From aa3afd676b06ec7b27f77b00f2f6ec43f9f08275 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Sat, 31 Oct 2020 14:46:08 -0700
Subject: [PATCH] Add option for including packers in scan

---
 BurnOutSharp/FileType/Executable.cs | 54 ++++++++++++++++-------------
 BurnOutSharp/Scanner.cs             |  5 +++
 Test/Program.cs                     |  1 +
 3 files changed, 35 insertions(+), 25 deletions(-)

diff --git a/BurnOutSharp/FileType/Executable.cs b/BurnOutSharp/FileType/Executable.cs
index 150a96ea..9de41efb 100644
--- a/BurnOutSharp/FileType/Executable.cs
+++ b/BurnOutSharp/FileType/Executable.cs
@@ -248,38 +248,42 @@ namespace BurnOutSharp.FileType
 
             #endregion
 
-            // These are detected as protections until we can unpack them
             #region Packers
 
-            // Armadillo
-            protection = Armadillo.CheckContents(fileContent, scanner.IncludePosition);
-            if (!string.IsNullOrWhiteSpace(protection))
-                Utilities.AppendToDictionary(protections, file, protection);
+            // If we're looking for packers too, run scans
+            if (scanner.IncludePackers)
+            {
 
-            // dotFuscator
-            protection = dotFuscator.CheckContents(fileContent, scanner.IncludePosition);
-            if (!string.IsNullOrWhiteSpace(protection))
-                Utilities.AppendToDictionary(protections, file, protection);
+                // Armadillo
+                protection = Armadillo.CheckContents(fileContent, scanner.IncludePosition);
+                if (!string.IsNullOrWhiteSpace(protection))
+                    Utilities.AppendToDictionary(protections, file, protection);
 
-            // EXE Stealth
-            protection = EXEStealth.CheckContents(fileContent, scanner.IncludePosition);
-            if (!string.IsNullOrWhiteSpace(protection))
-                Utilities.AppendToDictionary(protections, file, protection);
+                // dotFuscator
+                protection = dotFuscator.CheckContents(fileContent, scanner.IncludePosition);
+                if (!string.IsNullOrWhiteSpace(protection))
+                    Utilities.AppendToDictionary(protections, file, protection);
 
-            // NSIS
-            protection = NSIS.CheckContents(fileContent, scanner.IncludePosition);
-            if (!string.IsNullOrWhiteSpace(protection))
-                Utilities.AppendToDictionary(protections, file, protection);
+                // EXE Stealth
+                protection = EXEStealth.CheckContents(fileContent, scanner.IncludePosition);
+                if (!string.IsNullOrWhiteSpace(protection))
+                    Utilities.AppendToDictionary(protections, file, protection);
 
-            // PE Compact
-            protection = PECompact.CheckContents(fileContent, scanner.IncludePosition);
-            if (!string.IsNullOrWhiteSpace(protection))
-                Utilities.AppendToDictionary(protections, file, protection);
+                // NSIS
+                protection = NSIS.CheckContents(fileContent, scanner.IncludePosition);
+                if (!string.IsNullOrWhiteSpace(protection))
+                    Utilities.AppendToDictionary(protections, file, protection);
 
-            // UPX
-            protection = UPX.CheckContents(fileContent, scanner.IncludePosition);
-            if (!string.IsNullOrWhiteSpace(protection))
-                Utilities.AppendToDictionary(protections, file, protection);
+                // PE Compact
+                protection = PECompact.CheckContents(fileContent, scanner.IncludePosition);
+                if (!string.IsNullOrWhiteSpace(protection))
+                    Utilities.AppendToDictionary(protections, file, protection);
+
+                // UPX
+                protection = UPX.CheckContents(fileContent, scanner.IncludePosition);
+                if (!string.IsNullOrWhiteSpace(protection))
+                    Utilities.AppendToDictionary(protections, file, protection);
+            }
 
             #endregion
 
diff --git a/BurnOutSharp/Scanner.cs b/BurnOutSharp/Scanner.cs
index fb8060f1..f466c09e 100644
--- a/BurnOutSharp/Scanner.cs
+++ b/BurnOutSharp/Scanner.cs
@@ -31,6 +31,11 @@ namespace BurnOutSharp
         /// </summary>
         public bool ScanArchives { get; set; } = true;
 
+        /// <summary>
+        /// Determines if packers are counted as detected protections or not
+        /// </summary>
+        public bool IncludePackers { get; set; } = false;
+
         /// <summary>
         /// Constructor
         /// </summary>
diff --git a/Test/Program.cs b/Test/Program.cs
index 57f99fd8..f718eb50 100644
--- a/Test/Program.cs
+++ b/Test/Program.cs
@@ -19,6 +19,7 @@ namespace Test
                 IncludePosition = true,
                 ScanAllFiles = false,
                 ScanArchives = true,
+                IncludePackers = true,
             };
 
             foreach (string arg in args)