diff --git a/BurnOutSharp/Scanner.cs b/BurnOutSharp/Scanner.cs index 3649cf21..11766d4f 100644 --- a/BurnOutSharp/Scanner.cs +++ b/BurnOutSharp/Scanner.cs @@ -405,14 +405,9 @@ namespace BurnOutSharp AppendToDictionary(protections, fileName, subProtections.Values.ToArray()); // If we have any extractable packers - var extractables = subProtections.Keys.Where(c => c is IExtractable).Select(c => c as IExtractable); - Parallel.ForEach(extractables, extractable => - { - // Get the protection for the class, if possible - var extractedProtections = Handler.HandleExtractable(extractable, fileName, stream, this); - if (extractedProtections != null) - AppendToDictionary(protections, extractedProtections); - }); + var extractedProtections = HandleExtractableProtections(subProtections.Keys, fileName, stream); + if (extractedProtections != null) + AppendToDictionary(protections, extractedProtections); } else if (wrapper is NewExecutable nex) { @@ -424,14 +419,9 @@ namespace BurnOutSharp AppendToDictionary(protections, fileName, subProtections.Values.ToArray()); // If we have any extractable packers - var extractables = subProtections.Keys.Where(c => c is IExtractable).Select(c => c as IExtractable); - Parallel.ForEach(extractables, extractable => - { - // Get the protection for the class, if possible - var extractedProtections = Handler.HandleExtractable(extractable, fileName, stream, this); - if (extractedProtections != null) - AppendToDictionary(protections, extractedProtections); - }); + var extractedProtections = HandleExtractableProtections(subProtections.Keys, fileName, stream); + if (extractedProtections != null) + AppendToDictionary(protections, extractedProtections); } else if (wrapper is PortableExecutable pex) { @@ -443,19 +433,43 @@ namespace BurnOutSharp AppendToDictionary(protections, fileName, subProtections.Values.ToArray()); // If we have any extractable packers - var extractables = subProtections.Keys.Where(c => c is IExtractable).Select(c => c as IExtractable); - Parallel.ForEach(extractables, extractable => - { - // Get the protection for the class, if possible - var extractedProtections = Handler.HandleExtractable(extractable, fileName, stream, this); - if (extractedProtections != null) - AppendToDictionary(protections, extractedProtections); - }); + var extractedProtections = HandleExtractableProtections(subProtections.Keys, fileName, stream); + if (extractedProtections != null) + AppendToDictionary(protections, extractedProtections); } return protections; } + /// + /// Handle extractable protections, such as executable packers + /// + /// Set of classes returned from Exectuable scans + /// Name of the source file of the stream, for tracking + /// Stream to scan the contents of + /// Set of protections found from extraction, null on error + private ConcurrentDictionary> HandleExtractableProtections(IEnumerable classes, string fileName, Stream stream) + { + // If we have an invalid set of classes + if (classes?.Any() != true) + return null; + + // Create the output dictionary + var protections = new ConcurrentDictionary>(); + + // If we have any extractable packers + var extractables = classes.Where(c => c is IExtractable).Select(c => c as IExtractable); + Parallel.ForEach(extractables, extractable => + { + // Get the protection for the class, if possible + var extractedProtections = Handler.HandleExtractable(extractable, fileName, stream, this); + if (extractedProtections != null) + AppendToDictionary(protections, extractedProtections); + }); + + return protections; + } + #endregion } }