2 * Copyright (c) 2015 Kai Wang
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 ELFTC_VCSID("$Id: libpe_rich.c 3312 2016-01-10 09:23:51Z kaiwang27 $");
37 memfind(char *s, const char *find, size_t slen, size_t flen)
41 if (slen == 0 || flen == 0 || flen > slen)
44 for (i = 0; (size_t) i <= slen - flen; i++) {
49 if (memcmp(&s[i + 1], &find[1], flen - 1) == 0)
57 libpe_parse_rich_header(PE *pe)
64 assert(pe->pe_stub != NULL && pe->pe_stub_ex > 0);
66 /* Search for the "Rich" keyword to locate the Rich header. */
67 s = pe->pe_stub + sizeof(PE_DosHdr);
68 r = memfind(s, PE_RICH_TEXT, pe->pe_stub_ex, 4);
69 if (r == NULL || r + 8 > s + pe->pe_stub_ex) {
74 if ((rh = calloc(1, sizeof(*rh))) == NULL) {
79 rh->rh_xor = le32dec(r + 4); /* Retrieve the "XOR mask" */
82 * Search for the hidden keyword "DanS" by XOR the dwords before
83 * the "Rich" keyword with the XOR mask.
86 for (p = r - 4; p >= s; p -= 4) {
87 x = le32dec(p) ^ rh->rh_xor;
88 if (x == PE_RICH_HIDDEN) {
100 * Found the "DanS" keyword, which is the start of the Rich header.
101 * The next step is to skip the first 16 bytes (DanS, XOR mask,
102 * XOR mask, XOR mask) and read the (compid,cnt) tuples.
106 rh->rh_total = (r - p) / 8;
107 if ((rh->rh_compid = malloc(rh->rh_total * sizeof(*rh->rh_compid))) ==
113 if ((rh->rh_cnt = malloc(rh->rh_total * sizeof(*rh->rh_cnt))) ==
120 for (i = 0; (uint32_t) i < rh->rh_total; i++, p += 8) {
121 rh->rh_compid[i] = le32dec(p) ^ rh->rh_xor;
122 rh->rh_cnt[i] = le32dec(p + 4) ^ rh->rh_xor;