CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/external/source/exploits/CVE-2017-13861/liboffsetfinder64/lzssdec.c
Views: 11784
1
//
2
// lzssdec.h
3
// img4tool
4
//
5
// Code borrowed from: http://newosxbook.com/src.jl?tree=listings&file=joker.c
6
// Coded by Jonathan Levin (a.k.a @Morpheus______), http://newosxbook.com
7
8
#include "lzssdec.h"
9
#include <string.h>
10
#include <stdlib.h>
11
12
/**************************************************************
13
LZSS.C -- A Data Compression Program
14
***************************************************************
15
4/6/1989 Haruhiko Okumura
16
Use, distribute, and modify this program freely.
17
Please send me your improved versions.
18
PC-VAN SCIENCE
19
NIFTY-Serve PAF01022
20
CompuServe 74050,1022
21
**************************************************************/
22
/*
23
* lzss.c - Package for decompressing lzss compressed objects
24
*
25
* Copyright (c) 2003 Apple Computer, Inc.
26
*
27
* DRI: Josh de Cesare
28
*/
29
#define N 4096 /* size of ring buffer - must be power of 2 */
30
#define F 18 /* upper limit for match_length */
31
#define THRESHOLD 2 /* encode string into position and length
32
if match_length is greater than this */
33
#define NIL N /* index for root of binary search trees */
34
35
int decompress_lzss(u_int8_t *dst, u_int8_t *src, u_int32_t srclen){
36
/* ring buffer of size N, with extra F-1 bytes to aid string comparison */
37
u_int8_t text_buf[N + F - 1];
38
u_int8_t *dststart = dst;
39
u_int8_t *srcend = src + srclen;
40
int i, j, k, r, c;
41
unsigned int flags;
42
43
dst = dststart;
44
srcend = src + srclen;
45
for (i = 0; i < N - F; i++)
46
text_buf[i] = ' ';
47
r = N - F;
48
flags = 0;
49
for ( ; ; ) {
50
if (((flags >>= 1) & 0x100) == 0) {
51
if (src < srcend) c = *src++; else break;
52
flags = c | 0xFF00; /* uses higher byte cleverly */
53
} /* to count eight */
54
if (flags & 1) {
55
if (src < srcend) c = *src++; else break;
56
*dst++ = c;
57
text_buf[r++] = c;
58
r &= (N - 1);
59
} else {
60
if (src < srcend) i = *src++; else break;
61
if (src < srcend) j = *src++; else break;
62
i |= ((j & 0xF0) << 4);
63
j = (j & 0x0F) + THRESHOLD;
64
for (k = 0; k <= j; k++) {
65
c = text_buf[(i + k) & (N - 1)];
66
*dst++ = c;
67
text_buf[r++] = c;
68
r &= (N - 1);
69
}
70
}
71
}
72
73
return (int)(dst - dststart);
74
}
75
76
struct compHeader {
77
char sig[8] ; // "complzss"
78
uint32_t unknown; // Likely CRC32. But who cares, anyway?
79
uint32_t uncompressedSize;
80
uint32_t compressedSize;
81
uint32_t unknown1; // 1
82
};
83
84
char *tryLZSS(char *compressed, size_t *filesize){
85
struct compHeader *compHeader = (struct compHeader*)compressed;
86
if (!compHeader) return NULL;
87
int sig[2] = { 0xfeedfacf, 0x0100000c };
88
89
char *decomp = malloc (ntohl(compHeader->uncompressedSize));
90
91
char *feed = memmem(compressed+64, 1024, sig, sizeof(sig));
92
93
if (!feed)
94
return NULL;
95
96
feed--;
97
int rc = decompress_lzss((void*)decomp, (void*)feed, ntohl(compHeader->compressedSize));
98
if (rc != ntohl(compHeader->uncompressedSize)) {
99
return NULL;
100
}
101
102
*filesize = rc;
103
return (decomp);
104
105
} // compLZSS
106
107