SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-22 14:54:56 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Smarter executable scanning, maybe

Browse Source
This commit is contained in:
Matt Nadareski
2025-09-02 22:18:42 -04:00
parent 138842318a
commit e21a6e78d7
2 changed files with 92 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
BinaryObjectScanner/FileType/Executable.cs
View File

@@ -123,13 +123,34 @@ namespace BinaryObjectScanner.FileType
return false;
// Extract all files
bool extractAny = false;
Directory.CreateDirectory(outDir);
if (exe is PortableExecutable pex)
pex.Extract(outDir, includeDebug);
else if (exe is NewExecutable nex)
nex.Extract(outDir, includeDebug);
{
if (new Packer.CExe().CheckExecutable(file, pex, includeDebug) != null)
extractAny |= pex.ExtractCExe(outDir, includeDebug);
return true;
if (new Packer.EmbeddedFile().CheckExecutable(file, pex, includeDebug) != null)
{
extractAny |= pex.ExtractFromOverlay(outDir, includeDebug);
extractAny |= pex.ExtractFromResources(outDir, includeDebug);
}
if (new Packer.WiseInstaller().CheckExecutable(file, pex, includeDebug) != null)
extractAny |= pex.ExtractWise(outDir, includeDebug);
}
else if (exe is NewExecutable nex)
{
if (new Packer.EmbeddedFile().CheckExecutable(file, nex, includeDebug) != null)
{
extractAny |= nex.ExtractFromOverlay(outDir, includeDebug);
}
if (new Packer.WiseInstaller().CheckExecutable(file, nex, includeDebug) != null)
extractAny |= nex.ExtractWise(outDir, includeDebug);
}
return extractAny;
}
#region Check Runners

68
BinaryObjectScanner/Packer/EmbeddedFile.cs
View File

@@ -10,8 +10,74 @@ namespace BinaryObjectScanner.Packer
/// Though not technically a packer, this detection is for any executables that include
/// archives or executables in their resources in some uncompressed manner to be used at runtime.
/// </summary>
public class EmbeddedFile : IExecutableCheck<PortableExecutable>
public class EmbeddedFile : IExecutableCheck<NewExecutable>, IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, NewExecutable nex, bool includeDebug)
{
// TODO: Have this return all detected things, not just the first
// Check the overlay, if it exists
if (nex.OverlayData != null && nex.OverlayData.Length > 0)
{
// Set the output variables
int overlayOffset = 0;
// Only process the overlay if it is recognized
for (; overlayOffset < 0x100 && overlayOffset < nex.OverlayData.Length - 0x10; overlayOffset++)
{
int temp = overlayOffset;
byte[] overlaySample = nex.OverlayData.ReadBytes(ref temp, 0x10);
if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
{
return "Embedded 7-Zip Archive";
}
else if (overlaySample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes))
{
return "Embedded MS-CAB Archive";
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
{
return "Embedded PKZIP Archive";
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes))
{
return "Embedded PKZIP Archive";
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes))
{
return "Embedded PKZIP Archive";
}
else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes))
{
return "Embedded PKZIP Archive";
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
{
return "Embedded RAR Archive";
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
{
return "Embedded RAR Archive";
}
else if (overlaySample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes))
{
return "Embedded Executable";
}
else if (overlaySample.StartsWith([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C]))
{
// 7-zip SFX script -- ";!@Install" to ";!@InstallEnd@!"
overlayOffset = nex.OverlayData.FirstPosition([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x45, 0x6E, 0x64, 0x40, 0x21]);
if (overlayOffset > -1)
return "Embedded 7-Zip Archive";
}
}
}
return null;
}
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{