From c0e82fa021b3f3821a05852790ec5bae8fd07dea Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Tue, 2 Sep 2025 20:28:38 -0400 Subject: [PATCH] Handle extractable executables properly --- BinaryObjectScanner/FileType/Executable.cs | 7 ++----- BinaryObjectScanner/Scanner.cs | 4 ++-- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/BinaryObjectScanner/FileType/Executable.cs b/BinaryObjectScanner/FileType/Executable.cs index a80ef802..8f0b701b 100644 --- a/BinaryObjectScanner/FileType/Executable.cs +++ b/BinaryObjectScanner/FileType/Executable.cs @@ -27,7 +27,7 @@ namespace BinaryObjectScanner.FileType public string? Detect(Stream stream, string file, bool includeDebug) { // Get all non-nested protections - var protections = DetectDict(stream, file, getProtections: null, includeDebug); + var protections = DetectDict(stream, file, includeDebug); if (protections.Count == 0) return null; @@ -46,10 +46,7 @@ namespace BinaryObjectScanner.FileType /// Ideally, we wouldn't need to circumvent the proper handling of file types just for Executable, /// but due to the complexity of scanning, this is not currently possible. /// - public ProtectionDictionary DetectDict(Stream stream, - string file, - Func? getProtections, - bool includeDebug) + public ProtectionDictionary DetectDict(Stream stream, string file, bool includeDebug) { // Create the output dictionary var protections = new ProtectionDictionary(); diff --git a/BinaryObjectScanner/Scanner.cs b/BinaryObjectScanner/Scanner.cs index 787e0ea0..467a91dc 100644 --- a/BinaryObjectScanner/Scanner.cs +++ b/BinaryObjectScanner/Scanner.cs @@ -271,7 +271,7 @@ namespace BinaryObjectScanner // If we have an executable, it needs to bypass normal handling if (detectable is Executable executable) { - var subProtections = executable.DetectDict(stream, fileName, GetProtections, _options.IncludeDebug); + var subProtections = executable.DetectDict(stream, fileName, _options.IncludeDebug); protections.Append(subProtections); } @@ -291,7 +291,7 @@ namespace BinaryObjectScanner var extractable = Factory.CreateExtractable(fileType); // If we're scanning archives - if (extractable != null && _options.ScanArchives) + if (extractable != null && (extractable is Executable || _options.ScanArchives)) { // If the extractable file itself fails try