SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-02-14 05:36:07 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Improve NSIS matching

Browse Source
This commit is contained in:
Matt Nadareski
2021-08-30 11:40:14 -07:00
parent 9c32f663b0
commit f0b66d4bfb
1 changed files with 58 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
BurnOutSharp/PackerType/NSIS.cs
View File

@@ -2,6 +2,7 @@ using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
@@ -9,36 +10,11 @@ namespace BurnOutSharp.PackerType
public class NSIS : IContentCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
{
return new List<ContentMatchSet>
{
// Nullsoft Install System
new ContentMatchSet(new byte?[]
{
0x4e, 0x75, 0x6c, 0x6c, 0x73, 0x6f, 0x66, 0x74,
0x20, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c,
0x20, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d
}, GetVersion, "NSIS"),
// NullsoftInst
new ContentMatchSet(new byte?[]
{
0x4e, 0x75, 0x6c, 0x6c, 0x73, 0x6f, 0x66, 0x74,
0x49, 0x6e, 0x73, 0x74
}, "NSIS"),
};
}
public List<ContentMatchSet> GetContentMatchSets() => null;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
{
// Get the sections from the executable, if possible
// PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
// var sections = pex?.SectionTable;
// if (sections == null)
// return null;
// TODO: Implement resource finding instead of using the built in methods
// Assembly information lives in the .rsrc section
// I need to find out how to navigate the resources in general
@@ -46,6 +22,62 @@ namespace BurnOutSharp.PackerType
// file info and MUI (XML) info. Once I figure this out,
// that also opens the doors to easier assembly XML checks.
// TODO: Use this instead of the seek inside of `.rsrc` when that's fixed
//string description = Utilities.GetManifestDescription(fileContent);
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;
// Get the .rsrc section, if it exists
var rsrcSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rsrc"));
if (rsrcSection != null)
{
int sectionAddr = (int)rsrcSection.PointerToRawData;
int sectionEnd = sectionAddr + (int)rsrcSection.VirtualSize;
var matchers = new List<ContentMatchSet>
{
// Nullsoft Install System
new ContentMatchSet(
new ContentMatch(new byte?[]
{
0x4e, 0x75, 0x6c, 0x6c, 0x73, 0x6f, 0x66, 0x74,
0x20, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c,
0x20, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d
}, start: sectionAddr, end: sectionEnd),
GetVersion, "NSIS"),
};
string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .data section, if it exists
var dataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".data"));
if (dataSection != null)
{
int sectionAddr = (int)dataSection.PointerToRawData;
int sectionEnd = sectionAddr + (int)dataSection.VirtualSize;
var matchers = new List<ContentMatchSet>
{
// NullsoftInst
new ContentMatchSet(
new ContentMatch(new byte?[]
{
0x4E, 0x75, 0x6C, 0x6C, 0x73, 0x6F, 0x66, 0x74,
0x49, 0x6E, 0x73, 0x74
}, start: sectionAddr, end: sectionEnd),
"NSIS"),
};
string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
return null;
}