From 9a2f2e6f17408c50a1de14faa7638586c13743f8 Mon Sep 17 00:00:00 2001
From: SilasLaspada <silasqwerty@ymail.com>
Date: Tue, 26 Oct 2021 11:23:08 -0600
Subject: [PATCH] Add initial detection for InstallAnywhere (#67)

---
 BurnOutSharp/PackerType/InstallAnywhere.cs | 67 ++++++++++++++++++++++
 README.md                                  |  1 +
 2 files changed, 68 insertions(+)
 create mode 100644 BurnOutSharp/PackerType/InstallAnywhere.cs

diff --git a/BurnOutSharp/PackerType/InstallAnywhere.cs b/BurnOutSharp/PackerType/InstallAnywhere.cs
new file mode 100644
index 00000000..8357ef83
--- /dev/null
+++ b/BurnOutSharp/PackerType/InstallAnywhere.cs
@@ -0,0 +1,67 @@
+using System;
+using System.Collections.Concurrent;
+using System.IO;
+using BurnOutSharp.ExecutableType.Microsoft;
+using BurnOutSharp.Tools;
+
+namespace BurnOutSharp.PackerType
+{
+    public class InstallAnywhere : IContentCheck, IScannable
+    {
+        /// <inheritdoc/>
+        public bool ShouldScan(byte[] magic) => true;
+
+        /// <inheritdoc/>
+        public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
+        {
+            // Get the sections from the executable, if possible
+            var sections = pex?.SectionTable;
+            if (sections == null)
+                return null;
+
+            string name = Utilities.GetFileDescription(pex);
+            if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("InstallAnywhere Self Extractor", StringComparison.OrdinalIgnoreCase))
+                return $"Setup Factory {GetVersion(pex)}";
+
+            name = Utilities.GetProductName(pex);
+            if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("InstallAnywhere", StringComparison.OrdinalIgnoreCase))
+                return $"Setup Factory {GetVersion(pex)}";
+
+            return null;
+        }
+
+        /// <inheritdoc/>
+        public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, string file)
+        {
+            if (!File.Exists(file))
+                return null;
+
+            using (var fs = File.OpenRead(file))
+            {
+                return Scan(scanner, fs, file);
+            }
+        }
+
+        /// <inheritdoc/>
+        // TODO: Add extraction, which may be possible with the current libraries but needs to be investigated further.
+        public ConcurrentDictionary<string, ConcurrentQueue<string>> Scan(Scanner scanner, Stream stream, string file)
+        {
+            return null;
+        }
+
+        private string GetVersion(PortableExecutable pex)
+        {
+            // Check the manifest version first
+            string version = Utilities.GetManifestVersion(pex);
+            if (!string.IsNullOrEmpty(version))
+                return version;
+
+            // Then check the file version
+            version = Utilities.GetFileVersion(pex);
+            if (!string.IsNullOrEmpty(version))
+                return version;
+
+            return "(Unknown Version)";
+        }
+    }
+}
diff --git a/README.md b/README.md
index ea145350..5bc95c6e 100644
--- a/README.md
+++ b/README.md
@@ -117,6 +117,7 @@ Below is a list of executable packers detected by BurnOutSharp. The three column
 | dotFuscator | Yes | No | No |
 | EXE Stealth | Yes | No | No |
 | Inno Setup | Yes | No | No |
+| InstallAnywhere | Yes | No | No |
 | Installer VISE | Yes | No | No |
 | Intel Installation Framework | Yes | No | No |
 | Microsoft CAB SFX | Yes | No | No |