SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-19 15:25:09 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Only deserialze a file once per round of checks

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-10 16:10:15 -07:00
parent 5344de96b2
commit b779f2f546
121 changed files with 162 additions and 225 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
BurnOutSharp/PackerType/AdvancedInstaller.cs
View File

@@ -10,10 +10,9 @@ namespace BurnOutSharp.PackerType
public class AdvancedInstaller : IContentCheck
{
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

18
BurnOutSharp/PackerType/Armadillo.cs
View File

@@ -10,21 +10,9 @@ namespace BurnOutSharp.PackerType
public class Armadillo : IContentCheck
{
/// <inheritdoc/>
private List<ContentMatchSet> GetContentMatchSets() => null;
// {
// // TODO: Remove this if the below section check is proven
// return new List<ContentMatchSet>
// {
// // .nicode + (char)0x00
// new ContentMatchSet(new byte?[] { 0x2E, 0x6E, 0x69, 0x63, 0x6F, 0x64, 0x65, 0x00 }, "Armadillo"),
// };
// }
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;
@@ -52,10 +40,6 @@ namespace BurnOutSharp.PackerType
return match;
}
var contentMatchSets = GetContentMatchSets();
if (contentMatchSets != null && contentMatchSets.Any())
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
return null;
}
}

3
BurnOutSharp/PackerType/CExe.cs
View File

@@ -2,6 +2,7 @@ using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
@@ -34,7 +35,7 @@ namespace BurnOutSharp.PackerType
}
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
var contentMatchSets = GetContentMatchSets();
if (contentMatchSets != null && contentMatchSets.Any())

3
BurnOutSharp/PackerType/EXEStealth.cs
View File

@@ -1,5 +1,6 @@
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
@@ -25,7 +26,7 @@ namespace BurnOutSharp.PackerType
}
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
var contentMatchSets = GetContentMatchSets();
if (contentMatchSets != null && contentMatchSets.Any())

3
BurnOutSharp/PackerType/InnoSetup.cs
View File

@@ -15,10 +15,9 @@ namespace BurnOutSharp.PackerType
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

3
BurnOutSharp/PackerType/InstallerVISE.cs
View File

@@ -15,10 +15,9 @@ namespace BurnOutSharp.PackerType
//TODO: Add exact version detection for Windows builds, make sure versions before 3.X are detected as well, and detect the Mac builds.
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

3
BurnOutSharp/PackerType/IntelInstallationFramework.cs
View File

@@ -8,10 +8,9 @@ namespace BurnOutSharp.PackerType
public class IntelInstallationFramework : IContentCheck
{
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

3
BurnOutSharp/PackerType/MicrosoftCABSFX.cs
View File

@@ -17,10 +17,9 @@ namespace BurnOutSharp.PackerType
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

3
BurnOutSharp/PackerType/NSIS.cs
View File

@@ -10,10 +10,9 @@ namespace BurnOutSharp.PackerType
public class NSIS : IContentCheck
{
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

3
BurnOutSharp/PackerType/PECompact.cs
View File

@@ -9,10 +9,9 @@ namespace BurnOutSharp.PackerType
public class PECompact : IContentCheck
{
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

3
BurnOutSharp/PackerType/SetupFactory.cs
View File

@@ -12,10 +12,9 @@ namespace BurnOutSharp.PackerType
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

3
BurnOutSharp/PackerType/UPX.cs
View File

@@ -10,10 +10,9 @@ namespace BurnOutSharp.PackerType
public class UPX : IContentCheck
{
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

3
BurnOutSharp/PackerType/WinRARSFX.cs
View File

@@ -18,10 +18,9 @@ namespace BurnOutSharp.PackerType
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;

4
BurnOutSharp/PackerType/WinZipSFX.cs
View File

@@ -19,10 +19,9 @@ namespace BurnOutSharp.PackerType
public bool ShouldScan(byte[] magic) => true;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Try to read the contents as a PE executable
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
if (pex != null)
{
var sections = pex?.SectionTable;
@@ -111,7 +110,6 @@ namespace BurnOutSharp.PackerType
}
// Try to read the contents as an NE executable
NewExecutable nex = NewExecutable.Deserialize(fileContent, 0);
if (nex != null)
{
string version = GetNEHeaderVersion(nex);

7
BurnOutSharp/PackerType/WiseInstaller.cs
View File

@@ -29,10 +29,9 @@ namespace BurnOutSharp.PackerType
}
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
{
@@ -56,10 +55,6 @@ namespace BurnOutSharp.PackerType
new ContentMatch(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, start: sectionAddr, end: sectionEnd),
"Wise Installation Wizard Module"),
};
string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .rdata section, if it exists

3
BurnOutSharp/PackerType/dotFuscator.cs
View File

@@ -1,5 +1,6 @@
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
@@ -23,7 +24,7 @@ namespace BurnOutSharp.PackerType
}
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
var contentMatchSets = GetContentMatchSets();
if (contentMatchSets != null && contentMatchSets.Any())