diff --git a/BurnOutSharp/PackerType/WinZipSFX.cs b/BurnOutSharp/PackerType/WinZipSFX.cs index 4ef3faef..053d16a1 100644 --- a/BurnOutSharp/PackerType/WinZipSFX.cs +++ b/BurnOutSharp/PackerType/WinZipSFX.cs @@ -1,11 +1,9 @@ using System; using System.Collections.Concurrent; -using System.Collections.Generic; using System.IO; using System.Linq; using System.Text; using BurnOutSharp.Interfaces; -using BurnOutSharp.Matching; using BurnOutSharp.Tools; using BurnOutSharp.Wrappers; using SharpCompress.Archives; @@ -54,77 +52,17 @@ namespace BurnOutSharp.PackerType if (sections == null) return null; - // Get the .rdata section, if it exists - if (pex.ContainsSection(".rdata")) + // Check the export directory table, if it exists + if (pex.ExportTable?.ExportDirectoryTable != null) { - string version = GetSFXSectionDataVersion(file, pex.GetFirstSectionData(".rdata"), includeDebug); + string version = GetPEExportDirectoryVersion(pex); if (!string.IsNullOrWhiteSpace(version)) return $"WinZip SFX {version}"; } // Get the _winzip_ section, if it exists if (pex.ContainsSection("_winzip_", exact: true)) - { - string version = GetPEHeaderVersion(pex); - if (!string.IsNullOrWhiteSpace(version)) - return $"WinZip SFX {version}"; - - version = GetAdjustedManifestVersion(pex); - if (!string.IsNullOrWhiteSpace(version)) - return $"WinZip SFX {version}"; - return "WinZip SFX Unknown Version (32-bit)"; - } - - #region Unknown Version checks - - // Get the .rdata section, if it exists - if (pex.ContainsSection(".rdata")) - { - string version = GetSFXSectionDataUnknownVersion(file, pex.GetFirstSectionData(".rdata"), includeDebug); - if (!string.IsNullOrWhiteSpace(version)) - return $"WinZip SFX {version}"; - } - - // Get the .data/DATA section, if it exists - var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA"); - if (dataSectionRaw != null) - { - var matchers = new List - { - // WinZip Self-Extractor header corrupt. - new ContentMatchSet(new byte?[] - { - 0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70, 0x20, 0x53, - 0x65, 0x6C, 0x66, 0x2D, 0x45, 0x78, 0x74, 0x72, - 0x61, 0x63, 0x74, 0x6F, 0x72, 0x20, 0x68, 0x65, - 0x61, 0x64, 0x65, 0x72, 0x20, 0x63, 0x6F, 0x72, - 0x72, 0x75, 0x70, 0x74, 0x2E, - }, "Unknown Version (32-bit)"), - - // winzip\shell\open\command - new ContentMatchSet(new byte?[] - { - 0x77, 0x69, 0x6E, 0x7A, 0x69, 0x70, 0x5C, 0x73, - 0x68, 0x65, 0x6C, 0x6C, 0x5C, 0x6F, 0x70, 0x65, - 0x6E, 0x5C, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x6E, - 0x64, - }, "Unknown Version (32-bit)"), - }; - - string version = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".data"), matchers, false); - if (!string.IsNullOrWhiteSpace(version)) - { - // Try to grab the value from the manifest, if possible - string manifestVersion = GetAdjustedManifestVersion(pex); - if (!string.IsNullOrWhiteSpace(manifestVersion)) - return $"WinZip SFX {manifestVersion}"; - - return $"WinZip SFX {version}"; - } - } - - #endregion return null; } @@ -200,53 +138,6 @@ namespace BurnOutSharp.PackerType return null; } - /// - /// Get the version from the assembly manifest, correcting where possible - /// - private static string GetAdjustedManifestVersion(PortableExecutable pex) - { - // Get the manifest information, if possible - string description = pex.AssemblyDescription; - string version = pex.AssemblyVersion; - - // Either an incorrect description or empty version mean we can't match - if (description != "WinZip Self-Extractor") - return null; - else if (string.IsNullOrEmpty(version)) - return null; - - // Some version strings don't exactly match the public version number - switch (version) - { - case "2.3.6594.0": - return "Personal Edition Build 6604"; - case "2.3.6602.0": - return "Personal Edition Build 6663"; - case "2.3.7305.0": - return "Personal Edition Build 7305"; - case "2.3.7382.0": - return "Personal Edition Build 7452+"; - case "3.0.7158.0": - return "3.0.7158"; - case "3.0.7454.0": - return "3.0.7454+"; - case "3.0.7212.0": - return "3.0.7212"; - case "3.1.7556.0": - return "3.1.7556"; - case "3.1.8421.0": - return "4.0.8421"; - case "4.0.8421.0": - return "4.0.8421"; - case "3.1.8672.0": - return "4.0.8672"; - case "4.0.1221.0": - return "4.0.12218"; - default: - return $"(Unknown - internal version {version})"; - } - } - /// /// Get the version from the NE header value combinations /// @@ -807,414 +698,204 @@ namespace BurnOutSharp.PackerType } /// - /// Get the version from the PE header value combinations + /// Get the version from the PE export directory table value combinations /// - /// TODO: Reduce the checks to only the ones that differ between versions /// TODO: Research to see if the versions are embedded elsewhere in these files - private string GetPEHeaderVersion(PortableExecutable pex) + private string GetPEExportDirectoryVersion(PortableExecutable pex) { - // 2.2.3063 - if (pex.Machine == Models.PortableExecutable.MachineType.IMAGE_FILE_MACHINE_I386 - && pex.NumberOfSections == 0x0005 - && pex.TimeDateStamp == 0x38BE7AC9 - && pex.PointerToSymbolTable == 0x00000000 - && pex.NumberOfSymbols == 0x00000000 - && pex.SizeOfOptionalHeader == 0x00E0 - && (ushort)pex.Characteristics == 0x010F + string sfxFileName = pex.ExportTable.ExportDirectoryTable.Name; + uint sfxTimeDateStamp = pex.ExportTable.ExportDirectoryTable.TimeDateStamp; + string assemblyVersion = pex.AssemblyVersion ?? "Unknown Version"; - && pex.OH_Magic == Models.PortableExecutable.OptionalHeaderMagicNumber.PE32 - && pex.OH_MajorLinkerVersion == 0x05 - && pex.OH_MinorLinkerVersion == 0x0A - && pex.OH_SizeOfCode == 0x00005C00 - && pex.OH_SizeOfInitializedData == 0x00004C00 - && pex.OH_SizeOfUninitializedData == 0x00000000 - && pex.OH_AddressOfEntryPoint == 0x00003E71 - && pex.OH_BaseOfCode == 0x00001000 - && pex.OH_BaseOfData == 0x00007000 - && pex.OH_ImageBase == 0x00400000) - return "2.2.3063"; + // Standard + if (sfxFileName == "VW95SE.SFX" || sfxFileName == "ST32E.SFX" + || sfxFileName == "WZIPSE32.exe" || sfxFileName == "SI32LPG.SFX" + || sfxFileName == "ST32E.WZE") + { + switch (sfxTimeDateStamp) + { + case 842636344: + return "2.0 (32-bit)"; + case 865370756: + return "2.1 RC2 (32-bit)"; + case 869059925: + return "2.1 (32-bit)"; + case 979049321: + return "2.2.4003"; + case 1149714685: + return "3.0.7158"; + case 1185211734: + return "3.1.7556"; + case 1185211920: + return "3.1.7556"; + case 1235490556: + return "4.0.8421"; + case 1235490757: + return "4.0.8421"; + case 1235490687: + return "4.0.8421"; // 3.1.8421.0, SI32LPG? + case 1257193383: + return "4.0.8672"; // 3.1.8672.0 + case 1257193543: + return "4.0.8672"; + case 1470410848: + return "4.0.12218"; // 4.0.1221.0 + default: + return $"{assemblyVersion} (32-bit)"; + } + } - // 2.2.4003 - if (pex.Machine == Models.PortableExecutable.MachineType.IMAGE_FILE_MACHINE_I386 - && pex.NumberOfSections == 0x0005 - && pex.TimeDateStamp == 0x3A5B1B69 - && pex.PointerToSymbolTable == 0x00000000 - && pex.NumberOfSymbols == 0x00000000 - && pex.SizeOfOptionalHeader == 0x00E0 - && (ushort)pex.Characteristics == 0x010F + // Personal Edition + if (sfxFileName == "VW95LE.SFX" || sfxFileName == "PE32E.SFX" + || sfxFileName == "wzsepe32.exe" || sfxFileName == "SI32PE.SFX" + || sfxFileName == "SI32LPE.SFX") + { + switch (sfxTimeDateStamp) + { + case 845061601: + return "Personal Edition (32-bit)"; // TODO: Find version + case 868303343: + return "Personal Edition (32-bit)"; // TODO: Find version + case 868304170: + return "Personal Edition (32-bit)"; // TODO: Find version + case 906039079: + return "Personal Edition 2.2.1260 (32-bit)"; + case 906040543: + return "Personal Edition 2.2.1260 (32-bit)"; + case 908628435: + return "Personal Edition 2.2.1285 (32-bit)"; + case 908628785: + return "Personal Edition 2.2.1285 (32-bit)"; + case 956165981: + return "Personal Edition 2.2.3063"; + case 956166038: + return "Personal Edition 2.2.3063"; + case 1006353695: + return "Personal Edition 2.2.4325"; + case 1006353714: + return "Personal Edition 2.2.4325"; // 8.1.0.0 + case 1076515698: + return "Personal Edition 2.2.6028"; + case 1076515784: + return "Personal Edition 2.2.6028"; // 9.0.6028.0 + case 1092688561: + return "Personal Edition 2.2.6224"; + case 1092688645: + return "Personal Edition 2.2.6224"; // 9.0.6224.0 + case 1125074095: + return "Personal Edition 2.2.6604"; + case 1125074162: + return "Personal Edition 2.2.6604"; // 10.0.6604.0 + case 1130153399: + return "Personal Edition 2.2.6663"; + case 1130153428: + return "Personal Edition 2.2.6663"; // 10.0.6663.0 + case 1149714176: + return "Personal Edition 3.0.7158"; + case 1163137967: + return "Personal Edition 3.0.7305"; + case 1163137994: + return "Personal Edition 3.0.7313"; // 11.0.7313.0 + case 1176345383: + return "Personal Edition 3.0.7452"; + case 1176345423: + return "Personal Edition 3.1.7466"; // 11.1.7466.0 + case 1184106698: + return "Personal Edition 3.1.7556"; + case 1207280880: + return "Personal Edition 4.0.8060"; // 2.3.7382.0 + case 1207280892: + return "Personal Edition 4.0.8094"; // 11.2.8094.0 + case 1220904506: + return "Personal Edition 4.0.8213"; // 2.3.7382.0 + case 1220904518: + return "Personal Edition 4.0.8252"; // 12.0.8252.0 + case 1235490648: + return "Personal Edition 4.0.8421"; // 3.1.8421.0 + case 1242049399: + return "Personal Edition 4.0.8497"; // 12.1.8497.0 + case 1257193469: + return "Personal Edition 4.0.8672"; // 3.1.8672.0, SI32LPE? + default: + return $"Personal Edition {assemblyVersion} (32-bit)"; + } + } - && pex.OH_Magic == Models.PortableExecutable.OptionalHeaderMagicNumber.PE32 - && pex.OH_MajorLinkerVersion == 0x05 - && pex.OH_MinorLinkerVersion == 0x0A - && pex.OH_SizeOfCode == 0x00004A00 - && pex.OH_SizeOfInitializedData == 0x00002A00 - && pex.OH_SizeOfUninitializedData == 0x00000000 - && pex.OH_AddressOfEntryPoint == 0x000039D8 - && pex.OH_BaseOfCode == 0x00001000 - && pex.OH_BaseOfData == 0x00006000 - && pex.OH_ImageBase == 0x00400000) - return "2.2.4003"; + // Software Installation + else if (sfxFileName == "VW95SRE.SFX" || sfxFileName == "SI32E.SFX" + || sfxFileName == "SI32E.WZE") + { + switch (sfxTimeDateStamp) + { + case 842636381: + return "Software Installation 2.0 (32-bit)"; + case 865370800: + return "Software Installation 2.1 RC2 (32-bit)"; + case 869059963: + return "Software Installation 2.1 (32-bit)"; + case 893107697: + return "Software Installation 2.2.1110 (32-bit)"; + case 952007369: + return "Software Installation 2.2.3063"; + case 1006352634: + return "Software Installation 2.2.4325"; // +Personal Edition? + case 979049345: + return "Software Installation 2.2.4403"; + case 1026227373: + return "Software Installation 2.2.5196"; // +Personal Edition? + case 1090582390: + return "Software Installation 2.2.6202"; // +Personal Edition? + case 1149714757: + return "Software Installation 3.0.7158"; + case 1154357628: + return "Software Installation 3.0.7212"; + case 1175234637: + return "Software Installation 3.0.7454"; + case 1185211802: + return "Software Installation 3.1.7556"; + case 1470410906: + return "Software Installation 4.0.12218"; // 4.0.1221.0 + default: + return $"Software Installation {assemblyVersion} (32-bit)"; + } + } - // Software Installation 2.2.4003 - if (pex.Machine == Models.PortableExecutable.MachineType.IMAGE_FILE_MACHINE_I386 - && pex.NumberOfSections == 0x0005 - && pex.TimeDateStamp == 0x3A5B1B81 - && pex.PointerToSymbolTable == 0x00000000 - && pex.NumberOfSymbols == 0x00000000 - && pex.SizeOfOptionalHeader == 0x00E0 - && (ushort)pex.Characteristics == 0x010F + switch (sfxFileName) + { + // Standard + case "VW95SE.SFX": + return "Unknown Version (32-bit)"; // TODO: Find starting version + case "ST32E.SFX": + return "Unknown Version (32-bit)"; // TODO: Find starting version + case "WZIPSE32.exe": + return "Unknown Version (32-bit)"; // TODO: Find starting version + case "SI32LPG.SFX": + return "Unknown Version (32-bit)"; // TODO: Find starting version + case "ST32E.WZE": + return "Unknown Version (32-bit)"; // TODO: Find starting version - && pex.OH_Magic == Models.PortableExecutable.OptionalHeaderMagicNumber.PE32 - && pex.OH_MajorLinkerVersion == 0x05 - && pex.OH_MinorLinkerVersion == 0x0A - && pex.OH_SizeOfCode == 0x00005600 - && pex.OH_SizeOfInitializedData == 0x00002A00 - && pex.OH_SizeOfUninitializedData == 0x00000000 - && pex.OH_AddressOfEntryPoint == 0x00003F8F - && pex.OH_BaseOfCode == 0x00001000 - && pex.OH_BaseOfData == 0x00007000 - && pex.OH_ImageBase == 0x00400000) - return "Software Installation 2.2.4003"; + // Personal Edition + case "VW95LE.SFX": + return "Unknown Version before Personal Edition Build 1285 (32-bit)"; + case "PE32E.SFX": + return "Unknown Version after Personal Edition Build 1285 (32-bit)"; + case "wzsepe32.exe": + return "Unknown Version Personal Edition (32-bit)"; // TODO: Find starting version + case "SI32PE.SFX": + return "Unknown Version Personal Edition (32-bit)"; // TODO: Find starting version + case "SI32LPE.SFX": + return "Unknown Version Personal Edition (32-bit)"; // TODO: Find starting version - // 2.2.4325 - if (pex.Machine == Models.PortableExecutable.MachineType.IMAGE_FILE_MACHINE_I386 - && pex.NumberOfSections == 0x0005 - && pex.TimeDateStamp == 0x3BFBB8FA - && pex.PointerToSymbolTable == 0x00000000 - && pex.NumberOfSymbols == 0x00000000 - && pex.SizeOfOptionalHeader == 0x00E0 - && (ushort)pex.Characteristics == 0x010F - - && pex.OH_Magic == Models.PortableExecutable.OptionalHeaderMagicNumber.PE32 - && pex.OH_MajorLinkerVersion == 0x06 - && pex.OH_MinorLinkerVersion == 0x00 - && pex.OH_SizeOfCode == 0x00006000 - && pex.OH_SizeOfInitializedData == 0x0000F000 - && pex.OH_SizeOfUninitializedData == 0x00000000 - && pex.OH_AddressOfEntryPoint == 0x00003EF0 - && pex.OH_BaseOfCode == 0x00001000 - && pex.OH_BaseOfData == 0x00007000 - && pex.OH_ImageBase == 0x00400000 - && pex.OH_SectionAlignment == 0x00001000 - && pex.OH_FileAlignment == 0x00001000) - return "2.2.4325"; - - // 2.2.5196 - if (pex.Machine == Models.PortableExecutable.MachineType.IMAGE_FILE_MACHINE_I386 - && pex.NumberOfSections == 0x0005 - && pex.TimeDateStamp == 0x3D2AFCAD - && pex.PointerToSymbolTable == 0x00000000 - && pex.NumberOfSymbols == 0x00000000 - && pex.SizeOfOptionalHeader == 0x00E0 - && (ushort)pex.Characteristics == 0x010F - - && pex.OH_Magic == Models.PortableExecutable.OptionalHeaderMagicNumber.PE32 - && pex.OH_MajorLinkerVersion == 0x07 - && pex.OH_MinorLinkerVersion == 0x00 - && pex.OH_SizeOfCode == 0x00007000 - && pex.OH_SizeOfInitializedData == 0x00010000 - && pex.OH_SizeOfUninitializedData == 0x00000000 - && pex.OH_AddressOfEntryPoint == 0x00004554 - && pex.OH_BaseOfCode == 0x00001000 - && pex.OH_BaseOfData == 0x00008000 - && pex.OH_ImageBase == 0x00400000 - && pex.OH_SectionAlignment == 0x00001000 - && pex.OH_FileAlignment == 0x00001000) - return "2.2.5196"; - - // 2.2.6202 - if (pex.Machine == Models.PortableExecutable.MachineType.IMAGE_FILE_MACHINE_I386 - && pex.NumberOfSections == 0x0005 - && pex.TimeDateStamp == 0x4100F776 - && pex.PointerToSymbolTable == 0x00000000 - && pex.NumberOfSymbols == 0x00000000 - && pex.SizeOfOptionalHeader == 0x00E0 - && (ushort)pex.Characteristics == 0x010F - - && pex.OH_Magic == Models.PortableExecutable.OptionalHeaderMagicNumber.PE32 - && pex.OH_MajorLinkerVersion == 0x07 - && pex.OH_MinorLinkerVersion == 0x00 - && pex.OH_SizeOfCode == 0x00007000 - && pex.OH_SizeOfInitializedData == 0x00010000 - && pex.OH_SizeOfUninitializedData == 0x00000000 - && pex.OH_AddressOfEntryPoint == 0x00004603 - && pex.OH_BaseOfCode == 0x00001000 - && pex.OH_BaseOfData == 0x00008000 - && pex.OH_ImageBase == 0x00400000) - return "2.2.6202"; + // Software Installation + case "VW95SRE.SFX": + return "Unknown Version before Software Installation 2.1 (32-bit)"; + case "SI32E.SFX": + return "Unknown Version after Software Installation 2.1 (32-bit)"; + case "SI32E.WZE": + return "Unknown Version Software Installation (32-bit)"; // TODO: Find starting version + } return null; } - - /// - /// Get the version from the .rdata SFX header data - /// - /// TODO: Research to see if the versions are embedded elsewhere in these files - private string GetSFXSectionDataVersion(string file, byte[] sectionContent, bool includeDebug) - { - var matchers = new List - { - // .............8�92....�P..............�P..�P..�P..VW95SE.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x38, 0x9C, 0x39, - 0x32, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, - 0x53, 0x46, 0x58, - }, "2.0 (32-bit)"), - - // .............]�92....�P..............�P..�P..�P..VW95SRE.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x5D, 0x9C, 0x39, - 0x32, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, - 0x2E, 0x53, 0x46, 0x58, - }, "Software Installation 2.0 (32-bit)"), - - // .............���3....�P..............�P..�P..�P..VW95SE.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 0x82, 0x94, - 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, - 0x53, 0x46, 0x58, - }, "2.1 RC2 (32-bit)"), - - // .............���3....�P..............�P..�P..�P..VW95SRE.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0xB0, 0x82, 0x94, - 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, - 0x2E, 0x53, 0x46, 0x58, - }, "Software Installation 2.1 RC2 (32-bit)"), - - // .............U��3....�P..............�P..�P..�P..VW95SE.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x55, 0xCD, 0xCC, - 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, - 0x53, 0x46, 0x58, - }, "2.1 (32-bit)"), - - // .............{��3....�P..............�P..�P..�P..VW95SRE.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x7B, 0xCD, 0xCC, - 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, - 0x2E, 0x53, 0x46, 0x58, - }, "Software Installation 2.1 (32-bit)"), - - // .............ñ½;5....ˆ`..............ˆ`..ˆ`..ˆ`..SI32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0xF1, 0xBD, 0x3B, - 0x35, 0x00, 0x00, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x88, 0x60, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x53, 0x49, 0x33, 0x32, 0x45, 0x2E, 0x53, - 0x46, 0x58, - }, "Software Installation 2.2.1110 (32-bit)"), - - // .............á.^2....ˆP..............ˆP..ˆP..ˆP..VW95LE.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0xE1, 0x9D, 0x5E, - 0x32, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x56, 0x57, 0x39, 0x35, 0x4C, 0x45, 0x2E, - 0x53, 0x46, 0x58, - }, "Personal Edition (32-bit)"), - - // .............ïAÁ3....ˆP..............ˆP..ˆP..ˆP..VW95LE.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0xEF, 0x41, 0xC1, - 0x33, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x88, 0x50, 0x00, 0x00, 0x88, 0x50, 0x00, - 0x00, 0x56, 0x57, 0x39, 0x35, 0x4C, 0x45, 0x2E, - 0x53, 0x46, 0x58, - }, "Personal Edition 32-bit (32-bit)"), - - // .............'..6....ˆ`..............ˆ`..ˆ`..ˆ`..PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x27, 0x0F, 0x01, - 0x36, 0x00, 0x00, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x88, 0x60, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x50, 0x45, 0x33, 0x32, 0x45, 0x2E, 0x53, - 0x46, 0x58, - }, "Personal Edition 32-bit Build 1260 (32-bit)"), - - // .............Ó‘(6....ˆ`..............ˆ`..ˆ`..ˆ`..PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0xD3, 0x91, 0x28, - 0x36, 0x00, 0x00, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x88, 0x60, 0x00, 0x00, 0x88, 0x60, 0x00, - 0x00, 0x50, 0x45, 0x33, 0x32, 0x45, 0x2E, 0x53, - 0x46, 0x58, - }, "Personal Edition 32-bit Build 1285 (32-bit)"), - - // ......]ïý8....˜z..............˜z..˜z..˜z..PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x5D, 0xEF, - 0xFD, 0x38, 0x00, 0x00, 0x00, 0x00, 0x98, 0x7A, - 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x98, 0x7A, - 0x00, 0x00, 0x98, 0x7A, 0x00, 0x00, 0x98, 0x7A, - 0x00, 0x00, 0x50, 0x45, 0x33, 0x32, 0x45, 0x2E, - 0x53, 0x46, 0x58, - }, "Personal Edition 32-bit Build 3063"), - - // ...................½û;....ˆj..............ˆj..ˆj..ˆj..PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x1F, 0xBD, 0xFB, 0x3B, 0x00, 0x00, - 0x00, 0x00, 0x88, 0x6A, 0x00, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x88, 0x6A, 0x00, 0x00, 0x88, 0x6A, - 0x00, 0x00, 0x88, 0x6A, 0x00, 0x00, 0x50, 0x45, - 0x33, 0x32, 0x45, 0x2E, 0x53, 0x46, 0x58, - }, "Personal Edition 32-bit Build 4325"), - - // ................rS*@....Xƒ..............Xƒ..Xƒ..Xƒ..PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x72, 0x53, 0x2A, 0x40, 0x00, 0x00, 0x00, 0x00, - 0x58, 0x83, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x58, 0x83, 0x00, 0x00, 0x58, 0x83, 0x00, 0x00, - 0x58, 0x83, 0x00, 0x00, 0x50, 0x45, 0x33, 0x32, - 0x45, 0x2E, 0x53, 0x46, 0x58, - }, "Personal Edition 32-bit Build 6028"), - - // ................±.!A....Xƒ..............Xƒ..Xƒ..Xƒ..PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xB1, 0x1A, 0x21, 0x41, 0x00, 0x00, 0x00, 0x00, - 0x58, 0x83, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x58, 0x83, 0x00, 0x00, 0x58, 0x83, 0x00, 0x00, - 0x58, 0x83, 0x00, 0x00, 0x50, 0x45, 0x33, 0x32, - 0x45, 0x2E, 0x53, 0x46, 0x58, - }, "Personal Edition 32-bit Build 6224"), - - // ................¯D.C....x„..............x„..x„..x„..PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xAF, 0x44, 0x0F, 0x43, 0x00, 0x00, 0x00, 0x00, - 0x78, 0x84, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x78, 0x84, 0x00, 0x00, 0x78, 0x84, 0x00, 0x00, - 0x78, 0x84, 0x00, 0x00, 0x50, 0x45, 0x33, 0x32, - 0x45, 0x2E, 0x53, 0x46, - }, "Personal Edition 32-bit Build 6604"), - - //................·Å\C....x„..............x„..x„..x„..PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xB7, 0xC5, 0x5C, 0x43, 0x00, 0x00, 0x00, 0x00, - 0x78, 0x84, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x78, 0x84, 0x00, 0x00, 0x78, 0x84, 0x00, 0x00, - 0x78, 0x84, 0x00, 0x00, 0x50, 0x45, 0x33, 0x32, - 0x45, 0x2E, 0x53, 0x46, 0x58, - }, "Personal Edition 32-bit Build 6663"), - }; - - return MatchUtil.GetFirstMatch(file, sectionContent, matchers, includeDebug); - } - - /// - /// Get the unknown version from the .rdata SFX header data - /// - private string GetSFXSectionDataUnknownVersion(string file, byte[] sectionContent, bool includeDebug) - { - var matchers = new List - { - // VW95SE.SFX - new ContentMatchSet(new byte?[] - { - 0x56, 0x57, 0x39, 0x35, 0x53, 0x45, 0x2E, 0x53, - 0x46, 0x58, - }, "Unknown Version (32-bit)"), - - // VW95SRE.SFX - new ContentMatchSet(new byte?[] - { - 0x56, 0x57, 0x39, 0x35, 0x53, 0x52, 0x45, 0x2E, - 0x53, 0x46, 0x58, - }, "Unknown Version Software Installation (32-bit)"), - - // VW95LE.SFX - new ContentMatchSet(new byte?[] - { - 0x56, 0x57, 0x39, 0x35, 0x4C, 0x45, 0x2E, 0x53, - 0x46, 0x58, - }, "Unknown Version before build 1285 Personal Edition (32-bit)"), - - // PE32E.SFX - new ContentMatchSet(new byte?[] - { - 0x50, 0x45, 0x33, 0x32, 0x45, 0x2E, 0x53, 0x46, - 0x58, - }, "Unknown Version after 1285 Personal Edition (32-bit)"), - }; - - return MatchUtil.GetFirstMatch(file, sectionContent, matchers, includeDebug); - } } }