mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
33711a0407
Added a standard header comment to all db framework and detection rule files, indicating they are part of the Detect It Easy (DiE-JS) framework and warning against unauthorized changes. This improves consistency and clarifies file purpose for maintainers.
48 lines
No EOL
1.8 KiB
Text
48 lines
No EOL
1.8 KiB
Text
// Detect It Easy: DiE-JS framework file
|
|
// Don't change anything unless you're sure about what you're doing
|
|
|
|
// Detect a Cab archive.
|
|
// Author: Jason Hood <jadoxa@yahoo.com.au>
|
|
|
|
includeScript("archive-file");
|
|
sName = "Microsoft Cabinet File";
|
|
|
|
function detect_Cab(nOffset, nSize) {
|
|
if (nSize > 48) {
|
|
if (File.compare("'MSCF'00000000", nOffset)) {
|
|
bDetected = true;
|
|
sVersion = File.readByte(nOffset + 0x19) + ".0" + File.readByte(nOffset + 0x18);
|
|
var nFilesOffset = nOffset + File.readDword(nOffset + 0x10);
|
|
var nFiles = File.readWord(nOffset + 0x1C);
|
|
var nPacked = File.readDword(nOffset + 8);
|
|
if (File.readByte(nOffset + 0x1E) & 4) {
|
|
nOffset += File.readDword(nOffset + 0x24) + 4;
|
|
}
|
|
switch (File.readByte(nOffset + 0x2A) & 15) {
|
|
case 1:
|
|
sOptions = sOptions.append("MSZip");
|
|
break;
|
|
case 2:
|
|
sOptions = sOptions.append("Quantum");
|
|
break;
|
|
case 3:
|
|
sOptions = sOptions.append("LZX");
|
|
break;
|
|
}
|
|
// Packed size is not stored directly, so assume the first
|
|
// folder's data is first and just skip the names.
|
|
nPacked -= File.readDword(nOffset + 0x24);
|
|
while (nFiles--) {
|
|
Archive.add(File.readDword(nFilesOffset), nPacked,
|
|
File.readByte(nFilesOffset + 14) & 16);
|
|
nFilesOffset = File.findByte(nFilesOffset + 16, 256, 0) + 1;
|
|
nPacked = 0;
|
|
}
|
|
sOptions = sOptions.append(Archive.contents());
|
|
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
} |