daniel/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2026-06-16 15:59:24 +00:00
Code Issues Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
vxunderground
2020-10-09 21:56:39 -05:00
committed by GitHub
parent cb8e4ddb00
commit a5fc35f165
69 changed files with 14340 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/VirTool.Win32.Disassembler.4553_LDE.txt
+901
View File
@@ -0,0 +1,901 @@
/*
*
* ____| | | _) ___| |
* __| | _ \ __| __| __| _ \ __ \ | __|\___ \ _ \ | | | __|
* | | __/ ( | | ( | | | | ( | ( | | | |\__ \
* _____|_|\___|\___|\__|_| \___/ _| _|_|\___|_____/ \___/ \____|_|____/
*
* Presents
*
* [ 0x4553_LDE - 16/32-bit Length Disassembler Engine ]
*
* (c) Ares, 2003
*
*[-----------------------------------------------------------------------------------]
* Description:
* It based on ADE32 disassembler engine by z0mbie, modified and ported to AT&T asm.
*
* table.h - contain table of opcodes from 0x00 to 0xFF,
* it define the type of each other.
*
* Usage:
* There is the main function l_disasm(). It get one parameter from stack,
* which point to array with data. Return value reside in %eax - length of opcode.
*
* Example:
* ...
* mov data,%eax
* add $123,%eax # data[123]
* push %eax
* call l_disasm
* ...
*
* Section Headers:
* [Nr] Name Type Addr Off Size ES Flg Lk Inf Al
* [ 0] NULL 00000000 000000 000000 00 0 0 0
* [ 1] .text PROGBITS 08048074 000074 0002c2 00 AX 0 0 4
* [ 2] .data PROGBITS 08049380 000380 000800 00 WA 0 0 4
* ...
* = AA5(hex) = 2725(dec)
*
*[-----------------------------------------------------------------------------------]
*
* version: 1.0BETA
*
*/
.include "table.h"
.text
# little defines
diza = 12
buffer = -4
flag1 = -52
flag2 = -51
opcode = -53
t = -60
mod = -61
rm = -62
a = -68
b = -72
counter = -76
.globl l_disasm
l_disasm:
pushl %ebp
movl %esp,%ebp
movl 8(%ebp),%eax
movl %eax,buffer(%ebp) # buf
leal -48(%ebp),%eax # temp diza structure
movl %eax,diza(%ebp) # diza
movb $4,1(%eax) # filling structure
movb $4,(%eax)
movl $0,flag1(%ebp) # flag1 = 0
loop:
movl buffer(%ebp),%eax
movb (%eax),%dl
movb %dl,opcode(%ebp) # opcode
incl buffer(%ebp) # buf++;
movzbl opcode(%ebp),%eax
leal 0(,%eax,4),%edx
movl $op_tab,%eax
movl (%edx,%eax),%edx
movl %edx,t(%ebp) # t = op_tab[opcode]
movb t(%ebp),%al
andb $0xF8,%al
testb %al,%al
je check_opcode
movl flag1(%ebp),%eax
andl t(%ebp),%eax
testl %eax,%eax
jne return
movl t(%ebp),%edx
orl %edx,flag1(%ebp)
# prefix/mod/rm/flags/opcodes...checking
# no reason to comment all this stuff...
check_prefix:
movb t(%ebp),%al
test %esi,%esi
jne chp1
andb $0x10,%al
testb %al,%al
je chp1
jmp chpn
chp1:
movb t(%ebp),%al
incl %esi
andb $0x20,%al
testb %al,%al
je cp_sub2
chpn:
movl diza(%ebp),%eax
movl diza(%ebp),%edx
movb 1(%edx),%cl
xorb $6,%cl
movb %cl,1(%eax)
jmp loop
cp_sub2:
movb t(%ebp),%al
andb $0x80,%al
testb %al,%al
je cp_sub3
movl diza(%ebp),%eax
movb opcode(%ebp),%dl
movb %dl,21(%eax)
jmp loop
cp_sub3:
movb t(%ebp),%al
andb $0x40,%al
testb %al,%al
je loop
movl diza(%ebp),%eax
movb opcode(%ebp),%dl
movb %dl,20(%eax)
check_opcode:
movl t(%ebp),%eax
orl %eax,flag1(%ebp)
movl diza(%ebp),%eax
movb opcode(%ebp),%dl
movb %dl,22(%eax)
cmpb $15,opcode(%ebp)
jne co_sub1
movl buffer(%ebp),%ebx
movb (%ebx),%al
movb %al,opcode(%ebp)
incl buffer(%ebp)
movl diza(%ebp),%eax
movb opcode(%ebp),%dl
movb %dl,23(%eax)
movzbl opcode(%ebp),%eax
leal 256(%eax),%edx
leal 0(,%edx,4),%eax
movl $op_tab,%edx
movl (%eax,%edx),%ecx
orl %ecx,flag1(%ebp)
cmpl $-1,flag1(%ebp)
jne check_mod
jmp return
co_sub1:
cmpb $0xF7,opcode(%ebp)
jne co_sub2
movl buffer(%ebp),%eax
movb (%eax),%dl
andb $0x38,%dl
testb %dl,%dl
jne check_mod
orb $0x20,flag2(%ebp)
jmp check_mod
co_sub2:
cmpb $0xF6,opcode(%ebp)
jne check_mod
movl buffer(%ebp),%eax
movb (%eax),%dl
andb $0x38,%dl
testb %dl,%dl
jne check_mod
orb $1,flag2(%ebp)
check_mod:
movl flag1(%ebp),%eax
andl $0x4000,%eax
testl %eax,%eax
je checks_complete
movl buffer(%ebp),%edi
movb (%edi),%al
movb %al,opcode(%ebp)
incl buffer(%ebp)
movl diza(%ebp),%eax
movb opcode(%ebp),%dl
movb %dl,24(%eax)
movb opcode(%ebp),%al
andb $0x38,%al
cmpb $0x20,%al
jne cm_sub1
movl diza(%ebp),%eax
cmpb $0xFF,22(%eax)
jne cm_sub1
orb $4,-50(%ebp) # flag
cm_sub1:
movb opcode(%ebp),%al
andb $0xC0,%al
movb %al,mod(%ebp)
movb opcode(%ebp),%dl
andb $7,%dl
movb %dl,rm(%ebp)
cmpb $0xC0,mod(%ebp)
je checks_complete
movl diza(%ebp),%eax
cmpb $4,(%eax)
jne cm_sub5
cmpb $4,rm(%ebp)
jne cm_sub2
orb $8,flag2(%ebp)
movl buffer(%ebp),%edi
movb (%edi),%al
movb %al,opcode(%ebp)
incl buffer(%ebp)
movl diza(%ebp),%eax
movb opcode(%ebp),%dl
movb %dl,25(%eax)
movb opcode(%ebp),%cl
andb $7,%cl
movb %cl,rm(%ebp)
cm_sub2:
cmpb $0x40,mod(%ebp)
jne cm_sub3
orb $1,flag1(%ebp)
jmp checks_complete
cm_sub3:
cmpb $0x80,mod(%ebp)
jne cm_sub4
orb $4,flag1(%ebp)
jmp checks_complete
cm_sub4:
cmpb $5,rm(%ebp)
jne checks_complete
orb $4,flag1(%ebp)
jmp checks_complete
cm_sub5:
cmpb $0x40,mod(%ebp)
jne cm_sub6
orb $1,flag1(%ebp)
jmp checks_complete
cm_sub6:
cmpb $0x80,mod(%ebp)
jne cm_sub7
orb $2,flag1(%ebp)
jmp checks_complete
cm_sub7:
cmpb $6,rm(%ebp)
jne checks_complete
orb $2,flag1(%ebp)
checks_complete:
movl diza(%ebp),%eax
movl flag1(%ebp),%edx
movl %edx,8(%eax)
movl flag1(%ebp),%eax
andl $7,%eax
movl %eax,a(%ebp)
movl flag1(%ebp),%edx
andl $0x700,%edx
shrl $8,%edx
movl %edx,b(%ebp)
movl flag1(%ebp),%eax
andl $0x1000,%eax
testl %eax,%eax
je cc_sub1
movl diza(%ebp),%eax
movzbl (%eax),%edx
addl %edx,a(%ebp)
cc_sub1:
movl flag1(%ebp),%eax
andl $0x2000,%eax
testl %eax,%eax
je cc_sub2
movl diza(%ebp),%eax
movzbl 1(%eax),%edx
addl %edx,b(%ebp)
cc_sub2:
movl diza(%ebp),%eax
movl a(%ebp),%edx
movl %edx,diza(%eax)
movl diza(%ebp),%eax
movl b(%ebp),%edx
movl %edx,16(%eax)
movl $0,counter(%ebp)
cc_sub3:
movl counter(%ebp),%eax
cmpl a(%ebp),%eax
jnb cc_sub4
movl diza(%ebp),%edx
leal 28(%edx),%eax
movl counter(%ebp),%edx
movl buffer(%ebp),%ecx
movl %ecx,(%edx,%eax)
incl buffer(%ebp)
incl counter(%ebp)
jmp cc_sub3
cc_sub4:
movl $0,counter(%ebp)
cc_sub5:
movl counter(%ebp),%eax
cmpl b(%ebp),%eax
jnb cc_sub6
movl diza(%ebp),%edx
leal 36(%edx),%eax
movl counter(%ebp),%edx
movl buffer(%ebp),%ecx
movl %ecx,(%edx,%eax)
incl buffer(%ebp)
incl counter(%ebp)
jmp cc_sub5
cc_sub6:
movl buffer(%ebp),%eax
subl 8(%ebp),%eax
return:
leave
ret
/****************************************************
.include "0x4553_LDE.s"
.globl main
main:
push %ebp
mov %esp,%ebp
push $2
push $file
call open
mov %eax,fd
push $424
call malloc
mov %eax,data
push $424
push data
push fd
call read
mov data,%eax
add $0x74,%eax # entry point, first instruction - xor %eax,%eax
push %eax
call l_disasm
push %eax
push $l
call printf
call exit
l:.string"Lenght of instruction: %d\n"
file: .string "test"
.comm fd,4,4
.comm data,424,4
*****************************************************/
/****************************************************
table.h
.globl op_tab
.data
op_tab:
.long 16384 # 0x00
.long 16384 # 0x01
.long 16384 # 0x02
.long 16384 # ...
.long 256
.long 8192
.long 32768
.long 32768
.long 16384
.long 16384
.long 16384
.long 16384
.long 256
.long 8192
.long 32768
.long 65536
.long 49152
.long 16384
.long 49152
.long 16384
.long 33024
.long 40960
.long 32768
.long 32768
.long 49152
.long 16384
.long 16384
.long 16384
.long 33024
.long 40960
.long 32768
.long 32768
.long 16384
.long 16384
.long 16384
.long 16384
.long 256
.long 8192
.long 32896
.long 32768
.long 16384
.long 16384
.long 16384
.long 16384
.long 256
.long 8192
.long 32896
.long 32768
.long 16384
.long 16384
.long 16384
.long 16384
.long 256
.long 8192
.long 32896
.long 32768
.long 16384
.long 16384
.long 16384
.long 16384
.long 256
.long 8192
.long 32896
.long 32768
.long 0
.long 0
.long 0
.long 0
.long 32768
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 32768
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 0
.long 32768
.long 0
.long 0
.long 0
.long 32768
.long 32768
.long 49152
.long 49152
.long 128
.long 32896
.long 32
.long 16
.long 8192
.long 24576
.long 256
.long 16640
.long 32768
.long 32768
.long 32768
.long 32768
.long 164096
.long 164096
.long 131328
.long 131328
.long 131328
.long 131328
.long 131328
.long 131328
.long 131328
.long 131328
.long 164096
.long 164096
.long 131328
.long 131328
.long 131328
.long 131328
.long 16640
.long 24576
.long 49408
.long 16640
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 49152
.long 16384
.long 49152
.long 16384
.long 0
.long 0
.long 0
.long 32768
.long 32768
.long 32768
.long 32768
.long 32768
.long 32768
.long 0
.long 41472
.long 0
.long 32768
.long 32768
.long 32768
.long 32768
.long 4096
.long 4096
.long 4096
.long 4096
.long 0
.long 0
.long 0
.long 0
.long 256
.long 8192
.long 0
.long 0
.long 0
.long 32768
.long 0
.long 32768
.long 256
.long 256
.long 256
.long 256
.long 256
.long 256
.long 33024
.long 33024
.long 8192
.long 8192
.long 8192
.long 8192
.long 40960
.long 8192
.long 8192
.long 8192
.long 16640
.long 16640
.long 262656
.long 262144
.long 49152
.long 49152
.long 16640
.long 24576
.long 768
.long 0
.long 295424
.long 294912
.long 32768
.long 256
.long 32768
.long 294912
.long 16384
.long 16384
.long 16384
.long 16384
.long 33024
.long 33024
.long 32768
.long 32768
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 164096
.long 164096
.long 131328
.long 131328
.long 33024
.long 33024
.long 33024
.long 33024
.long 139264
.long 401408
.long 41472
.long 393472
.long 32768
.long 32768
.long 32768
.long 32768
.long 32776
.long 32768
.long 64
.long 64
.long 32768
.long 32768
.long 16384
.long 16384
.long 0
.long 0
.long 32768
.long 32768
.long 0
.long 0
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long -1
.long -1
.long 0
.long -1
.long 0
.long 0
.long 0
.long 0
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 139264
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 0
.long 0
.long 0
.long 16384
.long 16640
.long 16384
.long -1
.long -1
.long 0
.long 0
.long 0
.long 16384
.long 16640
.long 16384
.long -1
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long -1
.long -1
.long 16640
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long 16384
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long 0
.long 0
.long 0
.long 0
.long 0
.long 256
.long 0
.long 0
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1
.long -1 # 0xff
*****************************************************/