private static void HandleFileEntry(byte[] data) { using (var stream = new MemoryStream(data)) { var length = stream.Length; if (length < 8) { return; } using (var reader = new BinaryReader(stream)) { var fileHeader = PeManager.FromBinaryReader <BOXED_FILE_HEADER>(reader); reader.BaseStream.Seek(fileHeader.FileNamePos, SeekOrigin.Begin); //var fileName = Encoding.Unicode.GetString(reader.ReadBytes((int) (fileHeader.Unknown1Pos - fileHeader.FileNamePos - 2))); reader.BaseStream.Seek(fileHeader.FilePathPos, SeekOrigin.Begin); var filePath = Encoding.Unicode.GetString(reader.ReadBytes((int)(fileHeader.DataPos - fileHeader.FilePathPos - 2))).Replace("<ExeDir>\\", ""); reader.BaseStream.Seek(fileHeader.DataPos, SeekOrigin.Begin); if (length - fileHeader.DataPos <= 0) { return; } var fileData = reader.ReadBytes((int)(length - fileHeader.DataPos)); var path = Path.GetDirectoryName(filePath); if (!string.IsNullOrWhiteSpace(path) && !Directory.Exists(path)) { Directory.CreateDirectory(path); } File.WriteAllBytes(filePath, fileData); Console.WriteLine("Exported file: " + filePath); } } }
private static void HandleHeader(byte[] data) { using (var stream = new MemoryStream(data)) { var length = stream.Length; var headerSize = Marshal.SizeOf(typeof(BOXED_ENTRY_HEADER)); using (var reader = new BinaryReader(stream)) { long current = 0; while (current + headerSize < length) { var entryHeader = PeManager.FromBinaryReader <BOXED_ENTRY_HEADER>(reader); if (entryHeader.Size == 0) { break; } reader.BaseStream.Seek(-headerSize, SeekOrigin.Current); var rawData = reader.ReadBytes((int)entryHeader.Size); current += entryHeader.Size; if (entryHeader.Type == 65541) { HandleFileEntry(rawData); } } } } }