From 077abd590ac8daea6e22f63c00c725d86126fd64 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Thu, 25 Sep 2025 21:13:07 -0400 Subject: [PATCH] Use constants, add CFB detection to overlays and resources --- .../Printers/PortableExecutable.cs | 8 ++--- .../Wrappers/NewExecutable.Extraction.cs | 16 +++++++--- .../Wrappers/PortableExecutable.Extraction.cs | 32 +++++++++++++------ 3 files changed, 37 insertions(+), 19 deletions(-) diff --git a/SabreTools.Serialization/Printers/PortableExecutable.cs b/SabreTools.Serialization/Printers/PortableExecutable.cs index 06a7a4cf..a0430207 100644 --- a/SabreTools.Serialization/Printers/PortableExecutable.cs +++ b/SabreTools.Serialization/Printers/PortableExecutable.cs @@ -1362,11 +1362,11 @@ namespace SabreTools.Serialization.Printers { builder.AppendLine($"{padding}Data: [Embedded spanned PKZIP file]"); // TODO: Parse this out and print separately } - else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) + else if (magic.StartsWith(Models.RAR.Constants.OldSignatureBytes)) { builder.AppendLine($"{padding}Data: [Embedded RAR file]"); // TODO: Parse this out and print separately } - else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) + else if (magic.StartsWith(Models.RAR.Constants.NewSignatureBytes)) { builder.AppendLine($"{padding}Data: [Embedded RAR5 file]"); // TODO: Parse this out and print separately } @@ -1848,11 +1848,11 @@ namespace SabreTools.Serialization.Printers { builder.AppendLine($"{padding}Data: [Embedded spanned PKZIP file]"); // TODO: Parse this out and print separately } - else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) + else if (magic.StartsWith(Models.RAR.Constants.OldSignatureBytes)) { builder.AppendLine($"{padding}Data: [Embedded RAR file]"); // TODO: Parse this out and print separately } - else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) + else if (magic.StartsWith(Models.RAR.Constants.NewSignatureBytes)) { builder.AppendLine($"{padding}Data: [Embedded RAR5 file]"); // TODO: Parse this out and print separately } diff --git a/SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs b/SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs index 3416a7ae..20968829 100644 --- a/SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs +++ b/SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs @@ -46,7 +46,7 @@ namespace SabreTools.Serialization.Wrappers int temp = overlayOffset; byte[] overlaySample = overlayData.ReadBytes(ref temp, 0x10); - if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C])) + if (overlaySample.StartsWith(Models.SevenZip.Constants.SignatureBytes)) { extension = "7z"; break; @@ -62,11 +62,17 @@ namespace SabreTools.Serialization.Wrappers extension = "7z"; break; } - else if (overlaySample.StartsWith([0x42, 0x5A, 0x68])) + else if (overlaySample.StartsWith(Models.BZip2.Constants.SignatureBytes)) { extension = "bz2"; break; } + else if (overlaySample.StartsWith(Models.CFB.Constants.SignatureBytes)) + { + // Assume embedded CFB files are MSI + extension = "msi"; + break; + } else if (overlaySample.StartsWith([0x1F, 0x8B])) { extension = "gz"; @@ -97,12 +103,12 @@ namespace SabreTools.Serialization.Wrappers extension = "zip"; break; } - else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) + else if (overlaySample.StartsWith(Models.RAR.Constants.OldSignatureBytes)) { extension = "rar"; break; } - else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) + else if (overlaySample.StartsWith(Models.RAR.Constants.NewSignatureBytes)) { extension = "rar"; break; @@ -127,7 +133,7 @@ namespace SabreTools.Serialization.Wrappers extension = "xml"; break; } - else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) + else if (overlaySample.StartsWith(Models.XZ.Constants.SignatureBytes)) { extension = "xz"; break; diff --git a/SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs b/SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs index 65f15193..a375c866 100644 --- a/SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs +++ b/SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs @@ -107,7 +107,7 @@ namespace SabreTools.Serialization.Wrappers int temp = overlayOffset; byte[] overlaySample = overlayData.ReadBytes(ref temp, 0x10); - if (overlaySample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C])) + if (overlaySample.StartsWith(Models.SevenZip.Constants.SignatureBytes)) { extension = "7z"; break; @@ -123,11 +123,17 @@ namespace SabreTools.Serialization.Wrappers extension = "7z"; break; } - else if (overlaySample.StartsWith([0x42, 0x5A, 0x68])) + else if (overlaySample.StartsWith(Models.BZip2.Constants.SignatureBytes)) { extension = "bz2"; break; } + else if (overlaySample.StartsWith(Models.CFB.Constants.SignatureBytes)) + { + // Assume embedded CFB files are MSI + extension = "msi"; + break; + } else if (overlaySample.StartsWith([0x1F, 0x8B])) { extension = "gz"; @@ -158,12 +164,12 @@ namespace SabreTools.Serialization.Wrappers extension = "zip"; break; } - else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) + else if (overlaySample.StartsWith(Models.RAR.Constants.OldSignatureBytes)) { extension = "rar"; break; } - else if (overlaySample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) + else if (overlaySample.StartsWith(Models.RAR.Constants.NewSignatureBytes)) { extension = "rar"; break; @@ -188,7 +194,7 @@ namespace SabreTools.Serialization.Wrappers extension = "xml"; break; } - else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) + else if (overlaySample.StartsWith(Models.XZ.Constants.SignatureBytes)) { extension = "xz"; break; @@ -290,7 +296,7 @@ namespace SabreTools.Serialization.Wrappers int temp = resourceOffset; byte[] resourceSample = ba.ReadBytes(ref temp, 0x10); - if (resourceSample.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C])) + if (resourceSample.StartsWith(Models.SevenZip.Constants.SignatureBytes)) { extension = "7z"; break; @@ -300,11 +306,17 @@ namespace SabreTools.Serialization.Wrappers extension = "bmp"; break; } - else if (resourceSample.StartsWith([0x42, 0x5A, 0x68])) + else if (resourceSample.StartsWith(Models.BZip2.Constants.SignatureBytes)) { extension = "bz2"; break; } + else if (resourceSample.StartsWith(Models.CFB.Constants.SignatureBytes)) + { + // Assume embedded CFB files are MSI + extension = "msi"; + break; + } else if (resourceSample.StartsWith([0x47, 0x49, 0x46, 0x38])) { extension = "gif"; @@ -355,12 +367,12 @@ namespace SabreTools.Serialization.Wrappers extension = "png"; break; } - else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])) + else if (resourceSample.StartsWith(Models.RAR.Constants.OldSignatureBytes)) { extension = "rar"; break; } - else if (resourceSample.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00])) + else if (resourceSample.StartsWith(Models.RAR.Constants.NewSignatureBytes)) { extension = "rar"; break; @@ -385,7 +397,7 @@ namespace SabreTools.Serialization.Wrappers extension = "xml"; break; } - else if (resourceSample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) + else if (resourceSample.StartsWith(Models.XZ.Constants.SignatureBytes)) { extension = "xz"; break;