SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-22 14:54:56 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Reduce size of 32-bit checks

Browse Source
This commit is contained in:
Matt Nadareski
2021-03-14 14:16:54 -07:00
parent bedbceafa7
commit 152f6c7051
1 changed files with 83 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files

240
BurnOutSharp/PackerType/WinZipSFX.cs
View File

@@ -146,7 +146,7 @@ namespace BurnOutSharp.PackerType
private static string GetV2Version(byte[] fileContent)
{
#region NE Header Checks
#region 16-bit NE Header Checks
byte[] check = new byte[]
{
@@ -319,205 +319,131 @@ namespace BurnOutSharp.PackerType
#endregion
// WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............8<EFBFBD>92....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SE.SFX
#region 32-bit SFX Header Checks
// .............8<EFBFBD>92....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SE.SFX
check = new byte[]
{
0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52,
0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45,
0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72,
0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67,
0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31,
0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E,
0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20,
0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E,
0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x38, 0x9C, 0x39, 0x32,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, 0x53,
0x46, 0x58,
0x00, 0x00, 0x00, 0x00, 0x00, 0x38, 0x9C, 0x39,
0x32, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E,
0x53, 0x46, 0x58,
};
if (fileContent.Contains(check, out _))
return "Version 2.0 (32-bit)";
// WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............]<5D>92....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SRE.SFX
// .............]<5D>92....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SRE.SFX
check = new byte[]
{
0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52,
0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45,
0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72,
0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67,
0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31,
0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E,
0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20,
0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E,
0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x5D, 0x9C, 0x39, 0x32,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, 0x2E,
0x53, 0x46, 0x58,
0x00, 0x00, 0x00, 0x00, 0x00, 0x5D, 0x9C, 0x39,
0x32, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45,
0x2E, 0x53, 0x46, 0x58,
};
if (fileContent.Contains(check, out _))
return "Software Installation Version 2.0 (32-bit)";
// WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............<2E><><EFBFBD>3....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SE.SFX
// .............<2E><><EFBFBD>3....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SE.SFX
check = new byte[]
{
0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52,
0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45,
0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72,
0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67,
0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31,
0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E,
0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20,
0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E,
0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x84, 0x82, 0x94, 0x33,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, 0x53,
0x46, 0x58,
0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 0x82, 0x94,
0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E,
0x53, 0x46, 0x58,
};
if (fileContent.Contains(check, out _))
return "Version 2.1 RC2 (32-bit)";
// WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............<2E><><EFBFBD>3....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SRE.SFX
// .............<2E><><EFBFBD>3....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SRE.SFX
check = new byte[]
{
0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52,
0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45,
0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72,
0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67,
0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31,
0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E,
0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20,
0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E,
0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xB0, 0x82, 0x94, 0x33,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, 0x2E,
0x53, 0x46, 0x58,
0x00, 0x00, 0x00, 0x00, 0x00, 0xB0, 0x82, 0x94,
0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45,
0x2E, 0x53, 0x46, 0x58,
};
if (fileContent.Contains(check, out _))
return "Software Installation Version 2.1 RC2 (32-bit)";
// WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............U<><55>3....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SE.SFX
// .............U<><55>3....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SE.SFX
check = new byte[]
{
0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52,
0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45,
0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72,
0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67,
0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31,
0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E,
0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20,
0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E,
0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x55, 0xCD, 0xCC, 0x33,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, 0x53,
0x46, 0x58,
0x00, 0x00, 0x00, 0x00, 0x00, 0x55, 0xCD, 0xCC,
0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E,
0x53, 0x46, 0x58,
};
if (fileContent.Contains(check, out _))
return "Version 2.1 (32-bit)";
// WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............{<7B><>3....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SRE.SFX
// .............{<7B><>3....<2E>P..............<2E>P..<2E>P..<2E>P..VW95SRE.SFX
check = new byte[]
{
0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52,
0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45,
0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72,
0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67,
0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31,
0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E,
0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20,
0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E,
0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x7B, 0xCD, 0xCC, 0x33,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00,
0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, 0x2E,
0x53, 0x46, 0x58,
0x00, 0x00, 0x00, 0x00, 0x00, 0x7B, 0xCD, 0xCC,
0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00,
0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45,
0x2E, 0x53, 0x46, 0x58,
};
if (fileContent.Contains(check, out _))
return "Software Installation Version 2.1 (32-bit)";
// I'm not as sure about version 2.2 detection, so check for _winzip_ to prevent any false positives
// "_winzip_"
check = new byte[] { 0x5F, 0x77, 0x69, 0x6E, 0x7A, 0x69, 0x70, 0x5F };
if (fileContent.Contains(check, out _))
#endregion
#region 32-bit PE Header Checks
// PE..L...i.[:........<2E>........J...*......<2E>9.......`....@.
check = new byte[]
{
// ....$.......<2E>'~S<>F..<2E>F..<2E>F..<2E>F..<2E>F...@..<2E>F...Z..<2E>F..Rich<63>F..........................PE..L...i.[:........<2E>........J...*......<2E>9.......`....@.
check = new byte[]
{
0x2E, 0x0D, 0x0D, 0x0A, 0x24, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xD2, 0x27, 0x7E, 0x53,
0x96, 0x46, 0x10, 0x00, 0x96, 0x46, 0x10, 0x00,
0x96, 0x46, 0x10, 0x00, 0x96, 0x46, 0x10, 0x00,
0xEA, 0x46, 0x10, 0x00, 0x12, 0x40, 0x16, 0x00,
0x97, 0x46, 0x10, 0x00, 0x11, 0x5A, 0x12, 0x00,
0x97, 0x46, 0x10, 0x00, 0x52, 0x69, 0x63, 0x68,
0x96, 0x46, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x50, 0x45, 0x00, 0x00,
0x4C, 0x01, 0x05, 0x00, 0x69, 0x1B, 0x5B, 0x3A,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xE0, 0x00, 0x0F, 0x01, 0x0B, 0x01, 0x05, 0x0A,
0x00, 0x4A, 0x00, 0x00, 0x00, 0x2A, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xD8, 0x39, 0x00, 0x00,
0x00, 0x10, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00,
0x00, 0x00, 0x40, 0x00,
};
if (fileContent.Contains(check, out _))
return "Version 2.2.4003";
// ....$.......<2E>'~S<>F..<2E>F..<2E>F..<2E>F...F...@..<2E>F...Z..<2E>F..Rich<63>F..........................PE..L.....[:........<2E>........V...*.......?.......p....@.
check = new byte[]
{
0x2E, 0x0D, 0x0D, 0x0A, 0x24, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xD2, 0x27, 0x7E, 0x53,
0x96, 0x46, 0x10, 0x00, 0x96, 0x46, 0x10, 0x00,
0x96, 0x46, 0x10, 0x00, 0x96, 0x46, 0x10, 0x00,
0x1B, 0x46, 0x10, 0x00, 0x12, 0x40, 0x16, 0x00,
0x97, 0x46, 0x10, 0x00, 0x11, 0x5A, 0x12, 0x00,
0x97, 0x46, 0x10, 0x00, 0x52, 0x69, 0x63, 0x68,
0x96, 0x46, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x50, 0x45, 0x00, 0x00,
0x4C, 0x01, 0x05, 0x00, 0x81, 0x1B, 0x5B, 0x3A,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xE0, 0x00, 0x0F, 0x01, 0x0B, 0x01, 0x05, 0x0A,
0x00, 0x56, 0x00, 0x00, 0x00, 0x2A, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x8F, 0x3F, 0x00, 0x00,
0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
0x00, 0x00, 0x40, 0x00,
};
if (fileContent.Contains(check, out _))
return "Software Installation Version 2.2.4003";
}
0x50, 0x45, 0x00, 0x00, 0x4C, 0x01, 0x05, 0x00,
0x69, 0x1B, 0x5B, 0x3A, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x0F, 0x01,
0x0B, 0x01, 0x05, 0x0A, 0x00, 0x4A, 0x00, 0x00,
0x00, 0x2A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xD8, 0x39, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,
};
if (fileContent.Contains(check, out _))
return "Version 2.2.4003";
// PE..L.....[:........<2E>........V...*.......?.......p....@.
check = new byte[]
{
0x50, 0x45, 0x00, 0x00, 0x4C, 0x01, 0x05, 0x00,
0x81, 0x1B, 0x5B, 0x3A, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x0F, 0x01,
0x0B, 0x01, 0x05, 0x0A, 0x00, 0x56, 0x00, 0x00,
0x00, 0x2A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x8F, 0x3F, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
0x00, 0x70, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,
};
if (fileContent.Contains(check, out _))
return "Software Installation Version 2.2.4003";
#endregion
return "Unknown Version 2.X";
}