From 0d371d0f3ceba182e8056de613f68f3b5bb85a50 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Sun, 7 Sep 2025 11:04:28 -0400
Subject: [PATCH] Add GP-Install detection (fixes #99)

---
 BinaryObjectScanner/Packer/GPInstall.cs | 22 ++++++++++++++++++++++
 README.md                               |  1 +
 2 files changed, 23 insertions(+)
 create mode 100644 BinaryObjectScanner/Packer/GPInstall.cs

diff --git a/BinaryObjectScanner/Packer/GPInstall.cs b/BinaryObjectScanner/Packer/GPInstall.cs
new file mode 100644
index 00000000..1735bf11
--- /dev/null
+++ b/BinaryObjectScanner/Packer/GPInstall.cs
@@ -0,0 +1,22 @@
+using BinaryObjectScanner.Interfaces;
+using SabreTools.Serialization.Wrappers;
+
+namespace BinaryObjectScanner.Packer
+{
+    /// <summary>
+    /// GP-Install
+    /// </summary>
+    public class GPInstall : IExecutableCheck<PortableExecutable>
+    {
+        /// <inheritdoc/>
+        public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
+        {
+            // <see href="https://www.virustotal.com/gui/file/0e0a93cba8163cef9c979cbb49a6f15604956b9441aba6fb9e9f0c6897cc73ed/details"/>
+            var name = pex.FileDescription;
+            if (name.OptionalContains("GP-Install"))
+                return "GP-Install";
+
+            return null;
+        }
+    }
+}
diff --git a/README.md b/README.md
index d9f8f4c4..e28fb355 100644
--- a/README.md
+++ b/README.md
@@ -154,6 +154,7 @@ Below is a list of executable packers detected by BinaryObjectScanner. The three
 | EXE Stealth | Yes | No | No | |
 | Gentee Installer | Yes | No | No | |
 | GkWare SFX | Yes | No | No | |
+| GP-Install | Yes | No | No | |
 | HyperTech CrackProof | Yes | No | No | |
 | Inno Setup | Yes | No | No | |
 | InstallAnywhere | Yes | No | No | |