From bf385f0bbf92dd6b70b655dd268a47aa109c2844 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Fri, 10 Sep 2021 21:45:14 -0700
Subject: [PATCH] Identify and use .rsrc item for NSIS

---
 BurnOutSharp/PackerType/NSIS.cs | 48 ++++-----------------------------
 BurnOutSharp/Tools/Utilities.cs |  2 +-
 2 files changed, 6 insertions(+), 44 deletions(-)

diff --git a/BurnOutSharp/PackerType/NSIS.cs b/BurnOutSharp/PackerType/NSIS.cs
index 7625b6dd..43ab0150 100644
--- a/BurnOutSharp/PackerType/NSIS.cs
+++ b/BurnOutSharp/PackerType/NSIS.cs
@@ -4,6 +4,7 @@ using System.Linq;
 using System.Text;
 using BurnOutSharp.ExecutableType.Microsoft;
 using BurnOutSharp.Matching;
+using BurnOutSharp.Tools;
 
 namespace BurnOutSharp.PackerType
 {
@@ -17,30 +18,10 @@ namespace BurnOutSharp.PackerType
             if (sections == null)
                 return null;
 
-            // TODO: Find this inside of the .rsrc section using the executable header
-            // Get the .rsrc section, if it exists
-            var rsrcSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rsrc"));
-            if (rsrcSection != null)
-            {
-                int sectionAddr = (int)rsrcSection.PointerToRawData;
-                int sectionEnd = sectionAddr + (int)rsrcSection.VirtualSize;
-                var matchers = new List<ContentMatchSet>
-                {
-                    // Nullsoft Install System
-                    new ContentMatchSet(
-                        new ContentMatch(new byte?[]
-                        {
-                            0x4e, 0x75, 0x6c, 0x6c, 0x73, 0x6f, 0x66, 0x74,
-                            0x20, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c,
-                            0x20, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d
-                        }, start: sectionAddr, end: sectionEnd),
-                    GetVersion, "NSIS"),
-                };
-
-                string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
-                if (!string.IsNullOrWhiteSpace(match))
-                    return match;
-            }
+            string description = Utilities.GetManifestDescription(pex);
+            Console.WriteLine(description);
+            if (!string.IsNullOrWhiteSpace(description) && description.StartsWith("Nullsoft Install System"))
+                return $"NSIS {description.Substring("Nullsoft Install System".Length).Trim()}";
 
             // Get the .data section, if it exists
             var dataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".data"));
@@ -67,24 +48,5 @@ namespace BurnOutSharp.PackerType
 
             return null;
         }
-
-        public static string GetVersion(string file, byte[] fileContent, List<int> positions)
-        {
-            try
-            {
-                int index = positions[0];
-                index += 24;
-                if (fileContent[index] != 'v')
-                    return "(Unknown Version)";
-
-                var versionBytes = new ReadOnlySpan<byte>(fileContent, index, 16).ToArray();
-                var onlyVersion = versionBytes.TakeWhile(b => b != '<').ToArray();
-                return Encoding.ASCII.GetString(onlyVersion);
-            }
-            catch
-            {
-                return "(Unknown Version)";
-            }
-        }
     }
 }
\ No newline at end of file
diff --git a/BurnOutSharp/Tools/Utilities.cs b/BurnOutSharp/Tools/Utilities.cs
index 3b47bebf..605e9cc8 100644
--- a/BurnOutSharp/Tools/Utilities.cs
+++ b/BurnOutSharp/Tools/Utilities.cs
@@ -435,7 +435,7 @@ namespace BurnOutSharp.Tools
         /// </summary>
         /// <param name="rs">ResourceSection from the executable</param>
         /// <returns>Full assembly manifest, null on error</returns>
-        private static string FindAssemblyManifest(ResourceSection rs) => FindResourceInSection(rs, dataStart: "<assembly")?.DataAsUTF8String;
+        private static string FindAssemblyManifest(ResourceSection rs) => FindResourceInSection(rs, dataContains: "<assembly")?.DataAsUTF8String;
 
         /// <summary>
         /// Get the assembly identity node from an embedded manifest