From 6b8f8957deff6750a3461c6fad8d0f8e80eb086e Mon Sep 17 00:00:00 2001
From: SilasLaspada <silasqwerty@ymail.com>
Date: Sun, 21 Mar 2021 23:36:01 -0600
Subject: [PATCH] Add Advanced Installer Detection (#32)

* Add Advanced Installer Detection

* Updated README

* Address comments
---
 BurnOutSharp/PackerType/AdvancedInstaller.cs | 20 ++++++++++++++++++++
 README.md                                    |  1 +
 2 files changed, 21 insertions(+)
 create mode 100644 BurnOutSharp/PackerType/AdvancedInstaller.cs

diff --git a/BurnOutSharp/PackerType/AdvancedInstaller.cs b/BurnOutSharp/PackerType/AdvancedInstaller.cs
new file mode 100644
index 00000000..91a22a84
--- /dev/null
+++ b/BurnOutSharp/PackerType/AdvancedInstaller.cs
@@ -0,0 +1,20 @@
+using System;
+using System.IO;
+
+namespace BurnOutSharp.PackerType
+{
+    // TODO: Add extraction and verify that all versions are detected
+    public class AdvancedInstaller : IContentCheck
+    {
+        /// <inheritdoc/>
+        public string CheckContents(string file, byte[] fileContent, bool includePosition = false)
+        {
+            // Software\Caphyon\Advanced Installer
+            byte?[] check = new byte?[] { 0x53, 0x6F, 0x66, 0x74, 0x77, 0x61, 0x72, 0x65, 0x5C, 0x43, 0x61, 0x70, 0x68, 0x79, 0x6F, 0x6E, 0x5C, 0x41, 0x64, 0x76, 0x61, 0x6E, 0x63, 0x65, 0x64, 0x20, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x65, 0x72 };
+            if (fileContent.FirstPosition(check, out int position))
+                return "Caphyon Advanced Installer" + (includePosition ? $" (Index {position})" : string.Empty);
+
+            return null;
+        }
+    }
+}
diff --git a/README.md b/README.md
index 0b41ae76..a1ca167b 100644
--- a/README.md
+++ b/README.md
@@ -88,6 +88,7 @@ Below is a list of the protections that can be detected using this code:
 
 Below is a list of the executable packers that can be detected using this code:
 
+- Advanced Installer
 - Armadillo
 - CExe
 - dotFuscator