retdec
Public Member Functions | Protected Attributes | Private Member Functions | Private Attributes | List of all members
retdec::unpackertool::upx::PeUpxStub< bits > Class Template Reference

#include <pe_upx_stub.h>

Inheritance diagram for retdec::unpackertool::upx::PeUpxStub< bits >:
Inheritance graph
[legend]
Collaboration diagram for retdec::unpackertool::upx::PeUpxStub< bits >:
Collaboration graph
[legend]

Public Member Functions

 PeUpxStub (retdec::loader::Image *inputFile, const UpxStubData *stubData, const DynamicBuffer &stubCapturedData, std::unique_ptr< Decompressor > decompressor, const UpxMetadata &metadata)
 
virtual void unpack (const std::string &ouputFile) override
 
virtual void setupPackingMethod (std::uint8_t packingMethod)
 
virtual void readUnpackingStub (DynamicBuffer &unpackingStub)
 
virtual void readPackedData (DynamicBuffer &packedData, bool trustMetadata)
 
virtual void decompress (DynamicBuffer &packedData, DynamicBuffer &unpackedData, bool trustMetadata)
 
virtual void cleanup () override
 
virtual std::uint32_t getRealEpAddress () const override
 
void setRealEpAddress (std::uint32_t realEpAddress)
 
- Public Member Functions inherited from retdec::unpackertool::upx::UpxStub
 UpxStub (retdec::loader::Image *inputFile, const UpxStubData *stubData, const DynamicBuffer &stubCapturedData, std::unique_ptr< Decompressor > decompressor, const UpxMetadata &metadata)
 
UpxStubVersion getVersion () const
 
const UpxStubDatagetStubData () const
 
const DynamicBuffergetStubCapturedData () const
 
DecompressorgetDecompressor () const
 
const UpxMetadatagetUpxMetadata () const
 
void setStubData (const UpxStubData *stubData)
 
void setStubCapturedData (const DynamicBuffer &stubCapturedData)
 
- Public Member Functions inherited from retdec::unpacker::UnpackingStub
 UnpackingStub (loader::Image *file)
 
virtual ~UnpackingStub ()=default
 
loader::ImagegetFile ()
 

Protected Attributes

const retdec::loader::Segment_upx0Sect
 Pointer to section UPX0. More...
 
std::uint32_t _realEpAddress
 The real entry point address. More...
 
- Protected Attributes inherited from retdec::unpackertool::upx::UpxStub
const UpxStubData_stubData
 Additional stub information. More...
 
DynamicBuffer _stubCapturedData
 Data captured while matching signature of this stub. More...
 
std::unique_ptr< Decompressor_decompressor
 Decompressor associated with stub. More...
 
UpxMetadata _metadata
 UPX metadata aka packheader. More...
 
- Protected Attributes inherited from retdec::unpacker::UnpackingStub
loader::Image_file
 

Private Member Functions

void prepare ()
 
void detectUnfilter (const DynamicBuffer &unpackingStub)
 
void unpackData (DynamicBuffer &unpackedData)
 
void readPackedFileILT (DynamicBuffer &ilt)
 
void fixSizeOfSections (const DynamicBuffer &unpackedData)
 
UpxExtraData parseExtraData (DynamicBuffer &unpackedData, DynamicBuffer &originalHeader)
 
void fixPeHeader (const DynamicBuffer &originalHeader)
 
void unfilterData (DynamicBuffer &unpackedData)
 
void fixImports (const DynamicBuffer &unpackedData, const UpxExtraData &extraData, const DynamicBuffer &ilt)
 
void fixRelocations (DynamicBuffer &unpackedData, const UpxExtraData &extraData)
 
void fixTls (const DynamicBuffer &originalHeader)
 
void fixOep (const DynamicBuffer &originalHeader)
 
void fixExports (const DynamicBuffer &originalHeader)
 
void fixLoadConfiguration (const DynamicBuffer &originalHeader)
 
void fixResources (const DynamicBuffer &unpackedData, const DynamicBuffer &originalHeader)
 
void fixSectionHeaders (const DynamicBuffer &originalHeader)
 
void fixCoffSymbolTable ()
 
void fixCertificates ()
 
void cutHintsData (DynamicBuffer &unpackedData, const UpxExtraData &extraData)
 
void saveFile (const std::string &outputFile, DynamicBuffer &unpackedData)
 
void loadResources (PeLib::ResourceNode *rootNode, std::uint32_t offset, std::uint32_t uncompressedRsrcRva, std::uint32_t compressedRsrcRva, const DynamicBuffer &uncompressedRsrcs, const DynamicBuffer &unpackedData, std::unordered_set< std::uint32_t > &visitedNodes)
 
std::uint8_t getPackingMethod (bool trustMetadata) const
 

Private Attributes

PeLib::PeFileT_newPeFile
 Unpacked output file. More...
 
std::uint32_t _rvaShift
 Size of sections UPX1 and UPX2 which are deleted and virtual addresses are shifted. More...
 
bool _exportsCompressed
 True if the exports are compressed in the packed file, otherwise false. More...
 
std::vector< std::uint8_t > _coffSymbolTable
 COFF symbol table data if any exists. More...
 
Data read from signatures.
std::uint32_t _filterId
 ID of the used filter. More...
 
std::uint32_t _filterCount
 Number of jumps that are filtered. More...
 
std::uint32_t _filterParam
 Parameter of the filter. More...
 

Additional Inherited Members

- Static Public Member Functions inherited from retdec::unpackertool::upx::UpxStub
static std::shared_ptr< UpxStubcreateStub (retdec::loader::Image *file)
 
static std::shared_ptr< UpxStubcreateStub (retdec::loader::Image *file, const DynamicBuffer &stubBytes)
 
- Protected Member Functions inherited from retdec::unpackertool::upx::UpxStub
std::unique_ptr< DecompressordecodePackingMethod (std::uint8_t packingMethod) const
 
- Protected Member Functions inherited from retdec::unpacker::UnpackingStub
void setFile (loader::Image *file)
 

Detailed Description

template<int bits>
class retdec::unpackertool::upx::PeUpxStub< bits >

Basic unpacking stub class for unpacking files in PE format.

Constructor & Destructor Documentation

◆ PeUpxStub()

template<int bits>
retdec::unpackertool::upx::PeUpxStub< bits >::PeUpxStub ( retdec::loader::Image inputFile,
const UpxStubData stubData,
const DynamicBuffer stubCapturedData,
std::unique_ptr< Decompressor decompressor,
const UpxMetadata metadata 
)

Constructor.

Parameters
inputFilePacked input file.
stubDataUpxStubData associated with this unpacking stub.
stubCapturedDataData captured from signature matching.
decompressorAssociated decompressor with this unpacking stub.
metadataThe UPX metadata associated with this unpacking stub.

Member Function Documentation

◆ cleanup()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::cleanup
overridevirtual

Performs releasing of owned resources.

Implements retdec::unpacker::UnpackingStub.

◆ cutHintsData()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::cutHintsData ( DynamicBuffer unpackedData,
const UpxExtraData extraData 
)
private

Unpacked data contains the original file content and hints for unpacking. This method separates these data by erasing it from unpacked data and storing it in another buffer.

Parameters
unpackedDataThe unpacked data.
extraDataUpxExtraData structure.

◆ decompress()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::decompress ( DynamicBuffer packedData,
DynamicBuffer unpackedData,
bool  trustMetadata 
)
virtual

Decompresses the packed data and stores result in retdec::utils::DynamicBuffer.

Parameters
packedDataData to decompress.
unpackedDataBuffer where to store the result.
trustMetadataFalse if signature has more priority, otherwise metadata is prioritized.

◆ detectUnfilter()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::detectUnfilter ( const DynamicBuffer unpackingStub)
private

Detects used unfilter based on signature. If no signature is matched, UPX metadata are used if present in the file.

Parameters
unpackingStubThe unpacking stub buffer.

◆ fixCertificates()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixCertificates
private

Fixes certificate (security) directory in the unpacked file.

◆ fixCoffSymbolTable()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixCoffSymbolTable
private

Loads COFF symbol table if any exists into _coffSymbolTable attribute and sets the pointer to the offset that equals to the sum of all raw sizes of the sections in the unpacked file.

◆ fixExports()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixExports ( const DynamicBuffer originalHeader)
private

Performs fixing of exports directory using original PE header. This directory is used especially by DLLs. Export directory data are already in the unpacked data, only directory RVA and size needs to be fixed.

Parameters
originalHeaderThe original PE header.

◆ fixImports()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixImports ( const DynamicBuffer unpackedData,
const UpxExtraData extraData,
const DynamicBuffer ilt 
)
private

Performs the import fixing based on the hints data and the packed file ILT (Import Lookup Table).

Parameters
unpackedDataThe unpacked data with hints.
extraDataUpxExtraData structure.
iltILT of the packed file.

◆ fixLoadConfiguration()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixLoadConfiguration ( const DynamicBuffer originalHeader)
private

Performs fixing of Load Configuration directory using original PE header. This directory is used especially by MSVC compiler for security cookie. Load configuration directory data are already in the unpacked data, only directory RVA and size needs to be fixed.

Parameters
originalHeaderThe original PE header.

◆ fixOep()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixOep ( const DynamicBuffer originalHeader)
private

Performs fixing of OEP based on the value in original PE header.

Parameters
originalHeaderThe original PE header.

◆ fixPeHeader()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixPeHeader ( const DynamicBuffer originalHeader)
private

Fixes certain attributes in PE header.

Parameters
originalHeaderOriginal PE header.

◆ fixRelocations()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixRelocations ( DynamicBuffer unpackedData,
const UpxExtraData extraData 
)
private

Performs fixing of relocations. Relocations are not fixed by reconstruction of relocation directory. Instead, they are fixed "in-place" and the file is marked as "RELOCS_STRIPPED". This tells the loader not to relocate the image base of the file at all. Data from hints are used to fix them.

Todo:
Properly fix relocations by reloc directory reconstruction.
Parameters
unpackedDataThe unpacked data.
extraDataUpxExtraData structure.

◆ fixResources()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixResources ( const DynamicBuffer unpackedData,
const DynamicBuffer originalHeader 
)
private

Performs fixing of resources. Resources are very specific part of UPX since they can be either packed and unpacked simultaneously. The section UPX2 is usually renamed to rsrc and is populated with the new resource directory. The tree structure of the resources is mantained across the original and the packed file. Icons, manifest, version info etc. are not packed. They are put into new rsrc section. Resources that are packed are kept in its original place, so can be found in the unpacked data. This method builds the new resource tree combining the packed and non-packed resources.

Parameters
unpackedDataThe unpacked data.
originalHeaderThe original PE header.

◆ fixSectionHeaders()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixSectionHeaders ( const DynamicBuffer originalHeader)
private

Performs the section header fixing using original PE header. The section UPX0 is divided into smaller sections based on the section headers in the original PE header.

Parameters
originalHeaderThe original PE header.

◆ fixSizeOfSections()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixSizeOfSections ( const DynamicBuffer unpackedData)
private

Fixes the size of the sections in the unpacked output file. Raw size of section UPX0 is set to match its virtual size so unpacked data can be placed into it. It is also enlarged in case there is an overlap between UPX0 and UPX1 sections. UPX1 and UPX2/rsrc sections are removed from the unpacked file.

Parameters
unpackedDataThe unpacked data.

◆ fixTls()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::fixTls ( const DynamicBuffer originalHeader)
private

Performs fixing of TLS directory using original PE header. TLS directory data are already in the unpacked data, only directory RVA and size needs to be fixed.

Parameters
originalHeaderThe original PE header.

◆ getPackingMethod()

template<int bits>
std::uint8_t retdec::unpackertool::upx::PeUpxStub< bits >::getPackingMethod ( bool  trustMetadata) const
private

◆ getRealEpAddress()

template<int bits>
std::uint32_t retdec::unpackertool::upx::PeUpxStub< bits >::getRealEpAddress
overridevirtual

Returns the entry point address.

Returns
Entry point address.

Reimplemented from retdec::unpackertool::upx::UpxStub.

◆ loadResources()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::loadResources ( PeLib::ResourceNode rootNode,
std::uint32_t  offset,
std::uint32_t  uncompressedRsrcRva,
std::uint32_t  compressedRsrcRva,
const DynamicBuffer uncompressedRsrcs,
const DynamicBuffer unpackedData,
std::unordered_set< std::uint32_t > &  visitedNodes 
)
private

Loads all child resources from the node in the resource tree. Method is used to recursively load resources from the whole tree. Leaf nodes, which point directly to data, are loaded either from unpacked data or directly from uncompressed resources.

Parameters
rootNodeThe parent node from which to load resources.
offsetThe offset of the current node in the resource directory.
uncompressedRsrcRvaResource directory RVA in the packed file.
compressedRsrcRvaResource directory RVA in the unpacked file/the original file.
uncompressedRsrcsThe non-packed resources.
unpackedDataThe unpacked data.
visitedNodesThe set that contains already visited nodes in resource tree to avoid stack overflow.

◆ parseExtraData()

template<int bits>
UpxExtraData retdec::unpackertool::upx::PeUpxStub< bits >::parseExtraData ( DynamicBuffer unpackedData,
DynamicBuffer originalHeader 
)
private

Parses the extra data from the tail of the unpacked data. There are data such as offset to original PE header, offset to import hints, offset to relocations hints and lot more we don't use recently.

Parameters
unpackedDataThe unpacked data.
originalHeaderBuffer where to write original PE header.
Returns
UpxExtraData structure.

◆ prepare()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::prepare
private

Prepares the unpacking stub for unpacking.

◆ readPackedData()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::readPackedData ( DynamicBuffer packedData,
bool  trustMetadata 
)
virtual

Reads the packed data based on signature or metadata information.

Parameters
packedDataBuffer where to store packed data.
trustMetadataFalse if signature has more priority, otherwise metadata is prioritized.

◆ readPackedFileILT()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::readPackedFileILT ( DynamicBuffer ilt)
private

Reads the ILT (Import Lookup Table) of the packed file and stores it into retdec::utils::DynamicBuffer.

Parameters
iltBuffer where to store ILT.

◆ readUnpackingStub()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::readUnpackingStub ( DynamicBuffer unpackingStub)
virtual

Reads the unpacking stub (from EP up to the end of the EP section) and stores it into retdec::utils::DynamicBuffer.

Parameters
unpackingStubBuffer where to store unpacking stub.

◆ saveFile()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::saveFile ( const std::string &  outputFile,
DynamicBuffer unpackedData 
)
private

Saves the unpacked data to the output file.

Parameters
outputFilePath to the unpacked output file.
unpackedDataUnpacked data to write.

◆ setRealEpAddress()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::setRealEpAddress ( std::uint32_t  realEpAddress)

Sets the entry point address.

Parameters
realEpAddressEntry point address to set.

◆ setupPackingMethod()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::setupPackingMethod ( std::uint8_t  packingMethod)
virtual

Accepts the visitor-like decompressor and runs checking of packing method.

Parameters
packingMethodThe packing method to check.

◆ unfilterData()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::unfilterData ( DynamicBuffer unpackedData)
private

Performs unfiltering of unpacked data.

Parameters
unpackedDataThe unpacked data.

◆ unpack()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::unpack ( const std::string &  outputFile)
overridevirtual

Performs the whole process of unpacking. This is the method that is being run from UpxPlugin to start unpacking stub.

Parameters
outputFilePath to unpacked output file.

Implements retdec::unpacker::UnpackingStub.

◆ unpackData()

template<int bits>
void retdec::unpackertool::upx::PeUpxStub< bits >::unpackData ( DynamicBuffer unpackedData)
private

Member Data Documentation

◆ _coffSymbolTable

template<int bits>
std::vector<std::uint8_t> retdec::unpackertool::upx::PeUpxStub< bits >::_coffSymbolTable
private

COFF symbol table data if any exists.

◆ _exportsCompressed

template<int bits>
bool retdec::unpackertool::upx::PeUpxStub< bits >::_exportsCompressed
private

True if the exports are compressed in the packed file, otherwise false.

◆ _filterCount

template<int bits>
std::uint32_t retdec::unpackertool::upx::PeUpxStub< bits >::_filterCount
private

Number of jumps that are filtered.

◆ _filterId

template<int bits>
std::uint32_t retdec::unpackertool::upx::PeUpxStub< bits >::_filterId
private

ID of the used filter.

◆ _filterParam

template<int bits>
std::uint32_t retdec::unpackertool::upx::PeUpxStub< bits >::_filterParam
private

Parameter of the filter.

◆ _newPeFile

template<int bits>
PeLib::PeFileT* retdec::unpackertool::upx::PeUpxStub< bits >::_newPeFile
private

Unpacked output file.

◆ _realEpAddress

template<int bits>
std::uint32_t retdec::unpackertool::upx::PeUpxStub< bits >::_realEpAddress
protected

The real entry point address.

◆ _rvaShift

template<int bits>
std::uint32_t retdec::unpackertool::upx::PeUpxStub< bits >::_rvaShift
private

Size of sections UPX1 and UPX2 which are deleted and virtual addresses are shifted.

◆ _upx0Sect

template<int bits>
const retdec::loader::Segment* retdec::unpackertool::upx::PeUpxStub< bits >::_upx0Sect
protected

Pointer to section UPX0.


The documentation for this class was generated from the following files: