diff --git a/BinaryObjectScanner/Packer/EmbeddedFile.cs b/BinaryObjectScanner/Packer/EmbeddedFile.cs index adfee2a0..fc1d65e4 100644 --- a/BinaryObjectScanner/Packer/EmbeddedFile.cs +++ b/BinaryObjectScanner/Packer/EmbeddedFile.cs @@ -1,3 +1,4 @@ +using System.Collections.Generic; using BinaryObjectScanner.Interfaces; using SabreTools.IO.Extensions; using SabreTools.Matching; @@ -14,10 +15,11 @@ namespace BinaryObjectScanner.Packer /// public string? CheckExecutable(string file, NewExecutable exe, bool includeDebug) { - // TODO: Have this return all detected things, not just the first - byte[]? overlayData = exe.OverlayData; + // Create a list for all detected file types + List embeddedTypes = []; // Check the overlay, if it exists + byte[]? overlayData = exe.OverlayData; if (overlayData != null && overlayData.Length > 0) { // Set the output variables @@ -31,76 +33,79 @@ namespace BinaryObjectScanner.Packer if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C])) { - return "Embedded 7-Zip Archive"; + embeddedTypes.Add("Embedded 7-Zip Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes)) { - return "Embedded MS-CAB Archive"; + embeddedTypes.Add("Embedded MS-CAB Archive"); } else if (overlaySample.StartsWith([0x42, 0x5A, 0x68])) { - return "Embedded BZip2 Archive"; + embeddedTypes.Add("Embedded BZip2 Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes)) { - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes)) { - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes)) { - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes)) { - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); } else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) { - return "Embedded RAR Archive"; + embeddedTypes.Add("Embedded RAR Archive"); } else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) { - return "Embedded RAR Archive"; + embeddedTypes.Add("Embedded RAR Archive"); } else if (overlaySample.StartsWith([0x55, 0x48, 0x41, 0x06])) { - return "Embedded UHARC Archive"; + embeddedTypes.Add("Embedded UHARC Archive"); } else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) { - return "Embedded XZ Archive"; + embeddedTypes.Add("Embedded XZ Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes)) { - return "Embedded Executable"; + embeddedTypes.Add("Embedded Executable"); } else if (overlaySample.StartsWith([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C])) { // 7-zip SFX script -- ";!@Install" to ";!@InstallEnd@!" overlayOffset = overlayData.FirstPosition([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x45, 0x6E, 0x64, 0x40, 0x21]); if (overlayOffset > -1) - return "Embedded 7-Zip Archive"; + embeddedTypes.Add("Embedded 7-Zip Archive"); } } } - return null; + // If there are no embedded files + if (embeddedTypes.Count == 0) + return null; + + return string.Join(";", [.. embeddedTypes]); } /// public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) { - // TODO: Have this return all detected things, not just the first + // Create a list for all detected file types + List embeddedTypes = []; // Only process the resources if they are recognized - if (exe.ResourceData != null) + var resourceData = exe.ResourceData; + if (resourceData != null) { - // Cache the resource data for easier reading - var resourceData = exe.ResourceData; - // Get the resources that have an archive signature foreach (var value in resourceData.Values) { @@ -117,104 +122,109 @@ namespace BinaryObjectScanner.Packer byte[] resourceSample = ba.ReadBytes(ref temp, 0x10); if (resourceSample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C])) - return "Embedded 7-Zip Archive"; + embeddedTypes.Add("Embedded 7-Zip Archive"); else if (resourceSample.StartsWith([0x42, 0x5A, 0x68])) - return "Embedded BZip2 Archive"; + embeddedTypes.Add("Embedded BZip2 Archive"); else if (resourceSample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes)) - return "Embedded MS-CAB Archive"; + embeddedTypes.Add("Embedded MS-CAB Archive"); else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes)) - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes)) - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes)) - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); else if (resourceSample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes)) - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) - return "Embedded RAR Archive"; + embeddedTypes.Add("Embedded RAR Archive"); else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) - return "Embedded RAR Archive"; + embeddedTypes.Add("Embedded RAR Archive"); else if (resourceSample.StartsWith([0x55, 0x48, 0x41, 0x06])) - return "Embedded UHARC Archive"; + embeddedTypes.Add("Embedded UHARC Archive"); else if (resourceSample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) - return "Embedded XZ Archive"; + embeddedTypes.Add("Embedded XZ Archive"); else if (resourceSample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes)) - return "Embedded Executable"; + embeddedTypes.Add("Embedded Executable"); } } } // Check the overlay, if it exists - if (exe.OverlayData != null && exe.OverlayData.Length > 0) + byte[]? overlayData = exe.OverlayData; + if (overlayData != null && overlayData.Length > 0) { // Set the output variables int overlayOffset = 0; // Only process the overlay if it is recognized - for (; overlayOffset < 0x400 && overlayOffset < exe.OverlayData.Length - 0x10; overlayOffset++) + for (; overlayOffset < 0x400 && overlayOffset < overlayData.Length - 0x10; overlayOffset++) { int temp = overlayOffset; - byte[] overlaySample = exe.OverlayData.ReadBytes(ref temp, 0x10); + byte[] overlaySample = overlayData.ReadBytes(ref temp, 0x10); if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C])) { - return "Embedded 7-Zip Archive"; + embeddedTypes.Add("Embedded 7-Zip Archive"); } else if (overlaySample.StartsWith([0x42, 0x5A, 0x68])) { - return "Embedded BZip2 Archive"; + embeddedTypes.Add("Embedded BZip2 Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes)) { - return "Embedded MS-CAB Archive"; + embeddedTypes.Add("Embedded MS-CAB Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes)) { - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes)) { - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes)) { - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes)) { - return "Embedded PKZIP Archive"; + embeddedTypes.Add("Embedded PKZIP Archive"); } else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) { - return "Embedded RAR Archive"; + embeddedTypes.Add("Embedded RAR Archive"); } else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) { - return "Embedded RAR Archive"; + embeddedTypes.Add("Embedded RAR Archive"); } else if (overlaySample.StartsWith([0x55, 0x48, 0x41, 0x06])) { - return "Embedded UHARC Archive"; + embeddedTypes.Add("Embedded UHARC Archive"); } else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) { - return "Embedded XZ Archive"; + embeddedTypes.Add("Embedded XZ Archive"); } else if (overlaySample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes)) { - return "Embedded Executable"; + embeddedTypes.Add("Embedded Executable"); } else if (overlaySample.StartsWith([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C])) { // 7-zip SFX script -- ";!@Install" to ";!@InstallEnd@!" overlayOffset = exe.OverlayData.FirstPosition([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x45, 0x6E, 0x64, 0x40, 0x21]); if (overlayOffset > -1) - return "Embedded 7-Zip Archive"; + embeddedTypes.Add("Embedded 7-Zip Archive"); } } } - return null; + // If there are no embedded files + if (embeddedTypes.Count == 0) + return null; + + return string.Join(";", [.. embeddedTypes]); } } }