SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-22 14:54:56 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add header matchers for Wise

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-27 10:53:28 -08:00
parent 68be17de66
commit 4da713702a
1 changed files with 114 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

116
BurnOutSharp/PackerType/WiseInstaller.cs
View File

@@ -6,8 +6,8 @@ using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
using Wise = WiseUnpacker.WiseUnpacker;
using static BurnOutSharp.Utilities.Dictionary;
using Wise = WiseUnpacker.WiseUnpacker;
namespace BurnOutSharp.PackerType
{
@@ -21,6 +21,10 @@ namespace BurnOutSharp.PackerType
if (nex == null)
return null;
// If we match a known header
if (MatchesNEVersion(nex))
return "Wise Installation Wizard Module";
// TODO: Don't read entire file
var data = nex.ReadArbitraryRange();
if (data == null)
@@ -33,7 +37,7 @@ namespace BurnOutSharp.PackerType
// WiseMain
new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"),
};
return MatchUtil.GetFirstMatch(file, data, neMatchSets, includeDebug);
}
@@ -45,6 +49,10 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
// If we match a known header
if (MatchesPEVersion(pex))
return "Wise Installation Wizard Module";
// TODO: Investigate STUB32.EXE in export directory table
// Get the .data/DATA section strings, if they exist
@@ -115,5 +123,109 @@ namespace BurnOutSharp.PackerType
return null;
}
/// <summary>
/// Checks an NE header to see if it matches a known signature
/// </summary>
/// <param name="nex">New executable to check</param>
/// <returns>True if it matches a known version, false otherwise</returns>
private bool MatchesNEVersion(NewExecutable nex)
{
switch (nex.Stub_NewExeHeaderAddr)
{
// Dll = false, ArchiveStart = 0x11, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = true
case 0x84b0: return true;
// Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false
case 0x3e10: return true;
// Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false
case 0x3e50: return true;
// Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false
case 0x3c20: return true;
// Dll = false, ArchiveStart = 0x22, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false
case 0x3c30: return true;
// Dll = false, ArchiveStart = 0x40, ArchiveEnd = 0x3c, InitText = false, FilenamePosition = 0x04, NoCrc = false
case 0x3660: return true;
// Dll = false, ArchiveStart = 0x48, ArchiveEnd = 0x44, InitText = false, FilenamePosition = 0x1c, NoCrc = false
case 0x36f0: return true;
// Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
case 0x3770: return true;
// Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
case 0x3780: return true;
// Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
case 0x37b0: return true;
// Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
case 0x37d0: return true;
// Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
case 0x3c80: return true;
// Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
case 0x3bd0: return true;
// Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
case 0x3c10: return true;
default: return false;
}
}
/// <summary>
/// Checks a PE header to see if it matches a known signature
/// </summary>
/// <param name="pex">Portable executable to check</param>
/// <returns>True if it matches a known version, false otherwise</returns>
private bool MatchesPEVersion(PortableExecutable pex)
{
// Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
if (pex.Stub_NewExeHeaderAddr == 0x6e00
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4
&& pex.GetFirstSection(".data")?.VirtualSize == 0x1528)
return true;
// Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
else if (pex.Stub_NewExeHeaderAddr == 0x6e00
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4
&& pex.GetFirstSection(".data")?.VirtualSize == 0x1568)
return true;
// Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
else if (pex.Stub_NewExeHeaderAddr == 0x6e00
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3d54)
return true;
// Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
else if (pex.Stub_NewExeHeaderAddr == 0x6e00
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3d44)
return true;
// Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
else if (pex.Stub_NewExeHeaderAddr == 0x6e00
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3d04)
return true;
// Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
else if (pex.Stub_NewExeHeaderAddr == 0x3000)
return true;
// Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
else if (pex.Stub_NewExeHeaderAddr == 0x3800)
return true;
// Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
else if (pex.Stub_NewExeHeaderAddr == 0x3a00)
return true;
return false;
}
}
}