From 152f6c70514cab2a167581e5188c1658676209b1 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Sun, 14 Mar 2021 14:16:54 -0700 Subject: [PATCH] Reduce size of 32-bit checks --- BurnOutSharp/PackerType/WinZipSFX.cs | 240 +++++++++------------------ 1 file changed, 83 insertions(+), 157 deletions(-) diff --git a/BurnOutSharp/PackerType/WinZipSFX.cs b/BurnOutSharp/PackerType/WinZipSFX.cs index 42095cd5..f4b0f25e 100644 --- a/BurnOutSharp/PackerType/WinZipSFX.cs +++ b/BurnOutSharp/PackerType/WinZipSFX.cs @@ -146,7 +146,7 @@ namespace BurnOutSharp.PackerType private static string GetV2Version(byte[] fileContent) { - #region NE Header Checks + #region 16-bit NE Header Checks byte[] check = new byte[] { @@ -319,205 +319,131 @@ namespace BurnOutSharp.PackerType #endregion - // WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............8�92....�P..............�P..�P..�P..VW95SE.SFX + #region 32-bit SFX Header Checks + + // .............8�92....�P..............�P..�P..�P..VW95SE.SFX check = new byte[] { - 0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52, - 0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45, - 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72, - 0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, - 0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31, - 0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E, - 0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20, - 0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E, - 0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x38, 0x9C, 0x39, 0x32, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, 0x53, - 0x46, 0x58, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x38, 0x9C, 0x39, + 0x32, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, + 0x53, 0x46, 0x58, }; if (fileContent.Contains(check, out _)) return "Version 2.0 (32-bit)"; - // WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............]�92....�P..............�P..�P..�P..VW95SRE.SFX + // .............]�92....�P..............�P..�P..�P..VW95SRE.SFX check = new byte[] { - 0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52, - 0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45, - 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72, - 0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, - 0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31, - 0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E, - 0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20, - 0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E, - 0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x5D, 0x9C, 0x39, 0x32, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, 0x2E, - 0x53, 0x46, 0x58, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x5D, 0x9C, 0x39, + 0x32, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, + 0x2E, 0x53, 0x46, 0x58, }; if (fileContent.Contains(check, out _)) return "Software Installation Version 2.0 (32-bit)"; - // WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............���3....�P..............�P..�P..�P..VW95SE.SFX + // .............���3....�P..............�P..�P..�P..VW95SE.SFX check = new byte[] { - 0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52, - 0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45, - 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72, - 0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, - 0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31, - 0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E, - 0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20, - 0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E, - 0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x84, 0x82, 0x94, 0x33, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, 0x53, - 0x46, 0x58, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 0x82, 0x94, + 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, + 0x53, 0x46, 0x58, }; if (fileContent.Contains(check, out _)) return "Version 2.1 RC2 (32-bit)"; - // WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............���3....�P..............�P..�P..�P..VW95SRE.SFX + // .............���3....�P..............�P..�P..�P..VW95SRE.SFX check = new byte[] { - 0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52, - 0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45, - 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72, - 0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, - 0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31, - 0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E, - 0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20, - 0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E, - 0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xB0, 0x82, 0x94, 0x33, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, 0x2E, - 0x53, 0x46, 0x58, + 0x00, 0x00, 0x00, 0x00, 0x00, 0xB0, 0x82, 0x94, + 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, + 0x2E, 0x53, 0x46, 0x58, }; if (fileContent.Contains(check, out _)) return "Software Installation Version 2.1 RC2 (32-bit)"; - // WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............U��3....�P..............�P..�P..�P..VW95SE.SFX + // .............U��3....�P..............�P..�P..�P..VW95SE.SFX check = new byte[] { - 0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52, - 0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45, - 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72, - 0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, - 0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31, - 0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E, - 0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20, - 0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E, - 0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x55, 0xCD, 0xCC, 0x33, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, 0x53, - 0x46, 0x58, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x55, 0xCD, 0xCC, + 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, + 0x53, 0x46, 0x58, }; if (fileContent.Contains(check, out _)) return "Version 2.1 (32-bit)"; - // WinZip(R) Self-Extractor Copyright (c) 1995,96 Nico Mak Computing, Inc..............{��3....�P..............�P..�P..�P..VW95SRE.SFX + // .............{��3....�P..............�P..�P..�P..VW95SRE.SFX check = new byte[] { - 0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x28, 0x52, - 0x29, 0x20, 0x53, 0x65, 0x6C, 0x66, 0x2D, 0x45, - 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6F, 0x72, - 0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, - 0x68, 0x74, 0x20, 0x28, 0x63, 0x29, 0x20, 0x31, - 0x39, 0x39, 0x35, 0x2C, 0x39, 0x36, 0x20, 0x4E, - 0x69, 0x63, 0x6F, 0x20, 0x4D, 0x61, 0x6B, 0x20, - 0x43, 0x6F, 0x6D, 0x70, 0x75, 0x74, 0x69, 0x6E, - 0x67, 0x2C, 0x20, 0x49, 0x6E, 0x63, 0x2E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x7B, 0xCD, 0xCC, 0x33, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, 0x00, - 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, 0x2E, - 0x53, 0x46, 0x58, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x7B, 0xCD, 0xCC, + 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, + 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, + 0x2E, 0x53, 0x46, 0x58, }; if (fileContent.Contains(check, out _)) return "Software Installation Version 2.1 (32-bit)"; - // I'm not as sure about version 2.2 detection, so check for _winzip_ to prevent any false positives - // "_winzip_" - check = new byte[] { 0x5F, 0x77, 0x69, 0x6E, 0x7A, 0x69, 0x70, 0x5F }; - if (fileContent.Contains(check, out _)) + #endregion + + #region 32-bit PE Header Checks + + // PE..L...i.[:........�........J...*......�9.......`....@. + check = new byte[] { - // ....$.......�'~S�F..�F..�F..�F..�F...@..�F...Z..�F..Rich�F..........................PE..L...i.[:........�........J...*......�9.......`....@. - check = new byte[] - { - 0x2E, 0x0D, 0x0D, 0x0A, 0x24, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xD2, 0x27, 0x7E, 0x53, - 0x96, 0x46, 0x10, 0x00, 0x96, 0x46, 0x10, 0x00, - 0x96, 0x46, 0x10, 0x00, 0x96, 0x46, 0x10, 0x00, - 0xEA, 0x46, 0x10, 0x00, 0x12, 0x40, 0x16, 0x00, - 0x97, 0x46, 0x10, 0x00, 0x11, 0x5A, 0x12, 0x00, - 0x97, 0x46, 0x10, 0x00, 0x52, 0x69, 0x63, 0x68, - 0x96, 0x46, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x50, 0x45, 0x00, 0x00, - 0x4C, 0x01, 0x05, 0x00, 0x69, 0x1B, 0x5B, 0x3A, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xE0, 0x00, 0x0F, 0x01, 0x0B, 0x01, 0x05, 0x0A, - 0x00, 0x4A, 0x00, 0x00, 0x00, 0x2A, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xD8, 0x39, 0x00, 0x00, - 0x00, 0x10, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, - 0x00, 0x00, 0x40, 0x00, - }; - if (fileContent.Contains(check, out _)) - return "Version 2.2.4003"; - - // ....$.......�'~S�F..�F..�F..�F...F...@..�F...Z..�F..Rich�F..........................PE..L.....[:........�........V...*.......?.......p....@. - check = new byte[] - { - 0x2E, 0x0D, 0x0D, 0x0A, 0x24, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xD2, 0x27, 0x7E, 0x53, - 0x96, 0x46, 0x10, 0x00, 0x96, 0x46, 0x10, 0x00, - 0x96, 0x46, 0x10, 0x00, 0x96, 0x46, 0x10, 0x00, - 0x1B, 0x46, 0x10, 0x00, 0x12, 0x40, 0x16, 0x00, - 0x97, 0x46, 0x10, 0x00, 0x11, 0x5A, 0x12, 0x00, - 0x97, 0x46, 0x10, 0x00, 0x52, 0x69, 0x63, 0x68, - 0x96, 0x46, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x50, 0x45, 0x00, 0x00, - 0x4C, 0x01, 0x05, 0x00, 0x81, 0x1B, 0x5B, 0x3A, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xE0, 0x00, 0x0F, 0x01, 0x0B, 0x01, 0x05, 0x0A, - 0x00, 0x56, 0x00, 0x00, 0x00, 0x2A, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x8F, 0x3F, 0x00, 0x00, - 0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, - 0x00, 0x00, 0x40, 0x00, - }; - if (fileContent.Contains(check, out _)) - return "Software Installation Version 2.2.4003"; - } + 0x50, 0x45, 0x00, 0x00, 0x4C, 0x01, 0x05, 0x00, + 0x69, 0x1B, 0x5B, 0x3A, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x0F, 0x01, + 0x0B, 0x01, 0x05, 0x0A, 0x00, 0x4A, 0x00, 0x00, + 0x00, 0x2A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xD8, 0x39, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, + 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, + }; + if (fileContent.Contains(check, out _)) + return "Version 2.2.4003"; + + // PE..L.....[:........�........V...*.......?.......p....@. + check = new byte[] + { + 0x50, 0x45, 0x00, 0x00, 0x4C, 0x01, 0x05, 0x00, + 0x81, 0x1B, 0x5B, 0x3A, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x0F, 0x01, + 0x0B, 0x01, 0x05, 0x0A, 0x00, 0x56, 0x00, 0x00, + 0x00, 0x2A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x8F, 0x3F, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, + 0x00, 0x70, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, + }; + if (fileContent.Contains(check, out _)) + return "Software Installation Version 2.2.4003"; + + #endregion return "Unknown Version 2.X"; }