diff --git a/BurnOutSharp/FileType/Executable.cs b/BurnOutSharp/FileType/Executable.cs index b77179fe..9421e850 100644 --- a/BurnOutSharp/FileType/Executable.cs +++ b/BurnOutSharp/FileType/Executable.cs @@ -4,9 +4,9 @@ using System.IO; using System.Text; using System.Threading.Tasks; using BurnOutSharp.Interfaces; +using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; using static BinaryObjectScanner.Utilities.Dictionary; -using BinaryObjectScanner.Interfaces; namespace BurnOutSharp.FileType { @@ -68,17 +68,6 @@ namespace BurnOutSharp.FileType if (ShouldAddProtection(contentCheckClass, scanner.ScanPackers, protection)) AppendToDictionary(protections, file, protection); - // If we have an IScannable implementation - if (contentCheckClass is IScannable scannable) - { - if (file != null && !string.IsNullOrEmpty(protection)) - { - var subProtections = scannable.Scan(scanner, file); - PrependToKeys(subProtections, file); - AppendToDictionary(protections, subProtections); - } - } - // If we have an IExtractable implementation if (contentCheckClass is IExtractable extractable) { @@ -135,17 +124,6 @@ namespace BurnOutSharp.FileType if (ShouldAddProtection(contentCheckClass, scanner.ScanPackers, protection)) AppendToDictionary(protections, file, protection); - // If we have an IScannable implementation - if (contentCheckClass is IScannable scannable) - { - if (file != null && !string.IsNullOrEmpty(protection)) - { - var subProtections = scannable.Scan(scanner, file); - PrependToKeys(subProtections, file); - AppendToDictionary(protections, subProtections); - } - } - // If we have an IExtractable implementation if (contentCheckClass is IExtractable extractable) { @@ -202,17 +180,6 @@ namespace BurnOutSharp.FileType if (ShouldAddProtection(contentCheckClass, scanner.ScanPackers, protection)) AppendToDictionary(protections, file, protection); - // If we have an IScannable implementation - if (contentCheckClass is IScannable scannable) - { - if (file != null && !string.IsNullOrEmpty(protection)) - { - var subProtections = scannable.Scan(scanner, file); - PrependToKeys(subProtections, file); - AppendToDictionary(protections, subProtections); - } - } - // If we have an IExtractable implementation if (contentCheckClass is IExtractable extractable) { diff --git a/BurnOutSharp/PackerType/ASPack.cs b/BurnOutSharp/PackerType/ASPack.cs index 12a29fd3..f375bb6d 100644 --- a/BurnOutSharp/PackerType/ASPack.cs +++ b/BurnOutSharp/PackerType/ASPack.cs @@ -1,8 +1,6 @@ -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Text; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; @@ -10,7 +8,7 @@ using BinaryObjectScanner.Wrappers; namespace BurnOutSharp.PackerType { // TODO: Add extraction - public class ASPack : IExtractable, IPortableExecutableCheck, IScannable + public class ASPack : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -70,24 +68,6 @@ namespace BurnOutSharp.PackerType return null; } - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } - /// /// Generate the set of matchers used for each section /// diff --git a/BurnOutSharp/PackerType/AdvancedInstaller.cs b/BurnOutSharp/PackerType/AdvancedInstaller.cs index 498f2784..1a87ea40 100644 --- a/BurnOutSharp/PackerType/AdvancedInstaller.cs +++ b/BurnOutSharp/PackerType/AdvancedInstaller.cs @@ -1,8 +1,6 @@ -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -10,7 +8,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction // TODO: Verify that all versions are detected - public class AdvancedInstaller : IExtractable, IPortableExecutableCheck, IScannable + public class AdvancedInstaller : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -48,23 +46,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/Armadillo.cs b/BurnOutSharp/PackerType/Armadillo.cs index e20b3e91..9e706656 100644 --- a/BurnOutSharp/PackerType/Armadillo.cs +++ b/BurnOutSharp/PackerType/Armadillo.cs @@ -1,8 +1,6 @@ -using System.Collections.Concurrent; -using System.Collections.Generic; +using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -11,7 +9,7 @@ namespace BurnOutSharp.PackerType // TODO: Add extraction // TODO: Add version checking, if possible // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class Armadillo : IExtractable, IPortableExecutableCheck, IScannable + public class Armadillo : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -58,23 +56,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/AutoPlayMediaStudio.cs b/BurnOutSharp/PackerType/AutoPlayMediaStudio.cs index daa4118f..57719366 100644 --- a/BurnOutSharp/PackerType/AutoPlayMediaStudio.cs +++ b/BurnOutSharp/PackerType/AutoPlayMediaStudio.cs @@ -1,7 +1,5 @@ using System; -using System.Collections.Concurrent; using System.IO; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -10,7 +8,7 @@ namespace BurnOutSharp.PackerType // Created by IndigoRose (creators of Setup Factory), primarily to be used to create autorun menus for various media. // Official website: https://www.autoplay.org/ // TODO: Add extraction - public class AutoPlayMediaStudio : IExtractable, IPortableExecutableCheck, IScannable + public class AutoPlayMediaStudio : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -52,24 +50,6 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } private string GetVersion(PortableExecutable pex) { diff --git a/BurnOutSharp/PackerType/CExe.cs b/BurnOutSharp/PackerType/CExe.cs index 99fbbeed..d2051eaf 100644 --- a/BurnOutSharp/PackerType/CExe.cs +++ b/BurnOutSharp/PackerType/CExe.cs @@ -1,10 +1,8 @@ using System; -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Linq; using BinaryObjectScanner.Compression; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; @@ -15,7 +13,7 @@ namespace BurnOutSharp.PackerType // The official website for CExe also includes the source code (which does have to be retrieved by the Wayback Machine) // http://www.scottlu.com/Content/CExe.html // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class CExe : IExtractable, IPortableExecutableCheck, IScannable + public class CExe : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -134,117 +132,5 @@ namespace BurnOutSharp.PackerType return tempPath; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - // Parse into an executable again for easier extraction - PortableExecutable pex = PortableExecutable.Create(stream); - if (pex == null) - return null; - - // Get the first resource of type 99 with index 2 - byte[] payload = pex.FindResourceByNamedType("99, 2").FirstOrDefault(); - if (payload == null || payload.Length == 0) - return null; - - // Determine which compression was used - bool zlib = pex.FindResourceByNamedType("99, 1").Any(); - - // Create the output data buffer - byte[] data; - - // If we had the decompression DLL included, it's zlib - if (zlib) - { - try - { - // Inflate the data into the buffer - Inflater inflater = new Inflater(); - inflater.SetInput(payload); - data = new byte[payload.Length * 4]; - int read = inflater.Inflate(data); - - // Trim the buffer to the proper size - data = new ReadOnlySpan(data, 0, read).ToArray(); - } - catch - { - // Reset the data - data = null; - } - } - - // Otherwise, LZ is used via the Windows API - else - { - try - { - data = LZ.Decompress(payload); - } - catch - { - // Reset the data - data = null; - } - } - - // If we have no data - if (data == null) - return null; - - // If the extraction fails - try - { - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - Directory.CreateDirectory(tempPath); - - // Create the temp filename - string tempFile = string.IsNullOrEmpty(file) ? "temp.sxe" : $"{Path.GetFileNameWithoutExtension(file)}.sxe"; - tempFile = Path.Combine(tempPath, tempFile); - - // Write the file data to a temp file - using (Stream tempStream = File.Open(tempFile, FileMode.Create, FileAccess.Write, FileShare.ReadWrite)) - { - tempStream.Write(data, 0, data.Length); - } - - // Collect and format all found protections - var protections = scanner.GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - // Remove temporary path references - BinaryObjectScanner.Utilities.Dictionary.StripFromKeys(protections, tempPath); - - return protections; - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - return null; - } } } diff --git a/BurnOutSharp/PackerType/EXEStealth.cs b/BurnOutSharp/PackerType/EXEStealth.cs index 4d473629..ff05c063 100644 --- a/BurnOutSharp/PackerType/EXEStealth.cs +++ b/BurnOutSharp/PackerType/EXEStealth.cs @@ -1,7 +1,5 @@ -using System.Collections.Concurrent; -using System.Collections.Generic; +using System.Collections.Generic; using System.IO; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; @@ -12,7 +10,7 @@ namespace BurnOutSharp.PackerType // TODO: Detect 3.15 and up (maybe looking for `Metamorphism`) // TODO: Add extraction // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class EXEStealth : IContentCheck, IExtractable, IPortableExecutableCheck, IScannable + public class EXEStealth : IContentCheck, IExtractable, IPortableExecutableCheck { /// public string CheckContents(string file, byte[] fileContent, bool includeDebug) @@ -93,23 +91,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/EmbeddedExecutable.cs b/BurnOutSharp/PackerType/EmbeddedExecutable.cs index 338637d9..c98ba543 100644 --- a/BurnOutSharp/PackerType/EmbeddedExecutable.cs +++ b/BurnOutSharp/PackerType/EmbeddedExecutable.cs @@ -1,8 +1,6 @@ using System; -using System.Collections.Concurrent; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; @@ -13,7 +11,7 @@ namespace BurnOutSharp.PackerType /// Though not technically a packer, this detection is for any executables that include /// others in their resources in some uncompressed manner to be used at runtime. /// - public class EmbeddedExecutable : IExtractable, IPortableExecutableCheck, IScannable + public class EmbeddedExecutable : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -78,80 +76,5 @@ namespace BurnOutSharp.PackerType return tempPath; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - // Parse into an executable again for easier extraction - PortableExecutable pex = PortableExecutable.Create(stream); - if (pex?.ResourceData == null) - return null; - - // Get the resources that have an executable signature - var resources = pex.ResourceData - .Where(kvp => kvp.Value != null && kvp.Value is byte[]) - .Where(kvp => (kvp.Value as byte[]).StartsWith(BinaryObjectScanner.Models.MSDOS.Constants.SignatureBytes)) - .ToList(); - - // If any of the individual extractions fail - try - { - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - Directory.CreateDirectory(tempPath); - - for (int i = 0; i < resources.Count; i++) - { - // Get the resource data - var resource = resources[i]; - byte[] data = resource.Value as byte[]; - - // Create the temp filename - string tempFile = $"embedded_resource_{i}.bin"; - tempFile = Path.Combine(tempPath, tempFile); - - // Write the resource data to a temp file - using (Stream tempStream = File.Open(tempFile, FileMode.Create, FileAccess.Write, FileShare.ReadWrite)) - { - tempStream.Write(data, 0, data.Length); - } - } - - // Collect and format all found protections - var protections = scanner.GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - // Remove temporary path references - BinaryObjectScanner.Utilities.Dictionary.StripFromKeys(protections, tempPath); - - return protections; - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - return null; - } } } diff --git a/BurnOutSharp/PackerType/GenteeInstaller.cs b/BurnOutSharp/PackerType/GenteeInstaller.cs index ce97aa24..7ec21c6e 100644 --- a/BurnOutSharp/PackerType/GenteeInstaller.cs +++ b/BurnOutSharp/PackerType/GenteeInstaller.cs @@ -1,8 +1,6 @@ -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -10,7 +8,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class GenteeInstaller : IExtractable, IPortableExecutableCheck, IScannable + public class GenteeInstaller : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -51,23 +49,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/HyperTechCrackProof.cs b/BurnOutSharp/PackerType/HyperTechCrackProof.cs index 0412de3d..8310aabc 100644 --- a/BurnOutSharp/PackerType/HyperTechCrackProof.cs +++ b/BurnOutSharp/PackerType/HyperTechCrackProof.cs @@ -1,7 +1,5 @@ -using System.Collections.Concurrent; -using System.IO; +using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -12,7 +10,7 @@ namespace BurnOutSharp.PackerType // https://www.reddit.com/r/riseofincarnates/comments/m3vbnm/subreddit_revival_does_anyone_still_have_rise_of/ // https://steamcommunity.com/app/310950/discussions/0/4224890554455490819/ // https://github.com/horsicq/Detect-It-Easy/blob/63a1aa8bb23ca02d8a7fd5936db8dbc5c5d52dea/db/PE/HyperTech%20Crackproof.2.sg - public class HyperTechCrackProof : IExtractable, IPortableExecutableCheck, IScannable + public class HyperTechCrackProof : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -50,23 +48,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/InnoSetup.cs b/BurnOutSharp/PackerType/InnoSetup.cs index 028f9ebc..794dc209 100644 --- a/BurnOutSharp/PackerType/InnoSetup.cs +++ b/BurnOutSharp/PackerType/InnoSetup.cs @@ -1,8 +1,6 @@ -using System.Collections.Concurrent; -using System.Collections.Generic; +using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; @@ -11,7 +9,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction - https://github.com/dscharrer/InnoExtract // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class InnoSetup : IExtractable, INewExecutableCheck, IPortableExecutableCheck, IScannable + public class InnoSetup : IExtractable, INewExecutableCheck, IPortableExecutableCheck { /// public string CheckNewExecutable(string file, NewExecutable nex, bool includeDebug) @@ -77,24 +75,6 @@ namespace BurnOutSharp.PackerType return null; } - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } - private static string GetOldVersion(string file, NewExecutable nex) { // Notes: diff --git a/BurnOutSharp/PackerType/InstallAnywhere.cs b/BurnOutSharp/PackerType/InstallAnywhere.cs index 7ec3a48f..570ef206 100644 --- a/BurnOutSharp/PackerType/InstallAnywhere.cs +++ b/BurnOutSharp/PackerType/InstallAnywhere.cs @@ -1,7 +1,5 @@ using System; -using System.Collections.Concurrent; using System.IO; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -9,7 +7,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction, which may be possible with the current libraries but needs to be investigated further. // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class InstallAnywhere : IExtractable, IPortableExecutableCheck, IScannable + public class InstallAnywhere : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -48,24 +46,6 @@ namespace BurnOutSharp.PackerType return null; } - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } - private string GetVersion(PortableExecutable pex) { // Check the internal versions diff --git a/BurnOutSharp/PackerType/InstallerVISE.cs b/BurnOutSharp/PackerType/InstallerVISE.cs index c680543a..e14b247a 100644 --- a/BurnOutSharp/PackerType/InstallerVISE.cs +++ b/BurnOutSharp/PackerType/InstallerVISE.cs @@ -1,8 +1,6 @@ -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -10,7 +8,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction - https://github.com/Bioruebe/UniExtract2 // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class InstallerVISE : IExtractable, IPortableExecutableCheck, IScannable + public class InstallerVISE : IExtractable, IPortableExecutableCheck { //TODO: Add exact version detection for Windows builds, make sure versions before 3.X are detected as well, and detect the Mac builds. /// @@ -49,23 +47,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/IntelInstallationFramework.cs b/BurnOutSharp/PackerType/IntelInstallationFramework.cs index 46e9986a..c686e1f3 100644 --- a/BurnOutSharp/PackerType/IntelInstallationFramework.cs +++ b/BurnOutSharp/PackerType/IntelInstallationFramework.cs @@ -1,14 +1,12 @@ using System; -using System.Collections.Concurrent; using System.IO; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; namespace BurnOutSharp.PackerType { // TODO: Add extraction, seems to primarily use MSZip compression. - public class IntelInstallationFramework : IExtractable, IPortableExecutableCheck, IScannable + public class IntelInstallationFramework : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -52,23 +50,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/MicrosoftCABSFX.cs b/BurnOutSharp/PackerType/MicrosoftCABSFX.cs index a6edf93e..dd040821 100644 --- a/BurnOutSharp/PackerType/MicrosoftCABSFX.cs +++ b/BurnOutSharp/PackerType/MicrosoftCABSFX.cs @@ -1,9 +1,7 @@ using System; -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -11,7 +9,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction, which should be possible with LibMSPackN, but it refuses to extract due to SFX files lacking the typical CAB identifiers. // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class MicrosoftCABSFX : IExtractable, IPortableExecutableCheck, IScannable + public class MicrosoftCABSFX : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -67,24 +65,6 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } private string GetVersion(PortableExecutable pex) { diff --git a/BurnOutSharp/PackerType/NSIS.cs b/BurnOutSharp/PackerType/NSIS.cs index 656b0bc0..296c3d0a 100644 --- a/BurnOutSharp/PackerType/NSIS.cs +++ b/BurnOutSharp/PackerType/NSIS.cs @@ -1,15 +1,13 @@ -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; namespace BurnOutSharp.PackerType { // TODO: Add extraction - public class NSIS : IExtractable, IPortableExecutableCheck, IScannable + public class NSIS : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -51,23 +49,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } \ No newline at end of file diff --git a/BurnOutSharp/PackerType/PECompact.cs b/BurnOutSharp/PackerType/PECompact.cs index 03c647eb..ebbc1787 100644 --- a/BurnOutSharp/PackerType/PECompact.cs +++ b/BurnOutSharp/PackerType/PECompact.cs @@ -1,6 +1,4 @@ -using System.Collections.Concurrent; -using System.IO; -using BurnOutSharp.Interfaces; +using System.IO; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -8,7 +6,7 @@ namespace BurnOutSharp.PackerType { // TODO: Better version detection - https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt // TODO: Add extraction - public class PECompact : IExtractable, IPortableExecutableCheck, IScannable + public class PECompact : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -60,23 +58,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/Petite.cs b/BurnOutSharp/PackerType/Petite.cs index 43aeb431..8df83588 100644 --- a/BurnOutSharp/PackerType/Petite.cs +++ b/BurnOutSharp/PackerType/Petite.cs @@ -1,6 +1,4 @@ -using System.Collections.Concurrent; -using System.IO; -using BurnOutSharp.Interfaces; +using System.IO; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -8,7 +6,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class PEtite : IExtractable, IPortableExecutableCheck, IScannable + public class PEtite : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -43,23 +41,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/SetupFactory.cs b/BurnOutSharp/PackerType/SetupFactory.cs index 22ac51b3..721be961 100644 --- a/BurnOutSharp/PackerType/SetupFactory.cs +++ b/BurnOutSharp/PackerType/SetupFactory.cs @@ -1,7 +1,5 @@ using System; -using System.Collections.Concurrent; using System.IO; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -10,7 +8,7 @@ namespace BurnOutSharp.PackerType // TODO: Add extraction, which is possible but the only tools available that can // do this seem to be Universal Extractor 2 and InstallExplorer (https://totalcmd.net/plugring/InstallExplorer.html) // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class SetupFactory : IExtractable, IPortableExecutableCheck, IScannable + public class SetupFactory : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -57,24 +55,6 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } private string GetVersion(PortableExecutable pex) { diff --git a/BurnOutSharp/PackerType/SevenZipSFX.cs b/BurnOutSharp/PackerType/SevenZipSFX.cs index 86b58a57..3ee86c83 100644 --- a/BurnOutSharp/PackerType/SevenZipSFX.cs +++ b/BurnOutSharp/PackerType/SevenZipSFX.cs @@ -1,14 +1,12 @@ -using System.Collections.Concurrent; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; namespace BurnOutSharp.PackerType { // TODO: Add extraction - public class SevenZipSFX : IExtractable, IPortableExecutableCheck, IScannable + public class SevenZipSFX : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -64,23 +62,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/Shrinker.cs b/BurnOutSharp/PackerType/Shrinker.cs index 9ae8aa0f..36d93393 100644 --- a/BurnOutSharp/PackerType/Shrinker.cs +++ b/BurnOutSharp/PackerType/Shrinker.cs @@ -1,6 +1,4 @@ -using System.Collections.Concurrent; using System.IO; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -8,7 +6,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class Shrinker : IExtractable, IPortableExecutableCheck, IScannable + public class Shrinker : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -44,23 +42,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } } diff --git a/BurnOutSharp/PackerType/UPX.cs b/BurnOutSharp/PackerType/UPX.cs index d46b0804..694b8618 100644 --- a/BurnOutSharp/PackerType/UPX.cs +++ b/BurnOutSharp/PackerType/UPX.cs @@ -1,10 +1,8 @@ -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Linq; using System.Text; using System.Text.RegularExpressions; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; @@ -12,7 +10,7 @@ namespace BurnOutSharp.PackerType { // TODO: Add extraction // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class UPX : IExtractable, IPortableExecutableCheck, IScannable + public class UPX : IExtractable, IPortableExecutableCheck { private static readonly Regex _oldUpxVersionMatch = new Regex(@"\$Id: UPX (.*?) Copyright \(C\)", RegexOptions.Compiled); @@ -83,24 +81,6 @@ namespace BurnOutSharp.PackerType return null; } - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } - public static string GetVersion(string file, byte[] fileContent, List positions) { try diff --git a/BurnOutSharp/PackerType/WinRARSFX.cs b/BurnOutSharp/PackerType/WinRARSFX.cs index 8fc9d8ce..c943995b 100644 --- a/BurnOutSharp/PackerType/WinRARSFX.cs +++ b/BurnOutSharp/PackerType/WinRARSFX.cs @@ -1,17 +1,14 @@ using System; -using System.Collections.Concurrent; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; using SharpCompress.Archives; using SharpCompress.Archives.Rar; -using static BinaryObjectScanner.Utilities.Dictionary; namespace BurnOutSharp.PackerType { - public class WinRARSFX : IExtractable, IPortableExecutableCheck, IScannable + public class WinRARSFX : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -66,74 +63,5 @@ namespace BurnOutSharp.PackerType return tempPath; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - // If the rar file itself fails - try - { - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - Directory.CreateDirectory(tempPath); - - // Should be using stream instead of file, but stream fails to extract anything. My guess is that the executable portion of the archive is causing stream to fail, but not file. - using (RarArchive zipFile = RarArchive.Open(file, new SharpCompress.Readers.ReaderOptions() {LookForHeader = true})) - { - foreach (var entry in zipFile.Entries) - { - // If an individual entry fails - try - { - // If we have a directory, skip it - if (entry.IsDirectory) - continue; - - string tempFile = Path.Combine(tempPath, entry.Key); - entry.WriteToFile(tempFile); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - } - } - - // Collect and format all found protections - var protections = scanner.GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - // Remove temporary path references - StripFromKeys(protections, tempPath); - - return protections; - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - return null; - } } } diff --git a/BurnOutSharp/PackerType/WinZipSFX.cs b/BurnOutSharp/PackerType/WinZipSFX.cs index 13e55dda..c0f6dc6e 100644 --- a/BurnOutSharp/PackerType/WinZipSFX.cs +++ b/BurnOutSharp/PackerType/WinZipSFX.cs @@ -1,18 +1,15 @@ using System; -using System.Collections.Concurrent; using System.IO; using System.Linq; using System.Text; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; using SharpCompress.Archives; using SharpCompress.Archives.Zip; -using static BinaryObjectScanner.Utilities.Dictionary; namespace BurnOutSharp.PackerType { - public class WinZipSFX : IExtractable, INewExecutableCheck, IPortableExecutableCheck, IScannable + public class WinZipSFX : IExtractable, INewExecutableCheck, IPortableExecutableCheck { /// public string CheckNewExecutable(string file, NewExecutable nex, bool includeDebug) @@ -102,75 +99,6 @@ namespace BurnOutSharp.PackerType return tempPath; } - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - // If the zip file itself fails - try - { - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - Directory.CreateDirectory(tempPath); - - // Should be using stream instead of file, but stream fails to extract anything. My guess is that the executable portion of the archive is causing stream to fail, but not file. - using (ZipArchive zipFile = ZipArchive.Open(file)) - { - foreach (var entry in zipFile.Entries) - { - // If an individual entry fails - try - { - // If we have a directory, skip it - if (entry.IsDirectory) - continue; - - string tempFile = Path.Combine(tempPath, entry.Key); - entry.WriteToFile(tempFile); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - } - } - - // Collect and format all found protections - var protections = scanner.GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - // Remove temporary path references - StripFromKeys(protections, tempPath); - - return protections; - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - return null; - } - /// /// Get the version from the NE header value combinations /// diff --git a/BurnOutSharp/PackerType/WiseInstaller.cs b/BurnOutSharp/PackerType/WiseInstaller.cs index 14356261..62ab284d 100644 --- a/BurnOutSharp/PackerType/WiseInstaller.cs +++ b/BurnOutSharp/PackerType/WiseInstaller.cs @@ -1,20 +1,17 @@ using System; -using System.Collections.Concurrent; using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Utilities; using BinaryObjectScanner.Wrappers; -using static BinaryObjectScanner.Utilities.Dictionary; using Wise = WiseUnpacker.WiseUnpacker; namespace BurnOutSharp.PackerType { // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt - public class WiseInstaller : IExtractable, INewExecutableCheck, IPortableExecutableCheck, IScannable + public class WiseInstaller : IExtractable, INewExecutableCheck, IPortableExecutableCheck { /// public string CheckNewExecutable(string file, NewExecutable nex, bool includeDebug) @@ -107,44 +104,6 @@ namespace BurnOutSharp.PackerType return null; } - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - // If the installer file itself fails - try - { - // Try to parse as a New Executable - NewExecutable nex = NewExecutable.Create(stream); - if (nex != null) - return ScanNewExecutable(scanner, nex, file); - - // Try to parse as a Portable Executable - PortableExecutable pex = PortableExecutable.Create(stream); - if (pex != null) - return ScanPortableExecutable(scanner, pex, file); - - return null; - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - return null; - } - /// /// Checks an NE header to see if it matches a known signature /// @@ -247,51 +206,6 @@ namespace BurnOutSharp.PackerType return null; } - /// - /// Attempt to extract Wise data from a New Executable - /// - /// Scanner object for state tracking - /// New executable to check - /// Path to the input file - /// True if it matches a known version, false otherwise - private ConcurrentDictionary> ScanNewExecutable(Scanner scanner, NewExecutable nex, string file) - { - // If the installer file itself fails - try - { - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - Directory.CreateDirectory(tempPath); - - // TODO: Try to find where the file data lives and how to get it - Wise unpacker = new Wise(); - unpacker.ExtractTo(file, tempPath); - - // Collect and format all found protections - var protections = scanner.GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - // Remove temporary path references - StripFromKeys(protections, tempPath); - - return protections; - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - return null; - } - /// /// Attempt to extract Wise data from a New Executable /// @@ -310,154 +224,6 @@ namespace BurnOutSharp.PackerType return tempPath; } - /// - /// Attempt to extract Wise data from a Portable Executable - /// - /// Scanner object for state tracking - /// Portable executable to check - /// Path to the input file - /// True if it matches a known version, false otherwise - private ConcurrentDictionary> ScanPortableExecutable(Scanner scanner, PortableExecutable pex, string file) - { - // If the installer file itself fails - try - { - string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); - Directory.CreateDirectory(tempPath); - - // Get the matching PE format - var format = GetPEFormat(pex); - if (format == null) - return null; - - // Get the overlay data for easier reading - int overlayOffset = 0, dataStart = 0; - byte[] overlayData = pex.OverlayData; - if (overlayData == null) - return null; - - // Skip over the additional DLL name, if we expect it - if (format.Dll) - { - // Read the name length - byte dllNameLength = overlayData.ReadByte(ref overlayOffset); - dataStart++; - - // Read the name, if it exists - if (dllNameLength != 0) - { - // Ignore the name for now - _ = overlayData.ReadBytes(ref overlayOffset, dllNameLength); - dataStart += dllNameLength; - - // Named DLLs also have a DLL length that we ignore - _ = overlayData.ReadUInt32(ref overlayOffset); - dataStart += 4; - } - } - - // Check if flags are consistent - if (!format.NoCrc) - { - // Unlike WiseUnpacker, we ignore the flag value here - _ = overlayData.ReadUInt32(ref overlayOffset); - } - - // Ensure that we have an archive end - if (format.ArchiveEnd > 0) - { - overlayOffset = dataStart + format.ArchiveEnd; - int archiveEndLoaded = overlayData.ReadInt32(ref overlayOffset); - if (archiveEndLoaded != 0) - format.ArchiveEnd = archiveEndLoaded; - } - - // Skip to the start of the archive - overlayOffset = dataStart + format.ArchiveStart; - - // Skip over the initialization text, if we expect it - if (format.InitText) - { - int initTextLength = overlayData.ReadByte(ref overlayOffset); - _ = overlayData.ReadBytes(ref overlayOffset, initTextLength); - } - - // Cache the current offset in the overlay as the "start of data" - int offsetReal = overlayOffset; - - // If the first entry is PKZIP, we assume it's an embedded zipfile - byte[] magic = overlayData.ReadBytes(ref overlayOffset, 4); overlayOffset -= 4; - bool pkzip = magic.StartsWith(new byte?[] { (byte)'P', (byte)'K' }); - - // If we have PKZIP - if (pkzip) - { - try - { - string tempFile = Path.Combine(tempPath, "WISEDATA.zip"); - using (Stream tempStream = File.Open(tempFile, FileMode.Create, FileAccess.Write, FileShare.ReadWrite)) - { - tempStream.Write(overlayData, overlayOffset, overlayData.Length - overlayOffset); - } - - // Collect and format all found protections - var protections = scanner.GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - // Remove temporary path references - StripFromKeys(protections, tempPath); - - return protections; - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - return null; - } - } - - // If we have DEFLATE -- TODO: Port implementation here or use DeflateStream - else - { - Wise unpacker = new Wise(); - unpacker.ExtractTo(file, tempPath); - - // Collect and format all found protections - var protections = scanner.GetProtections(tempPath); - - // If temp directory cleanup fails - try - { - Directory.Delete(tempPath, true); - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - // Remove temporary path references - StripFromKeys(protections, tempPath); - - return protections; - } - } - catch (Exception ex) - { - if (scanner.IncludeDebug) Console.WriteLine(ex); - } - - return null; - } - /// /// Attempt to extract Wise data from a Portable Executable /// diff --git a/BurnOutSharp/PackerType/dotFuscator.cs b/BurnOutSharp/PackerType/dotFuscator.cs index 832dae05..6a8bad54 100644 --- a/BurnOutSharp/PackerType/dotFuscator.cs +++ b/BurnOutSharp/PackerType/dotFuscator.cs @@ -1,15 +1,13 @@ -using System.Collections.Concurrent; -using System.Collections.Generic; +using System.Collections.Generic; using System.IO; using System.Linq; -using BurnOutSharp.Interfaces; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Wrappers; namespace BurnOutSharp.PackerType { // TODO: Add extraction - public class dotFuscator : IExtractable, IPortableExecutableCheck, IScannable + public class dotFuscator : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -47,23 +45,5 @@ namespace BurnOutSharp.PackerType { return null; } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, string file) - { - if (!File.Exists(file)) - return null; - - using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) - { - return Scan(scanner, fs, file); - } - } - - /// - public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) - { - return null; - } } }