SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-24 15:54:57 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Ensure packer consistency

Browse Source
This commit is contained in:
Matt Nadareski
2022-05-01 21:02:59 -07:00
parent c16946ace7
commit 1e20c1b147
17 changed files with 262 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
BurnOutSharp/PackerType/AdvancedInstaller.cs
View File

@@ -1,13 +1,19 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction and verify that all versions are detected
public class AdvancedInstaller : IPortableExecutableCheck
// TODO: Add extraction
// TODO: Verify that all versions are detected
public class AdvancedInstaller : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -37,5 +43,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}

28
BurnOutSharp/PackerType/Armadillo.cs
View File

@@ -1,4 +1,6 @@
using System.Collections.Generic;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
@@ -6,9 +8,13 @@ using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction
// TODO: Add version checking, if possible
public class Armadillo : IPortableExecutableCheck
public class Armadillo : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -42,5 +48,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}

1
BurnOutSharp/PackerType/AutoPlayMediaStudio.cs
View File

@@ -9,6 +9,7 @@ namespace BurnOutSharp.PackerType
{
// Created by IndigoRose (creators of Setup Factory), primarily to be used to create autorun menus for various media.
// Official website: https://www.autoplay.org/
// TODO: Add extraction
public class AutoPlayMediaStudio : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>

2
BurnOutSharp/PackerType/CExe.cs
View File

@@ -9,6 +9,7 @@ namespace BurnOutSharp.PackerType
{
// The official website for CExe also includes the source code (which does have to be retrieved by the Wayback Machine)
// http://www.scottlu.com/Content/CExe.html
// TODO: Add extraction
public class CExe : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
@@ -56,7 +57,6 @@ namespace BurnOutSharp.PackerType
}
/// <inheritdoc/>
// TODO: Add extraction if viable
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;

28
BurnOutSharp/PackerType/EXEStealth.cs
View File

@@ -1,4 +1,6 @@
using System.Collections.Generic;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
@@ -8,8 +10,12 @@ namespace BurnOutSharp.PackerType
// TODO: Figure out how to more granularly determine versions like PiD,
// at least for the 2.41 -> 2.75 range
// TODO: Detect 3.15 and up (maybe looking for `Metamorphism`)
public class EXEStealth : IContentCheck, IPortableExecutableCheck
// TODO: Add extraction
public class EXEStealth : IContentCheck, IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug)
{
@@ -60,5 +66,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}

1
BurnOutSharp/PackerType/GenteeInstaller.cs
View File

@@ -60,7 +60,6 @@ namespace BurnOutSharp.PackerType
}
/// <inheritdoc/>
// TODO: Add extraction if viable
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;

3
BurnOutSharp/PackerType/InnoSetup.cs
View File

@@ -11,6 +11,7 @@ using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction - https://github.com/dscharrer/InnoExtract
public class InnoSetup : INewExecutableCheck, IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
@@ -79,8 +80,6 @@ namespace BurnOutSharp.PackerType
}
}
// TOOO: Add Inno Setup extraction
// https://github.com/dscharrer/InnoExtract
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{

2
BurnOutSharp/PackerType/InstallAnywhere.cs
View File

@@ -7,6 +7,7 @@ using BurnOutSharp.Tools;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction, which may be possible with the current libraries but needs to be investigated further.
public class InstallAnywhere : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
@@ -44,7 +45,6 @@ namespace BurnOutSharp.PackerType
}
/// <inheritdoc/>
// TODO: Add extraction, which may be possible with the current libraries but needs to be investigated further.
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;

3
BurnOutSharp/PackerType/InstallerVISE.cs
View File

@@ -7,6 +7,7 @@ using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction - https://github.com/Bioruebe/UniExtract2
public class InstallerVISE : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
@@ -36,8 +37,6 @@ namespace BurnOutSharp.PackerType
return null;
}
// TODO: Add Installer VISE extraction
// https://github.com/Bioruebe/UniExtract2
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{

25
BurnOutSharp/PackerType/IntelInstallationFramework.cs
View File

@@ -1,4 +1,6 @@
using System;
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Tools;
@@ -6,8 +8,11 @@ using BurnOutSharp.Tools;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction, seems to primarily use MSZip compression.
public class IntelInstallationFramework : IPortableExecutableCheck
public class IntelInstallationFramework : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -34,5 +39,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}

26
BurnOutSharp/PackerType/NSIS.cs
View File

@@ -1,12 +1,18 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
public class NSIS : IPortableExecutableCheck
// TODO: Add extraction
public class NSIS : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -39,5 +45,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}

30
BurnOutSharp/PackerType/PECompact.cs
View File

@@ -1,11 +1,17 @@
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction and better version detection
public class PECompact : IPortableExecutableCheck
// TODO: Better version detection
// TODO: Add extraction
public class PECompact : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -38,5 +44,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}

28
BurnOutSharp/PackerType/Petite.cs
View File

@@ -1,10 +1,16 @@
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
namespace BurnOutSharp.PackerType
{
public class PEtite : IPortableExecutableCheck
// TODO: Add extraction
public class PEtite : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -20,5 +26,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}

4
BurnOutSharp/PackerType/SetupFactory.cs
View File

@@ -7,6 +7,8 @@ using BurnOutSharp.Tools;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction, which is possible but the only tools available that can
// do this seem to be Universal Extractor 2 and InstallExplorer (https://totalcmd.net/plugring/InstallExplorer.html)
public class SetupFactory : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
@@ -53,8 +55,6 @@ namespace BurnOutSharp.PackerType
}
/// <inheritdoc/>
// TODO: Add extraction, which is possible but the only tools available that can
// do this seem to be Universal Extractor 2 and InstallExplorer (https://totalcmd.net/plugring/InstallExplorer.html)
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;

25
BurnOutSharp/PackerType/Shrinker.cs
View File

@@ -1,11 +1,16 @@
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction
public class Shrinker : IPortableExecutableCheck
public class Shrinker : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -22,5 +27,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}

26
BurnOutSharp/PackerType/UPX.cs
View File

@@ -1,4 +1,6 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
@@ -6,8 +8,12 @@ using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
public class UPX : IPortableExecutableCheck
// TODO: Add extraction
public class UPX : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -45,6 +51,24 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
public static string GetVersion(string file, byte[] fileContent, List<int> positions)
{
try

28
BurnOutSharp/PackerType/dotFuscator.cs
View File

@@ -1,12 +1,18 @@
using System.Collections.Generic;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
public class dotFuscator : IPortableExecutableCheck
// TODO: Add extraction
public class dotFuscator : IPortableExecutableCheck, IScannable
{
/// <inheritdoc/>
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
@@ -36,5 +42,23 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
{
if (!File.Exists(file))
return null;
using (var fs = File.OpenRead(file))
{
return Scan(scanner, fs, file);
}
}
/// <inheritdoc/>
public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
{
return null;
}
}
}