Kerpack - disassembled, rewrited and corrected for FASM

git-svn-id: svn://kolibrios.org@1712 a494cfbc-eb01-0410-851d-a64ba20cac60
This commit is contained in:
Marat Zakiyanov (Mario79) 2010-12-01 20:02:47 +00:00
parent 8020de982d
commit 843504d669
7 changed files with 4288 additions and 0 deletions

View File

@ -0,0 +1,7 @@
@fasm -m 16384 kerpack.asm kerpack
@kpack kerpack
@pause

View File

@ -0,0 +1,13 @@
#!/bin/bash
# This script does for linux the same as build.bat for DOS,
# it compiles the KoOS kernel, hopefully ;-)
echo "lang fix en"
echo "lang fix en" > lang.inc
fasm -m 16384 kerpack.asm kerpack
rm -f lang.inc
exit 0

View File

@ -0,0 +1,32 @@
pop esi
push esi
loader_patch4:
mov ecx, 0 ; will be patched: number of calltrick entries
ctrloop:
lodsb
@@:
cmp al, 0xF
jnz .f
lodsb
cmp al, 80h
jb @b
cmp al, 90h
jb @f
.f:
sub al, 0E8h
cmp al, 1
ja ctrloop
@@:
cmp byte [esi], 0 ; will be patched: code in calltrick entries
loader_patch5:
jnz ctrloop
lodsd
; "bswap eax" is not supported on i386
; mov al,0/bswap eax = 4 bytes, following instructions = 9 bytes
shr ax, 8
ror eax, 16
xchg al, ah
sub eax, esi
add eax, [esp]
mov [esi-4], eax
loop ctrloop

View File

@ -0,0 +1,417 @@
; Kolibri kernel packer
; (C) copyright diamond 2006, 2007
;
; Disassemled and corrected in 2010 specially for FASM
; by Marat Zakiyanov aka Mario79, aka Mario
;
; This program is free software; you can redistribute it and/or modify
; it under the terms of the GNU General Public License as published by
; the Free Software Foundation; either version 2 of the License, or
; (at your option) any later version.
;
; This program is distributed in the hope that it will be useful,
; but WITHOUT ANY WARRANTY; without even the implied warranty of
; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
; GNU General Public License for more details.
; Uses LZMA compression library by Igor Pavlov
; (for more information on LZMA and 7-Zip visit http://www.7-zip.org)
; (plain-C packer is ported by diamond)
;---------------------------------------------------------------------
use32
org 0
db 'MENUET01'
dd 1
dd START
dd IM_END
dd I_END
dd stacktop
dd 0 ;params
dd 0 ;cur_dir_path
;---------------------------------------------------------------------
include '../../../macros.inc'
; do not touch "purge mov"!!!
purge mov ; for the correct patch of loader
; do not touch "purge mov"!!!
;*********************************************************************
die_with_err:
pop esi
@@:
lodsb
test al,al
jz @f
mov cl,al
mcall 63,1
jmp @b
;*********************************************************************
@@:
mcall 63,,13
mcall ,,10
mcall -1
;*********************************************************************
START:
mcall 70,fn70_read
cmp eax,6
jz read_ok
;--------------------------------------
read_err:
call die_with_err
db 'KerPack: cannot load kernel.mnt',0
;*********************************************************************
read_ok:
push 18
call lzma_set_dict_size
; find jump to 32-bit code
mov edi,infile - 1
;--------------------------------------
@@:
inc edi
cmp dword [edi],0xE88EE08E ; mov fs,ax/mov gs,ax
jnz @b
cmp dword [edi+4],0x00BCD08E ; mov ss,ax/mov esp,00xxxxxx
jnz @b
add edi,11
mov [inptr],edi
sub edi, infile
mov [indelta],edi
lea eax,[ebx+0x10000]
mov dword [loader_patch3+2],eax
sub ebx,edi
mov [insize],ebx
call preprocess_calltrick2
mov al,[cti]
mov [loader_patch5-1],al
mov eax,[ctn]
mov [loader_patch4+1],eax
mov eax,[inptr]
add eax, outfile - infile + loader_size - 5
push workmem
push [insize]
push eax
push [inptr]
call lzma_compress
add eax, loader_size-5
mov [loader_patch1+6],eax
add eax,[indelta]
mov [outsize],eax
mov eax,[indelta]
mov ecx,dword [eax + outfile + loader_size - 4]
bswap ecx
mov [loader_patch2+4],ecx
add eax, 0x10000
mov [loader_patch1+1],eax
mov esi,infile
mov edi,outfile
mov ecx,[indelta]
rep movsb
mov esi,loader_start
mov ecx,loader_size
rep movsb
mcall 70,fn70_write
test eax,eax
jz @f
call die_with_err
db 'KerPack: cannot save kernel.mnt',0
;*********************************************************************
@@:
call die_with_err
db 'KerPack: all is OK',0
;*********************************************************************
preprocess_calltrick2:
; input preprocessing
mov edi,ct1
xor eax,eax
push edi
mov ecx,256/4
rep stosd
pop edi
mov ecx,ebx
mov esi,[inptr]
mov ebx,inbuftmp
xchg eax,edx
;--------------------------------------
input_pre2:
lodsb
;--------------------------------------
@@:
cmp al,0Fh
jnz ip1
dec ecx
jz input_pre_done2
lodsb
cmp al,80h
jb @b
cmp al,90h
jb @f
;--------------------------------------
ip1:
sub al,0E8h
cmp al,1
ja input_pre_cont2
;--------------------------------------
@@:
cmp ecx,5
jb input_pre_done2
lodsd
add eax,esi
sub eax,[inptr]
cmp eax,[insize]
jae xxx2
cmp eax,1000000h
jae xxx2
sub ecx,4
xchg al,ah
rol eax,16
xchg al,ah
mov [esi-4],eax
inc edx
mov [ebx],esi
add ebx,4
jmp input_pre_cont2
;*********************************************************************
xxx2:
sub esi,4
movzx eax,byte [esi]
mov byte [eax+edi],1
;--------------------------------------
input_pre_cont2:
loop input_pre2
;--------------------------------------
input_pre_done2:
mov [ctn],edx
xor eax,eax
mov ecx,256
repnz scasb
jnz pack_calltrick_done
not cl
mov [cti],cl
;--------------------------------------
@@:
cmp ebx,inbuftmp
jz pack_calltrick_done
sub ebx,4
mov eax,[ebx]
mov [eax-4],cl
jmp @b
;*********************************************************************
pack_calltrick_done:
ret
;*********************************************************************
;lzma_compress:
include 'lzma_compress.inc'
;---------------------------------------------------------------------
;lzma_set_dict_size:
include 'lzma_set_dict_size.inc'
;---------------------------------------------------------------------
;
include 'loader_lzma.inc'
;*********************************************************************
fn70_read:
dd 0
dd 0
dd 0
dd 200*1024
dd infile
filename db '/rd/1/kernel.mnt',0
fn70_write:
dd 2
dd 0
dd 0
outsize dd ?
dd outfile
db 0
dd filename
;---------------------------------------------------------------------
align 4
LiteralNextStates:
db 0,0,0,0,1,2,3,4,5,6,4,5
MatchNextStates:
db 7,7,7,7,7,7,7,10,10,10,10,10
RepNextStates:
db 8,8,8,8,8,8,8,11,11,11,11,11
ShortRepNextStates:
db 9,9,9,9,9,9,9,11,11,11,11,11
;---------------------------------------------------------------------
;*********************************************************************
IM_END:
;*********************************************************************
;params:
; rb 256
;---------------------------------------------------------------------
;cur_dir_path:
; rb 4096
;---------------------------------------------------------------------
align 4
rb 4096
stacktop:
;---------------------------------------------------------------------
align 4
inptr dd ?
indelta dd ?
insize dd ?
ct1 rb 256
ctn dd ?
cti db ?
infile rb 200*1024
inbuftmp rb 200*1024
outfile rb 200*1024
workmem rb 6A8000h
;---------------------------------------------------------------------
; Compress data area start
;---------------------------------------------------------------------
align 4
_lenEncoder:
rd 8451
;-----------------------------------------------------
_prices:
rd 4384
rd 17
;-----------------------------------------------------
_finished: rb 1
_writeEndMark: rb 1
_longestMatchWasFound: rb 1
_previousByte: rb 1
_longestMatchLength: rd 1
;-----------------------------------------------------
g_FastPos:
rb 1024
;-----------------------------------------------------
_posSlotPrices:
rd 256
;-----------------------------------------------------
_isRep0Long:
rd 192
;-----------------------------------------------------
distances:
rd 274
;-----------------------------------------------------
_optimumCurrentIndex: rd 1
_additionalOffset: rd 1
;-----------------------------------------------------
_isRepG1:
rd 12
;-----------------------------------------------------
_isMatch:
rd 192
;-----------------------------------------------------
_alignPriceCount: rd 1
_numLiteralContextBits: rd 1
;-----------------------------------------------------
_literalEncoder:
rd 114
;-----------------------------------------------------
nowPos64:
rd 2
;-----------------------------------------------------
_distancesPrices:
rd 512
;-----------------------------------------------------
_repDistances:
rd 4
;-----------------------------------------------------
_posSlotEncoder:
rd 1028
;-----------------------------------------------------
lastPosSlotFillingPos:
rd 2
;-----------------------------------------------------
_numFastBytes: rd 1
_posStateMask: rd 1
;-----------------------------------------------------
_isRepG0:
rd 12
;-----------------------------------------------------
_repMatchLenEncoder:
rd 8451
rd 4384
rd 17
;-----------------------------------------------------
_isRepG2:
rd 12
;-----------------------------------------------------
_dictionarySize: rd 1
_numLiteralPosStateBits: rd 1
_distTableSize: rd 1
_optimumEndIndex: rd 1
;-----------------------------------------------------
;static CState state
state.State: rb 1
state.Prev1IsChar: rb 1
state.Prev2: rb 2
state.PosPrev2: rd 1
state.BackPrev2: rd 1
state.Price: rd 1
state.PosPrev: rd 1
state.BackPrev: rd 1
state.Backs:
rd 4
;----------------------------------------------------
rd 40950
;-----------------------------------------------------
_alignPrices:
rd 16
;-----------------------------------------------------
_isRep:
rd 12
;-----------------------------------------------------
_posAlignEncoder:
rd 256
;-----------------------------------------------------
i_01: rd 1
;-----------------------------------------------------
_state: rb 1
_cache: rb 1
_state.Prev2: rb 2
_posEncoders: rd 1
_numPrevBits: rd 1
_numPosBits: rd 1
_posMask: rd 1
_posStateBits: rd 1
_range: rd 1
_cacheSize: rd 1
_cyclicBufferSize: rd 1
;-----------------------------------------------------
low:
rd 2
;-----------------------------------------------------
Models:
rd 512
;-----------------------------------------------------
_matchMaxLen: rd 1
pack_pos: rd 1
_cutValue: rd 1
_hash: rd 1
;-----------------------------------------------------
crc_table:
rd 256
;-----------------------------------------------------
_buffer: rd 1
_pos: rd 1
_streamPos: rd 1
pack_length: rd 1
;---------------------------------------------------------------------
; Compress data area end
;---------------------------------------------------------------------
I_END:
;---------------------------------------------------------------------

View File

@ -0,0 +1,459 @@
loader_start:
; start address; this code will be injected after the init code
; (some commands below "B32" in the kernel)
mov edi, 0x280000
lea ebx, [edi+loader_size1+16]
lea edx, [ebx+4]
loader_patch1:
mov esi, 0 ; will be patched: start address to copy
mov ecx, 0 ; will be patched: size of data to copy
push esi
rep movsb
jmp edx
loader_size1 = $ - loader_start
loader_patch2:
dd 0x280000 + loader_size
dd 0 ; will be patched: start value for code
; (LZMA-specific)
dd -1
dd _RangeDecoderBitDecode_edx - loader_start + 0x280000
dd _RangeDecoderBitDecode - loader_start + 0x280000
RangeDecoderBitDecode equ dword [ebx]
RangeDecoderBitDecode_edx equ dword [ebx-4]
code_ equ ebx-12
range equ ebx-8
rep1 equ ebx-28
rep2 equ ebx-24
rep3 equ ebx-20
inptr_ldr equ ebx-16
pb equ 2 ; pos state bits
lp equ 0 ; literal pos state bits
lc equ 3 ; literal context bits
posStateMask equ ((1 shl pb)-1)
literalPosMask equ ((1 shl lp)-1)
kNumPosBitsMax = 4
kNumPosStatesMax = (1 shl kNumPosBitsMax)
kLenNumLowBits = 3
kLenNumLowSymbols = (1 shl kLenNumLowBits)
kLenNumMidBits = 3
kLenNumMidSymbols = (1 shl kLenNumMidBits)
kLenNumHighBits = 8
kLenNumHighSymbols = (1 shl kLenNumHighBits)
LenChoice = 0
LenChoice2 = 1
LenLow = 2
LenMid = (LenLow + (kNumPosStatesMax shl kLenNumLowBits))
LenHigh = (LenMid + (kNumPosStatesMax shl kLenNumMidBits))
kNumLenProbs = (LenHigh + kLenNumHighSymbols)
kNumStates = 12
kNumLitStates = 7
kStartPosModelIndex = 4
kEndPosModelIndex = 14
kNumFullDistances = (1 shl (kEndPosModelIndex/2))
kNumPosSlotBits = 6
kNumLenToPosStates = 4
kNumAlignBits = 4
kAlignTableSize = (1 shl kNumAlignBits)
kMatchMinLen = 2
IsMatch = 0
IsRep = 0xC0 ; (IsMatch + (kNumStates shl kNumPosBitsMax))
IsRepG0 = 0xCC ; (IsRep + kNumStates)
IsRepG1 = 0xD8 ; (IsRepG0 + kNumStates)
IsRepG2 = 0xE4 ; (IsRepG1 + kNumStates)
IsRep0Long = 0xF0 ; (IsRepG2 + kNumStates)
PosSlot = 0x1B0 ; (IsRep0Long + (kNumStates shl kNumPosBitsMax))
SpecPos = 0x2B0 ; (PosSlot + (kNumLenToPosStates shl kNumPosSlotBits))
Align_ = 0x322 ; (SpecPos + kNumFullDistances - kEndPosModelIndex)
Lencoder = 0x332 ; (Align_ + kAlignTableSize)
RepLencoder = 0x534 ; (Lencoder + kNumLenProbs)
Literal = 0x736 ; (RepLencoder + kNumLenProbs)
LZMA_BASE_SIZE = 1846 ; must be ==Literal
LZMA_LIT_SIZE = 768
kNumTopBits = 24
kTopValue = (1 shl kNumTopBits)
kNumBitModelTotalBits = 11
kBitModelTotal = (1 shl kNumBitModelTotalBits)
kNumMoveBits = 5
uninit_base = 2C0000h
p = uninit_base
unpacker:
xor ebp, ebp
xor eax, eax
dec eax
lea edi, [rep1]
stosd
stosd
stosd
xchg eax, esi
; mov ecx, Literal + (LZMA_LIT_SIZE shl (lc+lp))
mov ch, (Literal + (LZMA_LIT_SIZE shl (lc+lp)) + 0xFF) shr 8
mov eax, kBitModelTotal/2
mov edi, p
rep stosd
pop edi
push edi
loader_patch3:
.main_loop:
cmp edi, dword 0 ; will be patched: end of data to unpack
jae .main_loop_done
if posStateMask
mov edx, edi
and edx, posStateMask
else
xor edx, edx
end if
push eax ; al = previous byte
lea eax, [ebp + ((p+IsMatch*4) shr (kNumPosBitsMax+2))]
shl eax, kNumPosBitsMax+2
if posStateMask
call RangeDecoderBitDecode_edx
else
call RangeDecoderBitDecode
end if
pop eax
jc .1
movzx eax, al
if literalPosMask
mov ah, dl
and ah, literalPosMask
end if
if ((LZMA_LIT_SIZE*4) and ((1 shl (8-lc)) - 1)) <> 0
shr eax, 8-lc
imul eax, LZMA_LIT_SIZE*4
else
and al, not ((1 shl (8-lc)) - 1)
imul eax, (LZMA_LIT_SIZE*4) shr (8-lc)
end if
add eax, p+Literal*4
mov dl, 1
cmp ebp, kNumLitStates
jb .literal
mov cl, [edi + esi]
;--------------------------------------
.lx0:
add cl, cl
adc dh, 1
call RangeDecoderBitDecode_edx
adc dl, dl
jc .lx1
xor dh, dl
test dh, 1
mov dh, 0
jnz .lx0
;--------------------------------------
.literal:
@@:
call RangeDecoderBitDecode_edx
adc dl, dl
jnc @b
;--------------------------------------
.lx1:
mov eax, ebp
cmp al, 4
jb @f
cmp al, 10
mov al, 3
jb @f
mov al, 6
@@:
sub ebp, eax
xchg eax, edx
;--------------------------------------
.stosb_main_loop:
stosb
jmp .main_loop
;*********************************************************************
.1:
lea eax, [p + IsRep*4 + ebp*4]
call RangeDecoderBitDecode
jnc .10
add eax, (IsRepG0 - IsRep)*4 ;lea eax, [p + IsRepG0*4 + ebp*4]
call RangeDecoderBitDecode
jc .111
mov eax, ebp
shl eax, kNumPosBitsMax+2
add eax, p + IsRep0Long*4
call RangeDecoderBitDecode_edx
jc .1101
cmp ebp, 7
sbb ebp, ebp
lea ebp, [ebp+ebp+11]
mov al, [edi + esi]
jmp .stosb_main_loop
;*********************************************************************
.111:
add eax, (IsRepG1 - IsRepG0) * 4 ;lea eax, [p + IsRepG1*4 + ebp*4]
call RangeDecoderBitDecode
xchg esi, [rep1]
jnc @f
add eax, (IsRepG2 - IsRepG1) * 4 ;lea eax, [p + IsRepG2*4 + ebp*4]
call RangeDecoderBitDecode
xchg esi, [rep2]
jnc @f
xchg esi, [rep3]
;--------------------------------------
@@:
.1101:
mov eax, p + RepLencoder*4
call LzmaLenDecode
push 8
jmp .rmu
;*********************************************************************
.10:
xchg esi, [rep1]
xchg esi, [rep2]
mov [rep3], esi
mov eax, p + Lencoder*4
call LzmaLenDecode
push kNumLenToPosStates-1
pop edx
cmp edx, ecx
jb @f
mov edx, ecx
;--------------------------------------
@@:
push ecx
push kNumPosSlotBits
pop ecx
mov eax, p+PosSlot*4
shl edx, cl
call RangeDecoderBitTreeDecode
mov esi, ecx
cmp ecx, kStartPosModelIndex
jb .l6
mov edx, ecx
xor eax, eax
shr ecx, 1
adc al, 2
dec ecx
shl eax, cl
mov esi, eax
sub eax, edx
lea eax, [p + (SpecPos - 1)*4 + eax*4]
cmp edx, kEndPosModelIndex
jb .l59
; call RangeDecoderDecodeDirectBits
;RangeDecoderDecodeDirectBits:
xor eax, eax
;--------------------------------------
.l:
shr dword [range], 1
add eax, eax
mov edx, [code_]
sub edx, [range]
jb @f
mov [code_], edx
add al, 1 shl kNumAlignBits
;--------------------------------------
@@:
call update_decoder
dec ecx
cmp ecx, kNumAlignBits
jnz .l
; ret
add esi, eax
mov eax, p+Align_*4
;--------------------------------------
.l59:
; call RangeDecoderReverseBitTreeDecode_addesi
;_RangeDecoderReverseBitTreeDecode_addesi:
; in: eax->probs,ecx=numLevels
; out: esi+=length; destroys edx
push edi
xor edx, edx
inc edx
mov edi, edx
;--------------------------------------
@@:
call RangeDecoderBitDecode_edx
jnc .591
add esi, edi
stc
;--------------------------------------
.591:
adc edx, edx
add edi, edi
loop @b
pop edi
; ret
;--------------------------------------
.l6:
pop ecx
not esi
push 7
;--------------------------------------
.rmu:
cmp ebp, 7
pop ebp
jb @f
add ebp, 3
;--------------------------------------
@@:
.repmovsb:
inc ecx
push esi
add esi, edi
rep movsb
lodsb
pop esi
jmp .stosb_main_loop
;*********************************************************************
.main_loop_done:
include 'calltrick2.inc'
ret
;*********************************************************************
_RangeDecoderBitDecode:
; in: eax->prob
; out: CF=bit
push edx
mov edx, [range]
shr edx, kNumBitModelTotalBits
imul edx, [eax]
cmp [code_], edx
jae .ae
mov [range], edx
mov edx, kBitModelTotal
sub edx, [eax]
shr edx, kNumMoveBits
add [eax], edx
;--------------------------------------
.n:
pushfd
call update_decoder
popfd
pop edx
ret
;*********************************************************************
.ae:
sub [range], edx
sub [code_], edx
mov edx, [eax]
shr edx, kNumMoveBits
sub [eax], edx
stc
jmp .n
;*********************************************************************
update_decoder:
cmp byte [range+3], 0 ;cmp dword [range], kTopValue
jnz @f ;jae @f
shl dword [range], 8
shl dword [code_], 8
push eax
mov eax, [inptr_ldr]
mov al, [eax]
inc dword [inptr_ldr]
mov byte [code_], al
pop eax
@@:
ret
;*********************************************************************
_RangeDecoderBitDecode_edx:
push eax
lea eax, [eax+edx*4]
call RangeDecoderBitDecode
pop eax
ret
;*********************************************************************
LzmaLenDecode:
; in: eax->prob, edx=posState
; out: ecx=len
; LenChoice==0
; add eax, LenChoice*4
if kLenNumMidBits <> kLenNumLowBits
error in optimization
end if
mov cl, kLenNumMidBits
call RangeDecoderBitDecode
jnc .0
add eax, (LenChoice2-LenChoice)*4
call RangeDecoderBitDecode
jc @f
if (kLenNumMidBits <> 3) | (LenMid-LenChoice2 > 0x7F + kLenNumMidBits)
shl edx, cl
add edx, LenMid-LenChoice2
else
lea edx, [ecx + edx*8 - kLenNumMidBits + LenMid-LenChoice2]
end if
push kLenNumLowSymbols
jmp RangeDecoderBitTreeDecode.1
;*********************************************************************
@@:
mov edx, LenHigh-LenChoice2
mov cl, kLenNumHighBits
push kLenNumLowSymbols + kLenNumMidSymbols
jmp RangeDecoderBitTreeDecode.1
;*********************************************************************
.0:
shl edx, cl
if LenLow = 2
inc edx
inc edx
else
add edx, LenLow
end if
;--------------------------------------
RangeDecoderBitTreeDecode:
; in: eax+edx*4->probs,ecx=numLevels
; out: ecx=length; destroys edx
push 0
.1:
lea eax, [eax+edx*4]
xor edx, edx
inc edx
push ecx
@@:
call RangeDecoderBitDecode_edx
adc edx, edx
loop @b
pop ecx
btc edx, ecx
pop ecx
add ecx, edx
ret
loader_size = $ - loader_start
;*********************************************************************

File diff suppressed because it is too large Load Diff

View File

@ -0,0 +1,12 @@
;* Call: ***************************************************************
; lzma_set_dict_size(unsigned logdictsize)
lzma_set_dict_size:
mov ecx,[esp+4]
xor eax,eax
inc eax
shl eax,cl
mov [_dictionarySize],eax
lea eax,[ecx+ecx]
mov [_distTableSize],eax
ret 4
;*****************************************************************************