 64 bytes, compared to the prior 32 + 45 = 77 bytes, with no loss of features. (The packed payload is a bit shorter too.) * The new stub also sets ds and es to the segment value that would point to the DOS/EXE process's PSP. This is apparently not used by the UPX depacker but could be in a future or past version, or if another packer is used.
48 lines
832 B
NASM
48 lines
832 B
NASM
cpu 8086
|
|
org 0
|
|
|
|
bootloadunit: ; (byte of short jump re-used)
|
|
start:
|
|
jmp strict short entry
|
|
times (32 - 4) - ($ - $$) db 0
|
|
; area for CONFIG block
|
|
|
|
bootloadstack: ; (dword re-used for original ss:sp)
|
|
entry:
|
|
; common setup (copied from kernel.asm)
|
|
push cs
|
|
pop ds
|
|
xor di, di
|
|
mov byte [di + bootloadunit - $$], bl
|
|
push bp
|
|
mov word [di + bootloadstack - $$], sp
|
|
mov word [di + bootloadstack + 2 - $$], ss
|
|
|
|
; the UPX DOS/EXE depacker needs a certain ss:sp
|
|
cli
|
|
mov ax, 0
|
|
patchstacksegment: equ $ - 2
|
|
mov ss, ax
|
|
mov sp, 0
|
|
patchstackpointer: equ $ - 2
|
|
sti
|
|
|
|
mov ax, -10h
|
|
patchpspsegment: equ $ - 2
|
|
mov ds, ax
|
|
mov es, ax
|
|
|
|
jmp 0:0
|
|
patchcsip: equ $ - 4
|
|
end:
|
|
|
|
times 0C0h - ($ - $$) nop
|
|
entry_common:
|
|
|
|
times 100h - ($ - $$) db 0
|
|
dw patchstackpointer
|
|
dw patchstacksegment
|
|
dw patchpspsegment
|
|
dw patchcsip
|
|
dw end
|