SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-02-04 05:35:49 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Update guides

Browse Source
This commit is contained in:
Matt Nadareski
2023-03-09 15:17:35 -05:00
parent f6157ef79b
commit 67059b2e43
2 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
Coding Guide.md
View File

@@ -320,13 +320,13 @@ This section contains information on project and class organization principles t
| `BurnOutSharp` | One file per class. See below for details on subdirectories. |
| `BurnOutSharp/External` | One directory per external project. |
| `BurnOutSharp/FileType` | One file per file type. |
| `BurnOutSharp/Interfaces` | One file per interface. |
| `BurnOutSharp/PackerType` | At least one file per packer type. Partial classes allowed. |
| `BurnOutSharp/ProtectionType` | At least one file per protection type. Partial classes allowed. |
| `BurnOutSharp/Tools` | Two files - one for extension methods and one for utilities. |
| `BinaryObjectScanner.ASN1` | Flat directory structure. |
| `BinaryObjectScanner.Builders` | One file per executable type. |
| `BinaryObjectScanner.Compression` | One directory per compression type. |
| `BinaryObjectScanner.Interfaces` | One file per interface. |
| `BinaryObjectScanner.Matching` | Flat directory structure. Include interfaces and base classes. |
| `BinaryObjectScanner.Models` | One directory per executable type. One file per object model. |
| `BinaryObjectScanner.Utilities` | Flat directory structure. |
@@ -343,14 +343,14 @@ This section contains information on in-code organization principles that depend
| Project | Description |
| --- | --- |
| `BurnOutSharp` | Varies from file to file. |
| `BurnOutSharp/FileType` | `Scan(Scanner, string)`, `Scan(Scanner, Stream, string)`, helper methods. |
| `BurnOutSharp/Interfaces` | Methods ordered alphabetically. |
| `BurnOutSharp/PackerType` | `IContentCheck` implementations, `INewExecutableCheck` implementations, `IPortableExecutableCheck` implementations, `IPathCheck` implementations, `IScannable` implementations, helper methods. |
| `BurnOutSharp/ProtectionType` | `IContentCheck` implementations, `INewExecutableCheck` implementations, `IPortableExecutableCheck` implementations, `IPathCheck` implementations, `IScannable` implementations, helper methods.. |
| `BurnOutSharp/FileType` | `IExtractable` implementations, `IScannable` implementations, helper methods. |
| `BurnOutSharp/PackerType` | `IContentCheck` implementations, `ILinearExecutableCheck` implementations, `INewExecutableCheck` implementations, `IPortableExecutableCheck` implementations, `IPathCheck` implementations, `IExtractable` implementations, `IScannable` implementations, helper methods. |
| `BurnOutSharp/ProtectionType` | `IContentCheck` implementations, `ILinearExecutableCheck` implementations, `INewExecutableCheck` implementations, `IPortableExecutableCheck` implementations, `IPathCheck` implementations, `IExtractable` implementations, `IScannable` implementations, helper methods. |
| `BurnOutSharp/Tools` | Methods grouped by function. Regions ordered alphabetically. |
| `BinaryObjectScanner.ASN1` | Partial classes suggested for different implmentations. |
| `BinaryObjectScanner.Builders` | Two copies of each non-generic method: one for byte arrays and one for Streams. |
| `BinaryObjectScanner.Compression` | Varies from file to file. |
| `BinaryObjectScanner.Interfaces` | Methods ordered alphabetically. |
| `BinaryObjectScanner.Matching` | Varies from file to file. |
| `BinaryObjectScanner.Models` | No methods at all, just properties. |
| `BinaryObjectScanner.Utilities` | Varies from file to file. |

9
Developer Guide.md
View File

@@ -12,6 +12,7 @@ This is a guide for any developers who wish to research protections, implement n
| `BinaryObjectScanner.ASN1` | Library containing classes and methods associated with Abstract Syntax Notation One and OID parsing. |
| `BinaryObjectScanner.Builder` | Library containing classes that assist in populating the various object models defined in `BinaryObjectScanner.Models`. Builders can work with either byte arrays or streams for input. At the time of writing, the following executable types have builders: **MS-DOS**, **New Executable**, **Portable Executable**. |
| `BinaryObjectScanner.Compression` | Library containing classes that deal with different compression formats. This library is used extensively by the wrappers in `BinaryObjectScanner.Wrappers`. |
| `BinaryObjectScanner.Interfaces` | Library containing interface definitions for scanning and detection. |
| `BinaryObjectScanner.Matching` | Library containing models and logic for generic searching and matching. This library is used extensively by the packer and protection checks in `BurnOutSharp`. |
| `BinaryObjectScanner.Models` | Library containing object models that represent various pieces of known executable formats. At the time of writing, the following executable types have models: **MS-DOS**, **New Executable**, **Linear Executable (partial)**, **Portable Executable**. |
| `BinaryObjectScanner.Utilities` | Library containing helper and extension methods that don't rely on any other libraries. |
@@ -84,13 +85,13 @@ Adding a new checker or format should happen in a few distinct steps:
1. Create a skeleton class representing the new checker or format
- If it is a new supported file type (such as an archive format), create the file in `BurnOutSharp/FileType/`. By default, you will need to implement `BurnOutSharp.Interfaces.IScannable`. Do not implement any other interfaces. Please consider asking project maintainers before doing this work, especially if there are external dependencies.
- If it is a new supported file type (such as an archive format), create the file in `BurnOutSharp/FileType/`. By default, you will need to implement `BurnOutSharp.Interfaces.IScannable` or `BinaryObjectScanner.Interfaces.IExtractable`. Do not implement any other interfaces. Please consider asking project maintainers before doing this work, especially if there are external dependencies.
- If it is a new supported executable packer, compressor, or installer format, create the file in `BurnOutSharp/PackerType/`. By default, you will need to implement `BurnOutSharp.Interfaces.IScannable` as well as at least one of `BurnOutSharp.Interfaces.INewExecutableCheck` and/or `BurnOutSharp.Interfaces.IPortableExecutableCheck`. It is exceptionally rare to need to implement `BurnOutSharp.Interfaces.IPathCheck`.
- If it is a new supported executable packer, compressor, or installer format, create the file in `BurnOutSharp/PackerType/`. By default, you will need to implement `BurnOutSharp.Interfaces.IScannable` or `BinaryObjectScanner.Interfaces.IExtractable` as well as at least one of: `BinaryObjectScanner.Interfaces.ILinearExecutableCheck`, `BinaryObjectScanner.Interfaces.INewExecutableCheck`, and `BinaryObjectScanner.Interfaces.IPortableExecutableCheck`. It is exceptionally rare to need to implement `BinaryObjectScanner.Interfaces.IPathCheck`.
- If it is a new supported DRM scheme, copy protection, or obfuscator, create the file in `BurnOutSharp/ProtectionType/`. By default, you will need to implement at least one of `BurnOutSharp.Interfaces.INewExecutableCheck`, `BurnOutSharp.Interfaces.IPortableExecutableCheck`, and/or `BurnOutSharp.Interfaces.IPathCheck`. It is exceptionally rare to need to implement `BurnOutSharp.Interfaces.IScannable`.
- If it is a new supported DRM scheme, copy protection, or obfuscator, create the file in `BurnOutSharp/ProtectionType/`. By default, you will need to implement at least one of:`BinaryObjectScanner.Interfaces.ILinearExecutableCheck`, `BinaryObjectScanner.Interfaces.INewExecutableCheck`, `BinaryObjectScanner.Interfaces.IPortableExecutableCheck`, and `BinaryObjectScanner.Interfaces.IPathCheck`. It is exceptionally rare to need to implement `BurnOutSharp.Interfaces.IScannable`.
- In addition to the above, there is a debug-only interface called `BurnOutSharp.Interfaces.IContentCheck`. Though there are examples of this being used in code, it is highly recommended to avoid this in a final implementation.
- In addition to the above, there is a debug-only interface called `BinaryObjectScanner.Interfaces.IContentCheck`. Though there are examples of this being used in code, it is highly recommended to avoid this in a final implementation.
2. Look at other, similar classes for guidelines on how any given set of checks should be implemented. Test early and often, including using debugging tools. Err on the side of over-commenting. Do not try to be clever with your code; readable code is royalty.