using System; using System.Collections.Generic; using System.IO; using System.Linq; using BinaryObjectScanner.Compression; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; using ICSharpCode.SharpZipLib.Zip.Compression; namespace BinaryObjectScanner.Packer { // The official website for CExe also includes the source code (which does have to be retrieved by the Wayback Machine) // http://www.scottlu.com/Content/CExe.html // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt public class CExe : IExtractable, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { // Get the sections from the executable, if possible var sections = pex?.SectionTable; if (sections == null) return null; // If there are exactly 2 resources with type 99 if (pex.FindResourceByNamedType("99, ").Count() == 2) return "CExe"; var matchers = new List { new ContentMatchSet(new byte?[] { 0x25, 0x57, 0x6F, 0xC1, 0x61, 0x36, 0x01, 0x92, 0x61, 0x36, 0x01, 0x92, 0x61, 0x36, 0x01, 0x92, 0x61, 0x36, 0x00, 0x92, 0x7B, 0x36, 0x01, 0x92, 0x03, 0x29, 0x12, 0x92, 0x66, 0x36, 0x01, 0x92, 0x89, 0x29, 0x0A, 0x92, 0x60, 0x36, 0x01, 0x92, 0xD9, 0x30, 0x07, 0x92, 0x60, 0x36, 0x01, 0x92 }, "CExe") }; string match = MatchUtil.GetFirstMatch(file, pex.StubExecutableData, matchers, includeDebug); if (!string.IsNullOrWhiteSpace(match)) return match; return null; } /// public string Extract(string file, bool includeDebug) { if (!File.Exists(file)) return null; using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) { return Extract(fs, file, includeDebug); } } /// public string Extract(Stream stream, string file, bool includeDebug) { try { // Parse into an executable again for easier extraction PortableExecutable pex = PortableExecutable.Create(stream); if (pex == null) return null; // Get the first resource of type 99 with index 2 byte[] payload = pex.FindResourceByNamedType("99, 2").FirstOrDefault(); if (payload == null || payload.Length == 0) return null; // Determine which compression was used bool zlib = pex.FindResourceByNamedType("99, 1").Any(); // Create the output data buffer byte[] data; // If we had the decompression DLL included, it's zlib if (zlib) { try { // Inflate the data into the buffer Inflater inflater = new Inflater(); inflater.SetInput(payload); data = new byte[payload.Length * 4]; int read = inflater.Inflate(data); // Trim the buffer to the proper size data = new ReadOnlySpan(data, 0, read).ToArray(); } catch { // Reset the data data = null; } } // Otherwise, LZ is used via the Windows API else { try { data = LZ.Decompress(payload); } catch { // Reset the data data = null; } } // If we have no data if (data == null) return null; string tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString()); Directory.CreateDirectory(tempPath); // Create the temp filename string tempFile = string.IsNullOrEmpty(file) ? "temp.sxe" : $"{Path.GetFileNameWithoutExtension(file)}.sxe"; tempFile = Path.Combine(tempPath, tempFile); // Write the file data to a temp file using (Stream tempStream = File.Open(tempFile, FileMode.Create, FileAccess.Write, FileShare.ReadWrite)) { tempStream.Write(data, 0, data.Length); } return tempPath; } catch (Exception ex) { if (includeDebug) Console.WriteLine(ex); return null; } } } }