SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-22 06:45:03 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Clean up remarks, add SFX trailing name

Browse Source
This commit is contained in:
Matt Nadareski
2025-09-26 08:35:25 -04:00
parent 2a7455252e
commit 1765e4da16
1 changed files with 2 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
BinaryObjectScanner/Packer/AdvancedInstaller.cs
View File

@@ -3,30 +3,8 @@ using SabreTools.Serialization.Wrappers;
namespace BinaryObjectScanner.Packer
{
// TODO: Add extraction
// TODO: Add extraction based on SFX research
// TODO: Verify that all versions are detected
// Using the file "ds-1.0.6-patch.exe", it seems like the way that AdvancedInstaller
// works is by packing all of the files sequentially in the overlay and referencing
// them somehow. This has the unfortunate effect that, if any of these files are
// executables, then every single file appears embedded in the first's overlay.
// While this technically extracts the data, it does so improperly. It may require
// using the size of image and headers for overlay-extracted data.
//
// Further research shows that there is a signature at the end of the overlay:
// "41 44 56 49 4E 53 54 53 46 58 00 00" (ADVINSTSFX\0\0)
// Above it is something resembling the central directory of a PKZIP file,
// including clear entries that represent each file. This structure needs to
// be documented in Models.
//
// Right before the signature is what looks to be a hex string, potentially
// a key or identifier. Directly preceeding that is a 32-bit value that seems
// to correspond to the offset of the first data item.
//
// Each entry appears to be 40 bytes long, starting near a 0x0C. The name of the
// file is one of the last things in the list. Names appear to be UTF-16 encoded.
// There is a 32-bit value before the string that seems to represent the length
// of the name. More investigation is needed to find where the file length and
// file offset are stored.
public class AdvancedInstaller : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
@@ -37,7 +15,7 @@ namespace BinaryObjectScanner.Packer
if (strs != null)
{
if (strs.Exists(s => s.Contains("Software\\Caphyon\\Advanced Installer")))
return "Caphyon Advanced Installer";
return "Caphyon Advanced Installer SFX";
}
return null;