diff --git a/BinaryObjectScanner/Packer/EmbeddedFile.cs b/BinaryObjectScanner/Packer/EmbeddedFile.cs
index adfee2a0..fc1d65e4 100644
--- a/BinaryObjectScanner/Packer/EmbeddedFile.cs
+++ b/BinaryObjectScanner/Packer/EmbeddedFile.cs
@@ -1,3 +1,4 @@
+using System.Collections.Generic;
using BinaryObjectScanner.Interfaces;
using SabreTools.IO.Extensions;
using SabreTools.Matching;
@@ -14,10 +15,11 @@ namespace BinaryObjectScanner.Packer
///
public string? CheckExecutable(string file, NewExecutable exe, bool includeDebug)
{
- // TODO: Have this return all detected things, not just the first
- byte[]? overlayData = exe.OverlayData;
+ // Create a list for all detected file types
+ List embeddedTypes = [];
// Check the overlay, if it exists
+ byte[]? overlayData = exe.OverlayData;
if (overlayData != null && overlayData.Length > 0)
{
// Set the output variables
@@ -31,76 +33,79 @@ namespace BinaryObjectScanner.Packer
if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
{
- return "Embedded 7-Zip Archive";
+ embeddedTypes.Add("Embedded 7-Zip Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes))
{
- return "Embedded MS-CAB Archive";
+ embeddedTypes.Add("Embedded MS-CAB Archive");
}
else if (overlaySample.StartsWith([0x42, 0x5A, 0x68]))
{
- return "Embedded BZip2 Archive";
+ embeddedTypes.Add("Embedded BZip2 Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
{
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes))
{
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes))
{
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes))
{
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
{
- return "Embedded RAR Archive";
+ embeddedTypes.Add("Embedded RAR Archive");
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
{
- return "Embedded RAR Archive";
+ embeddedTypes.Add("Embedded RAR Archive");
}
else if (overlaySample.StartsWith([0x55, 0x48, 0x41, 0x06]))
{
- return "Embedded UHARC Archive";
+ embeddedTypes.Add("Embedded UHARC Archive");
}
else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
{
- return "Embedded XZ Archive";
+ embeddedTypes.Add("Embedded XZ Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes))
{
- return "Embedded Executable";
+ embeddedTypes.Add("Embedded Executable");
}
else if (overlaySample.StartsWith([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C]))
{
// 7-zip SFX script -- ";!@Install" to ";!@InstallEnd@!"
overlayOffset = overlayData.FirstPosition([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x45, 0x6E, 0x64, 0x40, 0x21]);
if (overlayOffset > -1)
- return "Embedded 7-Zip Archive";
+ embeddedTypes.Add("Embedded 7-Zip Archive");
}
}
}
- return null;
+ // If there are no embedded files
+ if (embeddedTypes.Count == 0)
+ return null;
+
+ return string.Join(";", [.. embeddedTypes]);
}
///
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
- // TODO: Have this return all detected things, not just the first
+ // Create a list for all detected file types
+ List embeddedTypes = [];
// Only process the resources if they are recognized
- if (exe.ResourceData != null)
+ var resourceData = exe.ResourceData;
+ if (resourceData != null)
{
- // Cache the resource data for easier reading
- var resourceData = exe.ResourceData;
-
// Get the resources that have an archive signature
foreach (var value in resourceData.Values)
{
@@ -117,104 +122,109 @@ namespace BinaryObjectScanner.Packer
byte[] resourceSample = ba.ReadBytes(ref temp, 0x10);
if (resourceSample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
- return "Embedded 7-Zip Archive";
+ embeddedTypes.Add("Embedded 7-Zip Archive");
else if (resourceSample.StartsWith([0x42, 0x5A, 0x68]))
- return "Embedded BZip2 Archive";
+ embeddedTypes.Add("Embedded BZip2 Archive");
else if (resourceSample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes))
- return "Embedded MS-CAB Archive";
+ embeddedTypes.Add("Embedded MS-CAB Archive");
else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes))
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes))
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes))
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
- return "Embedded RAR Archive";
+ embeddedTypes.Add("Embedded RAR Archive");
else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
- return "Embedded RAR Archive";
+ embeddedTypes.Add("Embedded RAR Archive");
else if (resourceSample.StartsWith([0x55, 0x48, 0x41, 0x06]))
- return "Embedded UHARC Archive";
+ embeddedTypes.Add("Embedded UHARC Archive");
else if (resourceSample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
- return "Embedded XZ Archive";
+ embeddedTypes.Add("Embedded XZ Archive");
else if (resourceSample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes))
- return "Embedded Executable";
+ embeddedTypes.Add("Embedded Executable");
}
}
}
// Check the overlay, if it exists
- if (exe.OverlayData != null && exe.OverlayData.Length > 0)
+ byte[]? overlayData = exe.OverlayData;
+ if (overlayData != null && overlayData.Length > 0)
{
// Set the output variables
int overlayOffset = 0;
// Only process the overlay if it is recognized
- for (; overlayOffset < 0x400 && overlayOffset < exe.OverlayData.Length - 0x10; overlayOffset++)
+ for (; overlayOffset < 0x400 && overlayOffset < overlayData.Length - 0x10; overlayOffset++)
{
int temp = overlayOffset;
- byte[] overlaySample = exe.OverlayData.ReadBytes(ref temp, 0x10);
+ byte[] overlaySample = overlayData.ReadBytes(ref temp, 0x10);
if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
{
- return "Embedded 7-Zip Archive";
+ embeddedTypes.Add("Embedded 7-Zip Archive");
}
else if (overlaySample.StartsWith([0x42, 0x5A, 0x68]))
{
- return "Embedded BZip2 Archive";
+ embeddedTypes.Add("Embedded BZip2 Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes))
{
- return "Embedded MS-CAB Archive";
+ embeddedTypes.Add("Embedded MS-CAB Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
{
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes))
{
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes))
{
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes))
{
- return "Embedded PKZIP Archive";
+ embeddedTypes.Add("Embedded PKZIP Archive");
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
{
- return "Embedded RAR Archive";
+ embeddedTypes.Add("Embedded RAR Archive");
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
{
- return "Embedded RAR Archive";
+ embeddedTypes.Add("Embedded RAR Archive");
}
else if (overlaySample.StartsWith([0x55, 0x48, 0x41, 0x06]))
{
- return "Embedded UHARC Archive";
+ embeddedTypes.Add("Embedded UHARC Archive");
}
else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
{
- return "Embedded XZ Archive";
+ embeddedTypes.Add("Embedded XZ Archive");
}
else if (overlaySample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes))
{
- return "Embedded Executable";
+ embeddedTypes.Add("Embedded Executable");
}
else if (overlaySample.StartsWith([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C]))
{
// 7-zip SFX script -- ";!@Install" to ";!@InstallEnd@!"
overlayOffset = exe.OverlayData.FirstPosition([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x45, 0x6E, 0x64, 0x40, 0x21]);
if (overlayOffset > -1)
- return "Embedded 7-Zip Archive";
+ embeddedTypes.Add("Embedded 7-Zip Archive");
}
}
}
- return null;
+ // If there are no embedded files
+ if (embeddedTypes.Count == 0)
+ return null;
+
+ return string.Join(";", [.. embeddedTypes]);
}
}
}