From 1e20c1b147601b3d1e4d84e3712cdd7f93225d89 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Sun, 1 May 2022 21:02:59 -0700 Subject: [PATCH] Ensure packer consistency --- BurnOutSharp/PackerType/AdvancedInstaller.cs | 28 +++++++++++++++-- BurnOutSharp/PackerType/Armadillo.cs | 28 +++++++++++++++-- .../PackerType/AutoPlayMediaStudio.cs | 1 + BurnOutSharp/PackerType/CExe.cs | 2 +- BurnOutSharp/PackerType/EXEStealth.cs | 28 +++++++++++++++-- BurnOutSharp/PackerType/GenteeInstaller.cs | 1 - BurnOutSharp/PackerType/InnoSetup.cs | 3 +- BurnOutSharp/PackerType/InstallAnywhere.cs | 2 +- BurnOutSharp/PackerType/InstallerVISE.cs | 3 +- .../PackerType/IntelInstallationFramework.cs | 25 +++++++++++++++- BurnOutSharp/PackerType/NSIS.cs | 26 +++++++++++++++- BurnOutSharp/PackerType/PECompact.cs | 30 +++++++++++++++++-- BurnOutSharp/PackerType/Petite.cs | 28 +++++++++++++++-- BurnOutSharp/PackerType/SetupFactory.cs | 4 +-- BurnOutSharp/PackerType/Shrinker.cs | 25 +++++++++++++++- BurnOutSharp/PackerType/UPX.cs | 26 +++++++++++++++- BurnOutSharp/PackerType/dotFuscator.cs | 28 +++++++++++++++-- 17 files changed, 262 insertions(+), 26 deletions(-) diff --git a/BurnOutSharp/PackerType/AdvancedInstaller.cs b/BurnOutSharp/PackerType/AdvancedInstaller.cs index 312f6fa3..fdf7f967 100644 --- a/BurnOutSharp/PackerType/AdvancedInstaller.cs +++ b/BurnOutSharp/PackerType/AdvancedInstaller.cs @@ -1,13 +1,19 @@ +using System.Collections.Concurrent; using System.Collections.Generic; +using System.IO; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; using BurnOutSharp.Matching; namespace BurnOutSharp.PackerType { - // TODO: Add extraction and verify that all versions are detected - public class AdvancedInstaller : IPortableExecutableCheck + // TODO: Add extraction + // TODO: Verify that all versions are detected + public class AdvancedInstaller : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -37,5 +43,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } } diff --git a/BurnOutSharp/PackerType/Armadillo.cs b/BurnOutSharp/PackerType/Armadillo.cs index dcb6ccdb..870fc415 100644 --- a/BurnOutSharp/PackerType/Armadillo.cs +++ b/BurnOutSharp/PackerType/Armadillo.cs @@ -1,4 +1,6 @@ -using System.Collections.Generic; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.IO; using System.Linq; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; @@ -6,9 +8,13 @@ using BurnOutSharp.Matching; namespace BurnOutSharp.PackerType { + // TODO: Add extraction // TODO: Add version checking, if possible - public class Armadillo : IPortableExecutableCheck + public class Armadillo : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -42,5 +48,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } } diff --git a/BurnOutSharp/PackerType/AutoPlayMediaStudio.cs b/BurnOutSharp/PackerType/AutoPlayMediaStudio.cs index bf2c76dc..f9b896ee 100644 --- a/BurnOutSharp/PackerType/AutoPlayMediaStudio.cs +++ b/BurnOutSharp/PackerType/AutoPlayMediaStudio.cs @@ -9,6 +9,7 @@ namespace BurnOutSharp.PackerType { // Created by IndigoRose (creators of Setup Factory), primarily to be used to create autorun menus for various media. // Official website: https://www.autoplay.org/ + // TODO: Add extraction public class AutoPlayMediaStudio : IPortableExecutableCheck, IScannable { /// diff --git a/BurnOutSharp/PackerType/CExe.cs b/BurnOutSharp/PackerType/CExe.cs index d475f6f1..f6c8548f 100644 --- a/BurnOutSharp/PackerType/CExe.cs +++ b/BurnOutSharp/PackerType/CExe.cs @@ -9,6 +9,7 @@ namespace BurnOutSharp.PackerType { // The official website for CExe also includes the source code (which does have to be retrieved by the Wayback Machine) // http://www.scottlu.com/Content/CExe.html + // TODO: Add extraction public class CExe : IPortableExecutableCheck, IScannable { /// @@ -56,7 +57,6 @@ namespace BurnOutSharp.PackerType } /// - // TODO: Add extraction if viable public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) { return null; diff --git a/BurnOutSharp/PackerType/EXEStealth.cs b/BurnOutSharp/PackerType/EXEStealth.cs index 0c80f486..8f9b1469 100644 --- a/BurnOutSharp/PackerType/EXEStealth.cs +++ b/BurnOutSharp/PackerType/EXEStealth.cs @@ -1,4 +1,6 @@ -using System.Collections.Generic; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.IO; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; using BurnOutSharp.Matching; @@ -8,8 +10,12 @@ namespace BurnOutSharp.PackerType // TODO: Figure out how to more granularly determine versions like PiD, // at least for the 2.41 -> 2.75 range // TODO: Detect 3.15 and up (maybe looking for `Metamorphism`) - public class EXEStealth : IContentCheck, IPortableExecutableCheck + // TODO: Add extraction + public class EXEStealth : IContentCheck, IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckContents(string file, byte[] fileContent, bool includeDebug) { @@ -60,5 +66,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } } diff --git a/BurnOutSharp/PackerType/GenteeInstaller.cs b/BurnOutSharp/PackerType/GenteeInstaller.cs index e7aca3b5..ee1d3884 100644 --- a/BurnOutSharp/PackerType/GenteeInstaller.cs +++ b/BurnOutSharp/PackerType/GenteeInstaller.cs @@ -60,7 +60,6 @@ namespace BurnOutSharp.PackerType } /// - // TODO: Add extraction if viable public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) { return null; diff --git a/BurnOutSharp/PackerType/InnoSetup.cs b/BurnOutSharp/PackerType/InnoSetup.cs index e211f9a2..079e9856 100644 --- a/BurnOutSharp/PackerType/InnoSetup.cs +++ b/BurnOutSharp/PackerType/InnoSetup.cs @@ -11,6 +11,7 @@ using BurnOutSharp.Matching; namespace BurnOutSharp.PackerType { + // TODO: Add extraction - https://github.com/dscharrer/InnoExtract public class InnoSetup : INewExecutableCheck, IPortableExecutableCheck, IScannable { /// @@ -79,8 +80,6 @@ namespace BurnOutSharp.PackerType } } - // TOOO: Add Inno Setup extraction - // https://github.com/dscharrer/InnoExtract /// public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) { diff --git a/BurnOutSharp/PackerType/InstallAnywhere.cs b/BurnOutSharp/PackerType/InstallAnywhere.cs index bf249c92..b8b669fe 100644 --- a/BurnOutSharp/PackerType/InstallAnywhere.cs +++ b/BurnOutSharp/PackerType/InstallAnywhere.cs @@ -7,6 +7,7 @@ using BurnOutSharp.Tools; namespace BurnOutSharp.PackerType { + // TODO: Add extraction, which may be possible with the current libraries but needs to be investigated further. public class InstallAnywhere : IPortableExecutableCheck, IScannable { /// @@ -44,7 +45,6 @@ namespace BurnOutSharp.PackerType } /// - // TODO: Add extraction, which may be possible with the current libraries but needs to be investigated further. public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) { return null; diff --git a/BurnOutSharp/PackerType/InstallerVISE.cs b/BurnOutSharp/PackerType/InstallerVISE.cs index 2ed6cf84..1e7fb09d 100644 --- a/BurnOutSharp/PackerType/InstallerVISE.cs +++ b/BurnOutSharp/PackerType/InstallerVISE.cs @@ -7,6 +7,7 @@ using BurnOutSharp.Matching; namespace BurnOutSharp.PackerType { + // TODO: Add extraction - https://github.com/Bioruebe/UniExtract2 public class InstallerVISE : IPortableExecutableCheck, IScannable { /// @@ -36,8 +37,6 @@ namespace BurnOutSharp.PackerType return null; } - // TODO: Add Installer VISE extraction - // https://github.com/Bioruebe/UniExtract2 /// public ConcurrentDictionary> Scan(Scanner scanner, string file) { diff --git a/BurnOutSharp/PackerType/IntelInstallationFramework.cs b/BurnOutSharp/PackerType/IntelInstallationFramework.cs index 298f470b..c12870ee 100644 --- a/BurnOutSharp/PackerType/IntelInstallationFramework.cs +++ b/BurnOutSharp/PackerType/IntelInstallationFramework.cs @@ -1,4 +1,6 @@ using System; +using System.Collections.Concurrent; +using System.IO; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; using BurnOutSharp.Tools; @@ -6,8 +8,11 @@ using BurnOutSharp.Tools; namespace BurnOutSharp.PackerType { // TODO: Add extraction, seems to primarily use MSZip compression. - public class IntelInstallationFramework : IPortableExecutableCheck + public class IntelInstallationFramework : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -34,5 +39,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } } diff --git a/BurnOutSharp/PackerType/NSIS.cs b/BurnOutSharp/PackerType/NSIS.cs index 885cf1eb..8f718f16 100644 --- a/BurnOutSharp/PackerType/NSIS.cs +++ b/BurnOutSharp/PackerType/NSIS.cs @@ -1,12 +1,18 @@ +using System.Collections.Concurrent; using System.Collections.Generic; +using System.IO; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; using BurnOutSharp.Matching; namespace BurnOutSharp.PackerType { - public class NSIS : IPortableExecutableCheck + // TODO: Add extraction + public class NSIS : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -39,5 +45,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } } \ No newline at end of file diff --git a/BurnOutSharp/PackerType/PECompact.cs b/BurnOutSharp/PackerType/PECompact.cs index f222c76f..1e7b45b2 100644 --- a/BurnOutSharp/PackerType/PECompact.cs +++ b/BurnOutSharp/PackerType/PECompact.cs @@ -1,11 +1,17 @@ -using BurnOutSharp.ExecutableType.Microsoft.PE; +using System.Collections.Concurrent; +using System.IO; +using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; namespace BurnOutSharp.PackerType { - // TODO: Add extraction and better version detection - public class PECompact : IPortableExecutableCheck + // TODO: Better version detection + // TODO: Add extraction + public class PECompact : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -38,5 +44,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } } diff --git a/BurnOutSharp/PackerType/Petite.cs b/BurnOutSharp/PackerType/Petite.cs index ebc2e2e9..8044ca85 100644 --- a/BurnOutSharp/PackerType/Petite.cs +++ b/BurnOutSharp/PackerType/Petite.cs @@ -1,10 +1,16 @@ -using BurnOutSharp.ExecutableType.Microsoft.PE; +using System.Collections.Concurrent; +using System.IO; +using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; namespace BurnOutSharp.PackerType { - public class PEtite : IPortableExecutableCheck + // TODO: Add extraction + public class PEtite : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -20,5 +26,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } } diff --git a/BurnOutSharp/PackerType/SetupFactory.cs b/BurnOutSharp/PackerType/SetupFactory.cs index 72eaf260..0d6cf39b 100644 --- a/BurnOutSharp/PackerType/SetupFactory.cs +++ b/BurnOutSharp/PackerType/SetupFactory.cs @@ -7,6 +7,8 @@ using BurnOutSharp.Tools; namespace BurnOutSharp.PackerType { + // TODO: Add extraction, which is possible but the only tools available that can + // do this seem to be Universal Extractor 2 and InstallExplorer (https://totalcmd.net/plugring/InstallExplorer.html) public class SetupFactory : IPortableExecutableCheck, IScannable { /// @@ -53,8 +55,6 @@ namespace BurnOutSharp.PackerType } /// - // TODO: Add extraction, which is possible but the only tools available that can - // do this seem to be Universal Extractor 2 and InstallExplorer (https://totalcmd.net/plugring/InstallExplorer.html) public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) { return null; diff --git a/BurnOutSharp/PackerType/Shrinker.cs b/BurnOutSharp/PackerType/Shrinker.cs index f7ddd4c8..5c714228 100644 --- a/BurnOutSharp/PackerType/Shrinker.cs +++ b/BurnOutSharp/PackerType/Shrinker.cs @@ -1,11 +1,16 @@ +using System.Collections.Concurrent; +using System.IO; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; namespace BurnOutSharp.PackerType { // TODO: Add extraction - public class Shrinker : IPortableExecutableCheck + public class Shrinker : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -22,5 +27,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } } diff --git a/BurnOutSharp/PackerType/UPX.cs b/BurnOutSharp/PackerType/UPX.cs index 455baae9..68c020c1 100644 --- a/BurnOutSharp/PackerType/UPX.cs +++ b/BurnOutSharp/PackerType/UPX.cs @@ -1,4 +1,6 @@ +using System.Collections.Concurrent; using System.Collections.Generic; +using System.IO; using System.Text; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; @@ -6,8 +8,12 @@ using BurnOutSharp.Matching; namespace BurnOutSharp.PackerType { - public class UPX : IPortableExecutableCheck + // TODO: Add extraction + public class UPX : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -45,6 +51,24 @@ namespace BurnOutSharp.PackerType return null; } + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } + public static string GetVersion(string file, byte[] fileContent, List positions) { try diff --git a/BurnOutSharp/PackerType/dotFuscator.cs b/BurnOutSharp/PackerType/dotFuscator.cs index c30b219b..d149937c 100644 --- a/BurnOutSharp/PackerType/dotFuscator.cs +++ b/BurnOutSharp/PackerType/dotFuscator.cs @@ -1,12 +1,18 @@ -using System.Collections.Generic; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.IO; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; using BurnOutSharp.Matching; namespace BurnOutSharp.PackerType { - public class dotFuscator : IPortableExecutableCheck + // TODO: Add extraction + public class dotFuscator : IPortableExecutableCheck, IScannable { + /// + public bool ShouldScan(byte[] magic) => true; + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -36,5 +42,23 @@ namespace BurnOutSharp.PackerType return null; } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.OpenRead(file)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + return null; + } } }