Skip to content

Commit d6920bc

Browse files
mnadareskimnadareski
committed
Fix Wise detection slightly
1 parent 68d4eee commit d6920bc

File tree

1 file changed

+32
-77
lines changed

1 file changed

+32
-77
lines changed

‎BinaryObjectScanner/Packer/WiseInstaller.cs‎

Lines changed: 32 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -105,53 +105,24 @@ public bool Extract(string file, PortableExecutable pex, string outDir, bool inc
105105
private static FormatProperty? MatchesNEVersion(NewExecutable nex)
106106
{
107107
// TODO: Offset is _not_ the EXE header address, rather where the data starts. Fix this.
108-
switch (nex.Model.Stub?.Header?.NewExeHeaderAddr)
108+
return (nex.Model.Stub?.Header?.NewExeHeaderAddr) switch
109109
{
110-
case 0x84b0:
111-
return new FormatProperty { Dll = false, ArchiveStart = 0x11, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = true };
112-
113-
case 0x3e10:
114-
return new FormatProperty { Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false };
115-
116-
case 0x3e50:
117-
return new FormatProperty { Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false };
118-
119-
case 0x3c20:
120-
return new FormatProperty { Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false };
121-
122-
case 0x3c30:
123-
return new FormatProperty { Dll = false, ArchiveStart = 0x22, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false };
124-
125-
case 0x3660:
126-
return new FormatProperty { Dll = false, ArchiveStart = 0x40, ArchiveEnd = 0x3c, InitText = false, FilenamePosition = 0x04, NoCrc = false };
127-
128-
case 0x36f0:
129-
return new FormatProperty { Dll = false, ArchiveStart = 0x48, ArchiveEnd = 0x44, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
130-
131-
case 0x3770:
132-
return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
133-
134-
case 0x3780:
135-
return new FormatProperty { Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
136-
137-
case 0x37b0:
138-
return new FormatProperty { Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
139-
140-
case 0x37d0:
141-
return new FormatProperty { Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
142-
143-
case 0x3c80:
144-
return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
145-
146-
case 0x3bd0:
147-
return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
148-
149-
case 0x3c10:
150-
return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
151-
152-
default:
153-
return null;
154-
}
110+
0x84b0 => new FormatProperty { ArchiveEnd = -1 },
111+
0x3e10 => new FormatProperty { ArchiveEnd = -1 },
112+
0x3e50 => new FormatProperty { ArchiveEnd = -1 },
113+
0x3c20 => new FormatProperty { ArchiveEnd = -1 },
114+
0x3c30 => new FormatProperty { ArchiveEnd = -1 },
115+
0x3660 => new FormatProperty { ArchiveEnd = 0x3c },
116+
0x36f0 => new FormatProperty { ArchiveEnd = 0x44 },
117+
0x3770 => new FormatProperty { ArchiveEnd = 0x4c },
118+
0x3780 => new FormatProperty { ArchiveEnd = 0x4c },
119+
0x37b0 => new FormatProperty { ArchiveEnd = 0x4c },
120+
0x37d0 => new FormatProperty { ArchiveEnd = 0x4c },
121+
0x3c80 => new FormatProperty { ArchiveEnd = 0x4c },
122+
0x3bd0 => new FormatProperty { ArchiveEnd = 0x4c },
123+
0x3c10 => new FormatProperty { ArchiveEnd = 0x4c },
124+
_ => null,
125+
};
155126
}
156127

157128
/// <summary>
@@ -161,40 +132,24 @@ public bool Extract(string file, PortableExecutable pex, string outDir, bool inc
161132
/// <returns>True if it matches a known version, false otherwise</returns>
162133
private static FormatProperty? GetPEFormat(PortableExecutable pex)
163134
{
164-
if (pex.OverlayAddress == 0x6e00
165-
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4
166-
&& pex.GetFirstSection(".data")?.VirtualSize == 0x1528)
167-
return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
168-
169-
else if (pex.OverlayAddress == 0x6e00
170-
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4
171-
&& pex.GetFirstSection(".data")?.VirtualSize == 0x1568)
172-
return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
173-
174-
else if (pex.OverlayAddress == 0x6e00
175-
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3d54)
176-
return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
177-
178-
else if (pex.OverlayAddress == 0x6e00
179-
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3d44)
180-
return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
135+
// Get the current format
136+
var current = new FormatProperty
137+
{
138+
ExecutableType = ExecutableType.PE,
139+
CodeSectionLength = (int?)pex.GetFirstSection(".text")?.VirtualSize ?? -1,
140+
DataSectionLength = (int?)pex.GetFirstSection(".data")?.VirtualSize ?? -1,
141+
};
181142

182-
else if (pex.OverlayAddress == 0x6e00
183-
&& pex.GetFirstSection(".text")?.VirtualSize == 0x3d04)
184-
return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
143+
// Search known formats
144+
foreach (var format in FormatProperty.KnownFormats)
145+
{
146+
if (current.Equals(format))
147+
return format;
148+
}
185149

186150
// Found in Binary.WiseCustomCalla
187-
else if (pex.OverlayAddress == 0x6200)
188-
return new FormatProperty { Dll = true, ArchiveStart = 0x62, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
189-
190-
else if (pex.OverlayAddress == 0x3000)
191-
return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
192-
193-
else if (pex.OverlayAddress == 0x3800)
194-
return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
195-
196-
else if (pex.OverlayAddress == 0x3a00)
197-
return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
151+
if (pex.OverlayAddress == 0x6200)
152+
return new FormatProperty { ArchiveEnd = 0x4c };
198153

199154
return null;
200155
}

0 commit comments

Comments
 (0)