
# Copyright (C) 1997 Farrell McKay
# All rights reserved.
#
# This file is part of the Fortify distribution, a toolkit for
# upgrading the cryptographic strength of the Netscape Navigator
# web browser, authored by Farrell McKay.
#
# This toolkit is provided to the recipient under the
# following terms and conditions:-
#   1.  This copyright notice must not be removed or modified.
#   2.  This toolkit may not be reproduced or included in any commercial
#       media distribution, or commercial publication (for example CD-ROM,
#       disk, book, magazine, journal) without first obtaining the author's
#       permission.
#   3.  Subject to the above conditions being observed (1,2), this toolkit
#       may be freely reproduced or redistributed.
#   4.  This software is provided "as-is", without express or implied
#       warranty.  In no event shall the author be liable for any direct,
#       indirect or consequential damages however caused.
#   5.  Subject to the above conditions being observed (1-4),
#       this toolkit may be used at no cost to the recipient.
#
# Farrell McKay			Farrell.McKay@mpx.com.au

init {
	grammar		1.1
	target		"navigator-v301-export.x86-unknown-linux-elf"
	text_offset	0x8000000
	data_offset	0x8001000
	rodata_offset	0x8000000
}
_main {
	segment		text
	msg		"main"
	base		0x803eb5c
        offset          0x0
	context		0x55			# pushl  %ebp
			0x89 0xe5		# movl   %esp,%ebp
			0x81 0xec		# subl   $0x13c0,%esp
			0xc0 0x13 0x00 0x00
			0x57			# pushl  %edi
			0x56			# pushl  %esi
			0x53			# pushl  %ebx
			0xc7 0x85 0x54 0xec	# movl $0x0,0xffffec54(%ebp)
			0xff 0xff 0x00 0x00
}
p0a {
	segment		text
	msg		"Changing domestic/export function"
	base		0x81a354c
	offset		0x3
	old_value	0x31 0xc0		# xorl %eax,%eax
	new_value	0xb0 0x01		# movb $0x1,%al
}
p1a {
	segment		text
	msg		"Altering cipher specs function - v2 mask tests"
	base		0x81a3560
	offset		0x14
	old_value	0xf7 0xc7 0x08 0x00 0x00 0x00	# testl $0x8,%edi
	new_value	0xf7 0xc7 0x01 0x00 0x00 0x00	# testl $0x1,%edi
}
p1b {
	segment		text
	msg		"Altering cipher specs function - v2 mask tests"
	base		0x81a3560
	offset		0x66
	old_value	0xf7 0xc7 0x08 0x00 0x00 0x00	# testl $0x8,%edi
	new_value	0xf7 0xc7 0x01 0x00 0x00 0x00	# testl $0x1,%edi
}
p1c {
	segment		text
	msg		"Altering cipher specs function - v2 cipher const"
	base		0x81a3560
	offset		0x6e
	old_value	0xc6 0x03 0x04			# movb $0x4,(%ebx)
	new_value	0xc6 0x03 0x01			# movb $0x1,(%ebx)
}
p2 {
	segment		text
	msg		"Altering cipher enable function - v2 cipher const"
	base		0x81a35fc
	offset		0x38
	old_value	0x81 0xfa 0x04 0xff 0x00 0x00	# cmpl $0xff04,%edx
	new_value	0x81 0xfa 0x01 0xff 0x00 0x00	# cmpl $0xff01,%edx
}
p3 {
	segment		text
	msg		"Altering cipher code test no. 1"
	base		0x81a36f8
	offset		0x10
	old_value	0x83 0xf8 0x04			# cmpl $0x4,%eax
	new_value	0x83 0xf8 0x01			# cmpl $0x1,%eax
}
p4 {
	segment		text
	msg		"Changing cipher code test no. 2"
	base		0x81a3bc8
	offset		0x39
	old_value	0x83 0x7d 0x20 0x04		# cmpl $0x4,0x20(%ebp)
	new_value	0x83 0x7d 0x20 0x01		# cmpl $0x1,0x20(%ebp)
}
p5 {
	segment		text
	msg		"Changing cipher code test no. 3"
	base		0x81a3bc8
	offset		0xeb
	old_value	0x83 0x7d 0x20 0x04		# cmpl $0x4,0x20(%ebp)
	new_value	0x83 0x7d 0x20 0x01		# cmpl $0x1,0x20(%ebp)
}
p6 {
	segment		text
	msg		"Changing cipher code test no. 4"
	base		0x81a3d04
	offset		0xdf
	old_value	0x74 0x0b			# je 0x81a3df0
	new_value	0x7e 0x0b			# jle 0x81a3df0
}
p7a {
	segment		text
	msg		"Changing cipher characteristics, part 1"
	base		0x81a4378
	offset		0xb2
	old_value	0x83 0x7d 0x90 0x04		# cmpl $0x4,0xffffff90(%ebp)
	new_value	0x83 0x7d 0x90 0x01		# cmpl $0x1,0xffffff90(%ebp)
}
p7b {
	segment		text
	msg		"Changing cipher characteristics, part 2"
	base		0x81a4378
	offset		0xc9
	old_value	
			0x89 0x5d 0x94			# movl %ebx,0xffffff94(%ebp)
			0xc7 0x45 0x8c			# movl $0x8,0xffffff8c(%ebp)
			0x08 0x00 0x00 0x00		#
	new_value	
			0x31 0xff			# xorl %edi,%edi
							#   -- reset the no. of clear
							#      bytes in %i1, calculated prior.
			0x31 0xdb			# xorl %ebx,%ebx
			0x89 0x5d 0x94			# movl %ebx,0xffffff94(%ebp)
							#	-- new ptr to IV data (NULL)
			0x89 0x5d 0x8c			# movl %ebx,0xffffff8c(%ebp)
							#	-- new size of cipher's IV (0)
}
version_str {
	segment		rodata
	msg		"Altering the -v version string in .rodata"
	base		0x82a5a11			
	offset		0x0e
	old_value	"export,"
	new_value	"Fortify"
}
ssl2_cipher_name {
	segment		rodata
	msg		"Changing name of v2 entry in v2+v3 cipher specs table"
	base		0x83875fb
	old_value	"RC2 encryptio"		# "n with a 40-bit key"
	new_value	"ssl2_rc4_128\000"
}
ssl3_cipher_name {
	segment		rodata
	msg		"Changing name of v3 entry in v2+v3 cipher specs table"
	base		0x83876e7
	old_value	"RC2 encryption with a"	# " 40-bit key and an MD5 MAC"
	new_value	"ssl3_rsa_rc4_128_md5\000"
}
security_code_12 {
	segment		data
	msg		"Changing security code value in .data"
	base		0x83b14b8		
	old_value	0x01 0x00 0x00 0x00	# 1
	new_value	0x02 0x00 0x00 0x00	# 2
}
v2_cipher_spec {
	segment		data
	msg		"Changing v2 cipher in v2+v3 cipher specs table"
	base		0x8432e64		
	offset		0x14
	old_value	0x04 0xff 0x00 0x00	# EXP-RC2-MD5
			0xc1 0xd7 0x37 0x08	# ptr to "ssl2_rc2_40\000"
	new_value	0x01 0xff 0x00 0x00	# RC4-MD5
			0xfb 0x75 0x38 0x08	# ptr to [ssl2_cipher_name]
	
}
v3_cipher_spec {
	segment		data
	msg		"Changing v3 cipher in v2+v3 cipher specs table"
	base		0x8432e64		
	offset		0x3c
	old_value	0x06 0x00 0x00 0x00	# EXP-RC2-MD5
			0x99 0xd7 0x37 0x08	# ptr to "ssl3_rsa_rc2_40_md5\000"
	new_value	0x04 0x00 0x00 0x00	# RC4-MD5
			0xe7 0x76 0x38 0x08	# ptr to [ssl3_cipher_name]
}
v2_preferred {
	segment		data
	msg		"Changing hard-coded EXP-RC4-MD5 const"
	base		0x8432ee4
	old_value	0x02 0x00 0x80 0x00	# EXP-RC4-MD5
	new_value	0x01 0x00 0x80 0x00	# RC4-MD5
}
v2_enabled {
	segment		data
	msg		"Changing v2 ciphers enabled bit mask"
	base		0x8432f14		# LSB word
	old_value	0x0a 0x00 0x00 0x00	# 0000 1010
			0x0a 0x00 0x00 0x00
	new_value	0x03 0x00 0x00 0x00	# 0000 0011
			0x03 0x00 0x00 0x00
}
v3_enabled {
	segment		data
	msg		"Changing v3 ciphers enabled table"
	base		0x8432f1c		# LSB halfwords
	old_value	0x03 0x00 0x06 0x00	# EXP-RC4-MD5 EXP-RC2-CBC-MD5
			0x01 0x00 0x00 0x00
	new_value	0x04 0x00 0x03 0x00	# RC4-MD5 EXP-RC4-MD5
			0x01 0x00 0x00 0x00
}
v2_cipher_descr {
	segment		data
	msg		"Changing v2 cipher description string number."
	base		0x8435110		# LSB word
	old_value	0x46 0xe2 0xff 0xff	# --> "RC2 encryption with a 40-bit key"
	new_value	0x41 0xe2 0xff 0xff	# --> "RC4 encryption with a 128-bit key"
}
v3_cipher_descr {
	segment		data
	msg		"Changing v3 cipher description string number."
	base		0x8435124		# LSB word
	old_value	0x4b 0xe2 0xff 0xff	# --> "RC2 encryption with a 40-bit key and an MD5 MAC"
	new_value	0x47 0xe2 0xff 0xff	# --> "RC4 encryption with a 128-bit key and an MD5 MAC"
}
