
# Copyright (C) 1997 Farrell McKay
# All rights reserved.
#
# This file is part of the Fortify distribution, a toolkit for
# upgrading the cryptographic strength of the Netscape Navigator
# web browser, authored by Farrell McKay.
#
# This toolkit is provided to the recipient under the
# following terms and conditions:-
#   1.  This copyright notice must not be removed or modified.
#   2.  This toolkit may not be reproduced or included in any commercial
#       media distribution, or commercial publication (for example CD-ROM,
#       disk, book, magazine, journal) without first obtaining the author's
#       permission.
#   3.  Subject to the above conditions being observed (1,2), this toolkit
#       may be freely reproduced or redistributed.
#   4.  This software is provided "as-is", without express or implied
#       warranty.  In no event shall the author be liable for any direct,
#       indirect or consequential damages however caused.
#   5.  Subject to the above conditions being observed (1-4),
#       this toolkit may be used at no cost to the recipient.
#
# Farrell McKay			Farrell.McKay@mpx.com.au

init {
	grammar		1.1
	target		"navigator-v301-export.sparc-sun-solaris2.4"
	text_offset	0x10000
	data_offset	0x20000
	rodata_offset	0x10000
}
_main {
	segment		text
	msg		"main"
	base		0xa3afc
        offset          0x0
	context		0x9d 0xe3 0xb0 0x00	# save  %sp, -4096, %sp
			0x9c 0x03 0xb4 0xf0	# add  %sp, -2832, %sp
			0xf0 0x27 0xa0 0x44	# st  %i0, [ %fp + 0x44 ]
			0xa6 0x10 0x20 0x00	# clr  %l3
}
p0a {
	segment		text
	msg		"Changing domestic/export function"
	base		0x247044		
	offset		0
	old_value	0x90 0x10 0x20 0x00   	# clr %o0
	new_value	0x90 0x10 0x20 0x01	# mov 1,%o0
}
p1a {
	segment		text
	msg		"Altering cipher specs function - v2 mask tests"
	base		0x247060		
	offset		0x18			
	old_value	0x80 0x8c 0xa0 0x08	# btst 8,%l2
	new_value	0x80 0x8c 0xa0 0x01	# btst 1,%l2
}
p1b {
	segment		text
	msg		"Altering cipher specs function - v2 mask tests"
	base		0x247060		
	offset		0x84			
	old_value	0x80 0x8c 0xa0 0x08	# btst 8,%l2
	new_value	0x80 0x8c 0xa0 0x01	# btst 1,%l2
}
p1c {
	segment		text
	msg		"Altering cipher specs function - v2 cipher const"
	base		0x247060		
	offset		0x90			
	old_value	0x90 0x10 0x20 0x04	# mov 4, %o0
	new_value	0x90 0x10 0x20 0x01	# mov 1, %o0
}
p2 {
	segment		text
	msg		"Altering cipher enable function - v2 cipher const"
	base		0x247148		
	offset		0x40			
	old_value	0x90 0x12 0x23 0x04    	# or 0x304, %o0, %o0
	new_value	0x90 0x12 0x23 0x01	# or 0x301, %o0, %o0
}
p3 {
	segment		text
	msg		"Altering cipher code test no. 1"
	base		0x247290		
	offset		0x14			
	old_value	0x80 0xa6 0xe0 0x04   	# cmp %i3, 4
	new_value	0x80 0xa6 0xe0 0x01	# cmp %i3, 1
}
p4 {
	segment		text
	msg		"Changing cipher code test no. 2"
	base		0x24786c		
	offset		0x2c			
	old_value	0x80 0xa5 0x20 0x04	# cmp %l4,4
	new_value	0x80 0xa5 0x20 0x01	# cmp %l4,1
}
p5 {
	segment		text
	msg		"Changing cipher code test no. 3"
	base		0x24786c		
	offset		0x110			
	old_value	0x80 0xa5 0x20 0x04	# cmp %l4,4
	new_value	0x80 0xa5 0x20 0x01	# cmp %l4,1
}
p6 {
	segment		text
	msg		"Changing cipher code test no. 4"
	base		0x2479bc		
	offset		0xc0			
	old_value	0x02 0x80 0x00 0x06	# be  0x247a94
	new_value	0x08 0x80 0x00 0x06	# bleu 0x247a94
}
p7a {
	segment		text
	msg		"Changing cipher characteristics, part 1"
	base		0x248100		
	offset		0x8c			
	old_value	0x80 0xa6 0xa0 0x04	# cmp %i2, 4
	new_value	0x80 0xa6 0xa0 0x01	# cmp %i2, 1
}
p7b {
	segment		text
	msg		"Changing cipher characteristics, part 2"
	base		0x248100		
	offset		0x9c
	old_value	
			0xb2 0x02 0x3f 0xfb	# add -5, %o0, %i1   -- no. of clear bytes
			0xa0 0x07 0xbf 0x98	# add -104, %fp, %l0
			0x90 0x10 0x00 0x10	# mov %l0 %o0
			0x7f 0xff 0xb6 0xfa	# call 0x235d90      -- generate IV (8 bytes)
			0x92 0x10 0x20 0x08	# mov 8, %o1
			0xa8 0x10 0x00 0x10	# mov %l0, %l4       -- ptr to IV data
			0x10 0x80 0x00 0x09	# b 0x2481d8
			0xa6 0x10 0x20 0x08	# mov 8, %l3         -- size of cipher's IV
	new_value
			0xb2 0x10 0x20 0x00	# clr %i1            -- reset the no. of clear
						#			bytes in %i1
			0xa0 0x07 0xbf 0x98	# add -104, %fp, %l0 -- no change
			0x90 0x10 0x00 0x10	# mov %l0 %o0        -- no change
			0x7f 0xff 0xb6 0xfa	# call 0x235d90      -- no change
			0x92 0x10 0x20 0x08	# mov 8, %o1	     -- no change
			0xa8 0x10 0x20 0x00	# clr %l4	     -- new ptr to IV data (NULL)
			0x10 0x80 0x00 0x09	# b 0x2481d8	     -- no change
			0xa6 0x10 0x20 0x00	# clr %l3            -- new size of cipher's IV (0)
}
version_str {
	segment		rodata
	msg		"Altering the -v version string in .rodata"
	base		0x28160c		
	offset		0x0e
	old_value	"export,"
	new_value	"Fortify"
}
ssl3_cipher_name {
	segment		rodata
	msg		"Changing name of v3 entry in v2+v3 cipher specs table"
	base		0x35ef70
	old_value	"ssl3_rsa_rc2_40_md5\000\000"
	new_value	"ssl3_rsa_rc4_128_md5\000"
}
ssl2_cipher_name {
	segment		rodata
	msg		"Changing name of v2 entry in v2+v3 cipher specs table"
	base		0x35efa0
	old_value	"ssl2_rc2_40\000\000"
	new_value	"ssl2_rc4_128\000"
}
security_code_12 {
	segment		data
	msg		"Changing security code value in .data"
	base		0x39d7b8		
	old_value	0x00 0x00 0x00 0x01	# 1
	new_value	0x00 0x00 0x00 0x02	# 2
}
v2_cipher_spec {
	segment		data
	msg		"Changing v2 cipher in v2+v3 cipher specs table"
	base		0x41ea48		
	offset		0x14
	old_value	0x00 0x00 0xff 0x04	# EXP-RC2-MD5
	new_value	0x00 0x00 0xff 0x01	# RC4-MD5
}
v3_cipher_spec {
	segment		data
	msg		"Changing v3 cipher in v2+v3 cipher specs table"
	base		0x41ea48		
	offset		0x3c
	old_value	0x00 0x00 0x00 0x06	# EXP-RC2-MD5
	new_value	0x00 0x00 0x00 0x04	# RC4-MD5
}
v2_preferred {
	segment		data
	msg		"Changing hard-coded EXP-RC4-MD5 const"
	base		0x41eac8		
	old_value	0x02 0x00 0x80 0x00	# EXP-RC4-MD5
	new_value	0x01 0x00 0x80 0x00	# RC4-MD5
}
v2_enabled {
	segment		data
	msg		"Changing v2 ciphers enabled bit mask"
	base		0x41eaf8		
	old_value	0x00 0x00 0x00 0x0a	# 0000 1010
			0x00 0x00 0x00 0x0a
	new_value	0x00 0x00 0x00 0x03	# 0000 0011
			0x00 0x00 0x00 0x03
}
v3_enabled {
	segment		data
	msg		"Changing v3 ciphers enabled table"
	base		0x41eb00		
	old_value	0x00 0x03 0x00 0x06	# EXP-RC4-MD5 EXP-RC2-CBC-MD5
			0x00 0x01 0x00 0x00
	new_value	0x00 0x04 0x00 0x03	# RC4-MD5 EXP-RC4-MD5
			0x00 0x01 0x00 0x00
}
v2_cipher_descr {
	segment		data
	msg		"Changing v2 cipher description string number."
	base		0x420d50
	old_value	0xff 0xff 0xe2 0x46	# --> "RC2 encryption with a 40-bit key"
	new_value	0xff 0xff 0xe2 0x41	# --> "RC4 encryption with a 128-bit key"
}
v3_cipher_descr {
	segment		data
	msg		"Changing v3 cipher description string number."
	base		0x420d64
	old_value	0xff 0xff 0xe2 0x4b	# --> "RC2 encryption with a 40-bit key and an MD5 MAC"
	new_value	0xff 0xff 0xe2 0x47	# --> "RC4 encryption with a 128-bit key and an MD5 MAC"
}
