mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
Set this.Name to this.FileName in the Resource constructor. This exposes a Name property mirroring FileName (alongside existing FileSize/FileOffset aliases) to improve compatibility with callers that expect a Name field.
207 lines
No EOL
6.2 KiB
Text
207 lines
No EOL
6.2 KiB
Text
// Detect It Easy: DiE-JS framework file
|
|
// Don't change anything unless you're sure about what you're doing
|
|
|
|
var File = PE;
|
|
var X = PE;
|
|
|
|
/**
|
|
* Get the signature at an offset of the entry point.
|
|
* @see Binary.getSignature
|
|
*/
|
|
PE.getEntryPointSignature = function (nOffset, nSize) {
|
|
return PE.getSignature(PE.nEP + nOffset, nSize);
|
|
}
|
|
|
|
|
|
/**
|
|
* Add console and/or administrator requirement to the general options.
|
|
* @returns {String}
|
|
*/
|
|
PE.getGeneralOptionsEx = function () {
|
|
sResult = PE.getGeneralOptions();
|
|
if (PE.isConsole()) {
|
|
sResult = sResult.append("console");
|
|
}
|
|
if (/requireAdministrator/.test(PE.getManifest())) {
|
|
sResult = sResult.append("admin");
|
|
}
|
|
if (PE.isSignedFile()) {
|
|
sResult = sResult.append("signed");
|
|
}
|
|
|
|
return sResult;
|
|
}
|
|
|
|
|
|
/**
|
|
* Locate the first library matching a pattern.
|
|
* @returns {?Array} <code>null</code> if not found, otherwise:
|
|
* <br><code>[-1]</code> is the number of the library;
|
|
* <br><code>[0]</code> is the name of the library (lower cased);
|
|
* <br><code>[1]</code> onwards are the captured subpatterns.
|
|
*/
|
|
PE.isLibraryPresentExp = function (sLibraryPattern) {
|
|
var aMatch = null;
|
|
for (var n = 0; n < PE.getNumberOfImports(); n++) {
|
|
aMatch = PE.getImportLibraryName(n).match(sLibraryPattern);
|
|
if (aMatch) {
|
|
aMatch[-1] = n;
|
|
aMatch[0] = PE.getImportLibraryName(n).toLowerCase();
|
|
break;
|
|
}
|
|
}
|
|
|
|
return aMatch;
|
|
}
|
|
|
|
|
|
/**
|
|
* Locate the first export function matching a pattern.
|
|
* @returns {?Array} <code>null</code> if not found, otherwise:
|
|
* <br><code>[-1]</code> is the number of the export function;
|
|
* <br><code>[0]</code> is the name of the export function;
|
|
* <br><code>[1]</code> onwards are the captured subpatterns.
|
|
*/
|
|
PE.isExportFunctionPresentExp = function (sExportPattern) {
|
|
var aMatch = null;
|
|
for (var n = 0; n < PE.getNumberOfExportFunctions(); n++) {
|
|
aMatch = PE.getExportFunctionName(n).match(sExportPattern);
|
|
if (aMatch) {
|
|
aMatch[-1] = n;
|
|
aMatch[0] = PE.getExportFunctionName(n);
|
|
break;
|
|
}
|
|
}
|
|
|
|
return aMatch;
|
|
}
|
|
|
|
|
|
/**
|
|
* Locate the first section matching a pattern.
|
|
* @returns {?Array} <code>null</code> if not found, otherwise:
|
|
* <br><code>[-1]</code> is the number of the section;
|
|
* <br><code>[0]</code> is the name of the section;
|
|
* <br><code>[1]</code> onwards are the captured subpatterns.
|
|
*/
|
|
PE.isSectionNamePresentExp = function (sSectionPattern) {
|
|
var aMatch = null;
|
|
for (var n = 0; n < PE.getNumberOfSections(); n++) {
|
|
aMatch = PE.getSectionName(n).match(sSectionPattern);
|
|
if (aMatch) {
|
|
aMatch[-1] = n;
|
|
aMatch[0] = PE.getSectionName(n);
|
|
break;
|
|
}
|
|
}
|
|
|
|
return aMatch;
|
|
}
|
|
|
|
|
|
/**
|
|
* Locate the first resource matching a pattern.
|
|
* @returns {?Array} <code>null</code> if not found, otherwise:
|
|
* <br><code>[-1]</code> is the number of the resource;
|
|
* <br><code>[0]</code> is the name of the resource;
|
|
* <br><code>[1]</code> onwards are the captured subpatterns.
|
|
*/
|
|
PE.isResourceNamePresentExp = function (sResourcePattern) {
|
|
var aMatch = null;
|
|
for (var n = 0; n < PE.getNumberOfResources(); n++) {
|
|
aMatch = PE.getResourceNameByNumber(n).match(sResourcePattern);
|
|
if (aMatch) {
|
|
aMatch[-1] = n;
|
|
aMatch[0] = PE.getResourceNameByNumber(n);
|
|
break;
|
|
}
|
|
}
|
|
|
|
return aMatch;
|
|
}
|
|
|
|
|
|
/**
|
|
* The number of the last section.
|
|
*/
|
|
PE.nLastSection = PE.getNumberOfSections() - 1;
|
|
|
|
function Section(number, name, virtsize, rva, filesize, offset, characteristics) {
|
|
this.Number = number;
|
|
this.Name = name;
|
|
this.VirtualSize = virtsize;
|
|
this.VirtualAddress = rva;
|
|
this.FileSize = filesize;
|
|
this.FileOffset = offset;
|
|
this.Characteristics = characteristics;
|
|
|
|
this.Size = this.FileSize;
|
|
this.Offset = this.FileOffset;
|
|
}
|
|
|
|
/**
|
|
* An array of sections, indexed by number and name (if not numeric). Members are the same as the functions.
|
|
* @example
|
|
* var rsrcSection = PE.section[".rsrc"].FileOffset;
|
|
*/
|
|
PE.section = [];
|
|
for (var i = 0; i <= PE.nLastSection; i++) {
|
|
PE.section[i] = new Section(i,
|
|
PE.getSectionName(i),
|
|
PE.getSectionVirtualSize(i),
|
|
PE.getSectionVirtualAddress(i),
|
|
PE.getSectionFileSize(i),
|
|
PE.getSectionFileOffset(i),
|
|
PE.getSectionCharacteristics(i));
|
|
if (PE.section[i].Name) {
|
|
var name = PE.section[i].Name;
|
|
// Don't do numeric names, as they are always treated as an index.
|
|
if (+name.toString() != name) { // parseInt crashes the application if Delphi project uses diedll :(
|
|
PE.section[name] = PE.section[i];
|
|
}
|
|
}
|
|
}
|
|
|
|
// Create dummy sections for the few files that need them.
|
|
PE.section[-1] = new Section(-1, "\0", 0, 0, 0, PE.getSize(), 0);
|
|
if (PE.nLastSection == -1) {
|
|
PE.section[0] = PE.section[-1];
|
|
}
|
|
|
|
|
|
// Create an array of resources.
|
|
|
|
function Resource(number, id, name, offset, size, type) {
|
|
this.Number = number;
|
|
this.Id = id;
|
|
this.FileName = name;
|
|
this.FileOffset = offset;
|
|
this.FileSize = size;
|
|
this.Type = type;
|
|
|
|
this.Name = this.FileName;
|
|
this.Size = this.FileSize;
|
|
this.Offset = this.FileOffset;
|
|
}
|
|
|
|
/**
|
|
* An array of resources, indexed by number and name (if not numeric). Members are the same as the functions.
|
|
* @example
|
|
* var packageInfoResource = PE.resource["PACKAGEINFO"].Offset;
|
|
*/
|
|
PE.resource = [];
|
|
for (var i = 0; i < PE.getNumberOfResources(); i++) {
|
|
PE.resource[i] = new Resource(i,
|
|
PE.getResourceIdByNumber(i),
|
|
PE.getResourceNameByNumber(i),
|
|
PE.getResourceOffsetByNumber(i),
|
|
PE.getResourceSizeByNumber(i),
|
|
PE.getResourceTypeByNumber(i));
|
|
if (PE.resource[i].Name) {
|
|
var name = PE.resource[i].Name;
|
|
// Don't do numeric names, as they are always treated as an index.
|
|
if ((+name).toString() != name) { // parseInt crashes the application if Delphi project uses diedll :(
|
|
PE.resource[name] = PE.resource[i];
|
|
}
|
|
}
|
|
} |