mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-07-08 18:06:34 +00:00
Add support for detecting NSIS (#14)
This commit is contained in:
@@ -172,7 +172,12 @@ namespace BurnOutSharp.FileType
|
||||
protection = LaserLock.CheckContents(file, fileContent, includePosition);
|
||||
if (!string.IsNullOrWhiteSpace(protection))
|
||||
protections.Add(protection);
|
||||
|
||||
|
||||
// NSIS
|
||||
protection = NSIS.CheckContents(fileContent, includePosition);
|
||||
if (!string.IsNullOrWhiteSpace(protection))
|
||||
protections.Add(protection);
|
||||
|
||||
// PE Compact
|
||||
protection = PECompact.CheckContents(fileContent, includePosition);
|
||||
if (!string.IsNullOrWhiteSpace(protection))
|
||||
|
||||
47
BurnOutSharp/ProtectionType/NSIS.cs
Normal file
47
BurnOutSharp/ProtectionType/NSIS.cs
Normal file
@@ -0,0 +1,47 @@
|
||||
using System.Text;
|
||||
using System;
|
||||
using System.Linq;
|
||||
|
||||
namespace BurnOutSharp.ProtectionType
|
||||
{
|
||||
public class NSIS
|
||||
{
|
||||
public static string CheckContents(byte[] fileContent, bool includePosition = false)
|
||||
{
|
||||
// Nullsoft Install System
|
||||
byte[] check = new byte[] { 0x4e, 0x75, 0x6c, 0x6c, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x20, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d };
|
||||
if (fileContent.Contains(check, out int position))
|
||||
{
|
||||
string version = GetVersion(fileContent, position);
|
||||
return $"NSIS {version}" + (includePosition ? $" (Index {position})" : string.Empty);
|
||||
}
|
||||
|
||||
// NullsoftInst
|
||||
check = new byte[] { 0x4e, 0x75, 0x6c, 0x6c, 0x73, 0x6f, 0x66, 0x74, 0x49, 0x6e, 0x73, 0x74 };
|
||||
if (fileContent.Contains(check, out position))
|
||||
{
|
||||
return $"NSIS" + (includePosition ? $" (Index {position})" : string.Empty);
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static string GetVersion(byte[] fileContent, int index)
|
||||
{
|
||||
try
|
||||
{
|
||||
index += 24;
|
||||
if (fileContent[index] != 'v')
|
||||
return "(Unknown Version)";
|
||||
var versionBytes = new ReadOnlySpan<byte>(fileContent, index, 16).ToArray();
|
||||
var onlyVersion = versionBytes.TakeWhile(b => b != '<').ToArray();
|
||||
string versionString = Encoding.ASCII.GetString(onlyVersion);
|
||||
return versionString;
|
||||
}
|
||||
catch
|
||||
{
|
||||
return "(Unknown Version)";
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user