retdec
pe_upx_stub.h
Go to the documentation of this file.
1 
7 #ifndef UNPACKERTOOL_PLUGINS_UPX_PE_PE_UPX_STUB_H
8 #define UNPACKERTOOL_PLUGINS_UPX_PE_PE_UPX_STUB_H
9 
10 #include <unordered_set>
11 
13 #include "retdec/pelib/PeFile.h"
16 
17 using namespace retdec::utils;
18 
19 namespace retdec {
20 namespace unpackertool {
21 namespace upx {
22 
31 {
33  std::uint32_t filterId;
34 };
35 
37 {
38 public:
39  UpxExtraData() : _importsOffset(0), _relocsOffset(0), _originalHeaderOffset(0), _relocsBigEndian(false) {}
40  UpxExtraData(const UpxExtraData& extraData)
41  : _importsOffset(extraData._importsOffset), _relocsOffset(extraData._relocsOffset), _originalHeaderOffset(extraData._originalHeaderOffset), _relocsBigEndian(extraData._relocsBigEndian) {}
42 
43  std::uint32_t getImportsOffset() const { return _importsOffset; }
44  void setImportsOffset(std::uint32_t importsOffset) { _importsOffset = importsOffset; }
45 
46  std::uint32_t getRelocationsOffset() const { return _relocsOffset; }
47  void setRelocationsOffset(std::uint32_t relocsOffset) { _relocsOffset = relocsOffset; }
48  bool areRelocationsBigEndian() const { return _relocsBigEndian; }
49  void setRelocationsBigEndian(bool set) { _relocsBigEndian = true; }
50 
51  std::uint32_t getOriginalHeaderOffset() const { return _originalHeaderOffset; }
52  void setOriginalHeaderOffset(std::uint32_t originalHeaderOffset) { _originalHeaderOffset = originalHeaderOffset; }
53 
54 private:
55  std::uint32_t _importsOffset;
56  std::uint32_t _relocsOffset;
57  std::uint32_t _originalHeaderOffset;
59 };
60 
64 template <int bits> class PeUpxStub : public UpxStub
65 {
66  public:
67 
68  PeUpxStub(retdec::loader::Image* inputFile, const UpxStubData* stubData, const DynamicBuffer& stubCapturedData,
69  std::unique_ptr<Decompressor> decompressor, const UpxMetadata& metadata);
70 
71  virtual void unpack(const std::string& ouputFile) override;
72  virtual void setupPackingMethod(std::uint8_t packingMethod);
73  virtual void readUnpackingStub(DynamicBuffer& unpackingStub);
74  virtual void readPackedData(DynamicBuffer& packedData, bool trustMetadata);
75  virtual void decompress(DynamicBuffer& packedData, DynamicBuffer& unpackedData, bool trustMetadata);
76  virtual void cleanup() override;
77 
78  virtual std::uint32_t getRealEpAddress() const override;
79  void setRealEpAddress(std::uint32_t realEpAddress);
80 
81 protected:
83  std::uint32_t _realEpAddress;
84 
85 private:
86  void prepare();
87  void detectUnfilter(const DynamicBuffer& unpackingStub);
88  void unpackData(DynamicBuffer& unpackedData);
89  void readPackedFileILT(DynamicBuffer& ilt);
90  void fixSizeOfSections(const DynamicBuffer& unpackedData);
91  UpxExtraData parseExtraData(DynamicBuffer& unpackedData, DynamicBuffer& originalHeader);
92  void fixPeHeader(const DynamicBuffer& originalHeader);
93  void unfilterData(DynamicBuffer& unpackedData);
94  void fixImports(const DynamicBuffer& unpackedData, const UpxExtraData& extraData, const DynamicBuffer& ilt);
95  void fixRelocations(DynamicBuffer& unpackedData, const UpxExtraData& extraData);
96  void fixTls(const DynamicBuffer& originalHeader);
97  void fixOep(const DynamicBuffer& originalHeader);
98  void fixExports(const DynamicBuffer& originalHeader);
99  void fixLoadConfiguration(const DynamicBuffer& originalHeader);
100  void fixResources(const DynamicBuffer& unpackedData, const DynamicBuffer& originalHeader);
101  void fixSectionHeaders(const DynamicBuffer& originalHeader);
102  void fixCoffSymbolTable();
103  void fixCertificates();
104  void cutHintsData(DynamicBuffer& unpackedData, const UpxExtraData& extraData);
105  void saveFile(const std::string& outputFile, DynamicBuffer& unpackedData);
106 
107  void loadResources(PeLib::ResourceNode* rootNode, std::uint32_t offset, std::uint32_t uncompressedRsrcRva, std::uint32_t compressedRsrcRva,
108  const DynamicBuffer& uncompressedRsrcs, const DynamicBuffer& unpackedData, std::unordered_set<std::uint32_t>& visitedNodes);
109  std::uint8_t getPackingMethod(bool trustMetadata) const;
110 
112  std::uint32_t _rvaShift;
114  std::vector<std::uint8_t> _coffSymbolTable;
115 
118  std::uint32_t _filterId;
119  std::uint32_t _filterCount;
120  std::uint32_t _filterParam;
122 };
123 
124 } // namespace upx
125 } // namespace unpackertool
126 } // namespace retdec
127 
128 #endif
std::unordered_set< Node > visitedNodes
Definition: cfg_traversal.cpp:46
Definition: PeFile.h:109
ResourceNodes represent the nodes in the resource tree.
Definition: ResourceDirectory.h:188
Definition: image.h:22
Definition: segment.h:25
Definition: signature.h:57
Definition: pe_upx_stub.h:65
std::uint32_t _filterCount
Number of jumps that are filtered.
Definition: pe_upx_stub.h:119
std::uint32_t _rvaShift
Size of sections UPX1 and UPX2 which are deleted and virtual addresses are shifted.
Definition: pe_upx_stub.h:112
std::uint32_t _realEpAddress
The real entry point address.
Definition: pe_upx_stub.h:83
PeLib::PeFileT * _newPeFile
Unpacked output file.
Definition: pe_upx_stub.h:111
bool _exportsCompressed
True if the exports are compressed in the packed file, otherwise false.
Definition: pe_upx_stub.h:113
std::vector< std::uint8_t > _coffSymbolTable
COFF symbol table data if any exists.
Definition: pe_upx_stub.h:114
const retdec::loader::Segment * _upx0Sect
Pointer to section UPX0.
Definition: pe_upx_stub.h:82
std::uint32_t _filterId
ID of the used filter.
Definition: pe_upx_stub.h:118
std::uint32_t _filterParam
Parameter of the filter.
Definition: pe_upx_stub.h:120
Definition: pe_upx_stub.h:37
UpxExtraData()
Definition: pe_upx_stub.h:39
std::uint32_t _relocsOffset
Definition: pe_upx_stub.h:56
void setRelocationsOffset(std::uint32_t relocsOffset)
Definition: pe_upx_stub.h:47
bool areRelocationsBigEndian() const
Definition: pe_upx_stub.h:48
void setOriginalHeaderOffset(std::uint32_t originalHeaderOffset)
Definition: pe_upx_stub.h:52
std::uint32_t _originalHeaderOffset
Definition: pe_upx_stub.h:57
std::uint32_t getImportsOffset() const
Definition: pe_upx_stub.h:43
bool _relocsBigEndian
Definition: pe_upx_stub.h:58
std::uint32_t getOriginalHeaderOffset() const
Definition: pe_upx_stub.h:51
void setImportsOffset(std::uint32_t importsOffset)
Definition: pe_upx_stub.h:44
void setRelocationsBigEndian(bool set)
Definition: pe_upx_stub.h:49
std::uint32_t getRelocationsOffset() const
Definition: pe_upx_stub.h:46
std::uint32_t _importsOffset
Definition: pe_upx_stub.h:55
UpxExtraData(const UpxExtraData &extraData)
Definition: pe_upx_stub.h:40
Definition: upx_stub.h:111
The class for dynamic buffered data manipulation taking the endianness of the data in account.
Definition: dynamic_buffer.h:36
Declaration of class for buffered data mainpulation.
Definition: unpacking_stub.h:16
Definition: archive_wrapper.h:19
void cleanup(ProgramOptions &po)
Definition: retdec-decompiler.cpp:910
retdec::unpacker::Signature * signature
Signature associated with the stub.
Definition: pe_upx_stub.h:32
std::uint32_t filterId
Used to store data specific for each type of stub.
Definition: pe_upx_stub.h:33
Definition: upx_stub_signatures.h:25
Declaration of class for matching signatures in executable files or buffers.
Declaration of abstract UPX stub class that represents the unpacking procedure itself.