From 4da713702afbd37a3113c537a75d9623fb833eee Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Tue, 27 Dec 2022 10:53:28 -0800 Subject: [PATCH] Add header matchers for Wise --- BurnOutSharp/PackerType/WiseInstaller.cs | 116 ++++++++++++++++++++++- 1 file changed, 114 insertions(+), 2 deletions(-) diff --git a/BurnOutSharp/PackerType/WiseInstaller.cs b/BurnOutSharp/PackerType/WiseInstaller.cs index 9da2a5e6..b473e689 100644 --- a/BurnOutSharp/PackerType/WiseInstaller.cs +++ b/BurnOutSharp/PackerType/WiseInstaller.cs @@ -6,8 +6,8 @@ using System.Linq; using BurnOutSharp.Interfaces; using BurnOutSharp.Matching; using BurnOutSharp.Wrappers; -using Wise = WiseUnpacker.WiseUnpacker; using static BurnOutSharp.Utilities.Dictionary; +using Wise = WiseUnpacker.WiseUnpacker; namespace BurnOutSharp.PackerType { @@ -21,6 +21,10 @@ namespace BurnOutSharp.PackerType if (nex == null) return null; + // If we match a known header + if (MatchesNEVersion(nex)) + return "Wise Installation Wizard Module"; + // TODO: Don't read entire file var data = nex.ReadArbitraryRange(); if (data == null) @@ -33,7 +37,7 @@ namespace BurnOutSharp.PackerType // WiseMain new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"), }; - + return MatchUtil.GetFirstMatch(file, data, neMatchSets, includeDebug); } @@ -45,6 +49,10 @@ namespace BurnOutSharp.PackerType if (sections == null) return null; + // If we match a known header + if (MatchesPEVersion(pex)) + return "Wise Installation Wizard Module"; + // TODO: Investigate STUB32.EXE in export directory table // Get the .data/DATA section strings, if they exist @@ -115,5 +123,109 @@ namespace BurnOutSharp.PackerType return null; } + + /// + /// Checks an NE header to see if it matches a known signature + /// + /// New executable to check + /// True if it matches a known version, false otherwise + private bool MatchesNEVersion(NewExecutable nex) + { + switch (nex.Stub_NewExeHeaderAddr) + { + // Dll = false, ArchiveStart = 0x11, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = true + case 0x84b0: return true; + + // Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false + case 0x3e10: return true; + + // Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false + case 0x3e50: return true; + + // Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false + case 0x3c20: return true; + + // Dll = false, ArchiveStart = 0x22, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false + case 0x3c30: return true; + + // Dll = false, ArchiveStart = 0x40, ArchiveEnd = 0x3c, InitText = false, FilenamePosition = 0x04, NoCrc = false + case 0x3660: return true; + + // Dll = false, ArchiveStart = 0x48, ArchiveEnd = 0x44, InitText = false, FilenamePosition = 0x1c, NoCrc = false + case 0x36f0: return true; + + // Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + case 0x3770: return true; + + // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + case 0x3780: return true; + + // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + case 0x37b0: return true; + + // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + case 0x37d0: return true; + + // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false + case 0x3c80: return true; + + // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false + case 0x3bd0: return true; + + // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false + case 0x3c10: return true; + + default: return false; + } + } + + /// + /// Checks a PE header to see if it matches a known signature + /// + /// Portable executable to check + /// True if it matches a known version, false otherwise + private bool MatchesPEVersion(PortableExecutable pex) + { + // Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + if (pex.Stub_NewExeHeaderAddr == 0x6e00 + && pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4 + && pex.GetFirstSection(".data")?.VirtualSize == 0x1528) + return true; + + // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + else if (pex.Stub_NewExeHeaderAddr == 0x6e00 + && pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4 + && pex.GetFirstSection(".data")?.VirtualSize == 0x1568) + return true; + + // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + else if (pex.Stub_NewExeHeaderAddr == 0x6e00 + && pex.GetFirstSection(".text")?.VirtualSize == 0x3d54) + return true; + + // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + else if (pex.Stub_NewExeHeaderAddr == 0x6e00 + && pex.GetFirstSection(".text")?.VirtualSize == 0x3d44) + return true; + + // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + else if (pex.Stub_NewExeHeaderAddr == 0x6e00 + && pex.GetFirstSection(".text")?.VirtualSize == 0x3d04) + return true; + + // Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false + else if (pex.Stub_NewExeHeaderAddr == 0x3000) + return true; + + // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false + else if (pex.Stub_NewExeHeaderAddr == 0x3800) + return true; + + // Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false + else if (pex.Stub_NewExeHeaderAddr == 0x3a00) + return true; + + return false; + } } }