3921 | 3921 |
cmp ecx,-1
|
3922 | 3922 |
je merge_elf_header
|
3923 | 3923 |
mov eax,[ecx+8]
|
|
3924 |
mov ecx,[ecx+4]
|
|
3925 |
elf_segment_separated_base:
|
3924 | 3926 |
mov [ebx+8],eax
|
3925 | 3927 |
mov [ebx+0Ch],eax
|
3926 | |
mov ecx,[ecx+4]
|
3927 | 3928 |
mov [ebx+4],ecx
|
3928 | 3929 |
sub eax,ecx
|
3929 | 3930 |
add eax,edi
|
|
3932 | 3933 |
jmp elf_segment_addressing_setup
|
3933 | 3934 |
merge_elf_header:
|
3934 | 3935 |
mov eax,[image_base]
|
3935 | |
mov [ebx+8],eax
|
3936 | |
mov [ebx+0Ch],eax
|
3937 | |
and dword [ebx+4],0
|
3938 | |
add eax,edi
|
3939 | |
sub eax,[code_start]
|
3940 | |
xor edx,edx
|
3941 | |
jmp elf_segment_addressing_setup
|
|
3936 |
xor ecx,ecx
|
|
3937 |
jmp elf_segment_separated_base
|
3942 | 3938 |
close_elf_segment:
|
3943 | 3939 |
cmp [number_of_sections],0
|
3944 | 3940 |
jne finish_elf_segment
|
|
3962 | 3958 |
mov edx,edi
|
3963 | 3959 |
cmp edi,[undefined_data_end]
|
3964 | 3960 |
jne elf_segment_size_ok
|
|
3961 |
cmp byte [ebx],1
|
|
3962 |
jne elf_segment_size_ok
|
3965 | 3963 |
mov edi,[undefined_data_start]
|
3966 | 3964 |
elf_segment_size_ok:
|
3967 | 3965 |
mov [ebx+14h],eax
|
|
3970 | 3968 |
mov [ebx+10h],eax
|
3971 | 3969 |
and [undefined_data_end],0
|
3972 | 3970 |
mov eax,[ebx+8]
|
3973 | |
mov cl,[ebx]
|
3974 | |
cmp cl,3
|
|
3971 |
cmp byte [ebx],1
|
|
3972 |
je elf_segment_position_move_and_align
|
|
3973 |
cmp [merge_segment],0
|
|
3974 |
jne elf_segment_position_move
|
|
3975 |
cmp byte [ebx],3
|
3975 | 3976 |
ja elf_segment_position_ok
|
|
3977 |
mov [merge_segment],ebx
|
|
3978 |
elf_segment_position_move:
|
3976 | 3979 |
add eax,[ebx+14h]
|
3977 | |
cmp cl,1
|
3978 | |
je elf_segment_position_adjust
|
3979 | |
cmp [merge_segment],0
|
3980 | |
jne elf_segment_position_ok
|
3981 | |
mov [merge_segment],ebx
|
3982 | 3980 |
jmp elf_segment_position_ok
|
3983 | |
elf_segment_position_adjust:
|
|
3981 |
elf_segment_position_move_and_align:
|
|
3982 |
add eax,[ebx+14h]
|
3984 | 3983 |
add eax,0FFFh
|
3985 | 3984 |
elf_segment_position_ok:
|
3986 | 3985 |
and eax,not 0FFFh
|
|
4069 | 4068 |
je merge_elf64_header
|
4070 | 4069 |
mov eax,[ecx+10h]
|
4071 | 4070 |
mov edx,[ecx+10h+4]
|
|
4071 |
mov ecx,[ecx+8]
|
|
4072 |
elf64_segment_separated_base:
|
4072 | 4073 |
mov [ebx+10h],eax
|
4073 | 4074 |
mov [ebx+10h+4],edx
|
4074 | 4075 |
mov [ebx+18h],eax
|
4075 | 4076 |
mov [ebx+18h+4],edx
|
4076 | |
mov ecx,[ecx+8]
|
4077 | 4077 |
mov [ebx+8],ecx
|
4078 | 4078 |
neg ecx
|
4079 | 4079 |
add ecx,edi
|
|
4084 | 4084 |
merge_elf64_header:
|
4085 | 4085 |
mov eax,[image_base]
|
4086 | 4086 |
mov edx,[image_base_high]
|
4087 | |
mov [ebx+10h],eax
|
4088 | |
mov [ebx+10h+4],edx
|
4089 | |
mov [ebx+18h],eax
|
4090 | |
mov [ebx+18h+4],edx
|
4091 | |
and dword [ebx+8],0
|
4092 | |
mov ecx,edi
|
4093 | |
sub ecx,[code_start]
|
4094 | |
add eax,ecx
|
4095 | |
adc edx,0
|
4096 | |
jmp elf_segment_addressing_setup
|
|
4087 |
xor ecx,ecx
|
|
4088 |
jmp elf64_segment_separated_base
|
4097 | 4089 |
close_elf64_segment:
|
4098 | 4090 |
cmp [number_of_sections],0
|
4099 | 4091 |
jne finish_elf64_segment
|
|
4118 | 4110 |
mov edx,edi
|
4119 | 4111 |
cmp edi,[undefined_data_end]
|
4120 | 4112 |
jne elf64_segment_size_ok
|
|
4113 |
cmp byte [ebx],1
|
|
4114 |
jne elf64_segment_size_ok
|
4121 | 4115 |
mov edi,[undefined_data_start]
|
4122 | 4116 |
elf64_segment_size_ok:
|
4123 | 4117 |
mov [ebx+28h],eax
|
|
4127 | 4121 |
and [undefined_data_end],0
|
4128 | 4122 |
mov eax,[ebx+10h]
|
4129 | 4123 |
mov edx,[ebx+10h+4]
|
4130 | |
mov cl,[ebx]
|
4131 | |
cmp cl,3
|
|
4124 |
cmp byte [ebx],1
|
|
4125 |
je elf64_segment_position_move_and_align
|
|
4126 |
cmp [merge_segment],0
|
|
4127 |
jne elf64_segment_position_move
|
|
4128 |
cmp byte [ebx],3
|
4132 | 4129 |
ja elf64_segment_position_ok
|
|
4130 |
mov [merge_segment],ebx
|
|
4131 |
elf64_segment_position_move:
|
4133 | 4132 |
add eax,[ebx+28h]
|
4134 | 4133 |
adc edx,0
|
4135 | |
cmp cl,1
|
4136 | |
je elf64_segment_position_adjust
|
4137 | |
cmp [merge_segment],0
|
4138 | |
jne elf64_segment_position_ok
|
4139 | |
mov [merge_segment],ebx
|
4140 | 4134 |
jmp elf64_segment_position_ok
|
4141 | |
elf64_segment_position_adjust:
|
|
4135 |
elf64_segment_position_move_and_align:
|
|
4136 |
add eax,[ebx+28h]
|
|
4137 |
adc edx,0
|
4142 | 4138 |
add eax,0FFFh
|
4143 | 4139 |
adc edx,0
|
4144 | 4140 |
elf64_segment_position_ok:
|