SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-09 02:16:46 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add overlay string finding

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-10 20:10:25 -08:00
parent d1a6c9be00
commit 4ad7c60443
5 changed files with 98 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
BurnOutSharp.Wrappers/PortableExecutable.cs
View File

@@ -383,7 +383,7 @@ namespace BurnOutSharp.Wrappers
/// Overlay data, if it exists
/// </summary>
/// <see href="https://www.autoitscript.com/forum/topic/153277-pe-file-overlay-extraction/"/>
public byte[] Overlay
public byte[] OverlayData
{
get
{
@@ -451,6 +451,77 @@ namespace BurnOutSharp.Wrappers
}
}
/// <summary>
/// Overlay strings, if they exist
/// </summary>
public List<string> OverlayStrings
{
get
{
lock (_sourceDataLock)
{
// Use the cached data if possible
if (_overlayStrings != null)
return _overlayStrings;
// Get the end of the file, if possible
int endOfFile = GetEndOfFile();
if (endOfFile == -1)
return null;
// If we have certificate data, use that as the end
if (OH_CertificateTable != null)
{
var certificateTable = _executable.OptionalHeader.CertificateTable;
int certificateTableAddress = (int)certificateTable.VirtualAddress.ConvertVirtualAddress(_executable.SectionTable);
if (certificateTableAddress != 0 && certificateTableAddress < endOfFile)
endOfFile = certificateTableAddress;
}
// Search through all sections and find the furthest a section goes
int endOfSectionData = -1;
foreach (var section in _executable.SectionTable)
{
// If we have an invalid section address
int sectionAddress = (int)section.VirtualAddress.ConvertVirtualAddress(_executable.SectionTable);
if (sectionAddress == 0)
continue;
// If we have an invalid section size
if (section.SizeOfRawData == 0 && section.VirtualSize == 0)
continue;
// Get the real section size
int sectionSize;
if (section.SizeOfRawData < section.VirtualSize)
sectionSize = (int)section.VirtualSize;
else
sectionSize = (int)section.SizeOfRawData;
// Compare and set the end of section data
if (sectionAddress + sectionSize > endOfSectionData)
endOfSectionData = sectionAddress + sectionSize;
}
// If we didn't find the end of section data
if (endOfSectionData <= 0)
return null;
// If we're at the end of the file, cache an empty list
if (endOfSectionData >= endOfFile)
{
_overlayStrings = new List<string>();
return _overlayStrings;
}
// Otherwise, cache and return the strings
int overlayLength = endOfFile - endOfSectionData;
_overlayStrings = ReadStringsFromDataSource(endOfSectionData, overlayLength, charLimit: 3);
return _overlayStrings;
}
}
}
/// <summary>
/// Sanitized section names
/// </summary>
@@ -691,16 +762,20 @@ namespace BurnOutSharp.Wrappers
private byte[] _headerPaddingData = null;
/// <summary>
/// Header padding data, if it exists
/// Header padding strings, if they exist
/// </summary>
private List<string> _headerPaddingStrings = null;
/// <summary>
/// Overlay data, if it exists
/// </summary>
/// TODO: Add overlay string data
private byte[] _overlayData = null;
/// <summary>
/// Overlay strings, if they exist
/// </summary>
private List<string> _overlayStrings = null;
/// <summary>
/// Stub executable data, if it exists
/// </summary>

4
BurnOutSharp.Wrappers/WrapperBase.cs
View File

@@ -189,6 +189,10 @@ namespace BurnOutSharp.Wrappers
// Check for Unicode strings
while (sourceDataIndex < sourceData.Length)
{
// Unicode characters are always 2 bytes
if (sourceDataIndex == sourceData.Length - 1)
break;
ushort ch = BitConverter.ToUInt16(sourceData, sourceDataIndex);
// If we have a null terminator or "invalid" character

13
BurnOutSharp/ProtectionType/ActiveMARK.cs
View File

@@ -55,17 +55,10 @@ namespace BurnOutSharp.ProtectionType
// TODO: Add entry point checks from https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt
// Get the overlay data, if it exists
if (pex.Overlay != null)
if (pex.OverlayStrings != null)
{
var matchers = new List<ContentMatchSet>
{
// (char)0x00 + TMSAMVOH
new ContentMatchSet(new byte?[] { 0x00, 0x54, 0x4D, 0x53, 0x41, 0x4D, 0x56, 0x4F, 0x48, }, "ActiveMARK"),
};
string match = MatchUtil.GetFirstMatch(file, pex.Overlay, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
if (pex.OverlayStrings.Any(s => s.Contains("TMSAMVOH")))
return "ActiveMARK";
}
// Get the last .bss section strings, if they exist

15
BurnOutSharp/ProtectionType/AlphaROM.cs
View File

@@ -75,18 +75,11 @@ namespace BurnOutSharp.ProtectionType
}
// Get the overlay data, if it exists
if (pex.Overlay != null)
if (pex.OverlayStrings != null)
{
var matchers = new List<ContentMatchSet>
{
// Found in Redump entry 84122.
// SETTEC0000
new ContentMatchSet(new byte?[] { 0x53, 0x45, 0x54, 0x54, 0x45, 0x43, 0x30, 0x30, 0x30, 0x30 }, "Alpha-ROM"),
};
string match = MatchUtil.GetFirstMatch(file, pex.Overlay, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Found in Redump entry 84122.
if (pex.OverlayStrings.Any(s => s.Contains("SETTEC0000")))
return "Alpha-ROM";
}
return null;

25
BurnOutSharp/ProtectionType/SecuROM.cs
View File

@@ -53,17 +53,10 @@ namespace BurnOutSharp.ProtectionType
return $"SecuROM SLL Protected (for SecuROM v8.x)";
// Search after the last section
if (pex.Overlay != null)
if (pex.OverlayStrings != null)
{
var matchers = new List<ContentMatchSet>
{
// AddD + (char)0x03 + (char)0x00 + (char)0x00 + (char)0x00)
new ContentMatchSet(new byte?[] { 0x41, 0x64, 0x64, 0x44, 0x03, 0x00, 0x00, 0x00 }, GetV4Version, "SecuROM"),
};
string match = MatchUtil.GetFirstMatch(file, pex.Overlay, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
if (pex.OverlayStrings.Any(s => s == "AddD"))
return $"SecuROM {GetV4Version(pex)}";
}
// Get the sections 5+, if they exist (example names: .fmqyrx, .vcltz, .iywiak)
@@ -161,19 +154,19 @@ namespace BurnOutSharp.ProtectionType
return MatchUtil.GetFirstMatch(path, matchers, any: true);
}
public static string GetV4Version(string file, byte[] fileContent, List<int> positions)
private static string GetV4Version(PortableExecutable pex)
{
int index = positions[0] + 8; // Begin reading after "AddD"
char version = (char)fileContent[index];
int index = 8; // Begin reading after "AddD"
char version = (char)pex.OverlayData[index];
index += 2;
string subVersion = Encoding.ASCII.GetString(fileContent, index, 2);
string subVersion = Encoding.ASCII.GetString(pex.OverlayData, index, 2);
index += 3;
string subSubVersion = Encoding.ASCII.GetString(fileContent, index, 2);
string subSubVersion = Encoding.ASCII.GetString(pex.OverlayData, index, 2);
index += 3;
string subSubSubVersion = Encoding.ASCII.GetString(fileContent, index, 4);
string subSubSubVersion = Encoding.ASCII.GetString(pex.OverlayData, index, 4);
if (!char.IsNumber(version))
return "(very old, v3 or less)";