Implement unused packer extractions

This commit is contained in:
Matt Nadareski
2023-03-09 15:46:48 -05:00
parent 41d77085ae
commit cd2673d1ba
25 changed files with 279 additions and 29 deletions

View File

@@ -45,8 +45,38 @@ namespace BurnOutSharp.PackerType
/// <inheritdoc/>
public string Extract(Stream stream, string file)
{
// Create extraction based off Scan
return null;
// Parse into an executable again for easier extraction
PortableExecutable pex = PortableExecutable.Create(stream);
if (pex?.ResourceData == null)
return null;
// Get the resources that have an executable signature
var resources = pex.ResourceData
.Where(kvp => kvp.Value != null && kvp.Value is byte[])
.Where(kvp => (kvp.Value as byte[]).StartsWith(BinaryObjectScanner.Models.MSDOS.Constants.SignatureBytes))
.ToList();
string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString());
Directory.CreateDirectory(tempPath);
for (int i = 0; i < resources.Count; i++)
{
// Get the resource data
var resource = resources[i];
byte[] data = resource.Value as byte[];
// Create the temp filename
string tempFile = $"embedded_resource_{i}.bin";
tempFile = Path.Combine(tempPath, tempFile);
// Write the resource data to a temp file
using (Stream tempStream = File.Open(tempFile, FileMode.Create, FileAccess.Write, FileShare.ReadWrite))
{
tempStream.Write(data, 0, data.Length);
}
}
return tempPath;
}
/// <inheritdoc/>