retdec
|
#include <pe_upx_stub.h>
Public Member Functions | |
PeUpxStub (retdec::loader::Image *inputFile, const UpxStubData *stubData, const DynamicBuffer &stubCapturedData, std::unique_ptr< Decompressor > decompressor, const UpxMetadata &metadata) | |
virtual void | unpack (const std::string &ouputFile) override |
virtual void | setupPackingMethod (std::uint8_t packingMethod) |
virtual void | readUnpackingStub (DynamicBuffer &unpackingStub) |
virtual void | readPackedData (DynamicBuffer &packedData, bool trustMetadata) |
virtual void | decompress (DynamicBuffer &packedData, DynamicBuffer &unpackedData, bool trustMetadata) |
virtual void | cleanup () override |
virtual std::uint32_t | getRealEpAddress () const override |
void | setRealEpAddress (std::uint32_t realEpAddress) |
![]() | |
UpxStub (retdec::loader::Image *inputFile, const UpxStubData *stubData, const DynamicBuffer &stubCapturedData, std::unique_ptr< Decompressor > decompressor, const UpxMetadata &metadata) | |
UpxStubVersion | getVersion () const |
const UpxStubData * | getStubData () const |
const DynamicBuffer * | getStubCapturedData () const |
Decompressor * | getDecompressor () const |
const UpxMetadata * | getUpxMetadata () const |
void | setStubData (const UpxStubData *stubData) |
void | setStubCapturedData (const DynamicBuffer &stubCapturedData) |
![]() | |
UnpackingStub (loader::Image *file) | |
virtual | ~UnpackingStub ()=default |
loader::Image * | getFile () |
Protected Attributes | |
const retdec::loader::Segment * | _upx0Sect |
Pointer to section UPX0. More... | |
std::uint32_t | _realEpAddress |
The real entry point address. More... | |
![]() | |
const UpxStubData * | _stubData |
Additional stub information. More... | |
DynamicBuffer | _stubCapturedData |
Data captured while matching signature of this stub. More... | |
std::unique_ptr< Decompressor > | _decompressor |
Decompressor associated with stub. More... | |
UpxMetadata | _metadata |
UPX metadata aka packheader. More... | |
![]() | |
loader::Image * | _file |
Private Member Functions | |
void | prepare () |
void | detectUnfilter (const DynamicBuffer &unpackingStub) |
void | unpackData (DynamicBuffer &unpackedData) |
void | readPackedFileILT (DynamicBuffer &ilt) |
void | fixSizeOfSections (const DynamicBuffer &unpackedData) |
UpxExtraData | parseExtraData (DynamicBuffer &unpackedData, DynamicBuffer &originalHeader) |
void | fixPeHeader (const DynamicBuffer &originalHeader) |
void | unfilterData (DynamicBuffer &unpackedData) |
void | fixImports (const DynamicBuffer &unpackedData, const UpxExtraData &extraData, const DynamicBuffer &ilt) |
void | fixRelocations (DynamicBuffer &unpackedData, const UpxExtraData &extraData) |
void | fixTls (const DynamicBuffer &originalHeader) |
void | fixOep (const DynamicBuffer &originalHeader) |
void | fixExports (const DynamicBuffer &originalHeader) |
void | fixLoadConfiguration (const DynamicBuffer &originalHeader) |
void | fixResources (const DynamicBuffer &unpackedData, const DynamicBuffer &originalHeader) |
void | fixSectionHeaders (const DynamicBuffer &originalHeader) |
void | fixCoffSymbolTable () |
void | fixCertificates () |
void | cutHintsData (DynamicBuffer &unpackedData, const UpxExtraData &extraData) |
void | saveFile (const std::string &outputFile, DynamicBuffer &unpackedData) |
void | loadResources (PeLib::ResourceNode *rootNode, std::uint32_t offset, std::uint32_t uncompressedRsrcRva, std::uint32_t compressedRsrcRva, const DynamicBuffer &uncompressedRsrcs, const DynamicBuffer &unpackedData, std::unordered_set< std::uint32_t > &visitedNodes) |
std::uint8_t | getPackingMethod (bool trustMetadata) const |
Private Attributes | |
PeLib::PeFileT * | _newPeFile |
Unpacked output file. More... | |
std::uint32_t | _rvaShift |
Size of sections UPX1 and UPX2 which are deleted and virtual addresses are shifted. More... | |
bool | _exportsCompressed |
True if the exports are compressed in the packed file, otherwise false. More... | |
std::vector< std::uint8_t > | _coffSymbolTable |
COFF symbol table data if any exists. More... | |
Data read from signatures. | |
std::uint32_t | _filterId |
ID of the used filter. More... | |
std::uint32_t | _filterCount |
Number of jumps that are filtered. More... | |
std::uint32_t | _filterParam |
Parameter of the filter. More... | |
Additional Inherited Members | |
![]() | |
static std::shared_ptr< UpxStub > | createStub (retdec::loader::Image *file) |
static std::shared_ptr< UpxStub > | createStub (retdec::loader::Image *file, const DynamicBuffer &stubBytes) |
![]() | |
std::unique_ptr< Decompressor > | decodePackingMethod (std::uint8_t packingMethod) const |
![]() | |
void | setFile (loader::Image *file) |
Basic unpacking stub class for unpacking files in PE format.
retdec::unpackertool::upx::PeUpxStub< bits >::PeUpxStub | ( | retdec::loader::Image * | inputFile, |
const UpxStubData * | stubData, | ||
const DynamicBuffer & | stubCapturedData, | ||
std::unique_ptr< Decompressor > | decompressor, | ||
const UpxMetadata & | metadata | ||
) |
Constructor.
inputFile | Packed input file. |
stubData | UpxStubData associated with this unpacking stub. |
stubCapturedData | Data captured from signature matching. |
decompressor | Associated decompressor with this unpacking stub. |
metadata | The UPX metadata associated with this unpacking stub. |
|
overridevirtual |
Performs releasing of owned resources.
Implements retdec::unpacker::UnpackingStub.
|
private |
Unpacked data contains the original file content and hints for unpacking. This method separates these data by erasing it from unpacked data and storing it in another buffer.
unpackedData | The unpacked data. |
extraData | UpxExtraData structure. |
|
virtual |
Decompresses the packed data and stores result in retdec::utils::DynamicBuffer.
packedData | Data to decompress. |
unpackedData | Buffer where to store the result. |
trustMetadata | False if signature has more priority, otherwise metadata is prioritized. |
|
private |
Detects used unfilter based on signature. If no signature is matched, UPX metadata are used if present in the file.
unpackingStub | The unpacking stub buffer. |
|
private |
Fixes certificate (security) directory in the unpacked file.
|
private |
Loads COFF symbol table if any exists into _coffSymbolTable
attribute and sets the pointer to the offset that equals to the sum of all raw sizes of the sections in the unpacked file.
|
private |
Performs fixing of exports directory using original PE header. This directory is used especially by DLLs. Export directory data are already in the unpacked data, only directory RVA and size needs to be fixed.
originalHeader | The original PE header. |
|
private |
Performs the import fixing based on the hints data and the packed file ILT (Import Lookup Table).
unpackedData | The unpacked data with hints. |
extraData | UpxExtraData structure. |
ilt | ILT of the packed file. |
|
private |
Performs fixing of Load Configuration directory using original PE header. This directory is used especially by MSVC compiler for security cookie. Load configuration directory data are already in the unpacked data, only directory RVA and size needs to be fixed.
originalHeader | The original PE header. |
|
private |
Performs fixing of OEP based on the value in original PE header.
originalHeader | The original PE header. |
|
private |
Fixes certain attributes in PE header.
originalHeader | Original PE header. |
|
private |
Performs fixing of relocations. Relocations are not fixed by reconstruction of relocation directory. Instead, they are fixed "in-place" and the file is marked as "RELOCS_STRIPPED". This tells the loader not to relocate the image base of the file at all. Data from hints are used to fix them.
unpackedData | The unpacked data. |
extraData | UpxExtraData structure. |
|
private |
Performs fixing of resources. Resources are very specific part of UPX since they can be either packed and unpacked simultaneously. The section UPX2 is usually renamed to rsrc and is populated with the new resource directory. The tree structure of the resources is mantained across the original and the packed file. Icons, manifest, version info etc. are not packed. They are put into new rsrc section. Resources that are packed are kept in its original place, so can be found in the unpacked data. This method builds the new resource tree combining the packed and non-packed resources.
unpackedData | The unpacked data. |
originalHeader | The original PE header. |
|
private |
Performs the section header fixing using original PE header. The section UPX0 is divided into smaller sections based on the section headers in the original PE header.
originalHeader | The original PE header. |
|
private |
Fixes the size of the sections in the unpacked output file. Raw size of section UPX0 is set to match its virtual size so unpacked data can be placed into it. It is also enlarged in case there is an overlap between UPX0 and UPX1 sections. UPX1 and UPX2/rsrc sections are removed from the unpacked file.
unpackedData | The unpacked data. |
|
private |
Performs fixing of TLS directory using original PE header. TLS directory data are already in the unpacked data, only directory RVA and size needs to be fixed.
originalHeader | The original PE header. |
|
private |
|
overridevirtual |
Returns the entry point address.
Reimplemented from retdec::unpackertool::upx::UpxStub.
|
private |
Loads all child resources from the node in the resource tree. Method is used to recursively load resources from the whole tree. Leaf nodes, which point directly to data, are loaded either from unpacked data or directly from uncompressed resources.
rootNode | The parent node from which to load resources. |
offset | The offset of the current node in the resource directory. |
uncompressedRsrcRva | Resource directory RVA in the packed file. |
compressedRsrcRva | Resource directory RVA in the unpacked file/the original file. |
uncompressedRsrcs | The non-packed resources. |
unpackedData | The unpacked data. |
visitedNodes | The set that contains already visited nodes in resource tree to avoid stack overflow. |
|
private |
Parses the extra data from the tail of the unpacked data. There are data such as offset to original PE header, offset to import hints, offset to relocations hints and lot more we don't use recently.
unpackedData | The unpacked data. |
originalHeader | Buffer where to write original PE header. |
|
private |
Prepares the unpacking stub for unpacking.
|
virtual |
Reads the packed data based on signature or metadata information.
packedData | Buffer where to store packed data. |
trustMetadata | False if signature has more priority, otherwise metadata is prioritized. |
|
private |
Reads the ILT (Import Lookup Table) of the packed file and stores it into retdec::utils::DynamicBuffer.
ilt | Buffer where to store ILT. |
|
virtual |
Reads the unpacking stub (from EP up to the end of the EP section) and stores it into retdec::utils::DynamicBuffer.
unpackingStub | Buffer where to store unpacking stub. |
|
private |
Saves the unpacked data to the output file.
outputFile | Path to the unpacked output file. |
unpackedData | Unpacked data to write. |
void retdec::unpackertool::upx::PeUpxStub< bits >::setRealEpAddress | ( | std::uint32_t | realEpAddress | ) |
Sets the entry point address.
realEpAddress | Entry point address to set. |
|
virtual |
Accepts the visitor-like decompressor and runs checking of packing method.
packingMethod | The packing method to check. |
|
private |
Performs unfiltering of unpacked data.
unpackedData | The unpacked data. |
|
overridevirtual |
Performs the whole process of unpacking. This is the method that is being run from UpxPlugin to start unpacking stub.
outputFile | Path to unpacked output file. |
Implements retdec::unpacker::UnpackingStub.
|
private |
|
private |
COFF symbol table data if any exists.
|
private |
True if the exports are compressed in the packed file, otherwise false.
|
private |
Number of jumps that are filtered.
|
private |
ID of the used filter.
|
private |
Parameter of the filter.
|
private |
Unpacked output file.
|
protected |
The real entry point address.
|
private |
Size of sections UPX1 and UPX2 which are deleted and virtual addresses are shifted.
|
protected |
Pointer to section UPX0.