531 lines
16 KiB
C
531 lines
16 KiB
C
/****************************************************************/
|
|
/* */
|
|
/* exeflat.c */
|
|
/* */
|
|
/* EXE flattening program */
|
|
/* */
|
|
/* Copyright (c) 2001 */
|
|
/* Bart E. Oldeman */
|
|
/* All Rights Reserved */
|
|
/* */
|
|
/* This file is part of DOS-C. */
|
|
/* */
|
|
/* DOS-C is free software; you can redistribute it and/or */
|
|
/* modify it under the terms of the GNU General Public License */
|
|
/* as published by the Free Software Foundation; either version */
|
|
/* 2, or (at your option) any later version. */
|
|
/* */
|
|
/* DOS-C is distributed in the hope that it will be useful, but */
|
|
/* WITHOUT ANY WARRANTY; without even the implied warranty of */
|
|
/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See */
|
|
/* the GNU General Public License for more details. */
|
|
/* */
|
|
/* You should have received a copy of the GNU General Public */
|
|
/* License along with DOS-C; see the file COPYING. If not, */
|
|
/* write to the Free Software Foundation, 675 Mass Ave, */
|
|
/* Cambridge, MA 02139, USA. */
|
|
/****************************************************************/
|
|
|
|
/*
|
|
|
|
Usage: exeflat (src.exe) (dest.sys) (relocation-factor)
|
|
|
|
large portions copied from task.c
|
|
|
|
*/
|
|
|
|
/* history
|
|
|
|
10/??/01 - Bart Oldeman
|
|
primary release
|
|
|
|
11/28/01 - tom ehlert
|
|
added -UPX option to make the kernel compressable with UPX
|
|
|
|
*/
|
|
|
|
#include "portab.h"
|
|
#include "exe.h"
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <ctype.h>
|
|
|
|
#define BUFSIZE 32768u
|
|
|
|
#define KERNEL_START 0x16 /* the kernel code really starts here at 60:16 */
|
|
#define KERNEL_CONFIG_LENGTH (32 - 2 - 4)
|
|
/* 32 entrypoint structure,
|
|
2 entrypoint short jump,
|
|
4 near jump / ss:sp storage */
|
|
char kernel_config[KERNEL_CONFIG_LENGTH];
|
|
|
|
typedef struct {
|
|
UWORD off, seg;
|
|
} farptr;
|
|
|
|
static int compReloc(const void *p1, const void *p2)
|
|
{
|
|
farptr *r1 = (farptr *) p1;
|
|
farptr *r2 = (farptr *) p2;
|
|
if (r1->seg > r2->seg)
|
|
return 1;
|
|
if (r1->seg < r2->seg)
|
|
return -1;
|
|
if (r1->off > r2->off)
|
|
return 1;
|
|
if (r1->off < r2->off)
|
|
return -1;
|
|
return 0;
|
|
}
|
|
|
|
static void usage(void)
|
|
{
|
|
printf("usage: exeflat (src.exe) (dest.sys) (relocation-factor)\n");
|
|
printf
|
|
(" -S10 - Silent relocate segment 10 (down list)\n");
|
|
|
|
exit(1);
|
|
}
|
|
|
|
static int exeflat(const char *srcfile, const char *dstfile,
|
|
const char *start, short *silentSegments, short silentcount,
|
|
int UPX, int patchsignal, exe_header *header)
|
|
{
|
|
int i, j;
|
|
size_t bufsize;
|
|
farptr *reloc;
|
|
UWORD start_seg;
|
|
ULONG size, to_xfer;
|
|
UBYTE **buffers;
|
|
UBYTE **curbuf;
|
|
UBYTE *signal;
|
|
FILE *src, *dest;
|
|
short silentdone = 0;
|
|
int compress_sys_file;
|
|
UWORD realentry;
|
|
|
|
if ((src = fopen(srcfile, "rb")) == NULL)
|
|
{
|
|
printf("Source file %s could not be opened\n", srcfile);
|
|
exit(1);
|
|
}
|
|
if (fread(header, sizeof(*header), 1, src) != 1)
|
|
{
|
|
printf("Error reading header from %s\n", srcfile);
|
|
fclose(src);
|
|
exit(1);
|
|
}
|
|
if (header->exSignature != MAGIC)
|
|
{
|
|
printf("Source file %s is not a valid .EXE\n", srcfile);
|
|
fclose(src);
|
|
exit(1);
|
|
}
|
|
start_seg = (UWORD)strtol(start, NULL, 0);
|
|
if (header->exExtraBytes == 0)
|
|
header->exExtraBytes = 0x200;
|
|
printf("header len = %lu = 0x%lx\n", header->exHeaderSize * 16UL,
|
|
header->exHeaderSize * 16UL);
|
|
size =
|
|
((DWORD) (header->exPages - 1) << 9) + header->exExtraBytes -
|
|
header->exHeaderSize * 16UL;
|
|
printf("image size (less header) = %lu = 0x%lx\n", size, size);
|
|
printf("first relocation offset = %u = 0x%x\n", header->exRelocTable,
|
|
header->exRelocTable);
|
|
|
|
/* first read file into memory chunks */
|
|
fseek(src, header->exHeaderSize * 16UL, SEEK_SET);
|
|
buffers = malloc((size_t)((size + BUFSIZE - 1) / BUFSIZE) * sizeof(char *));
|
|
if (buffers == NULL)
|
|
{
|
|
printf("Allocation error\n");
|
|
exit(1);
|
|
}
|
|
bufsize = BUFSIZE;
|
|
for (to_xfer = size, curbuf = buffers; to_xfer > 0;
|
|
to_xfer -= bufsize, curbuf++)
|
|
{
|
|
if (to_xfer < BUFSIZE)
|
|
bufsize = (size_t)to_xfer;
|
|
*curbuf = malloc(bufsize);
|
|
if (*curbuf == NULL)
|
|
{
|
|
printf("Allocation error\n");
|
|
exit(1);
|
|
}
|
|
if (fread(*curbuf, sizeof(char), bufsize, src) != bufsize)
|
|
{
|
|
printf("Source file read error %ld %d\n", to_xfer, (int)bufsize);
|
|
exit(1);
|
|
}
|
|
}
|
|
if (header->exRelocTable && header->exRelocItems)
|
|
{
|
|
fseek(src, header->exRelocTable, SEEK_SET);
|
|
reloc = malloc(header->exRelocItems * sizeof(farptr));
|
|
if (reloc == NULL)
|
|
{
|
|
printf("Allocation error\n");
|
|
exit(1);
|
|
}
|
|
if (fread(reloc, sizeof(farptr), header->exRelocItems, src) !=
|
|
header->exRelocItems)
|
|
{
|
|
printf("Source file read error\n");
|
|
exit(1);
|
|
}
|
|
}
|
|
fclose(src);
|
|
qsort(reloc, header->exRelocItems, sizeof(reloc[0]), compReloc);
|
|
for (i = 0; i < header->exRelocItems; i++)
|
|
{
|
|
ULONG spot = ((ULONG) reloc[i].seg << 4) + reloc[i].off;
|
|
UBYTE *spot0 = &buffers[(size_t)(spot / BUFSIZE)][(size_t)(spot % BUFSIZE)];
|
|
UBYTE *spot1 = &buffers[(size_t)((spot + 1) / BUFSIZE)][(size_t)((spot + 1) % BUFSIZE)];
|
|
UWORD segment = ((UWORD) * spot1 << 8) + *spot0;
|
|
|
|
for (j = 0; j < silentcount; j++)
|
|
if (segment == silentSegments[j])
|
|
{
|
|
silentdone++;
|
|
goto dontPrint;
|
|
}
|
|
|
|
printf("relocation at 0x%04x:0x%04x ->%04x\n", reloc[i].seg,
|
|
reloc[i].off, segment);
|
|
|
|
dontPrint:
|
|
|
|
segment += start_seg;
|
|
*spot0 = segment & 0xff;
|
|
*spot1 = segment >> 8;
|
|
}
|
|
|
|
printf("\nProcessed %d relocations, %d not shown\n",
|
|
header->exRelocItems, silentdone);
|
|
|
|
if (UPX)
|
|
{
|
|
struct x {
|
|
char y[(KERNEL_CONFIG_LENGTH + 2) <= BUFSIZE ? 1 : -1];
|
|
};
|
|
memcpy(kernel_config, &buffers[0][2], KERNEL_CONFIG_LENGTH);
|
|
}
|
|
|
|
realentry = KERNEL_START;
|
|
if (buffers[0][0] == 0xeb /* jmp short */)
|
|
{
|
|
realentry = buffers[0][1] + 2;
|
|
}
|
|
else if (buffers[0][0] == 0xe9 /* jmp near */)
|
|
{
|
|
realentry = ((UWORD)(buffers[0][2]) << 8) + buffers[0][1] + 3;
|
|
}
|
|
|
|
signal = &buffers[(size_t)(realentry / BUFSIZE)][(size_t)(realentry % BUFSIZE)];
|
|
if (patchsignal && UPX)
|
|
{
|
|
if (*signal == 0xF8) /* clc */
|
|
{
|
|
*signal = 0xF9; /* stc */
|
|
printf("Signal patched to indicate compression\n");
|
|
}
|
|
else if (*signal == 0xF9)
|
|
{
|
|
printf("Signal is already patched to indicate compression\n");
|
|
}
|
|
}
|
|
else if (patchsignal)
|
|
{
|
|
if (*signal == 0xF8) /* clc */
|
|
{
|
|
printf("Signal not patched as no compression used\n");
|
|
}
|
|
else if (*signal == 0xF9)
|
|
{
|
|
printf("Signal wrongly patched to indicate compression ??\n");
|
|
}
|
|
}
|
|
|
|
if ((dest = fopen(dstfile, "wb+")) == NULL)
|
|
{
|
|
printf("Destination file %s could not be created\n", dstfile);
|
|
exit(1);
|
|
}
|
|
|
|
/* The biggest .sys file that UPX accepts seems to be 65419 bytes long */
|
|
compress_sys_file = size < 65420;
|
|
if (UPX) {
|
|
printf("Compressing kernel - %s format\n", (compress_sys_file)?"sys":"exe");
|
|
}
|
|
if (UPX && !compress_sys_file) {
|
|
ULONG realsize;
|
|
/* write header without relocations to file */
|
|
exe_header nheader = *header;
|
|
nheader.exRelocItems = 0;
|
|
nheader.exHeaderSize = 2;
|
|
realsize = size + 32;
|
|
nheader.exPages = (UWORD)(realsize >> 9);
|
|
nheader.exExtraBytes = (UWORD)realsize & 511;
|
|
if (nheader.exExtraBytes)
|
|
nheader.exPages++;
|
|
if (fwrite(&nheader, sizeof(nheader), 1, dest) != 1) {
|
|
printf("Destination file write error\n");
|
|
exit(1);
|
|
}
|
|
fseek(dest, 32UL, SEEK_SET);
|
|
}
|
|
|
|
/* write dest file from memory chunks */
|
|
bufsize = BUFSIZE;
|
|
for (to_xfer = size, curbuf = buffers; to_xfer > 0;
|
|
to_xfer -= bufsize, curbuf++)
|
|
{
|
|
if (to_xfer < BUFSIZE)
|
|
bufsize = (size_t)to_xfer;
|
|
if (fwrite(*curbuf, sizeof(char), bufsize, dest) != bufsize)
|
|
|
|
{
|
|
printf("Destination file write error\n");
|
|
exit(1);
|
|
}
|
|
free(*curbuf);
|
|
}
|
|
|
|
if (UPX && compress_sys_file) {
|
|
/* overwrite first 8 bytes with SYS header */
|
|
UWORD dhdr[4];
|
|
fseek(dest, 0, SEEK_SET);
|
|
for (i = 0; i < 3; i++)
|
|
dhdr[i] = 0xffff;
|
|
/* strategy will jump to us, interrupt never called */
|
|
dhdr[3] = realentry; /* KERNEL_START; */
|
|
fwrite(dhdr, sizeof(dhdr), 1, dest);
|
|
printf("KERNEL_START = 0x%04x\n", realentry);
|
|
}
|
|
fclose(dest);
|
|
return compress_sys_file;
|
|
}
|
|
|
|
static void write_header(FILE *dest, size_t size)
|
|
{
|
|
/* UPX HEADER jump $+2+size */
|
|
static char JumpBehindCode[] = {
|
|
/* kernel config header - 32 bytes */
|
|
0xeb, 0x1b, /* jmp short realentry */
|
|
'C', 'O', 'N', 'F', 'I', 'G', 6, 0, /* WORD */
|
|
0, /* DLASortByDriveNo db 0 */
|
|
1, /* InitDiskShowDriveAssignment db 1 */
|
|
2, /* SkipConfigSeconds db 2 */
|
|
0, /* ForceLBA db 0 */
|
|
1, /* GlobalEnableLBAsupport db 1 */
|
|
0, /* BootHarddiskSeconds */
|
|
|
|
'n', 'u', 's', 'e', 'd', /* unused filler bytes */
|
|
8, 7, 6, 5, 4, 3, 2, 1,
|
|
/* real-entry: jump over the 'real' image do the trailer */
|
|
0xe9, 0, 0 /* 100: jmp 103 */
|
|
};
|
|
|
|
if (0 == memcmp(kernel_config, "CONFIG", 6)) {
|
|
unsigned long length = kernel_config[6] + kernel_config[7] * 256UL + 8;
|
|
if (length <= KERNEL_CONFIG_LENGTH) {
|
|
memcpy(&JumpBehindCode[2], kernel_config, length);
|
|
printf("Copied %lu bytes of kernel config block to header\n", length);
|
|
} else {
|
|
printf("Error: Found %lu bytes of kernel config block, too long!\n", length);
|
|
}
|
|
} else {
|
|
printf("Error: Found no kernel config block!\n");
|
|
}
|
|
|
|
struct x {
|
|
char y[sizeof(JumpBehindCode) == 0x20 ? 1 : -1];
|
|
};
|
|
|
|
fseek(dest, 0, SEEK_SET);
|
|
/* this assumes <= 0xfe00 code in kernel */
|
|
*(short *)&JumpBehindCode[0x1e] += (short)size;
|
|
fwrite(JumpBehindCode, 1, 0x20, dest);
|
|
}
|
|
|
|
static void write_trailer(FILE *dest, size_t size, int compress_sys_file,
|
|
exe_header *header)
|
|
{
|
|
/* UPX trailer */
|
|
/* hand assembled - so this remains ANSI C ;-) */
|
|
/* well almost: we still need packing and assume little endian ... */
|
|
/* move kernel down to place CONFIG-block, which added above,
|
|
at start_seg-2:0 (e.g. 0x5e:0) instead of
|
|
start_seg:0 (e.g. 0x60:0) and store there boot drive number
|
|
from BL; kernel.asm will then check presence of additional
|
|
CONFIG-block at this address. */
|
|
static char trailer[] = { /* shift down everything by sizeof JumpBehindCode */
|
|
0xB9, 0x00, 0x00, /* 0 mov cx,offset trailer */
|
|
0x0E, /* 3 push cs */
|
|
0x1F, /* 4 pop ds (=60) */
|
|
0x8C, 0xC8, /* 5 mov ax,cs */
|
|
0x48, /* 7 dec ax */
|
|
0x48, /* 8 dec ax */
|
|
0x8E, 0xC0, /* 9 mov es,ax */
|
|
0x93, /* 11 xchg ax,bx (to get al=bl) */
|
|
0x31, 0xFF, /* 12 xor di,di */
|
|
0xFC, /* 14 cld */
|
|
0xAA, /* 15 stosb (store drive number)*/
|
|
0x8B, 0xF7, /* 16 mov si,di */
|
|
0xF3, 0xA4, /* 18 rep movsb */
|
|
0x55, /* 20 push bp */
|
|
0x26, 0x8C, 0x16, 0x1E, 0x00, /* 21 mov word [es:(#32 - 2)], ss */
|
|
0x26, 0x89, 0x26, 0x1C, 0x00, /* 26 mov word [es:(#32 - 4)], sp */
|
|
0x1E, /* 31 push ds */
|
|
0x58, /* 32 pop ax */
|
|
0x05, 0x00, 0x00, /* 33 add ax,... */
|
|
0x8E, 0xD0, /* 36 mov ss,ax */
|
|
0xBC, 0x00, 0x00, /* 38 mov sp,... */
|
|
0x31, 0xC0, /* 41 xor ax,ax */
|
|
0xFF, 0xE0 /* 43 jmp ax */
|
|
};
|
|
|
|
*(short *)&trailer[1] = (short)size + 0x20;
|
|
*(short *)&trailer[34] = header->exInitSS;
|
|
*(short *)&trailer[39] = header->exInitSP;
|
|
if (compress_sys_file) {
|
|
/* replace by jmp word ptr [6]: ff 26 06 00
|
|
(the .SYS strategy handler which will unpack) */
|
|
*(long *)&trailer[41] = 0x000626ffL;
|
|
/* set up a 4K stack for the UPX decompressor to work with */
|
|
*(short *)&trailer[34] = 0x1000;
|
|
*(short *)&trailer[39] = 0x1000;
|
|
}
|
|
fwrite(trailer, 1, sizeof trailer, dest);
|
|
}
|
|
|
|
int main(int argc, char **argv)
|
|
{
|
|
short silentSegments[20], silentcount = 0;
|
|
static exe_header header; /* must be initialized to zero */
|
|
int UPX = FALSE;
|
|
int i;
|
|
size_t sz, len, len2, n;
|
|
int compress_sys_file;
|
|
char *buffer, *tmpexe, *cmdbuf;
|
|
FILE *dest;
|
|
long size;
|
|
|
|
/* if no arguments provided, show usage and exit */
|
|
if (argc < 4) usage();
|
|
|
|
/* do optional argument processing here */
|
|
for (i = 4; i < argc && !UPX; i++)
|
|
{
|
|
char *argptr = argv[i];
|
|
|
|
if (argptr[0] != '-' && argptr[0] != '/')
|
|
usage();
|
|
|
|
argptr++;
|
|
|
|
switch (toupper(argptr[0]))
|
|
{
|
|
case 'U':
|
|
UPX = i;
|
|
break;
|
|
case 'S':
|
|
if (silentcount >= LENGTH(silentSegments))
|
|
{
|
|
printf("can't handle more then %d silent's\n",
|
|
(int)LENGTH(silentSegments));
|
|
exit(1);
|
|
}
|
|
|
|
silentSegments[silentcount++] = (short)strtol(argptr + 1, NULL, 0);
|
|
break;
|
|
|
|
default:
|
|
usage();
|
|
}
|
|
}
|
|
|
|
/* arguments left :
|
|
infile outfile relocation offset */
|
|
|
|
compress_sys_file = exeflat(argv[1], argv[2], argv[3],
|
|
silentSegments, silentcount,
|
|
UPX, 1, &header);
|
|
if (!UPX)
|
|
exit(0);
|
|
|
|
/* move kernel.sys tmp.exe */
|
|
tmpexe = argv[2];
|
|
if (!compress_sys_file)
|
|
{
|
|
tmpexe = "tmp.exe";
|
|
rename(argv[2], tmpexe);
|
|
}
|
|
|
|
len2 = strlen(tmpexe) + 1;
|
|
sz = len2;
|
|
if (sz < 256) sz = 256;
|
|
cmdbuf = malloc(sz);
|
|
len = 0;
|
|
for (i = UPX+1; i < argc; i++)
|
|
{
|
|
n = strlen(argv[i]);
|
|
if (len + len2 + n + 2 >= sz) {
|
|
sz *= 2;
|
|
cmdbuf = realloc(cmdbuf, sz);
|
|
}
|
|
if (i > UPX+1)
|
|
cmdbuf[len++] = ' ';
|
|
memcpy(cmdbuf + len, argv[i], n + 1);
|
|
len += n;
|
|
}
|
|
cmdbuf[len++] = ' ';
|
|
/* if tmpexe is tmpfile set above no quotes needed, if user needs quotes should add on cmd line */
|
|
memcpy(cmdbuf + len, tmpexe, len2);
|
|
cmdbuf[len + len2] = '\0';
|
|
printf("%s\n", cmdbuf);
|
|
if (system(cmdbuf))
|
|
{
|
|
printf("Problems executing %s\n", cmdbuf);
|
|
printf("Removing [%s]\n", tmpexe);
|
|
remove(tmpexe);
|
|
exit(1);
|
|
}
|
|
free(cmdbuf);
|
|
|
|
if (!compress_sys_file)
|
|
{
|
|
exeflat(tmpexe, argv[2], argv[3],
|
|
silentSegments, silentcount,
|
|
FALSE, 0, &header);
|
|
remove(tmpexe);
|
|
}
|
|
|
|
/* argv[2] now contains the final flattened file: just
|
|
header and trailer need to be added */
|
|
/* the compressed file has two chunks max */
|
|
|
|
if ((dest = fopen(argv[2], "rb+")) == NULL)
|
|
{
|
|
printf("Destination file %s could not be opened\n", argv[2]);
|
|
exit(1);
|
|
}
|
|
|
|
buffer = malloc(0xfe01);
|
|
|
|
fread(buffer, 0xfe01, 1, dest);
|
|
size = ftell(dest);
|
|
if (size >= 0xfe00u)
|
|
{
|
|
printf("kernel; size too large - must be <= 0xfe00\n");
|
|
exit(1);
|
|
}
|
|
fseek(dest, 0, SEEK_SET);
|
|
write_header(dest, (size_t)size);
|
|
fwrite(buffer, (size_t)size, 1, dest);
|
|
write_trailer(dest, (size_t)size, compress_sys_file, &header);
|
|
return 0;
|
|
}
|