mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-02-10 13:52:16 +00:00
Add Shrinker PE detection
This commit is contained in:
27
BurnOutSharp/PackerType/Shrinker.cs
Normal file
27
BurnOutSharp/PackerType/Shrinker.cs
Normal file
@@ -0,0 +1,27 @@
|
||||
using System.Collections.Generic;
|
||||
using BurnOutSharp.ExecutableType.Microsoft.PE;
|
||||
using BurnOutSharp.Matching;
|
||||
|
||||
namespace BurnOutSharp.PackerType
|
||||
{
|
||||
// TODO: Add extraction
|
||||
public class Shrinker : IPEContentCheck
|
||||
{
|
||||
/// <inheritdoc/>
|
||||
public string CheckPEContents(string file, PortableExecutable pex, bool includeDebug)
|
||||
{
|
||||
// Get the sections from the executable, if possible
|
||||
var sections = pex?.SectionTable;
|
||||
if (sections == null)
|
||||
return null;
|
||||
|
||||
// Get the .shrink0 and .shrink2 sections, if they exist -- TODO: Confirm if both are needed or either/or is fine
|
||||
bool shrink0Section = pex.ContainsSection(".shrink0", true);
|
||||
bool shrink2Section = pex.ContainsSection(".shrink2", true);
|
||||
if (shrink0Section || shrink2Section)
|
||||
return "Shrinker";
|
||||
|
||||
return null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -126,6 +126,7 @@ Below is a list of executable packers detected by BurnOutSharp. The three column
|
||||
| PECompact | Yes | No | No |
|
||||
| PEtite | Yes | No | No |
|
||||
| Setup Factory | Yes | No | No |
|
||||
| Shrinker | Yes | No | No |
|
||||
| UPX and UPX (NOS Variant) | Yes | No | No |
|
||||
| WinRAR SFX | Yes | No | Yes |
|
||||
| WinZip SFX | Yes | No | Yes |
|
||||
|
||||
Reference in New Issue
Block a user