From 3dcce8a8acab27f91d016711317537debd1c8311 Mon Sep 17 00:00:00 2001
From: SilasLaspada <silasqwerty@ymail.com>
Date: Mon, 23 Aug 2021 23:56:31 -0600
Subject: [PATCH] Add support for Intel Installation Framework detection (#57)

* Add support for Intel Installation Framework detection

* Address reviews
---
 .../PackerType/IntelInstallationFramework.cs  | 32 +++++++++++++++++++
 README.md                                     |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 BurnOutSharp/PackerType/IntelInstallationFramework.cs

diff --git a/BurnOutSharp/PackerType/IntelInstallationFramework.cs b/BurnOutSharp/PackerType/IntelInstallationFramework.cs
new file mode 100644
index 00000000..3c1fb4b7
--- /dev/null
+++ b/BurnOutSharp/PackerType/IntelInstallationFramework.cs
@@ -0,0 +1,32 @@
+using System;
+
+namespace BurnOutSharp.PackerType
+{
+    // TODO: Add extraction, seems to primarily use MSZip compression.
+    public class IntelInstallationFramework : IContentCheck
+    {
+        /// <inheritdoc/>
+        public string CheckContents(string file, byte[] fileContent, bool includePosition = false)
+        {
+            var fvinfo = Utilities.GetFileVersionInfo(file);
+
+            string name = fvinfo?.FileDescription.Trim();
+            if (!string.IsNullOrWhiteSpace(name)
+                && (name.Equals("Intel(R) Installation Framework", StringComparison.OrdinalIgnoreCase)
+                || name.Equals("Intel Installation Framework", StringComparison.OrdinalIgnoreCase)))
+            {
+                return $"Intel Installation Framework {Utilities.GetFileVersion(file)}";
+            }
+
+            name = fvinfo?.ProductName.Trim();
+            if (!string.IsNullOrWhiteSpace(name)
+                && (name.Equals("Intel(R) Installation Framework", StringComparison.OrdinalIgnoreCase)
+                || name.Equals("Intel Installation Framework", StringComparison.OrdinalIgnoreCase)))
+            {
+                return $"Intel Installation Framework {Utilities.GetFileVersion(file)}";
+            }
+
+            return null;
+        }
+    }
+}
diff --git a/README.md b/README.md
index b6ef7e87..fd2ea723 100644
--- a/README.md
+++ b/README.md
@@ -95,6 +95,7 @@ Below is a list of the executable packers that can be detected using this code:
 - EXE Stealth
 - Inno Setup
 - Installer VISE
+- Intel Installation Framework
 - Microsoft CAB SFX
 - NSIS
 - PECompact