Add PKLITE32 detection (fixes #100)

This commit is contained in:
Matt Nadareski
2025-09-07 11:09:43 -04:00
parent 0d371d0f3c
commit bef5749b5e
3 changed files with 23 additions and 1 deletions

View File

@@ -0,0 +1,21 @@
using BinaryObjectScanner.Interfaces;
using SabreTools.Serialization.Wrappers;
namespace BinaryObjectScanner.Packer
{
/// <summary>
/// PKLITE and PKLITE32
/// </summary>
public class PKLite : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// <see href="https://www.virustotal.com/gui/file/601573f263115035921f621598f7a81ace998bf325e081165aa698b981822013/details"/>
if (pex.ContainsSection(".pklstb"))
return "PKLITE32"; // TODO: Figure out how to determine version
return null;
}
}
}

View File

@@ -47,7 +47,7 @@ namespace BinaryObjectScanner.Protection
return "Uniloc SoftAnchor";
// Found in Redump entry 114428
if (Array.IndexOf(exe.SectionNames, "SAAC0") > -1)
if (exe.ContainsSection("SAAC0"))
return "Uniloc SoftAnchor";
return null;

View File

@@ -165,6 +165,7 @@ Below is a list of executable packers detected by BinaryObjectScanner. The three
| NSIS | Yes | No | No | |
| PECompact | Yes | No | No | |
| PEtite | Yes | No | No | |
| PKLITE32 | Yes | No | No | |
| Setup Factory | Yes | No | No | |
| Shrinker | Yes | No | No | |
| UPX and UPX (NOS Variant) | Yes | No | No | |