[PR #350] [MERGED] Removed secondary ASPack 1.08.04 check due to false positives. #511

New Issue

Closed

opened 2026-01-29 21:09:47 +00:00 by claunia · 0 comments

claunia commented 2026-01-29 21:09:47 +00:00

Owner

Copy Link

📋 Pull Request Information

Original PR: https://github.com/SabreTools/BinaryObjectScanner/pull/350
Author: @HeroponRikiBestest
Created: 12/30/2024
Status: ✅ Merged
Merged: 12/31/2024
Merged by: @mnadareski

Base: master ← Head: master

---

📝 Commits (1)

• 9dacbf3 Removed secondary ASPack 1.08.04 check due to false positives.

📊 Changes

1 file changed (+3 additions, -2 deletions)

View changed files

📝 BinaryObjectScanner/Packer/ASPack.cs (+3 -2)

📄 Description

See title. http://redump.org/disc/47205/ has an executable protected by PE-Crypt 1.02, not ASPack. Fairly certain this is a false positive due to the executable itself specifying it was protected with PE-Crypt.

In general, this check seems prone to false positives anyways- two bytes, followed by any four bytes, followed by one more byte seems prone to other cases like this.
Please let me know if this change is not desired, or if an alternate fix is needed.

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/SabreTools/BinaryObjectScanner/pull/350 **Author:** [@HeroponRikiBestest](https://github.com/HeroponRikiBestest) **Created:** 12/30/2024 **Status:** ✅ Merged **Merged:** 12/31/2024 **Merged by:** [@mnadareski](https://github.com/mnadareski) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (1) - [`9dacbf3`](https://github.com/SabreTools/BinaryObjectScanner/commit/9dacbf35c085d2454c5864b64672c781b85d2d3b) Removed secondary ASPack 1.08.04 check due to false positives. ### 📊 Changes **1 file changed** (+3 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `BinaryObjectScanner/Packer/ASPack.cs` (+3 -2) </details> ### 📄 Description See title. http://redump.org/disc/47205/ has an executable protected by PE-Crypt 1.02, not ASPack. Fairly certain this is a false positive due to the executable itself specifying it was protected with PE-Crypt.  In general, this check seems prone to false positives anyways- two bytes, followed by any four bytes, followed by one more byte seems prone to other cases like this. Please let me know if this change is not desired, or if an alternate fix is needed. --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

claunia added the pull-request label 2026-01-29 21:09:47 +00:00

claunia closed this issue 2026-01-29 21:09:48 +00:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

rolling

3.5.0

3.4.6

3.4.5

3.4.4

3.4.3

3.4.2

3.4.1

3.4.0

3.3.4

3.3.3

3.3.2

3.3.1

3.3.0

3.2.3

3.2.2

3.2.1

3.2.0

3.1.16

3.1.15

3.1.14

3.1.13

3.1.12

3.1.11

3.1.10

3.1.9

3.1.8

3.1.7

3.1.6

3.1.5

3.1.4

3.1.3

3.1.2

3.1.1

3.1.0

3.0.2

3.0.1

3.0.0

2.9.0

2.8.0

2.7.0

2.6.0

2.5.0

2.3.4

2.3.3

2.3.2

2.3.1

2.3.0

2.1.0

2.0.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.1

1.5.0

1.4.1

1.4.0

1.03.9.1

1.03.9

1.03.8.2

1.03.8.1

1.03.8.0

1.03.7.1

1.03.5

1.03.7

1.03.6

Labels

Clear labels

bug

enhancement

help wanted

pull-request

Mirrored from GitHub Pull Request

question

No Label pull-request

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

claunia

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SabreTools/BinaryObjectScanner#511