Add initial detection for InstallAnywhere (#67)

BurnOutSharp/PackerType/InstallAnywhere.cs

@@ -0,0 +1,67 @@
+using System;
+using System.Collections.Concurrent;
+using System.IO;
+using BurnOutSharp.ExecutableType.Microsoft;
+using BurnOutSharp.Tools;
+
+namespace BurnOutSharp.PackerType
+{
+    public class InstallAnywhere : IContentCheck, IScannable
+    {
+        /// <inheritdoc/>
+        public bool ShouldScan(byte[] magic) => true;
+
+        /// <inheritdoc/>
+        public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
+        {
+            // Get the sections from the executable, if possible
+            var sections = pex?.SectionTable;
+            if (sections == null)
+                return null;
+
+            string name = Utilities.GetFileDescription(pex);
+            if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("InstallAnywhere Self Extractor", StringComparison.OrdinalIgnoreCase))
+                return $"Setup Factory {GetVersion(pex)}";
+
+            name = Utilities.GetProductName(pex);
+            if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("InstallAnywhere", StringComparison.OrdinalIgnoreCase))
+                return $"Setup Factory {GetVersion(pex)}";
+
+            return null;
+        }
+
+        /// <inheritdoc/>
+        public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
+        {
+            if (!File.Exists(file))
+                return null;
+
+            using (var fs = File.OpenRead(file))
+            {
+                return Scan(scanner, fs, file);
+            }
+        }
+
+        /// <inheritdoc/>
+        // TODO: Add extraction, which may be possible with the current libraries but needs to be investigated further.
+        public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
+        {
+            return null;
+        }
+
+        private string GetVersion(PortableExecutable pex)
+        {
+            // Check the manifest version first
+            string version = Utilities.GetManifestVersion(pex);
+            if (!string.IsNullOrEmpty(version))
+                return version;
+
+            // Then check the file version
+            version = Utilities.GetFileVersion(pex);
+            if (!string.IsNullOrEmpty(version))
+                return version;
+
+            return "(Unknown Version)";
+        }
+    }
+}

README.md

@@ -117,6 +117,7 @@ Below is a list of executable packers detected by BurnOutSharp. The three column
 | dotFuscator | Yes | No | No |
 | EXE Stealth | Yes | No | No |
 | Inno Setup | Yes | No | No |
+| InstallAnywhere | Yes | No | No |
 | Installer VISE | Yes | No | No |
 | Intel Installation Framework | Yes | No | No |
 | Microsoft CAB SFX | Yes | No | No |