private static void HandleFileEntry(byte[] data)
{
using (var stream = new MemoryStream(data))
{
var length = stream.Length;
if (length < 8)
{
return;
}
using (var reader = new BinaryReader(stream))
{
var fileHeader = PeManager.FromBinaryReader <BOXED_FILE_HEADER>(reader);
reader.BaseStream.Seek(fileHeader.FileNamePos, SeekOrigin.Begin);
//var fileName = Encoding.Unicode.GetString(reader.ReadBytes((int) (fileHeader.Unknown1Pos - fileHeader.FileNamePos - 2)));
reader.BaseStream.Seek(fileHeader.FilePathPos, SeekOrigin.Begin);
var filePath = Encoding.Unicode.GetString(reader.ReadBytes((int)(fileHeader.DataPos - fileHeader.FilePathPos - 2))).Replace("<ExeDir>\\", "");
reader.BaseStream.Seek(fileHeader.DataPos, SeekOrigin.Begin);
if (length - fileHeader.DataPos <= 0)
{
return;
}
var fileData = reader.ReadBytes((int)(length - fileHeader.DataPos));
var path = Path.GetDirectoryName(filePath);
if (!string.IsNullOrWhiteSpace(path) && !Directory.Exists(path))
{
Directory.CreateDirectory(path);
}
File.WriteAllBytes(filePath, fileData);
Console.WriteLine("Exported file: " + filePath);
}
}
}
private static void HandleHeader(byte[] data)
{
using (var stream = new MemoryStream(data))
{
var length = stream.Length;
var headerSize = Marshal.SizeOf(typeof(BOXED_ENTRY_HEADER));
using (var reader = new BinaryReader(stream))
{
long current = 0;
while (current + headerSize < length)
{
var entryHeader = PeManager.FromBinaryReader <BOXED_ENTRY_HEADER>(reader);
if (entryHeader.Size == 0)
{
break;
}
reader.BaseStream.Seek(-headerSize, SeekOrigin.Current);
var rawData = reader.ReadBytes((int)entryHeader.Size);
current += entryHeader.Size;
if (entryHeader.Type == 65541)
{
HandleFileEntry(rawData);
}
}
}
}
}
