Add MPRESS detection (fixes #206)

This commit is contained in:
Matt Nadareski
2025-09-07 11:37:09 -04:00
parent 4b697c7d20
commit 7b8c006f4d
2 changed files with 24 additions and 0 deletions

View File

@@ -0,0 +1,23 @@
using BinaryObjectScanner.Interfaces;
using SabreTools.Serialization.Wrappers;
namespace BinaryObjectScanner.Packer
{
// TODO: Add extraction
// https://www.virustotal.com/gui/file/e55a7f27452c7e5a3f5f388e4b477a124f0bb8bead4c2b0f2d5031578922bc77/detection
public class MPRESS : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
bool mpress1 = exe.ContainsSection(".MPRESS1");
bool mpress2 = exe.ContainsSection(".MPRESS2 ");
// TODO: Confirm if both need to be present
if (mpress1 || mpress2)
return "MPRESS"; // TODO: Figure out how to get version
return null;
}
}
}

View File

@@ -161,6 +161,7 @@ Below is a list of executable packers detected by BinaryObjectScanner. The three
| Installer VISE | Yes | No | No | |
| Intel Installation Framework | Yes | No | No | |
| Microsoft CAB SFX | Yes | No | No | |
| MPRESS | Yes | No | No |
| NeoLite | Yes | No | No | Only confirmed to detect version 2.X |
| NSIS | Yes | No | No | |
| PECompact | Yes | No | No | |