diff --git a/BurnOutSharp/PackerType/WiseInstaller.cs b/BurnOutSharp/PackerType/WiseInstaller.cs index 50f10a6e..be72d32c 100644 --- a/BurnOutSharp/PackerType/WiseInstaller.cs +++ b/BurnOutSharp/PackerType/WiseInstaller.cs @@ -2,6 +2,7 @@ using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; +using System.Linq; using BurnOutSharp.Interfaces; using BurnOutSharp.Matching; using BurnOutSharp.Tools; @@ -46,33 +47,20 @@ namespace BurnOutSharp.PackerType // TODO: Investigate STUB32.EXE in export directory table - // Get the .data/DATA section, if it exists - var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA"); - if (dataSectionRaw != null) + // Get the .data/DATA section strings, if they exist + List strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA"); + if (strs != null) { - var matchers = new List - { - // WiseMain - new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"), - }; - - string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug); - if (!string.IsNullOrWhiteSpace(match)) - return match; + if (strs.Any(s => s.Contains("WiseMain"))) + return "Wise Installation Wizard Module"; } - // Get the .rdata section, if it exists - if (pex.ContainsSection(".rdata")) + // Get the .rdata section strings, if they exist + strs = pex.GetFirstSectionStrings(".rdata"); + if (strs != null) { - var matchers = new List - { - // WiseMain - new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"), - }; - - string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug); - if (!string.IsNullOrWhiteSpace(match)) - return match; + if (strs.Any(s => s.Contains("WiseMain"))) + return "Wise Installation Wizard Module"; } return null;