From 85d238268017263fffd5c346690fc012ab4f9187 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Wed, 15 Sep 2021 15:44:26 -0700
Subject: [PATCH] Only use extra checks for NE executables in Wise

---
 BurnOutSharp/PackerType/WiseInstaller.cs | 29 ++++++++----------------
 1 file changed, 9 insertions(+), 20 deletions(-)

diff --git a/BurnOutSharp/PackerType/WiseInstaller.cs b/BurnOutSharp/PackerType/WiseInstaller.cs
index fc374bc6..d0e3ff9b 100644
--- a/BurnOutSharp/PackerType/WiseInstaller.cs
+++ b/BurnOutSharp/PackerType/WiseInstaller.cs
@@ -2,7 +2,6 @@
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
-using System.Linq;
 using BurnOutSharp.ExecutableType.Microsoft;
 using BurnOutSharp.Matching;
 using BurnOutSharp.Tools;
@@ -15,18 +14,6 @@ namespace BurnOutSharp.PackerType
         /// <inheritdoc/>
         public bool ShouldScan(byte[] magic) => true;
 
-        /// <inheritdoc/>
-        private List<ContentMatchSet> GetContentMatchSets()
-        {
-            // TODO: Keep this around until it can be confirmed with NE checks as well
-            // TODO: This _may_ actually over-match. See msvbvm50.exe for an example
-            return new List<ContentMatchSet>
-            {
-                // WiseMain
-                new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"),
-            };
-        }
-
         /// <inheritdoc/>
         public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
         {
@@ -36,9 +23,15 @@ namespace BurnOutSharp.PackerType
             {
                 if (nex != null)
                 {
-                    var neMatchSets = GetContentMatchSets();
-                    if (neMatchSets != null && neMatchSets.Any())
-                        return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug);
+                    // TODO: Keep this around until it can be confirmed with NE checks as well
+                    // TODO: This _may_ actually over-match. See msvbvm50.exe for an example
+                    var neMatchSets = new List<ContentMatchSet>
+                    {
+                        // WiseMain
+                        new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"),
+                    };
+                    
+                    return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug);
                 }
 
                 return null;
@@ -72,10 +65,6 @@ namespace BurnOutSharp.PackerType
                     return match;
             }
 
-            var contentMatchSets = GetContentMatchSets();
-            if (contentMatchSets != null && contentMatchSets.Any())
-                return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
-
             return null;
         }