public PkLiteUnpacker(MsdosImageLoader loader) : base(loader.Services, loader.Filename, loader.RawImage) { var cfgSvc = Services.RequireService <IConfigurationService>(); this.arch = cfgSvc.GetArchitecture("x86-real-16"); platform = cfgSvc.GetEnvironment("ms-dos") .Load(Services, arch); uint pkLiteHdrOffset = (uint)(loader.ExeLoader.e_cparHeader * 0x10); if (RawImage[pkLiteHdrOffset] != 0xB8) { throw new ApplicationException(string.Format("Expected MOV AX,XXXX at offset 0x{0:X4}.", pkLiteHdrOffset)); } uint cparUncompressed = ByteMemoryArea.ReadLeUInt16(RawImage, pkLiteHdrOffset + 1); abU = new byte[cparUncompressed * 0x10U]; if (RawImage[pkLiteHdrOffset + 0x04C] != 0x83) { throw new ApplicationException(string.Format("Expected ADD BX,+XX at offset 0x{0:X4}.", pkLiteHdrOffset + 0x04C)); } uint offCompressedData = pkLiteHdrOffset + RawImage[pkLiteHdrOffset + 0x04E] * 0x10u - PspSize; bitStm = new BitStream(RawImage, (int)offCompressedData); }
private ImageLoader CreateDeferredLoader() { // The image may have been packed. We ask the unpacker service // whether it can determine if the image is packed, and if so // provide us with an image loader that knows how to do unpacking. var loaderSvc = services.RequireService <IUnpackerService>(); uint?e_lfanew = LoadLfaToNewHeader(); if (e_lfanew.HasValue) { // It seems this file could have a new header. if (IsPortableExecutable(e_lfanew.Value)) { var peLdr = new PeImageLoader(services, Filename, base.RawImage, e_lfanew.Value); uint peEntryPointOffset = peLdr.ReadEntryPointRva(); return(loaderSvc.FindUnpackerBySignature(peLdr, peEntryPointOffset)); } else if (IsNewExecutable(e_lfanew.Value)) { // http://support.microsoft.com/kb/65122 var neLdr = new NeImageLoader(services, Filename, base.RawImage, e_lfanew.Value); return(neLdr); } } // Fall back to loading real-mode MS-DOS program. var msdosLoader = new MsdosImageLoader(this); var msdosEntryPointOffset = (((e_cparHeader + e_cs) << 4) + e_ip) & 0xFFFFF; return(loaderSvc.FindUnpackerBySignature(msdosLoader, (uint)msdosEntryPointOffset)); }
// Code inspired by unlzexe utility (unlzexe ver 0.8 (PC-VAN UTJ44266 Kou ) public LzExeUnpacker(MsdosImageLoader loader) : base(loader.Services, loader.Filename, loader.RawImage) { var cfgSvc = Services.RequireService<IConfigurationService>(); this.arch = cfgSvc.GetArchitecture("x86-real-16"); this.platform = cfgSvc.GetEnvironment("ms-dos") .Load(Services, arch); Validate(loader.ExeLoader); }
public ExePackLoader(MsdosImageLoader loader) : base(loader.Services, loader.Filename, loader.RawImage) { var cfgSvc = Services.RequireService <IConfigurationService>(); arch = cfgSvc.GetArchitecture("x86-real-16") !; platform = cfgSvc.GetEnvironment("ms-dos") .Load(Services, arch); var exe = loader.ExeLoader; this.exeHdrSize = (uint)(exe.e_cparHeader * 0x10U); this.hdrOffset = (uint)(exe.e_cparHeader + exe.e_cs) * 0x10U; EndianImageReader rdr = new LeImageReader(RawImage, hdrOffset); this.ip = rdr.ReadLeUInt16(); this.cs = rdr.ReadLeUInt16(); rdr.ReadLeUInt16(); this.cbExepackHeader = rdr.ReadLeUInt16(); this.sp = rdr.ReadLeUInt16(); this.ss = rdr.ReadLeUInt16(); this.cpUncompressed = rdr.ReadLeUInt16(); int offset = ExePackHeaderOffset(loader.ExeLoader); if (ByteMemoryArea.CompareArrays(loader.RawImage, offset, signature, signature.Length)) { relocationsOffset = 0x012D; } else if (ByteMemoryArea.CompareArrays(loader.RawImage, offset, signature2, signature2.Length)) { relocationsOffset = 0x0125; } else { throw new ApplicationException("Not a recognized EXEPACK image."); } this.imgU = null !; this.segmentMap = null !; }