diff --git a/BinaryObjectScanner/Packer/MPRESS.cs b/BinaryObjectScanner/Packer/MPRESS.cs new file mode 100644 index 00000000..eab33990 --- /dev/null +++ b/BinaryObjectScanner/Packer/MPRESS.cs @@ -0,0 +1,23 @@ +using BinaryObjectScanner.Interfaces; +using SabreTools.Serialization.Wrappers; + +namespace BinaryObjectScanner.Packer +{ + // TODO: Add extraction + // https://www.virustotal.com/gui/file/e55a7f27452c7e5a3f5f388e4b477a124f0bb8bead4c2b0f2d5031578922bc77/detection + public class MPRESS : IExecutableCheck + { + /// + public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) + { + bool mpress1 = exe.ContainsSection(".MPRESS1"); + bool mpress2 = exe.ContainsSection(".MPRESS2 "); + + // TODO: Confirm if both need to be present + if (mpress1 || mpress2) + return "MPRESS"; // TODO: Figure out how to get version + + return null; + } + } +} \ No newline at end of file diff --git a/README.md b/README.md index 3daffda2..847ff79c 100644 --- a/README.md +++ b/README.md @@ -161,6 +161,7 @@ Below is a list of executable packers detected by BinaryObjectScanner. The three | Installer VISE | Yes | No | No | | | Intel Installation Framework | Yes | No | No | | | Microsoft CAB SFX | Yes | No | No | | +| MPRESS | Yes | No | No | | NeoLite | Yes | No | No | Only confirmed to detect version 2.X | | NSIS | Yes | No | No | | | PECompact | Yes | No | No | |