feat(handler): support NSIS Installers #1255
Conversation
Searches for "Nullsoft" in the manifest to avoid false positives. Possibly too strict. Fixes onekey-sec#1249
qkaiser
added
enhancement
| if not self.is_nsis(binary): | ||
| return None |
There was a problem hiding this comment.
This check should be moved to a custom extractor, say PEExtractor so that if there is a PE file chunk in a file it will be carved out.
In the PEExtractor you can check if it's NSIS and do this if it is:
Command("7z", "x", "-y", "{inpath}", "-o{outdir}").extract(inpath, outdir)If it's not NSIS, do nothing. Unless you can think of anything to do with "normal" PE ?
| """ | ||
| Test if binary appears to be a Nullsoft Installer self-extracting archive | ||
|
|
||
| TODO: this series of tests is possibly too strict |
There was a problem hiding this comment.
I leave that call to you. I don't know much about NullSoft.
| if not binary.has_resources: | ||
| return False | ||
|
|
||
| if not binary.resources_manager.has_manifest: | ||
| return False | ||
|
|
||
| return "Nullsoft" in binary.resources_manager.manifest |
There was a problem hiding this comment.
Can be simplified to:
| if not binary.has_resources: | |
| return False | |
| if not binary.resources_manager.has_manifest: | |
| return False | |
| return "Nullsoft" in binary.resources_manager.manifest | |
| return binary.has_resources and binary.resources_manager.has_manifest and "Nullsoft" in binary.resources_manager.manifest |
| // MZ header | ||
| 4d 5a |
There was a problem hiding this comment.
Should we check for the "PE" signature (50 45 00 00) too ?
|
@jcrussell you should also create integration tests to check that the handler works as expected. You have to create the following directories:
I would put the following in the input directory:
To generate the output directory content, run the following: find unblob/tests/integration/executable/pe/__input__ -type f -exec unblob -f -k -e unblob/tests/integration/executable/pe/__output__ {} \; |
Searches for "Nullsoft" in the manifest to avoid false positives. Possibly too strict.
Fixes #1249