From a86af8c32ae6f3649504b369588bff2ffde87d81 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Tue, 17 Dec 2024 00:52:24 -0500
Subject: [PATCH] Expand printed detections

---
 .../Printers/PortableExecutable.cs            | 43 ++++++++++++-------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/SabreTools.Serialization/Printers/PortableExecutable.cs b/SabreTools.Serialization/Printers/PortableExecutable.cs
index 31a6264b..ee6b867e 100644
--- a/SabreTools.Serialization/Printers/PortableExecutable.cs
+++ b/SabreTools.Serialization/Printers/PortableExecutable.cs
@@ -4,6 +4,7 @@ using System.Text;
 using System.Xml;
 using SabreTools.ASN1;
 using SabreTools.IO.Extensions;
+using SabreTools.Matching;
 using SabreTools.Models.PortableExecutable;
 using SabreTools.Serialization.Interfaces;
 
@@ -1346,32 +1347,36 @@ namespace SabreTools.Serialization.Printers
             else
             {
                 int offset = 0;
-                byte[]? magic = entry.Data.ReadBytes(ref offset, Math.Min(entry.Data.Length, 16));
+                byte[] magic = entry.Data.ReadBytes(ref offset, Math.Min(entry.Data.Length, 16));
 
-                if (magic == null)
-                {
-                    // No-op
-                }
-                else if (magic[0] == 0x4D && magic[1] == 0x5A)
+                if (magic.StartsWith([0x4D, 0x5A]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded Executable File]"); // TODO: Parse this out and print separately
                 }
-                else if (magic[0] == 0x4D && magic[1] == 0x53 && magic[2] == 0x46 && magic[3] == 0x54)
+                else if (magic.StartsWith([0x4D, 0x53, 0x46, 0x54]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded OLE Library File]"); // TODO: Parse this out and print separately
                 }
-                else if (magic[0] == 0x50 && magic[1] == 0x4B && magic[2] == 0x03 && magic[3] == 0x04)
+                else if (magic.StartsWith([0x50, 0x4B, 0x03, 0x04]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded PKZIP file]"); // TODO: Parse this out and print separately
                 }
-                else if (magic[0] == 0x50 && magic[1] == 0x4B && magic[2] == 0x05 && magic[3] == 0x06)
+                else if (magic.StartsWith([0x50, 0x4B, 0x05, 0x06]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded empty PKZIP file]"); // TODO: Parse this out and print separately
                 }
-                else if (magic[0] == 0x50 && magic[1] == 0x4B && magic[2] == 0x07 && magic[3] == 0x08)
+                else if (magic.StartsWith([0x50, 0x4B, 0x07, 0x08]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded spanned PKZIP file]"); // TODO: Parse this out and print separately
                 }
+                else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
+                {
+                    builder.AppendLine($"{padding}Data: [Embedded RAR file]"); // TODO: Parse this out and print separately
+                }
+                else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
+                {
+                    builder.AppendLine($"{padding}Data: [Embedded RAR5 file]"); // TODO: Parse this out and print separately
+                }
                 else
                 {
                     builder.AppendLine(magic, $"{padding}Data");
@@ -1830,26 +1835,34 @@ namespace SabreTools.Serialization.Printers
                 int offset = 0;
 
                 byte[] magic = entry.Data.ReadBytes(ref offset, Math.Min(entry.Data.Length, 16));
-                if (magic[0] == 0x4D && magic[1] == 0x5A)
+                if (magic.StartsWith([0x4D, 0x5A]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded Executable File]"); // TODO: Parse this out and print separately
                 }
-                else if (magic[0] == 0x4D && magic[1] == 0x53 && magic[2] == 0x46 && magic[3] == 0x54)
+                else if (magic.StartsWith([0x4D, 0x53, 0x46, 0x54]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded OLE Library File]"); // TODO: Parse this out and print separately
                 }
-                else if (magic[0] == 0x50 && magic[1] == 0x4B && magic[2] == 0x03 && magic[3] == 0x04)
+                else if (magic.StartsWith([0x50, 0x4B, 0x03, 0x04]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded PKZIP file]"); // TODO: Parse this out and print separately
                 }
-                else if (magic[0] == 0x50 && magic[1] == 0x4B && magic[2] == 0x05 && magic[3] == 0x06)
+                else if (magic.StartsWith([0x50, 0x4B, 0x05, 0x06]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded empty PKZIP file]"); // TODO: Parse this out and print separately
                 }
-                else if (magic[0] == 0x50 && magic[1] == 0x4B && magic[2] == 0x07 && magic[3] == 0x08)
+                else if (magic.StartsWith([0x50, 0x4B, 0x07, 0x08]))
                 {
                     builder.AppendLine($"{padding}Data: [Embedded spanned PKZIP file]"); // TODO: Parse this out and print separately
                 }
+                else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
+                {
+                    builder.AppendLine($"{padding}Data: [Embedded RAR file]"); // TODO: Parse this out and print separately
+                }
+                else if (magic.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00]))
+                {
+                    builder.AppendLine($"{padding}Data: [Embedded RAR5 file]"); // TODO: Parse this out and print separately
+                }
                 else
                 {
                     builder.AppendLine(magic, $"{padding}Data");