diff --git a/BinaryObjectScanner/FileType/Executable.cs b/BinaryObjectScanner/FileType/Executable.cs index 8f0b701b..9d073096 100644 --- a/BinaryObjectScanner/FileType/Executable.cs +++ b/BinaryObjectScanner/FileType/Executable.cs @@ -123,13 +123,34 @@ namespace BinaryObjectScanner.FileType return false; // Extract all files + bool extractAny = false; Directory.CreateDirectory(outDir); if (exe is PortableExecutable pex) - pex.Extract(outDir, includeDebug); - else if (exe is NewExecutable nex) - nex.Extract(outDir, includeDebug); + { + if (new Packer.CExe().CheckExecutable(file, pex, includeDebug) != null) + extractAny |= pex.ExtractCExe(outDir, includeDebug); - return true; + if (new Packer.EmbeddedFile().CheckExecutable(file, pex, includeDebug) != null) + { + extractAny |= pex.ExtractFromOverlay(outDir, includeDebug); + extractAny |= pex.ExtractFromResources(outDir, includeDebug); + } + + if (new Packer.WiseInstaller().CheckExecutable(file, pex, includeDebug) != null) + extractAny |= pex.ExtractWise(outDir, includeDebug); + } + else if (exe is NewExecutable nex) + { + if (new Packer.EmbeddedFile().CheckExecutable(file, nex, includeDebug) != null) + { + extractAny |= nex.ExtractFromOverlay(outDir, includeDebug); + } + + if (new Packer.WiseInstaller().CheckExecutable(file, nex, includeDebug) != null) + extractAny |= nex.ExtractWise(outDir, includeDebug); + } + + return extractAny; } #region Check Runners diff --git a/BinaryObjectScanner/Packer/EmbeddedFile.cs b/BinaryObjectScanner/Packer/EmbeddedFile.cs index c538119d..e9b38632 100644 --- a/BinaryObjectScanner/Packer/EmbeddedFile.cs +++ b/BinaryObjectScanner/Packer/EmbeddedFile.cs @@ -10,8 +10,74 @@ namespace BinaryObjectScanner.Packer /// Though not technically a packer, this detection is for any executables that include /// archives or executables in their resources in some uncompressed manner to be used at runtime. /// - public class EmbeddedFile : IExecutableCheck + public class EmbeddedFile : IExecutableCheck, IExecutableCheck { + /// + public string? CheckExecutable(string file, NewExecutable nex, bool includeDebug) + { + // TODO: Have this return all detected things, not just the first + + // Check the overlay, if it exists + if (nex.OverlayData != null && nex.OverlayData.Length > 0) + { + // Set the output variables + int overlayOffset = 0; + + // Only process the overlay if it is recognized + for (; overlayOffset < 0x100 && overlayOffset < nex.OverlayData.Length - 0x10; overlayOffset++) + { + int temp = overlayOffset; + byte[] overlaySample = nex.OverlayData.ReadBytes(ref temp, 0x10); + + if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C])) + { + return "Embedded 7-Zip Archive"; + } + else if (overlaySample.StartsWith(SabreTools.Models.MicrosoftCabinet.Constants.SignatureBytes)) + { + return "Embedded MS-CAB Archive"; + } + else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes)) + { + return "Embedded PKZIP Archive"; + } + else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecordSignatureBytes)) + { + return "Embedded PKZIP Archive"; + } + else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.EndOfCentralDirectoryRecord64SignatureBytes)) + { + return "Embedded PKZIP Archive"; + } + else if (overlaySample.StartsWith(SabreTools.Models.PKZIP.Constants.DataDescriptorSignatureBytes)) + { + return "Embedded PKZIP Archive"; + } + else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) + { + return "Embedded RAR Archive"; + } + else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) + { + return "Embedded RAR Archive"; + } + else if (overlaySample.StartsWith(SabreTools.Models.MSDOS.Constants.SignatureBytes)) + { + return "Embedded Executable"; + } + else if (overlaySample.StartsWith([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C])) + { + // 7-zip SFX script -- ";!@Install" to ";!@InstallEnd@!" + overlayOffset = nex.OverlayData.FirstPosition([0x3B, 0x21, 0x40, 0x49, 0x6E, 0x73, 0x74, 0x61, 0x6C, 0x6C, 0x45, 0x6E, 0x64, 0x40, 0x21]); + if (overlayOffset > -1) + return "Embedded 7-Zip Archive"; + } + } + } + + return null; + } + /// public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug) {