diff --git a/BurnOutSharp/PackerType/WiseInstaller.cs b/BurnOutSharp/PackerType/WiseInstaller.cs
index 9da2a5e6..b473e689 100644
--- a/BurnOutSharp/PackerType/WiseInstaller.cs
+++ b/BurnOutSharp/PackerType/WiseInstaller.cs
@@ -6,8 +6,8 @@ using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
-using Wise = WiseUnpacker.WiseUnpacker;
using static BurnOutSharp.Utilities.Dictionary;
+using Wise = WiseUnpacker.WiseUnpacker;
namespace BurnOutSharp.PackerType
{
@@ -21,6 +21,10 @@ namespace BurnOutSharp.PackerType
if (nex == null)
return null;
+ // If we match a known header
+ if (MatchesNEVersion(nex))
+ return "Wise Installation Wizard Module";
+
// TODO: Don't read entire file
var data = nex.ReadArbitraryRange();
if (data == null)
@@ -33,7 +37,7 @@ namespace BurnOutSharp.PackerType
// WiseMain
new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"),
};
-
+
return MatchUtil.GetFirstMatch(file, data, neMatchSets, includeDebug);
}
@@ -45,6 +49,10 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
+ // If we match a known header
+ if (MatchesPEVersion(pex))
+ return "Wise Installation Wizard Module";
+
// TODO: Investigate STUB32.EXE in export directory table
// Get the .data/DATA section strings, if they exist
@@ -115,5 +123,109 @@ namespace BurnOutSharp.PackerType
return null;
}
+
+ ///
+ /// Checks an NE header to see if it matches a known signature
+ ///
+ /// New executable to check
+ /// True if it matches a known version, false otherwise
+ private bool MatchesNEVersion(NewExecutable nex)
+ {
+ switch (nex.Stub_NewExeHeaderAddr)
+ {
+ // Dll = false, ArchiveStart = 0x11, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = true
+ case 0x84b0: return true;
+
+ // Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false
+ case 0x3e10: return true;
+
+ // Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false
+ case 0x3e50: return true;
+
+ // Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false
+ case 0x3c20: return true;
+
+ // Dll = false, ArchiveStart = 0x22, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false
+ case 0x3c30: return true;
+
+ // Dll = false, ArchiveStart = 0x40, ArchiveEnd = 0x3c, InitText = false, FilenamePosition = 0x04, NoCrc = false
+ case 0x3660: return true;
+
+ // Dll = false, ArchiveStart = 0x48, ArchiveEnd = 0x44, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ case 0x36f0: return true;
+
+ // Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ case 0x3770: return true;
+
+ // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ case 0x3780: return true;
+
+ // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ case 0x37b0: return true;
+
+ // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ case 0x37d0: return true;
+
+ // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
+ case 0x3c80: return true;
+
+ // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
+ case 0x3bd0: return true;
+
+ // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
+ case 0x3c10: return true;
+
+ default: return false;
+ }
+ }
+
+ ///
+ /// Checks a PE header to see if it matches a known signature
+ ///
+ /// Portable executable to check
+ /// True if it matches a known version, false otherwise
+ private bool MatchesPEVersion(PortableExecutable pex)
+ {
+ // Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ if (pex.Stub_NewExeHeaderAddr == 0x6e00
+ && pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4
+ && pex.GetFirstSection(".data")?.VirtualSize == 0x1528)
+ return true;
+
+ // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ else if (pex.Stub_NewExeHeaderAddr == 0x6e00
+ && pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4
+ && pex.GetFirstSection(".data")?.VirtualSize == 0x1568)
+ return true;
+
+ // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ else if (pex.Stub_NewExeHeaderAddr == 0x6e00
+ && pex.GetFirstSection(".text")?.VirtualSize == 0x3d54)
+ return true;
+
+ // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ else if (pex.Stub_NewExeHeaderAddr == 0x6e00
+ && pex.GetFirstSection(".text")?.VirtualSize == 0x3d44)
+ return true;
+
+ // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ else if (pex.Stub_NewExeHeaderAddr == 0x6e00
+ && pex.GetFirstSection(".text")?.VirtualSize == 0x3d04)
+ return true;
+
+ // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false
+ else if (pex.Stub_NewExeHeaderAddr == 0x3000)
+ return true;
+
+ // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
+ else if (pex.Stub_NewExeHeaderAddr == 0x3800)
+ return true;
+
+ // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false
+ else if (pex.Stub_NewExeHeaderAddr == 0x3a00)
+ return true;
+
+ return false;
+ }
}
}