diff --git a/BurnOutSharp/FileType/Executable.cs b/BurnOutSharp/FileType/Executable.cs index 09ecb4f2..0eb9ef87 100644 --- a/BurnOutSharp/FileType/Executable.cs +++ b/BurnOutSharp/FileType/Executable.cs @@ -172,7 +172,12 @@ namespace BurnOutSharp.FileType protection = LaserLock.CheckContents(file, fileContent, includePosition); if (!string.IsNullOrWhiteSpace(protection)) protections.Add(protection); - + + // NSIS + protection = NSIS.CheckContents(fileContent, includePosition); + if (!string.IsNullOrWhiteSpace(protection)) + protections.Add(protection); + // PE Compact protection = PECompact.CheckContents(fileContent, includePosition); if (!string.IsNullOrWhiteSpace(protection)) diff --git a/BurnOutSharp/ProtectionType/NSIS.cs b/BurnOutSharp/ProtectionType/NSIS.cs new file mode 100644 index 00000000..1287aeff --- /dev/null +++ b/BurnOutSharp/ProtectionType/NSIS.cs @@ -0,0 +1,47 @@ +using System.Text; +using System; +using System.Linq; + +namespace BurnOutSharp.ProtectionType +{ + public class NSIS + { + public static string CheckContents(byte[] fileContent, bool includePosition = false) + { + // Nullsoft Install System + byte[] check = new byte[] { 0x4e, 0x75, 0x6c, 0x6c, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x20, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d }; + if (fileContent.Contains(check, out int position)) + { + string version = GetVersion(fileContent, position); + return $"NSIS {version}" + (includePosition ? $" (Index {position})" : string.Empty); + } + + // NullsoftInst + check = new byte[] { 0x4e, 0x75, 0x6c, 0x6c, 0x73, 0x6f, 0x66, 0x74, 0x49, 0x6e, 0x73, 0x74 }; + if (fileContent.Contains(check, out position)) + { + return $"NSIS" + (includePosition ? $" (Index {position})" : string.Empty); + } + + return null; + } + + private static string GetVersion(byte[] fileContent, int index) + { + try + { + index += 24; + if (fileContent[index] != 'v') + return "(Unknown Version)"; + var versionBytes = new ReadOnlySpan(fileContent, index, 16).ToArray(); + var onlyVersion = versionBytes.TakeWhile(b => b != '<').ToArray(); + string versionString = Encoding.ASCII.GetString(onlyVersion); + return versionString; + } + catch + { + return "(Unknown Version)"; + } + } + } +} \ No newline at end of file diff --git a/README.md b/README.md index 3b6cdbcd..abbb0cf3 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,7 @@ Below is a list of the protections that can be detected using this code: - LaserLock - MediaCloQ - MediaMax CD3 +- NSIS - Origin (partial) - ProtectDisc - Protect DVD-Video