mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-07-08 18:06:34 +00:00
Add MPRESS detection (fixes #206)
This commit is contained in:
23
BinaryObjectScanner/Packer/MPRESS.cs
Normal file
23
BinaryObjectScanner/Packer/MPRESS.cs
Normal file
@@ -0,0 +1,23 @@
|
||||
using BinaryObjectScanner.Interfaces;
|
||||
using SabreTools.Serialization.Wrappers;
|
||||
|
||||
namespace BinaryObjectScanner.Packer
|
||||
{
|
||||
// TODO: Add extraction
|
||||
// https://www.virustotal.com/gui/file/e55a7f27452c7e5a3f5f388e4b477a124f0bb8bead4c2b0f2d5031578922bc77/detection
|
||||
public class MPRESS : IExecutableCheck<PortableExecutable>
|
||||
{
|
||||
/// <inheritdoc/>
|
||||
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
|
||||
{
|
||||
bool mpress1 = exe.ContainsSection(".MPRESS1");
|
||||
bool mpress2 = exe.ContainsSection(".MPRESS2 ");
|
||||
|
||||
// TODO: Confirm if both need to be present
|
||||
if (mpress1 || mpress2)
|
||||
return "MPRESS"; // TODO: Figure out how to get version
|
||||
|
||||
return null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -161,6 +161,7 @@ Below is a list of executable packers detected by BinaryObjectScanner. The three
|
||||
| Installer VISE | Yes | No | No | |
|
||||
| Intel Installation Framework | Yes | No | No | |
|
||||
| Microsoft CAB SFX | Yes | No | No | |
|
||||
| MPRESS | Yes | No | No |
|
||||
| NeoLite | Yes | No | No | Only confirmed to detect version 2.X |
|
||||
| NSIS | Yes | No | No | |
|
||||
| PECompact | Yes | No | No | |
|
||||
|
||||
Reference in New Issue
Block a user