SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-10 19:07:02 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Use header padding data for UPX

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-05 16:50:18 -08:00
parent 1f5d5215f7
commit 5baa470d54
1 changed files with 6 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
BurnOutSharp/PackerType/UPX.cs
View File

@@ -23,30 +23,22 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
// Standard UPX
var sectionData = FindData(pex, "UPX");
if (sectionData != null)
// Check header padding data
var headerPaddingData = pex.HeaderPaddingData;
if (headerPaddingData != null)
{
var matchers = new List<ContentMatchSet>
{
// UPX!
new ContentMatchSet(new byte?[] { 0x55, 0x50, 0x58, 0x21 }, GetVersion, "UPX"),
};
return MatchUtil.GetFirstMatch(file, sectionData, matchers, includeDebug);
}
// NOS Variant
sectionData = FindData(pex, "NOS");
if (sectionData != null)
{
var matchers = new List<ContentMatchSet>
{
// NOS
new ContentMatchSet(new byte?[] { 0x4E, 0x4F, 0x53, 0x20 }, GetVersion, "UPX (NOS Variant)"),
};
return MatchUtil.GetFirstMatch(file, sectionData, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, headerPaddingData, matchers, includeDebug);
if (!string.IsNullOrEmpty(match))
return match;
}
return null;
@@ -98,25 +90,5 @@ namespace BurnOutSharp.PackerType
return "(Unknown Version)";
}
}
/// <summary>
/// Find the location of the first matched section, if possible
/// </summary>
/// <param name="pex">PortableExecutable representing the read-in file</param>
/// <param name="sectionPrefix">Prefix of the sections to check for</param>
/// <returns>Section data, null on error</returns>
private byte[] FindData(PortableExecutable pex, string sectionPrefix)
{
// Get the two matching sections, if possible
var firstSection = pex.GetFirstSection($"{sectionPrefix}0", exact: true);
var secondSection = pex.GetFirstSection($"{sectionPrefix}1", exact: true);
// If either section is null, we can't do anything
if (firstSection == null || secondSection == null)
return null;
// This subtract is needed because the version is before the section
return pex.GetFirstSectionDataWithOffset($"{sectionPrefix}0", offset: -128);
}
}
}