forked from thomasxm/shellcode
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathulz_depack_x86.asm
More file actions
110 lines (105 loc) · 2.48 KB
/
ulz_depack_x86.asm
File metadata and controls
110 lines (105 loc) · 2.48 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
;
; -----------------------------------------------
; ULZ depacker in x86 assembly
;
; size: 124 bytes
;
; global calls use cdecl convention
;
; -----------------------------------------------
bits 32
%ifndef BIN
global ulz_depackx
global _ulz_depackx
%endif
ulz_depackx:
_ulz_depackx:
pushad
lea esi, [esp+32+4]
lodsd
xchg ebx, eax ; ebx = inlen
lodsd
xchg edi, eax ; edi = outbuf
lodsd
xchg esi, eax ; esi = inbuf
add ebx, esi ; ebx += inbuf
ulz_main:
xor ecx, ecx
mul ecx
; while (in < end) {
cmp esi, ebx
jae ulz_exit
; token = *in++;
lodsb
; if(token >= 32) {
cmp al, 32
jb ulz_copy2
; len = token >> 5
mov cl, al
shr cl, 5
; if(len == 7)
cmp cl, 7
jne ulz_copy1
; len = add_mod(len, &in);
call add_mod
ulz_copy1:
; while(len--) *out++ = *in++;
rep movsb
; if(in >= end) break;
cmp esi, ebx
jae ulz_exit
ulz_copy2:
; len = (token & 15) + 4;
mov cl, al
and cl, 15
add cl, 4
; if(len == (15 + 4))
cmp cl, 15 + 4
jne ulz_copy3
; len = add_mod(len, &in);
call add_mod
ulz_copy3:
; dist = ((token & 16) << 12) + *(uint16_t*)in;
and al, 16
shl eax, 12
xchg eax, edx
; eax = *(uint16_t*)in;
; in += 2;
lodsw
add edx, eax
; p = out - dist
push esi
mov esi, edi
sub esi, edx
; while(len--) *out++ = *p++;
rep movsb
pop esi
jmp ulz_main
; }
ulz_exit:
; return (uint32_t)(out - (uint8_t*)outbuf);
sub edi, [esp+32+8]
mov [esp+28], edi
popad
ret
; static uint32_t add_mod(uint32_t x, uint8_t** p);
add_mod:
push eax ; save eax
xchg eax, ecx ; eax = len
xor ecx, ecx ; i = 0
am_loop:
mov dl, byte[esi] ; c = *(*p)++
inc esi
push edx ; save c
shl edx, cl ; x += (c << i)
add eax, edx
pop edx ; restore c
cmp dl, 128 ; if(c < 128) break;
jb am_exit
add cl, 7 ; i+=7
cmp cl, 21 ; i<=21
jbe am_loop
am_exit:
xchg eax, ecx ; ecx = len
pop eax ; restore eax
ret