From bef5749b5e723b86b0de5ce17b0e215fea8eec42 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Sun, 7 Sep 2025 11:09:43 -0400 Subject: [PATCH] Add PKLITE32 detection (fixes #100) --- BinaryObjectScanner/Packer/PKLite.cs | 21 +++++++++++++++++++ .../Protection/UnilocSoftAnchor.cs | 2 +- README.md | 1 + 3 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 BinaryObjectScanner/Packer/PKLite.cs diff --git a/BinaryObjectScanner/Packer/PKLite.cs b/BinaryObjectScanner/Packer/PKLite.cs new file mode 100644 index 00000000..3a0c379e --- /dev/null +++ b/BinaryObjectScanner/Packer/PKLite.cs @@ -0,0 +1,21 @@ +using BinaryObjectScanner.Interfaces; +using SabreTools.Serialization.Wrappers; + +namespace BinaryObjectScanner.Packer +{ + /// + /// PKLITE and PKLITE32 + /// + public class PKLite : IExecutableCheck + { + /// + public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug) + { + // + if (pex.ContainsSection(".pklstb")) + return "PKLITE32"; // TODO: Figure out how to determine version + + return null; + } + } +} diff --git a/BinaryObjectScanner/Protection/UnilocSoftAnchor.cs b/BinaryObjectScanner/Protection/UnilocSoftAnchor.cs index e6796a4d..12f6aae8 100644 --- a/BinaryObjectScanner/Protection/UnilocSoftAnchor.cs +++ b/BinaryObjectScanner/Protection/UnilocSoftAnchor.cs @@ -47,7 +47,7 @@ namespace BinaryObjectScanner.Protection return "Uniloc SoftAnchor"; // Found in Redump entry 114428 - if (Array.IndexOf(exe.SectionNames, "SAAC0") > -1) + if (exe.ContainsSection("SAAC0")) return "Uniloc SoftAnchor"; return null; diff --git a/README.md b/README.md index e28fb355..3daffda2 100644 --- a/README.md +++ b/README.md @@ -165,6 +165,7 @@ Below is a list of executable packers detected by BinaryObjectScanner. The three | NSIS | Yes | No | No | | | PECompact | Yes | No | No | | | PEtite | Yes | No | No | | +| PKLITE32 | Yes | No | No | | | Setup Factory | Yes | No | No | | | Shrinker | Yes | No | No | | | UPX and UPX (NOS Variant) | Yes | No | No | |