From 1f66edc201f367f1c22b4667154d018efb5eda7c Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Wed, 27 Jul 2022 11:10:46 -0700 Subject: [PATCH] Fix some resource finding --- .../ExecutableType/Microsoft/PE/PortableExecutable.cs | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs index f4629b6c..295378ed 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs @@ -629,6 +629,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE { if (rdte.IsResourceDataEntry() && rdte.DataEntry != null) { + // Ignore if we have a nested executable + // TODO: Support nested executables + if (rdte.DataEntry.DataAsUTF8String.StartsWith("MZ")) + return null; + if (dataStart != null && rdte.DataEntry.DataAsUTF8String.StartsWith(dataStart)) return rdte.DataEntry; else if (dataContains != null && rdte.DataEntry.DataAsUTF8String.Contains(dataContains)) @@ -648,6 +653,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE { if (rdte.IsResourceDataEntry() && rdte.DataEntry != null) { + // Ignore if we have a nested executable + // TODO: Support nested executables + if (rdte.DataEntry.DataAsUTF8String.StartsWith("MZ")) + return null; + if (dataStart != null && rdte.DataEntry.DataAsUTF8String.StartsWith(dataStart)) return rdte.DataEntry; else if (dataContains != null && rdte.DataEntry.DataAsUTF8String.Contains(dataContains))