示例#1
0
        /// <summary>
        /// Step #6
        ///
        /// Rebuild and save the unpacked file.
        /// </summary>
        /// <returns></returns>
        private bool Step6()
        {
            FileStream fStream = null;

            try
            {
                // Rebuild the file sections..
                this.File.RebuildSections();

                // Open the unpacked file for writing..
                var unpackedPath = this.File.FilePath + ".unpacked.exe";
                fStream = new FileStream(unpackedPath, FileMode.Create, FileAccess.ReadWrite);

                // Write the DOS header to the file..
                fStream.WriteBytes(Pe32Helpers.GetStructureBytes(this.File.DosHeader));

                // Write the DOS stub to the file..
                if (this.File.DosStubSize > 0)
                {
                    fStream.WriteBytes(this.File.DosStubData);
                }

                // Update the entry point of the file..
                var ntHeaders = this.File.NtHeaders;
                ntHeaders.OptionalHeader.AddressOfEntryPoint = (uint)this.StubHeader.OriginalEntryPoint;
                this.File.NtHeaders = ntHeaders;

                // Write the NT headers to the file..
                fStream.WriteBytes(Pe32Helpers.GetStructureBytes(ntHeaders));

                // Write the sections to the file..
                for (var x = 0; x < this.File.Sections.Count; x++)
                {
                    var section     = this.File.Sections[x];
                    var sectionData = this.File.SectionData[x];

                    // Write the section header to the file..
                    fStream.WriteBytes(Pe32Helpers.GetStructureBytes(section));

                    // Set the file pointer to the sections raw data..
                    var sectionOffset = fStream.Position;
                    fStream.Position = section.PointerToRawData;

                    // Write the sections raw data..
                    var sectionIndex = this.File.Sections.IndexOf(section);
                    if (sectionIndex == this.CodeSectionIndex)
                    {
                        fStream.WriteBytes(this.CodeSectionData ?? sectionData);
                    }
                    else
                    {
                        fStream.WriteBytes(sectionData);
                    }

                    // Reset the file offset..
                    fStream.Position = sectionOffset;
                }

                // Set the stream to the end of the file..
                fStream.Position = fStream.Length;

                // Write the overlay data if it exists..
                if (this.File.OverlayData != null)
                {
                    fStream.WriteBytes(this.File.OverlayData);
                }

                this.Log(" --> Unpacked file saved to disk!", LogMessageType.Success);
                this.Log($" --> File Saved As: {unpackedPath}", LogMessageType.Success);

                return(true);
            }
            catch
            {
                this.Log(" --> Error trying to save unpacked file!", LogMessageType.Error);
                return(false);
            }
            finally
            {
                fStream?.Dispose();
            }
        }
示例#2
0
        private void TextBox1DragDrop(object sender, DragEventArgs e)
        {
            try
            {
                Array arrayyy = (Array)e.Data.GetData(DataFormats.FileDrop);
                if (arrayyy != null)
                {
                    string text = arrayyy.GetValue(0).ToString();
                    int    num  = text.LastIndexOf(".", StringComparison.Ordinal);
                    if (num != -1)
                    {
                        string text2 = text.Substring(num);
                        text2 = text2.ToLower();
                        if (text2 == ".exe" || text2 == ".dll")
                        {
                            Activate();
                            ExePath     = text;
                            label2.Text = "Status : Exe Loaded";
                            int num2 = text.LastIndexOf("\\", StringComparison.Ordinal);
                            if (num2 != -1)
                            {
                                DirectoryName = text.Remove(num2, text.Length - num2);
                            }
                            if (DirectoryName.Length == 2)
                            {
                                DirectoryName += "\\";
                            }
                        }
                    }
                }
            }
            catch
            {
            }
            this.FileData = File.ReadAllBytes(ExePath);
            if (IntPtr.Size == 4)
            {
                this.NtHeaders32 = new NativeApi32.ImageNtHeaders32();
                this.DosHeader32 = new NativeApi32.ImageDosHeader32();
                this.DosHeader32 = Pe32Helpers.GetStructure <NativeApi32.ImageDosHeader32>(this.FileData);
                this.NtHeaders32 = Pe32Helpers.GetStructure <NativeApi32.ImageNtHeaders32>(this.FileData, this.DosHeader32.e_lfanew);
                int num = NtHeaders32.FileHeader.NumberOfSections;
                for (var x = 0; x < num; x++)
                {
                    var section = Pe32Helpers.GetSection(this.FileData, x, this.DosHeader32, this.NtHeaders32);
                    if (section.SectionName.Equals(".bxpck"))
                    {
                        var sectionData = new byte[this.GetAlignment(section.SizeOfRawData, this.NtHeaders32.OptionalHeader.FileAlignment)];
                        Array.Copy(this.FileData, section.PointerToRawData, sectionData, 0, section.SizeOfRawData);
                        string filename = DirectoryName + "\\" + Path.GetFileNameWithoutExtension(ExePath) + "-Unpacked" + Path.GetExtension(ExePath);

                        int firstIndex = GetNthIndex(sectionData, 0x5A, 1);
                        if (sectionData[firstIndex - 1] == 0x4D)
                        {
                            File.WriteAllBytes(filename, sectionData.Skip(firstIndex - 1).ToArray());
                            label3.Text += (firstIndex - 1).ToString("X");
                        }
                        else
                        {
                            int secondIndex = GetNthIndex(sectionData, 0x5A, 2);
                            if (sectionData[secondIndex - 1] == 0x4A)
                            {
                                File.WriteAllBytes(filename, sectionData.Skip(secondIndex - 1).ToArray());
                                label3.Text += (secondIndex - 1).ToString("X");
                            }
                            else
                            {
                                int lastIndex = GetNthIndex(sectionData, 0x4D, 3);
                                if (sectionData[lastIndex - 1] == 0x4D)
                                {
                                    File.WriteAllBytes(filename, sectionData.Skip(lastIndex - 1).ToArray());
                                    label3.Text += (lastIndex - 1).ToString("X");
                                }
                                else
                                {
                                }
                            }
                        }
                        goto sucess;
                    }
                }
            }
            else
            {
                this.DosHeader64 = new NativeApi64.ImageDosHeader64();
                this.NtHeaders64 = new NativeApi64.ImageNtHeaders64();
                this.DosHeader64 = Pe64Helpers.GetStructure <NativeApi64.ImageDosHeader64>(this.FileData);
                this.NtHeaders64 = Pe64Helpers.GetStructure <NativeApi64.ImageNtHeaders64>(this.FileData, this.DosHeader64.e_lfanew);
                for (var x = 0; x < this.NtHeaders64.FileHeader.NumberOfSections; x++)
                {
                    var section = Pe64Helpers.GetSection(this.FileData, x, this.DosHeader64, this.NtHeaders64);
                    if (section.SectionName.Equals(".bxpck"))
                    {
                        var sectionData = new byte[this.GetAlignment(section.SizeOfRawData, this.NtHeaders64.OptionalHeader.FileAlignment)];
                        Array.Copy(this.FileData, section.PointerToRawData, sectionData, 0, section.SizeOfRawData);
                        string filename = DirectoryName + "\\" + Path.GetFileNameWithoutExtension(ExePath) + "-Unpacked" + Path.GetExtension(ExePath);
                        File.WriteAllBytes(filename, sectionData.Skip(182).ToArray());
                        goto sucess;
                    }
                }
            }
            MessageBox.Show("BoxedAppPacker section not found (.bxpck) ! ", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
sucess:
            label2.Text = "Status : Success ! ";
        }
示例#3
0
        /// <summary>
        /// Processing function called when a file is being unpacked. Allows plugins to check the file
        /// and see if it can handle the file for its intended purpose.
        /// </summary>
        /// <param name="file"></param>
        /// <returns></returns>
        public override bool CanProcessFile(string file)
        {
            try
            {
                // Load the file..
                var f = new Pe32File(file);
                if (!f.Parse())
                {
                    this.Log("Failed to parse PE", LogMessageType.Information);
                    return(false);
                }
                if (f.IsFile64Bit())
                {
                    this.Log("Is not 32bit", LogMessageType.Information);
                    return(false);
                }
                if (!f.HasSection(".bind"))
                {
                    this.Log("No bind section", LogMessageType.Information);
                    return(false);
                }

                // Obtain the bind section data..
                var bind = f.GetSectionData(".bind");

                // Attempt to locate the known v3.x signature..
                var varient = Pe32Helpers.FindPattern(bind, "E8 00 00 00 00 50 53 51 52 56 57 55 8B 44 24 1C 2D 05 00 00 00 8B CC 83 E4 F0 51 51 51 50");
                if (varient == 0)
                {
                    return(false);
                }

                // Version patterns..
                var varientPatterns = new List <KeyValuePair <string, int> >
                {
                    new KeyValuePair <string, int>("55 8B EC 81 EC ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? 68", 0x10),                    // v3.1     [Original version?]
                    new KeyValuePair <string, int>("55 8B EC 81 EC ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? 8D 83", 0x16),                 // v3.1.1   [Newer, 3.1.1? (Seen 2015?)]
                    new KeyValuePair <string, int>("55 8B EC 81 EC ?? ?? ?? ?? 56 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D", 0x10)      // v3.1.2   [Newer, 3.1.2? (Seen late 2017.)]
                };

                var  headerSize = 0;
                uint offset     = 0;
                foreach (var p in varientPatterns)
                {
                    offset = Pe32Helpers.FindPattern(bind, p.Key);
                    if (offset <= 0)
                    {
                        continue;
                    }

                    headerSize = BitConverter.ToInt32(bind, (int)offset + p.Value);
                    break;
                }

                // Ensure valid data was found..
                if (offset == 0 || headerSize == 0)
                {
                    return(false);
                }

                return(headerSize == 0xF0);
            }
            catch (Exception e)
            {
                this.Log(e.ToString(), LogMessageType.Warning);
                return(false);
            }
        }
示例#4
0
文件: Main.cs 项目: clayne/Steamless
        /// <summary>
        /// Step #6
        ///
        /// Rebuild and save the unpacked file.
        /// </summary>
        /// <returns></returns>
        private bool Step6()
        {
            FileStream fStream = null;

            try
            {
                // Zero the DosStubData if desired..
                if (this.Options.ZeroDosStubData && this.File.DosStubSize > 0)
                {
                    this.File.DosStubData = Enumerable.Repeat((byte)0, (int)this.File.DosStubSize).ToArray();
                }

                // Rebuild the file sections..
                this.File.RebuildSections(this.Options.DontRealignSections == false);

                // Open the unpacked file for writing..
                var unpackedPath = this.File.FilePath + ".unpacked.exe";
                fStream = new FileStream(unpackedPath, FileMode.Create, FileAccess.ReadWrite);

                // Write the DOS header to the file..
                fStream.WriteBytes(Pe32Helpers.GetStructureBytes(this.File.DosHeader));

                // Write the DOS stub to the file..
                if (this.File.DosStubSize > 0)
                {
                    fStream.WriteBytes(this.File.DosStubData);
                }

                // Update the NT headers..
                var ntHeaders     = this.File.NtHeaders;
                var lastSection   = this.File.Sections[this.File.Sections.Count - 1];
                var originalEntry = BitConverter.ToUInt32(this.PayloadData.Skip(this.SteamDrmpOffsets[2]).Take(4).ToArray(), 0);
                ntHeaders.OptionalHeader.AddressOfEntryPoint = this.File.GetRvaFromVa(originalEntry);
                ntHeaders.OptionalHeader.CheckSum            = 0;
                ntHeaders.OptionalHeader.SizeOfImage         = this.File.GetAlignment(lastSection.VirtualAddress + lastSection.VirtualSize, this.File.NtHeaders.OptionalHeader.SectionAlignment);
                this.File.NtHeaders = ntHeaders;

                // Write the NT headers to the file..
                fStream.WriteBytes(Pe32Helpers.GetStructureBytes(ntHeaders));

                // Write the sections to the file..
                for (var x = 0; x < this.File.Sections.Count; x++)
                {
                    var section     = this.File.Sections[x];
                    var sectionData = this.File.SectionData[x];

                    // Write the section header to the file..
                    fStream.WriteBytes(Pe32Helpers.GetStructureBytes(section));

                    // Set the file pointer to the sections raw data..
                    var sectionOffset = fStream.Position;
                    fStream.Position = section.PointerToRawData;

                    // Write the sections raw data..
                    var sectionIndex = this.File.Sections.IndexOf(section);
                    if (sectionIndex == this.CodeSectionIndex)
                    {
                        fStream.WriteBytes(this.CodeSectionData ?? sectionData);
                    }
                    else
                    {
                        fStream.WriteBytes(sectionData);
                    }

                    // Reset the file offset..
                    fStream.Position = sectionOffset;
                }

                // Set the stream to the end of the file..
                fStream.Position = fStream.Length;

                // Write the overlay data if it exists..
                if (this.File.OverlayData != null)
                {
                    fStream.WriteBytes(this.File.OverlayData);
                }

                this.Log(" --> Unpacked file saved to disk!", LogMessageType.Success);
                this.Log($" --> File Saved As: {unpackedPath}", LogMessageType.Success);

                return(true);
            }
            catch
            {
                this.Log(" --> Error trying to save unpacked file!", LogMessageType.Error);
                return(false);
            }
            finally
            {
                fStream?.Dispose();
            }
        }