public PkLiteUnpacker(MsdosImageLoader loader)
: base(loader.Services, loader.Filename, loader.RawImage)
{
var cfgSvc = Services.RequireService <IConfigurationService>();
this.arch = cfgSvc.GetArchitecture("x86-real-16");
platform = cfgSvc.GetEnvironment("ms-dos")
.Load(Services, arch);
uint pkLiteHdrOffset = (uint)(loader.ExeLoader.e_cparHeader * 0x10);
if (RawImage[pkLiteHdrOffset] != 0xB8)
{
throw new ApplicationException(string.Format("Expected MOV AX,XXXX at offset 0x{0:X4}.", pkLiteHdrOffset));
}
uint cparUncompressed = ByteMemoryArea.ReadLeUInt16(RawImage, pkLiteHdrOffset + 1);
abU = new byte[cparUncompressed * 0x10U];
if (RawImage[pkLiteHdrOffset + 0x04C] != 0x83)
{
throw new ApplicationException(string.Format("Expected ADD BX,+XX at offset 0x{0:X4}.", pkLiteHdrOffset + 0x04C));
}
uint offCompressedData = pkLiteHdrOffset + RawImage[pkLiteHdrOffset + 0x04E] * 0x10u - PspSize;
bitStm = new BitStream(RawImage, (int)offCompressedData);
}
private ImageLoader CreateDeferredLoader()
{
// The image may have been packed. We ask the unpacker service
// whether it can determine if the image is packed, and if so
// provide us with an image loader that knows how to do unpacking.
var loaderSvc = services.RequireService <IUnpackerService>();
uint?e_lfanew = LoadLfaToNewHeader();
if (e_lfanew.HasValue)
{
// It seems this file could have a new header.
if (IsPortableExecutable(e_lfanew.Value))
{
var peLdr = new PeImageLoader(services, Filename, base.RawImage, e_lfanew.Value);
uint peEntryPointOffset = peLdr.ReadEntryPointRva();
return(loaderSvc.FindUnpackerBySignature(peLdr, peEntryPointOffset));
}
else if (IsNewExecutable(e_lfanew.Value))
{
// http://support.microsoft.com/kb/65122
var neLdr = new NeImageLoader(services, Filename, base.RawImage, e_lfanew.Value);
return(neLdr);
}
}
// Fall back to loading real-mode MS-DOS program.
var msdosLoader = new MsdosImageLoader(this);
var msdosEntryPointOffset = (((e_cparHeader + e_cs) << 4) + e_ip) & 0xFFFFF;
return(loaderSvc.FindUnpackerBySignature(msdosLoader, (uint)msdosEntryPointOffset));
}
// Code inspired by unlzexe utility (unlzexe ver 0.8 (PC-VAN UTJ44266 Kou )
public LzExeUnpacker(MsdosImageLoader loader)
: base(loader.Services, loader.Filename, loader.RawImage)
{
var cfgSvc = Services.RequireService<IConfigurationService>();
this.arch = cfgSvc.GetArchitecture("x86-real-16");
this.platform = cfgSvc.GetEnvironment("ms-dos")
.Load(Services, arch);
Validate(loader.ExeLoader);
}
public ExePackLoader(MsdosImageLoader loader)
: base(loader.Services, loader.Filename, loader.RawImage)
{
var cfgSvc = Services.RequireService <IConfigurationService>();
arch = cfgSvc.GetArchitecture("x86-real-16") !;
platform = cfgSvc.GetEnvironment("ms-dos")
.Load(Services, arch);
var exe = loader.ExeLoader;
this.exeHdrSize = (uint)(exe.e_cparHeader * 0x10U);
this.hdrOffset = (uint)(exe.e_cparHeader + exe.e_cs) * 0x10U;
EndianImageReader rdr = new LeImageReader(RawImage, hdrOffset);
this.ip = rdr.ReadLeUInt16();
this.cs = rdr.ReadLeUInt16();
rdr.ReadLeUInt16();
this.cbExepackHeader = rdr.ReadLeUInt16();
this.sp = rdr.ReadLeUInt16();
this.ss = rdr.ReadLeUInt16();
this.cpUncompressed = rdr.ReadLeUInt16();
int offset = ExePackHeaderOffset(loader.ExeLoader);
if (ByteMemoryArea.CompareArrays(loader.RawImage, offset, signature, signature.Length))
{
relocationsOffset = 0x012D;
}
else if (ByteMemoryArea.CompareArrays(loader.RawImage, offset, signature2, signature2.Length))
{
relocationsOffset = 0x0125;
}
else
{
throw new ApplicationException("Not a recognized EXEPACK image.");
}
this.imgU = null !;
this.segmentMap = null !;
}