SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-08 18:06:34 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Return all detected embedded types

Browse Source
This commit is contained in:
Matt Nadareski
2025-09-08 09:25:45 -04:00
parent d8b0588d6e
commit d29dec3904
1 changed files with 60 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

110
BinaryObjectScanner/Packer/EmbeddedFile.cs
View File

@@ -1,3 +1,4 @@
using System.Collections.Generic;
using BinaryObjectScanner.Interfaces;
using SabreTools.IO.Extensions;
using SabreTools.Matching;
@@ -14,10 +15,11 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, NewExecutable exe, bool includeDebug)
{
// TODO: Have this return all detected things, not just the first
byte[]? overlayData = exe.OverlayData;
// Create a list for all detected file types
List<string> embeddedTypes = [];
// Check the overlay, if it exists
byte[]? overlayData = exe.OverlayData;
if (overlayData != null && overlayData.Length > 0)
{
// Set the output variables
@@ -31,76 +33,79 @@ namespace BinaryObjectScanner.Packer
if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
{
return "Embedded 7-Zip Archive";
embeddedTypes.Add("Embedded 7-Zip Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes))
{
return "Embedded MS-CAB Archive";
embeddedTypes.Add("Embedded MS-CAB Archive");
}
else if (overlaySample.StartsWith([0x42, 0x5A, 0x68]))
{
return "Embedded BZip2 Archive";
embeddedTypes.Add("Embedded BZip2 Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
{
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes))
{
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes))
{
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes))
{
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
{
return "Embedded RAR Archive";
embeddedTypes.Add("Embedded RAR Archive");
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
{
return "Embedded RAR Archive";
embeddedTypes.Add("Embedded RAR Archive");
}
else if (overlaySample.StartsWith([0x55, 0x48, 0x41, 0x06]))
{
return "Embedded UHARC Archive";
embeddedTypes.Add("Embedded UHARC Archive");
}
else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
{
return "Embedded XZ Archive";
embeddedTypes.Add("Embedded XZ Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes))
{
return "Embedded Executable";
embeddedTypes.Add("Embedded Executable");
}
else if (overlaySample.StartsWith([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C]))
{
// 7-zip SFX script -- ";!@Install" to ";!@InstallEnd@!"
overlayOffset = overlayData.FirstPosition([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x45, 0x6E, 0x64, 0x40, 0x21]);
if (overlayOffset > -1)
return "Embedded 7-Zip Archive";
embeddedTypes.Add("Embedded 7-Zip Archive");
}
}
}
return null;
// If there are no embedded files
if (embeddedTypes.Count == 0)
return null;
return string.Join(";", [.. embeddedTypes]);
}
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Have this return all detected things, not just the first
// Create a list for all detected file types
List<string> embeddedTypes = [];
// Only process the resources if they are recognized
if (exe.ResourceData != null)
var resourceData = exe.ResourceData;
if (resourceData != null)
{
// Cache the resource data for easier reading
var resourceData = exe.ResourceData;
// Get the resources that have an archive signature
foreach (var value in resourceData.Values)
{
@@ -117,104 +122,109 @@ namespace BinaryObjectScanner.Packer
byte[] resourceSample = ba.ReadBytes(ref temp, 0x10);
if (resourceSample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
return "Embedded 7-Zip Archive";
embeddedTypes.Add("Embedded 7-Zip Archive");
else if (resourceSample.StartsWith([0x42, 0x5A, 0x68]))
return "Embedded BZip2 Archive";
embeddedTypes.Add("Embedded BZip2 Archive");
else if (resourceSample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes))
return "Embedded MS-CAB Archive";
embeddedTypes.Add("Embedded MS-CAB Archive");
else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes))
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes))
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes))
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
return "Embedded RAR Archive";
embeddedTypes.Add("Embedded RAR Archive");
else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
return "Embedded RAR Archive";
embeddedTypes.Add("Embedded RAR Archive");
else if (resourceSample.StartsWith([0x55, 0x48, 0x41, 0x06]))
return "Embedded UHARC Archive";
embeddedTypes.Add("Embedded UHARC Archive");
else if (resourceSample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
return "Embedded XZ Archive";
embeddedTypes.Add("Embedded XZ Archive");
else if (resourceSample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes))
return "Embedded Executable";
embeddedTypes.Add("Embedded Executable");
}
}
}
// Check the overlay, if it exists
if (exe.OverlayData != null && exe.OverlayData.Length > 0)
byte[]? overlayData = exe.OverlayData;
if (overlayData != null && overlayData.Length > 0)
{
// Set the output variables
int overlayOffset = 0;
// Only process the overlay if it is recognized
for (; overlayOffset < 0x400 && overlayOffset < exe.OverlayData.Length - 0x10; overlayOffset++)
for (; overlayOffset < 0x400 && overlayOffset < overlayData.Length - 0x10; overlayOffset++)
{
int temp = overlayOffset;
byte[] overlaySample = exe.OverlayData.ReadBytes(ref temp, 0x10);
byte[] overlaySample = overlayData.ReadBytes(ref temp, 0x10);
if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
{
return "Embedded 7-Zip Archive";
embeddedTypes.Add("Embedded 7-Zip Archive");
}
else if (overlaySample.StartsWith([0x42, 0x5A, 0x68]))
{
return "Embedded BZip2 Archive";
embeddedTypes.Add("Embedded BZip2 Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes))
{
return "Embedded MS-CAB Archive";
embeddedTypes.Add("Embedded MS-CAB Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
{
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes))
{
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes))
{
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes))
{
return "Embedded PKZIP Archive";
embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
{
return "Embedded RAR Archive";
embeddedTypes.Add("Embedded RAR Archive");
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
{
return "Embedded RAR Archive";
embeddedTypes.Add("Embedded RAR Archive");
}
else if (overlaySample.StartsWith([0x55, 0x48, 0x41, 0x06]))
{
return "Embedded UHARC Archive";
embeddedTypes.Add("Embedded UHARC Archive");
}
else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
{
return "Embedded XZ Archive";
embeddedTypes.Add("Embedded XZ Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes))
{
return "Embedded Executable";
embeddedTypes.Add("Embedded Executable");
}
else if (overlaySample.StartsWith([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C]))
{
// 7-zip SFX script -- ";!@Install" to ";!@InstallEnd@!"
overlayOffset = exe.OverlayData.FirstPosition([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x45, 0x6E, 0x64, 0x40, 0x21]);
if (overlayOffset > -1)
return "Embedded 7-Zip Archive";
embeddedTypes.Add("Embedded 7-Zip Archive");
}
}
}
return null;
// If there are no embedded files
if (embeddedTypes.Count == 0)
return null;
return string.Join(";", [.. embeddedTypes]);
}
}
}