diff --git a/BurnOutSharp/PackerType/InstallerVISE.cs b/BurnOutSharp/PackerType/InstallerVISE.cs index e59d3c03..7d316198 100644 --- a/BurnOutSharp/PackerType/InstallerVISE.cs +++ b/BurnOutSharp/PackerType/InstallerVISE.cs @@ -1,7 +1,11 @@ using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; +using System.Linq; +using System.Text; +using BurnOutSharp.ExecutableType.Microsoft; using BurnOutSharp.Matching; +using BurnOutSharp.Tools; namespace BurnOutSharp.PackerType { @@ -11,20 +15,40 @@ namespace BurnOutSharp.PackerType public bool ShouldScan(byte[] magic) => true; /// - public List GetContentMatchSets() - { - return new List - { - // ViseMain - new ContentMatchSet( - new ContentMatch(new byte?[] { 0x56, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, start: 0xE0A4, end: 0xE0A5), - "Installer VISE"), - }; - } + public List GetContentMatchSets() => null; //TODO: Add exact version detection for Windows builds, make sure versions before 3.X are detected as well, and detect the Mac builds. /// - public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null; + public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) + { + // Get the sections from the executable, if possible + PEExecutable pex = PEExecutable.Deserialize(fileContent, 0); + var sections = pex?.SectionHeaders; + if (sections == null) + return null; + + // Get the DATA/.data section, if it exists + var dataSection = sections.FirstOrDefault(s => { + string name = Encoding.ASCII.GetString(s.Name).Trim('\0'); + return name.StartsWith("DATA") || name.StartsWith(".data"); + }); + if (dataSection != null) + { + int sectionAddr = (int)EVORE.ConvertVirtualAddress(dataSection.VirtualAddress, sections); + int sectionEnd = sectionAddr + (int)dataSection.VirtualSize; + var matchers = new List + { + // ViseMain + new ContentMatchSet( + new ContentMatch(new byte?[] { 0x56, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, start: sectionAddr, end: sectionEnd), + "Installer VISE"), + }; + + return MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug); + } + + return null; + } // TODO: Add Installer VISE extraction // https://github.com/Bioruebe/UniExtract2