SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-25 23:59:59 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add UPX detection for odd cases

Browse Source
This commit is contained in:
Matt Nadareski
2021-02-25 11:13:57 -08:00
parent 9ebbeaed0f
commit 61202a87fb
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
BurnOutSharp/PackerType/UPX.cs
View File

@@ -4,6 +4,7 @@ namespace BurnOutSharp.PackerType
{
public class UPX
{
// TODO: Verify the NOS0/1 check with other executables
public static string CheckContents(byte[] fileContent, bool includePosition = false)
{
// UPX!
@@ -14,6 +15,30 @@ namespace BurnOutSharp.PackerType
return $"UPX {version}" + (includePosition ? $" (Index {position})" : string.Empty);
}
// UPX0
check = new byte[] { 0x55, 0x50, 0x58, 0x30 };
if (fileContent.Contains(check, out position))
{
// UPX1
byte[] check2 = new byte[] { 0x55, 0x50, 0x58, 0x31 };
if (fileContent.Contains(check2, out int position2))
{
return $"UPX (Unknown / Modified Version)" + (includePosition ? $" (Index {position}, {position2})" : string.Empty);
}
}
// NOS0
check = new byte[] { 0x4E, 0x4F, 0x53, 0x30 };
if (fileContent.Contains(check, out position))
{
// NOS1
byte[] check2 = new byte[] { 0x4E, 0x4F, 0x53, 0x31 };
if (fileContent.Contains(check2, out int position2))
{
return $"UPX (Unknown / Modified Version)" + (includePosition ? $" (Index {position}, {position2})" : string.Empty);
}
}
return null;
}