
# Copyright (C) 1997 Farrell McKay
# All rights reserved.
#
# This file is part of the Fortify distribution, a toolkit for
# upgrading the cryptographic strength of the Netscape Navigator
# web browser, authored by Farrell McKay.
#
# This toolkit is provided to the recipient under the
# following terms and conditions:-
#   1.  This copyright notice must not be removed or modified.
#   2.  This toolkit may not be reproduced or included in any commercial
#       media distribution, or commercial publication (for example CD-ROM,
#       disk, book, magazine, journal) without first obtaining the author's
#       permission.
#   3.  Subject to the above conditions being observed (1,2), this toolkit
#       may be freely reproduced or redistributed.
#   4.  This software is provided "as-is", without express or implied
#       warranty.  In no event shall the author be liable for any direct,
#       indirect or consequential damages however caused.
#   5.  Subject to the above conditions being observed (1-4),
#       this toolkit may be used at no cost to the recipient.
#
# Farrell McKay			Farrell.McKay@mpx.com.au

init {
	grammar		1.1
	target		"navigator-v301-export.mips-sgi-irix5.2"
	text_offset	0x400000
	data_offset	0xfc79000
	rodata_offset	0xfc79000
}
_main {
	segment		text
	msg		"main"
	base		0x4bba34
        offset		0x0
	context		0x3c 0x1c 0x0f 0xd4	# lui $gp,0xfd4
			0x27 0x9c 0xf1 0x0c	# addiu $gp,$gp,-3828
			0x03 0x99 0xe0 0x21	# addu $gp,$gp,$t9
			0x27 0xbd 0xe9 0x20	# addiu $sp,$sp,-5856
			0xaf 0xbf 0x00 0x4c 	# sw $ra,76($sp)
}
p0a {
	segment		text
	msg		"Changing domestic/export function"
	base		0x71b170
	offset		0x4
	old_value       0x00 0x00 0x10 0x25     # move $v0,$zero
	new_value       0x24 0x02 0x00 0x01     # li   $v0,1
}
p1a {
	segment		text
	msg		"Altering cipher specs function - v2 mask tests"
	base		0x71b180
	offset		0x24
	old_value	0x30 0x45 0x00 0x08	# andi $a1,$v0,0x8
	new_value	0x30 0x45 0x00 0x01	# andi $a1,$v0,0x1
}
p1c {
	segment		text
	msg		"Altering cipher specs function - v2 cipher const"
	base		0x71b180
	offset		0xd4
	old_value	0x24 0x08 0x00 0x04	# li $t0,4
	new_value	0x24 0x08 0x00 0x01	# li $t0,1
}
p2 {
	segment		text
	msg		"Altering cipher enable function - v2 cipher const"
	base		0x71b2bc
	offset		0x70
	old_value	0x34 0x01 0xff 0x04	# li $at,0xff04
	new_value	0x34 0x01 0xff 0x01	# li $at,0xff01
}
p3 {
	segment		text
	msg		"Altering cipher code test no. 1"
	base		0x71b49c
	offset		0x34
	old_value	0x24 0x01 0x00 0x04	# li $at,4
	new_value	0x24 0x01 0x00 0x01	# li $at,1
}
p4 {
	segment		text
	msg		"Changing cipher code test no. 2"
	base		0x71be2c
	offset		0x7c
	old_value	0x24 0x01 0x00 0x04	# li $at,4
	new_value	0x24 0x01 0x00 0x01	# li $at,1
}
p5 {
	segment		text
	msg		"Changing cipher code test no. 3"
	base		0x71be2c
	offset		0x1bc
	old_value	0x24 0x01 0x00 0x04     # li $at,4
	new_value	0x24 0x01 0x00 0x01     # li $at,1
}
p6 {
	segment		text
	msg		"Changing cipher code test no. 4"
	base		0x71c0a8
	offset		0x124
	old_value	0x24 0x01 0x00 0x02     # li $at,2
			0x8c 0x62 0x00 0x38	# lw $v0,56($v1)
			0x24 0x0d 0x00 0x01	# li $t5,1
			0x10 0x41 0x00 0x06	# beq $v0,$at,0x71c1f4
	new_value	0x24 0x41 0xff 0xfe	# addiu $at,$v0,-2
			0x8c 0x62 0x00 0x38	# lw $v0,56($v1)
			0x24 0x0d 0x00 0x01	# li $t5,1
			0x18 0x20 0x00 0x06	# blez $at,0x71c1f4
}
p7a {
	segment		text
	msg		"Changing cipher characteristics, part 1"
	base		0x71cb18
	offset		0xe0
	old_value	0x24 0x01 0x00 0x04     # li $at,4
	new_value	0x24 0x01 0x00 0x01     # li $at,1
}
p7b {
	segment		text
	msg		"Changing cipher characteristics, part 2"
	base		0x71cb18
	offset		0x108
	old_value
			0x25 0x4b 0xff 0xfb	# addiu $t3,$t2,-5 -- no. of clear bytes
			0xaf 0xab 0x00 0xbc	# sw $t3,188($sp)  -- save it away
			0x03 0x20 0xf8 0x09	# jalr $t9         -- generate IV (8 bytes)
			0x24 0x05 0x00 0x08	# li $a1,8
			0x8f 0xbc 0x00 0x30	# lw $gp,48($sp)
			0x27 0xac 0x00 0x54	# addiu $t4,$sp,84 -- ptr to IV data
			0x24 0x0d 0x00 0x08	# li $t5,8	   -- size of cipher's IV
	new_value
			0x00 0x00 0x58 0x25	# mov $t3,$zero    -- reset no. of clear bytes
			0xaf 0xab 0x00 0xbc	# sw $t3,188($sp)
			0x03 0x20 0xf8 0x09	# jalr $t9
			0x24 0x05 0x00 0x08	# li $a1,8
			0x8f 0xbc 0x00 0x30	# lw $gp,48($sp)
			0x00 0x00 0x60 0x25	# mov $t4,$zero    -- new ptr to IV data (NULL)
			0x00 0x00 0x68 0x25	# mov $t5,$zero    -- new size of cipher's IV (0)
}
security_code_12 {
	segment		data
	msg		"Changing security code value in .data"
	base		0x1001be84
	old_value	0x00 0x00 0x00 0x01	# 1
	new_value	0x00 0x00 0x00 0x02	# 2
}
v2_preferred {
	segment		data
	msg		"Changing hard-coded EXP-RC4-MD5 const"
	base		0x10098eb0
	old_value	0x02 0x00 0x80 0x00     # EXP-RC4-MD5
	new_value	0x01 0x00 0x80 0x00     # RC4-MD5
}
v2_enabled {
	segment		data
	msg		"Changing v2 ciphers enabled bit mask"
	base		0x10098ee0
        old_value       0x00 0x00 0x00 0x0a     # 0000 1010
                        0x00 0x00 0x00 0x0a
        new_value       0x00 0x00 0x00 0x03     # 0000 0011
                        0x00 0x00 0x00 0x03
}
v2_cipher_spec {
	segment		data
	msg		"Changing v2 cipher in v2+v3 cipher specs table"
	base		0x10098f10
	offset		0x14
	old_value       0x00 0x00 0xff 0x04     # EXP-RC2-MD5
			0x10 0x1d 0xe9 0x8c	# ptr to "ssl2_rc2_40\000"
	new_value       0x00 0x00 0xff 0x01     # RC4-MD5
			0x10 0x1e 0xac 0xcc	# ptr to [ssl2_cipher_name]
}
v3_cipher_spec {
	segment		data
	msg		"Changing v3 cipher in v2+v3 cipher specs table"
	base		0x10098f10
	offset		0x3c
	old_value       0x00 0x00 0x00 0x06     # EXP-RC2-MD5
			0x10 0x1d 0xe9 0xac	# ptr to "ssl3_rsa_rc2_40_md5\000"
	new_value       0x00 0x00 0x00 0x04     # RC4-MD5
			0x10 0x1e 0xad 0xc4	# ptr to [ssl3_cipher_name]
}
v3_enabled {
	segment		data
	msg		"Changing v3 ciphers enabled table"
	base		0x1009a070
        old_value       0x00 0x03 0x00 0x06     # EXP-RC4-MD5 EXP-RC2-CBC-MD5
                        0x00 0x01 0x00 0x00
        new_value       0x00 0x04 0x00 0x03     # RC4-MD5 EXP-RC4-MD5
                        0x00 0x01 0x00 0x00
}
v2_cipher_descr {
	segment		data
	msg		"Changing v2 cipher description string number."
	base		0x100a058c
	old_value       0xff 0xff 0xe2 0x46     # --> "RC2 encryption with a 40-bit key"
	new_value       0xff 0xff 0xe2 0x41     # --> "RC4 encryption with a 128-bit key"
}
v3_cipher_descr {
	segment		data
	msg		"Changing v3 cipher description string number."
	base		0x100a05a0
	old_value       0xff 0xff 0xe2 0x4b     # --> "RC2 encryption with a 40-bit key and an MD5 MAC"
	new_value       0xff 0xff 0xe2 0x47     # --> "RC4 encryption with a 128-bit key and an MD5 MAC"
}
version_str {
	segment		rodata
	msg		"Altering the -v version string in .rodata"
	base		0x100b8238
	offset          0x0e
	old_value       "export,"
	new_value       "Fortify"
}
ssl2_cipher_name {
	segment		rodata
	msg		"Changing name of v2 entry in v2+v3 cipher specs table"
	base		0x101eaccc
	old_value       "RC2 encryptio"		# "n with a 40-bit key"
	new_value       "ssl2_rc4_128\000"
}
ssl3_cipher_name {
	segment		rodata
	msg		"Changing name of v3 entry in v2+v3 cipher specs table"
	base		0x101eadc4
	old_value       "RC2 encryption with a"	# " 40-bit key and an MD5 MAC"
	new_value       "ssl3_rsa_rc4_128_md5\000"
}
