@@ -294,7 +294,7 @@ fn run(config: Config) -> Result<(), String> {
294294}
295295
296296fn is_obfuscated ( data : & [ u8 ] , magic : & [ u8 ] , offset : usize ) -> bool {
297- if data. len ( ) < offset + magic. len ( ) {
297+ if data. len ( ) < offset + magic. len ( ) + 4 { // +4 for length storage
298298 return false ;
299299 }
300300
@@ -314,29 +314,30 @@ fn obfuscate(data: &[u8], magic: &[u8], offset: usize) -> Result<Vec<u8>, String
314314 return Err ( format ! ( "File too small to obfuscate ({} bytes, need at least {})" , data. len( ) , magic. len( ) ) ) ;
315315 }
316316
317- if offset + magic. len ( ) > data. len ( ) && offset < 1024 {
318- return Err ( "Offset too close to end of file" . to_string ( ) ) ;
319- }
320-
317+ let original_len = data. len ( ) ;
321318 let mut result = data. to_vec ( ) ;
322319
323- // Extend file if necessary to accommodate offset
324- if result. len ( ) < offset + magic. len ( ) {
325- result. resize ( offset + magic. len ( ) , 0 ) ;
320+ // Always extend file if necessary to accommodate offset
321+ if result. len ( ) < offset + magic. len ( ) + 4 { // +4 for storing original length
322+ result. resize ( offset + magic. len ( ) + 4 , 0 ) ;
326323 }
327324
328325 // Store original magic bytes at offset
329326 let original_magic = result[ ..magic. len ( ) ] . to_vec ( ) ;
330327 result[ offset..offset + magic. len ( ) ] . copy_from_slice ( & original_magic) ;
331328
329+ // Store original file length at offset + magic.len()
330+ let len_bytes = ( original_len as u32 ) . to_le_bytes ( ) ;
331+ result[ offset + magic. len ( ) ..offset + magic. len ( ) + 4 ] . copy_from_slice ( & len_bytes) ;
332+
332333 // Replace magic bytes with obfuscation magic
333334 result[ ..magic. len ( ) ] . copy_from_slice ( magic) ;
334335
335336 Ok ( result)
336337}
337338
338339fn deobfuscate ( data : & [ u8 ] , magic : & [ u8 ] , offset : usize ) -> Result < Vec < u8 > , String > {
339- if data. len ( ) < offset + magic. len ( ) {
340+ if data. len ( ) < offset + magic. len ( ) + 4 {
340341 return Err ( "File too small or corrupted for deobfuscation" . to_string ( ) ) ;
341342 }
342343
@@ -351,8 +352,14 @@ fn deobfuscate(data: &[u8], magic: &[u8], offset: usize) -> Result<Vec<u8>, Stri
351352 let stored_magic = data[ offset..offset + magic. len ( ) ] . to_vec ( ) ;
352353 result[ ..magic. len ( ) ] . copy_from_slice ( & stored_magic) ;
353354
354- // Clear stored magic bytes (optional)
355- result[ offset..offset + magic. len ( ) ] . fill ( 0 ) ;
355+ // Get original file length
356+ let len_bytes = & data[ offset + magic. len ( ) ..offset + magic. len ( ) + 4 ] ;
357+ let original_len = u32:: from_le_bytes ( [ len_bytes[ 0 ] , len_bytes[ 1 ] , len_bytes[ 2 ] , len_bytes[ 3 ] ] ) as usize ;
358+
359+ // Trim to original length if it was extended
360+ if original_len > 0 && original_len < result. len ( ) {
361+ result. truncate ( original_len) ;
362+ }
356363
357364 Ok ( result)
358365}
0 commit comments