using System.Collections.Concurrent; using System.IO; using BurnOutSharp.ExecutableType.Microsoft.PE; using BurnOutSharp.Interfaces; namespace BurnOutSharp.PackerType { // TODO: Better version detection // TODO: Add extraction public class PECompact : IPortableExecutableCheck, IScannable { /// public bool ShouldScan(byte[] magic) => true; /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { // Get the sections from the executable, if possible var sections = pex?.SectionTable; if (sections == null) return null; // 0x4F434550 is "PECO" if (pex.ImageFileHeader.PointerToSymbolTable == 0x4F434550) return "PE Compact v1.x"; // TODO: Get more granular version detection. PiD is somehow able to detect version ranges based // on the data in the file. This may be related to information in other fields // Get the pec1 section, if it exists bool pec1Section = pex.ContainsSection("pec1", exact: true); if (pec1Section) return "PE Compact v1.x"; // Get the PEC2 section, if it exists -- TODO: Verify this comment since it's pulling the .text section var textSection = pex.GetFirstSection(".text", exact: true); if (textSection != null && textSection.PointerToRelocations == 0x32434550) { if (textSection.PointerToLinenumbers != 0) return $"PE Compact v{textSection.PointerToLinenumbers} (internal version)"; return "PE Compact v2.x (or newer)"; } return null; } /// public ConcurrentDictionary> Scan(Scanner scanner, string file) { if (!File.Exists(file)) return null; using (var fs = File.OpenRead(file)) { return Scan(scanner, fs, file); } } /// public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) { return null; } } }