From d8b0588d6ec5f4cb3d4ce3c565698cb1cee6c759 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Mon, 8 Sep 2025 09:14:22 -0400 Subject: [PATCH] Add embedded UHA support --- BinaryObjectScanner/Packer/EmbeddedFile.cs | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/BinaryObjectScanner/Packer/EmbeddedFile.cs b/BinaryObjectScanner/Packer/EmbeddedFile.cs index 04353038..adfee2a0 100644 --- a/BinaryObjectScanner/Packer/EmbeddedFile.cs +++ b/BinaryObjectScanner/Packer/EmbeddedFile.cs @@ -65,6 +65,10 @@ namespace BinaryObjectScanner.Packer { return "Embedded RAR Archive"; } + else if (overlaySample.StartsWith([0x55, 0x48, 0x41, 0x06])) + { + return "Embedded UHARC Archive"; + } else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) { return "Embedded XZ Archive"; @@ -91,7 +95,7 @@ namespace BinaryObjectScanner.Packer { // TODO: Have this return all detected things, not just the first - // Only process the overlay if it is recognized + // Only process the resources if they are recognized if (exe.ResourceData != null) { // Cache the resource data for easier reading @@ -130,6 +134,8 @@ namespace BinaryObjectScanner.Packer return "Embedded RAR Archive"; else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) return "Embedded RAR Archive"; + else if (resourceSample.StartsWith([0x55, 0x48, 0x41, 0x06])) + return "Embedded UHARC Archive"; else if (resourceSample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) return "Embedded XZ Archive"; else if (resourceSample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes)) @@ -186,6 +192,10 @@ namespace BinaryObjectScanner.Packer { return "Embedded RAR Archive"; } + else if (overlaySample.StartsWith([0x55, 0x48, 0x41, 0x06])) + { + return "Embedded UHARC Archive"; + } else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) { return "Embedded XZ Archive";