SabreTools/SabreTools.Serialization
1
0
Fork 0
mirror of https://github.com/SabreTools/SabreTools.Serialization.git synced 2026-07-08 18:06:41 +00:00
Code Issues 56 Packages Projects Releases 20 Wiki Activity

Use constants, add CFB detection to overlays and resources

Browse Source
This commit is contained in:
Matt Nadareski
2025-09-25 21:13:07 -04:00
parent cab890b1d9
commit 077abd590a
3 changed files with 37 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
SabreTools.Serialization/Printers/PortableExecutable.cs
View File

@@ -1362,11 +1362,11 @@ namespace SabreTools.Serialization.Printers
{
builder.AppendLine($"{padding}Data: [Embedded spanned PKZIP file]"); // TODO: Parse this out and print separately
}
else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
else if (magic.StartsWith(Models.RAR.Constants.OldSignatureBytes))
{
builder.AppendLine($"{padding}Data: [Embedded RAR file]"); // TODO: Parse this out and print separately
}
else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
else if (magic.StartsWith(Models.RAR.Constants.NewSignatureBytes))
{
builder.AppendLine($"{padding}Data: [Embedded RAR5 file]"); // TODO: Parse this out and print separately
}
@@ -1848,11 +1848,11 @@ namespace SabreTools.Serialization.Printers
{
builder.AppendLine($"{padding}Data: [Embedded spanned PKZIP file]"); // TODO: Parse this out and print separately
}
else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
else if (magic.StartsWith(Models.RAR.Constants.OldSignatureBytes))
{
builder.AppendLine($"{padding}Data: [Embedded RAR file]"); // TODO: Parse this out and print separately
}
else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
else if (magic.StartsWith(Models.RAR.Constants.NewSignatureBytes))
{
builder.AppendLine($"{padding}Data: [Embedded RAR5 file]"); // TODO: Parse this out and print separately
}

16
SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs
View File

@@ -46,7 +46,7 @@ namespace SabreTools.Serialization.Wrappers
int temp = overlayOffset;
byte[] overlaySample = overlayData.ReadBytes(ref temp, 0x10);
if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
if (overlaySample.StartsWith(Models.SevenZip.Constants.SignatureBytes))
{
extension = "7z";
break;
@@ -62,11 +62,17 @@ namespace SabreTools.Serialization.Wrappers
extension = "7z";
break;
}
else if (overlaySample.StartsWith([0x42, 0x5A, 0x68]))
else if (overlaySample.StartsWith(Models.BZip2.Constants.SignatureBytes))
{
extension = "bz2";
break;
}
else if (overlaySample.StartsWith(Models.CFB.Constants.SignatureBytes))
{
// Assume embedded CFB files are MSI
extension = "msi";
break;
}
else if (overlaySample.StartsWith([0x1F, 0x8B]))
{
extension = "gz";
@@ -97,12 +103,12 @@ namespace SabreTools.Serialization.Wrappers
extension = "zip";
break;
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
else if (overlaySample.StartsWith(Models.RAR.Constants.OldSignatureBytes))
{
extension = "rar";
break;
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
else if (overlaySample.StartsWith(Models.RAR.Constants.NewSignatureBytes))
{
extension = "rar";
break;
@@ -127,7 +133,7 @@ namespace SabreTools.Serialization.Wrappers
extension = "xml";
break;
}
else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
else if (overlaySample.StartsWith(Models.XZ.Constants.SignatureBytes))
{
extension = "xz";
break;

32
SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs
View File

@@ -107,7 +107,7 @@ namespace SabreTools.Serialization.Wrappers
int temp = overlayOffset;
byte[] overlaySample = overlayData.ReadBytes(ref temp, 0x10);
if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
if (overlaySample.StartsWith(Models.SevenZip.Constants.SignatureBytes))
{
extension = "7z";
break;
@@ -123,11 +123,17 @@ namespace SabreTools.Serialization.Wrappers
extension = "7z";
break;
}
else if (overlaySample.StartsWith([0x42, 0x5A, 0x68]))
else if (overlaySample.StartsWith(Models.BZip2.Constants.SignatureBytes))
{
extension = "bz2";
break;
}
else if (overlaySample.StartsWith(Models.CFB.Constants.SignatureBytes))
{
// Assume embedded CFB files are MSI
extension = "msi";
break;
}
else if (overlaySample.StartsWith([0x1F, 0x8B]))
{
extension = "gz";
@@ -158,12 +164,12 @@ namespace SabreTools.Serialization.Wrappers
extension = "zip";
break;
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
else if (overlaySample.StartsWith(Models.RAR.Constants.OldSignatureBytes))
{
extension = "rar";
break;
}
else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
else if (overlaySample.StartsWith(Models.RAR.Constants.NewSignatureBytes))
{
extension = "rar";
break;
@@ -188,7 +194,7 @@ namespace SabreTools.Serialization.Wrappers
extension = "xml";
break;
}
else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
else if (overlaySample.StartsWith(Models.XZ.Constants.SignatureBytes))
{
extension = "xz";
break;
@@ -290,7 +296,7 @@ namespace SabreTools.Serialization.Wrappers
int temp = resourceOffset;
byte[] resourceSample = ba.ReadBytes(ref temp, 0x10);
if (resourceSample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
if (resourceSample.StartsWith(Models.SevenZip.Constants.SignatureBytes))
{
extension = "7z";
break;
@@ -300,11 +306,17 @@ namespace SabreTools.Serialization.Wrappers
extension = "bmp";
break;
}
else if (resourceSample.StartsWith([0x42, 0x5A, 0x68]))
else if (resourceSample.StartsWith(Models.BZip2.Constants.SignatureBytes))
{
extension = "bz2";
break;
}
else if (resourceSample.StartsWith(Models.CFB.Constants.SignatureBytes))
{
// Assume embedded CFB files are MSI
extension = "msi";
break;
}
else if (resourceSample.StartsWith([0x47, 0x49, 0x46, 0x38]))
{
extension = "gif";
@@ -355,12 +367,12 @@ namespace SabreTools.Serialization.Wrappers
extension = "png";
break;
}
else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
else if (resourceSample.StartsWith(Models.RAR.Constants.OldSignatureBytes))
{
extension = "rar";
break;
}
else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
else if (resourceSample.StartsWith(Models.RAR.Constants.NewSignatureBytes))
{
extension = "rar";
break;
@@ -385,7 +397,7 @@ namespace SabreTools.Serialization.Wrappers
extension = "xml";
break;
}
else if (resourceSample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]))
else if (resourceSample.StartsWith(Models.XZ.Constants.SignatureBytes))
{
extension = "xz";
break;