Example #1
0
        private ScanResult[] ScanAllNormal(Stream stream)
        {
            stream.Seek(0,SeekOrigin.Begin);

            long section_offset = 0;
            long section_size = 0;
            long ep_offset = 0;

            using (ExeReader reader = ExeReader.FromStream(stream,false))
            {
                uint ep_address = reader.NTHeaders.OptionalHeader.AddressOfEntryPoint;
                Section section = reader.Sections.RVAToSection(ep_address);
                uint delta = ep_address - section.TableEntry.VirtualAddress;

                section_offset = section.TableEntry.PointerToRawData;
                section_size = section.TableEntry.SizeOfRawData;
                ep_offset = section_offset + delta;
            }

            stream.Seek(ep_offset,SeekOrigin.Begin);

            byte[] buffer = new byte[max_sig_length];
            int num_read = stream.Read(buffer,0,buffer.Length);

            if (num_read < min_sig_length)
                return null;

            List<ScanResult> results = new List<ScanResult>();
            List<Signature> signatures = new List<Signature>();

            Match(buffer,num_read,0,ep_tree,signatures);

            foreach(Signature signature in signatures)
            {
                byte[] data = new byte[signature.Pattern.Length];

                Array.Copy(buffer,0,data,0,data.Length);

                ScanResult result = new ScanResult() {
                    Offset = ep_offset,
                    Data = data,
                    Signature = signature
                };

                results.Add(result);
            }

            return results.ToArray();
        }
Example #2
0
        private ScanResult[] ScanAllHardcore(Stream stream)
        {
            List<ScanResult> results = new List<ScanResult>();
            var positions = Utils.IRange(0,stream.Length - min_sig_length);

            foreach(long position in positions)
            {
                stream.Seek(position,SeekOrigin.Begin);

                byte[] buffer = new byte[max_sig_length];
                int num_read = stream.Read(buffer,0,buffer.Length);

                if (num_read < min_sig_length)
                    return null;

                List<Signature> signatures = new List<Signature>();

                Match(buffer,num_read,0,non_ep_tree,signatures);

                foreach(Signature signature in signatures)
                {
                    byte[] data = new byte[signature.Pattern.Length];

                    Array.Copy(buffer,0,data,0,data.Length);

                    ScanResult result = new ScanResult() {
                        Offset = position,
                        Data = data,
                        Signature = signature
                    };

                    results.Add(result);
                }
            }

            return results.ToArray();
        }