diff --git a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs index f4629b6c..295378ed 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs @@ -629,6 +629,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE { if (rdte.IsResourceDataEntry() && rdte.DataEntry != null) { + // Ignore if we have a nested executable + // TODO: Support nested executables + if (rdte.DataEntry.DataAsUTF8String.StartsWith("MZ")) + return null; + if (dataStart != null && rdte.DataEntry.DataAsUTF8String.StartsWith(dataStart)) return rdte.DataEntry; else if (dataContains != null && rdte.DataEntry.DataAsUTF8String.Contains(dataContains)) @@ -648,6 +653,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE { if (rdte.IsResourceDataEntry() && rdte.DataEntry != null) { + // Ignore if we have a nested executable + // TODO: Support nested executables + if (rdte.DataEntry.DataAsUTF8String.StartsWith("MZ")) + return null; + if (dataStart != null && rdte.DataEntry.DataAsUTF8String.StartsWith(dataStart)) return rdte.DataEntry; else if (dataContains != null && rdte.DataEntry.DataAsUTF8String.Contains(dataContains))