Add Shrinker PE detection

This commit is contained in:
Matt Nadareski
2022-03-15 22:44:10 -07:00
parent c349f3a3c4
commit cab200e893
2 changed files with 28 additions and 0 deletions

View File

@@ -0,0 +1,27 @@
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
// TODO: Add extraction
public class Shrinker : IPEContentCheck
{
/// <inheritdoc/>
public string CheckPEContents(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex?.SectionTable;
if (sections == null)
return null;
// Get the .shrink0 and .shrink2 sections, if they exist -- TODO: Confirm if both are needed or either/or is fine
bool shrink0Section = pex.ContainsSection(".shrink0", true);
bool shrink2Section = pex.ContainsSection(".shrink2", true);
if (shrink0Section || shrink2Section)
return "Shrinker";
return null;
}
}
}

View File

@@ -126,6 +126,7 @@ Below is a list of executable packers detected by BurnOutSharp. The three column
| PECompact | Yes | No | No |
| PEtite | Yes | No | No |
| Setup Factory | Yes | No | No |
| Shrinker | Yes | No | No |
| UPX and UPX (NOS Variant) | Yes | No | No |
| WinRAR SFX | Yes | No | Yes |
| WinZip SFX | Yes | No | Yes |