From 61202a87fb0bda4616305d4a0c3aba233ff8368e Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Thu, 25 Feb 2021 11:13:57 -0800
Subject: [PATCH] Add UPX detection for odd cases

---
 BurnOutSharp/PackerType/UPX.cs | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/BurnOutSharp/PackerType/UPX.cs b/BurnOutSharp/PackerType/UPX.cs
index 9a7a090e..0380b057 100644
--- a/BurnOutSharp/PackerType/UPX.cs
+++ b/BurnOutSharp/PackerType/UPX.cs
@@ -4,6 +4,7 @@ namespace BurnOutSharp.PackerType
 {
     public class UPX
     {
+        // TODO: Verify the NOS0/1 check with other executables
         public static string CheckContents(byte[] fileContent, bool includePosition = false)
         {
             // UPX!
@@ -14,6 +15,30 @@ namespace BurnOutSharp.PackerType
                 return $"UPX {version}" + (includePosition ? $" (Index {position})" : string.Empty);
             }
 
+            // UPX0
+            check = new byte[] { 0x55, 0x50, 0x58, 0x30 };
+            if (fileContent.Contains(check, out position))
+            {
+                // UPX1
+                byte[] check2 = new byte[] { 0x55, 0x50, 0x58, 0x31 };
+                if (fileContent.Contains(check2, out int position2))
+                {
+                    return $"UPX (Unknown / Modified Version)" + (includePosition ? $" (Index {position}, {position2})" : string.Empty);
+                }                
+            }
+
+            // NOS0
+            check = new byte[] { 0x4E, 0x4F, 0x53, 0x30 };
+            if (fileContent.Contains(check, out position))
+            {
+                // NOS1
+                byte[] check2 = new byte[] { 0x4E, 0x4F, 0x53, 0x31 };
+                if (fileContent.Contains(check2, out int position2))
+                {
+                    return $"UPX (Unknown / Modified Version)" + (includePosition ? $" (Index {position}, {position2})" : string.Empty);
+                }
+            }
+
             return null;
         }