From 682529d7ba9e49c4d483785ad70eafa6153d0245 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Mon, 4 Nov 2024 23:49:13 -0500 Subject: [PATCH] Consolidate more typed methods --- BinaryObjectScanner/FileType/Executable.cs | 4 +- BinaryObjectScanner/Scanner.cs | 279 +++------------------ 2 files changed, 34 insertions(+), 249 deletions(-) diff --git a/BinaryObjectScanner/FileType/Executable.cs b/BinaryObjectScanner/FileType/Executable.cs index 50c6d21a..b9ceba46 100644 --- a/BinaryObjectScanner/FileType/Executable.cs +++ b/BinaryObjectScanner/FileType/Executable.cs @@ -274,7 +274,7 @@ namespace BinaryObjectScanner.FileType /// Implementation that was last used to check private static bool CheckIfGameEngine(object impl) { - return impl?.GetType()?.Namespace?.ToLowerInvariant()?.Contains("gameengine") ?? false; + return impl.GetType().Namespace?.ToLowerInvariant()?.Contains("gameengine") ?? false; } /// @@ -283,7 +283,7 @@ namespace BinaryObjectScanner.FileType /// Implementation that was last used to check private static bool CheckIfPacker(object impl) { - return impl.GetType()?.Namespace?.ToLowerInvariant()?.Contains("packer") ?? false; + return impl.GetType().Namespace?.ToLowerInvariant()?.Contains("packer") ?? false; } #endregion diff --git a/BinaryObjectScanner/Scanner.cs b/BinaryObjectScanner/Scanner.cs index ccb5a992..a501ac09 100644 --- a/BinaryObjectScanner/Scanner.cs +++ b/BinaryObjectScanner/Scanner.cs @@ -397,65 +397,48 @@ namespace BinaryObjectScanner if (_options.IncludeDebug) { var subProtections = executable.RunContentChecks(fileName, stream, _options.IncludeDebug); - if (subProtections != null) - protections.Append(fileName, subProtections.Values); + protections.Append(fileName, subProtections.Values); } if (wrapper is MSDOS mz) { + // Standard checks var subProtections = executable.RunExecutableChecks(fileName, mz, Executable.MSDOSExecutableCheckClasses, _options.IncludeDebug); - if (subProtections == null) - return protections; - - // Append the returned values protections.Append(fileName, subProtections.Values); - // If we have any extractable packers - var extractedProtections = HandleExtractableProtections(subProtections.Keys, fileName, mz); - if (extractedProtections != null) - protections.Append(extractedProtections); + // Extractable checks + var extractedProtections = HandleExtractableProtections(fileName, mz, subProtections.Keys); + protections.Append(extractedProtections); } else if (wrapper is LinearExecutable lex) { + // Standard checks var subProtections = executable.RunExecutableChecks(fileName, lex, Executable.LinearExecutableCheckClasses, _options.IncludeDebug); - if (subProtections == null) - return protections; - - // Append the returned values protections.Append(fileName, subProtections.Values); - // If we have any extractable packers - var extractedProtections = HandleExtractableProtections(subProtections.Keys, fileName, lex); - if (extractedProtections != null) - protections.Append(extractedProtections); + // Extractable checks + var extractedProtections = HandleExtractableProtections(fileName, lex, subProtections.Keys); + protections.Append(extractedProtections); } else if (wrapper is NewExecutable nex) { + // Standard checks var subProtections = executable.RunExecutableChecks(fileName, nex, Executable.NewExecutableCheckClasses, _options.IncludeDebug); - if (subProtections == null) - return protections; - - // Append the returned values protections.Append(fileName, subProtections.Values); - // If we have any extractable packers - var extractedProtections = HandleExtractableProtections(subProtections.Keys, fileName, nex); - if (extractedProtections != null) - protections.Append(extractedProtections); + // Extractable checks + var extractedProtections = HandleExtractableProtections(fileName, nex, subProtections.Keys); + protections.Append(extractedProtections); } else if (wrapper is PortableExecutable pex) { + // Standard checks var subProtections = executable.RunExecutableChecks(fileName, pex, Executable.PortableExecutableCheckClasses, _options.IncludeDebug); - if (subProtections == null) - return protections; - - // Append the returned values protections.Append(fileName, subProtections.Values); - // If we have any extractable packers - var extractedProtections = HandleExtractableProtections(subProtections.Keys, fileName, pex); - if (extractedProtections != null) - protections.Append(extractedProtections); + // Extractable checks + var extractedProtections = HandleExtractableProtections(fileName, pex, subProtections.Keys); + protections.Append(extractedProtections); } return protections; @@ -464,25 +447,25 @@ namespace BinaryObjectScanner /// /// Handle extractable protections, such as executable packers /// - /// Set of classes returned from Exectuable scans - /// Name of the source file of the stream, for tracking - /// MSDOS to scan the contents of + /// Name of the source file of the stream, for tracking + /// Executable to scan the contents of + /// Set of classes returned from Exectuable scans /// Set of protections found from extraction, null on error - private ProtectionDictionary? HandleExtractableProtections(IEnumerable>? classes, - string fileName, - MSDOS mz) + public ProtectionDictionary HandleExtractableProtections(string file, T exe, IEnumerable checks) + where T : WrapperBase + where U : IExecutableCheck { - // If we have an invalid set of classes - if (classes == null || !classes.Any()) - return null; - // Create the output dictionary var protections = new ProtectionDictionary(); + // If we have an invalid set of classes + if (checks == null || !checks.Any()) + return protections; + // If we have any extractable packers - var extractables = classes - .Where(c => c is IExtractableExecutable) - .Select(c => c as IExtractableExecutable); + var extractables = checks + .Where(c => c is IExtractableExecutable) + .Select(c => c as IExtractableExecutable); extractables.IterateWithAction(extractable => { // If we have an invalid extractable somehow @@ -494,7 +477,7 @@ namespace BinaryObjectScanner { // Extract and get the output path string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - bool extracted = extractable.Extract(fileName, mz, tempPath, _options.IncludeDebug); + bool extracted = extractable.Extract(file, exe, tempPath, _options.IncludeDebug); // Collect and format all found protections ProtectionDictionary? subProtections = null; @@ -514,205 +497,7 @@ namespace BinaryObjectScanner // Prepare the returned protections subProtections?.StripFromKeys(tempPath); - subProtections?.PrependToKeys(fileName); - if (subProtections != null) - protections.Append(subProtections); - } - catch (Exception ex) - { - if (_options.IncludeDebug) Console.WriteLine(ex); - } - }); - - return protections; - } - - /// - /// Handle extractable protections, such as executable packers - /// - /// Set of classes returned from Exectuable scans - /// Name of the source file of the stream, for tracking - /// LinearExecutable to scan the contents of - /// Set of protections found from extraction, null on error - private ProtectionDictionary? HandleExtractableProtections(IEnumerable>? classes, - string fileName, - LinearExecutable lex) - { - // If we have an invalid set of classes - if (classes == null || !classes.Any()) - return null; - - // Create the output dictionary - var protections = new ProtectionDictionary(); - - // If we have any extractable packers - var extractables = classes - .Where(c => c is IExtractableExecutable) - .Select(c => c as IExtractableExecutable); - extractables.IterateWithAction(extractable => - { - // If we have an invalid extractable somehow - if (extractable == null) - return; - - // If the extractable file itself fails - try - { - // Extract and get the output path - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - bool extracted = extractable.Extract(fileName, lex, tempPath, _options.IncludeDebug); - - // Collect and format all found protections - ProtectionDictionary? subProtections = null; - if (extracted) - subProtections = GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - if (Directory.Exists(tempPath)) - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (_options.IncludeDebug) Console.WriteLine(ex); - } - - // Prepare the returned protections - subProtections?.StripFromKeys(tempPath); - subProtections?.PrependToKeys(fileName); - if (subProtections != null) - protections.Append(subProtections); - } - catch (Exception ex) - { - if (_options.IncludeDebug) Console.WriteLine(ex); - } - }); - - return protections; - } - - /// - /// Handle extractable protections, such as executable packers - /// - /// Set of classes returned from Exectuable scans - /// Name of the source file of the stream, for tracking - /// NewExecutable to scan the contents of - /// Set of protections found from extraction, null on error - private ProtectionDictionary? HandleExtractableProtections(IEnumerable>? classes, - string fileName, - NewExecutable nex) - { - // If we have an invalid set of classes - if (classes == null || !classes.Any()) - return null; - - // Create the output dictionary - var protections = new ProtectionDictionary(); - - // If we have any extractable packers - var extractables = classes - .Where(c => c is IExtractableExecutable) - .Select(c => c as IExtractableExecutable); - extractables.IterateWithAction(extractable => - { - // If we have an invalid extractable somehow - if (extractable == null) - return; - - // If the extractable file itself fails - try - { - // Extract and get the output path - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - bool extracted = extractable.Extract(fileName, nex, tempPath, _options.IncludeDebug); - - // Collect and format all found protections - ProtectionDictionary? subProtections = null; - if (extracted) - subProtections = GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - if (Directory.Exists(tempPath)) - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (_options.IncludeDebug) Console.WriteLine(ex); - } - - // Prepare the returned protections - subProtections?.StripFromKeys(tempPath); - subProtections?.PrependToKeys(fileName); - if (subProtections != null) - protections.Append(subProtections); - } - catch (Exception ex) - { - if (_options.IncludeDebug) Console.WriteLine(ex); - } - }); - - return protections; - } - - /// - /// Handle extractable protections, such as executable packers - /// - /// Set of classes returned from Exectuable scans - /// Name of the source file of the stream, for tracking - /// PortableExecutable to scan the contents of - /// Set of protections found from extraction, null on error - private ProtectionDictionary? HandleExtractableProtections(IEnumerable>? classes, - string fileName, - PortableExecutable pex) - { - // If we have an invalid set of classes - if (classes == null || !classes.Any()) - return null; - - // Create the output dictionary - var protections = new ProtectionDictionary(); - - // If we have any extractable packers - var extractables = classes - .Where(c => c is IExtractableExecutable) - .Select(c => c as IExtractableExecutable); - extractables.IterateWithAction(extractable => - { - // If we have an invalid extractable somehow - if (extractable == null) - return; - - // If the extractable file itself fails - try - { - // Extract and get the output path - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - bool extracted = extractable.Extract(fileName, pex, tempPath, _options.IncludeDebug); - - // Collect and format all found protections - ProtectionDictionary? subProtections = null; - if (extracted) - subProtections = GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - if (Directory.Exists(tempPath)) - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (_options.IncludeDebug) Console.WriteLine(ex); - } - - // Prepare the returned protections - subProtections?.StripFromKeys(tempPath); - subProtections?.PrependToKeys(fileName); + subProtections?.PrependToKeys(file); if (subProtections != null) protections.Append(subProtections); }