From af6dd6a7fcd4106691e4e51a07ab68d708e08073 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Mon, 8 Sep 2025 07:52:41 -0400 Subject: [PATCH] Check for BZip2 and XZ in hidden places too --- .../Wrappers/NewExecutable.cs | 10 ++++++++++ .../Wrappers/PortableExecutable.cs | 20 +++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/SabreTools.Serialization/Wrappers/NewExecutable.cs b/SabreTools.Serialization/Wrappers/NewExecutable.cs index 47e4a668..af37141a 100644 --- a/SabreTools.Serialization/Wrappers/NewExecutable.cs +++ b/SabreTools.Serialization/Wrappers/NewExecutable.cs @@ -411,6 +411,11 @@ namespace SabreTools.Serialization.Wrappers extension = "7z"; break; } + else if (overlaySample.StartsWith([0x42, 0x5A, 0x68])) + { + extension = "bz2"; + break; + } else if (overlaySample.StartsWith(Models.MicrosoftCabinet.Constants.SignatureBytes)) { extension = "cab"; @@ -446,6 +451,11 @@ namespace SabreTools.Serialization.Wrappers extension = "rar"; break; } + else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) + { + extension = "xz"; + break; + } else if (overlaySample.StartsWith(Models.MSDOS.Constants.SignatureBytes)) { extension = "bin"; // exe/dll diff --git a/SabreTools.Serialization/Wrappers/PortableExecutable.cs b/SabreTools.Serialization/Wrappers/PortableExecutable.cs index 233091c3..6f796ed5 100644 --- a/SabreTools.Serialization/Wrappers/PortableExecutable.cs +++ b/SabreTools.Serialization/Wrappers/PortableExecutable.cs @@ -1173,6 +1173,11 @@ namespace SabreTools.Serialization.Wrappers extension = "7z"; break; } + else if (overlaySample.StartsWith([0x42, 0x5A, 0x68])) + { + extension = "bz2"; + break; + } else if (overlaySample.StartsWith(Models.MicrosoftCabinet.Constants.SignatureBytes)) { extension = "cab"; @@ -1208,6 +1213,11 @@ namespace SabreTools.Serialization.Wrappers extension = "rar"; break; } + else if (overlaySample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) + { + extension = "xz"; + break; + } else if (overlaySample.StartsWith(Models.MSDOS.Constants.SignatureBytes)) { extension = "bin"; // exe/dll @@ -1279,6 +1289,11 @@ namespace SabreTools.Serialization.Wrappers extension = "7z"; break; } + else if (resourceSample.StartsWith([0x42, 0x5A, 0x68])) + { + extension = "bz2"; + break; + } else if (resourceSample.StartsWith(Models.MicrosoftCabinet.Constants.SignatureBytes)) { extension = "cab"; @@ -1314,6 +1329,11 @@ namespace SabreTools.Serialization.Wrappers extension = "rar"; break; } + else if (resourceSample.StartsWith([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])) + { + extension = "xz"; + break; + } else if (resourceSample.StartsWith(Models.MSDOS.Constants.SignatureBytes)) { extension = "bin"; // exe/dll