diff --git a/BurnOutSharp/PackerType/PECompact.cs b/BurnOutSharp/PackerType/PECompact.cs
index 9bff21b0..70481d61 100644
--- a/BurnOutSharp/PackerType/PECompact.cs
+++ b/BurnOutSharp/PackerType/PECompact.cs
@@ -1,43 +1,52 @@
using System;
using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
+
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction and better version detection
public class PECompact : IContentCheck
{
///
- public List GetContentMatchSets()
- {
- // Another possible version string for version 1 is "PECO" (50 45 43 4F)
- return new List
- {
- // pec1
- new ContentMatchSet(new ContentMatch(new byte?[] { 0x70, 0x65, 0x63, 0x31 }, end: 2048), "PE Compact 1"),
-
- // PEC2
- new ContentMatchSet(new ContentMatch(new byte?[] { 0x50, 0x45, 0x43, 0x32 }, end: 2048), GetVersion, "PE Compact 2"),
-
- // PECompact2
- new ContentMatchSet(new byte?[]
- {
- 0x50, 0x45, 0x43, 0x6F, 0x6D, 0x70, 0x61, 0x63,
- 0x74, 0x32
- }, "PE Compact 2"),
- };
- }
+ public List GetContentMatchSets() => null;
///
- public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
-
- // TODO: Improve version detection, Protection ID is able to detect ranges of versions. For example, 1.66-1.84 or 2.20-3.02.
- public static string GetVersion(string file, byte[] fileContent, List positions)
+ public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
{
- short version = BitConverter.ToInt16(fileContent, positions[0] + 4);
- if (version == 0)
- return string.Empty;
- return $"(Internal Version {version})";
+ // Get the sections from the executable, if possible
+ PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
+ var sections = pex?.SectionTable;
+ if (sections == null)
+ return null;
+
+ // TODO: Do something with this information -
+ // PE Compact 1 uses the symbol table pointer in the file header to store the value 1329808720 / 50 45 43 4F / PECO
+ // Console.WriteLine($"{file} symbol table pointer: {pex.ImageFileHeader.PointerToSymbolTable}");
+ // Console.WriteLine($"{file} ptr as string: {Encoding.ASCII.GetString(BitConverter.GetBytes(pex.ImageFileHeader.PointerToSymbolTable))}");
+
+ // TODO: Get more granular version detection. PiD is somehow able to detect version ranges based
+ // on the data in the file. This may be related to information in other fields
+
+ // Get the pec1 section, if it exists
+ var pec1Section = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith("pec1"));
+ if (pec1Section != null)
+ return "PE Compact v1.x";
+
+ // Get the PEC2 section, if it exists
+ var textSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".text"));
+ if (textSection != null && textSection.PointerToRelocations == 0x32434550)
+ {
+ if (textSection.PointerToLinenumbers != 0)
+ return $"PE Compact v{textSection.PointerToLinenumbers} (internal version)";
+
+ return "PE Compact v2.x (or newer)";
+ }
+
+ return null;
}
}
}