├── README.md ├── staticscan.cmake ├── staticscan.pri ├── LICENSE ├── signatures.cpp ├── modules ├── nfd_ipa.cpp ├── nfd_npm.cpp ├── nfd_png.cpp ├── nfd_dos4g.cpp ├── nfd_image.cpp ├── nfd_dos16m.cpp ├── nfd_archive.cpp ├── nfd_machofat.cpp ├── nfd_png.h ├── nfd_ipa.h ├── nfd_npm.h ├── nfd_image.h ├── nfd_dos4g.h ├── nfd_dos16m.h ├── nfd_archive.h ├── nfd_text.h ├── nfd_machofat.h ├── nfd_jpeg.h ├── nfd_cfbf.h ├── nfd_pdf.h ├── nfd_amiga.h ├── nfd_atarist.h ├── nfd_jar.h ├── nfd_javaclass.h ├── nfd_ne.h ├── nfd_rar.h ├── nfd_le.h ├── nfd_lx.h ├── nfd_javaclass.cpp ├── nfd_text.cpp ├── nfd_jpeg.cpp ├── nfd_com.h ├── nfd_mach.h ├── nfd_amiga.cpp ├── nfd_atarist.cpp ├── nfd_apk.h ├── nfd_dex.h ├── nfd_zip.h ├── nfd_rar.cpp ├── nfd_cfbf.cpp ├── nfd_elf.h ├── nfd_pdf.cpp ├── nfd_msdos.h ├── nfd_ne.cpp ├── nfd_le.cpp ├── nfd_zip.cpp ├── nfd_lx.cpp ├── nfd_jar.cpp ├── nfd_com.cpp ├── nfd_pe.h └── nfd_binary.h ├── specabstract.h ├── specabstract.pri ├── specabstract.cmake ├── staticscan.h ├── specabstract.cpp └── staticscan.cpp /README.md: -------------------------------------------------------------------------------- 1 | # SpecAbstract 2 | 3 | Signatures for Nauz File Detector. 4 | -------------------------------------------------------------------------------- /staticscan.cmake: -------------------------------------------------------------------------------- 1 | include_directories(${CMAKE_CURRENT_LIST_DIR}) 2 | 3 | include(${CMAKE_CURRENT_LIST_DIR}/../SpecAbstract/specabstract.cmake) 4 | 5 | set(STATICSCAN_SOURCES 6 | ${SPECABSTRACT_SOURCES} 7 | ${CMAKE_CURRENT_LIST_DIR}/staticscan.cpp 8 | ${CMAKE_CURRENT_LIST_DIR}/staticscan.h 9 | ) 10 | -------------------------------------------------------------------------------- /staticscan.pri: -------------------------------------------------------------------------------- 1 | INCLUDEPATH += $$PWD 2 | DEPENDPATH += $$PWD 3 | 4 | HEADERS += \ 5 | $$PWD/staticscan.h 6 | 7 | SOURCES += \ 8 | $$PWD/staticscan.cpp 9 | 10 | !contains(XCONFIG, specabstract) { 11 | XCONFIG += specabstract 12 | include($$PWD/../SpecAbstract/specabstract.pri) 13 | } 14 | 15 | DISTFILES += \ 16 | $$PWD/LICENSE \ 17 | $$PWD/README.md \ 18 | $$PWD/staticscan.cmake 19 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2017-2025 hors 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /signatures.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "specabstract.h" 22 | 23 | -------------------------------------------------------------------------------- /modules/nfd_ipa.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_ipa.h" 22 | 23 | NFD_IPA::NFD_IPA(XIPA *pIPA, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : IPA_Script(pIPA, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | -------------------------------------------------------------------------------- /modules/nfd_npm.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_npm.h" 22 | 23 | NFD_NPM::NFD_NPM(XNPM *pNpm, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : NPM_Script(pNpm, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | -------------------------------------------------------------------------------- /modules/nfd_png.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_png.h" 22 | 23 | NFD_PNG::NFD_PNG(XPNG *pPNG, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : PNG_Script(pPNG, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | -------------------------------------------------------------------------------- /modules/nfd_dos4g.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_dos4g.h" 22 | 23 | NFD_DOS4G::NFD_DOS4G(XDOS16 *pXdos16, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : DOS4G_Script(pXdos16, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | -------------------------------------------------------------------------------- /modules/nfd_image.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_image.h" 22 | 23 | NFD_IMAGE::NFD_IMAGE(XBinary *pImage, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : Image_Script(pImage, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | -------------------------------------------------------------------------------- /modules/nfd_dos16m.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_dos16m.h" 22 | 23 | NFD_DOS16M::NFD_DOS16M(XDOS16 *pXdos16, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 24 | : DOS16M_Script(pXdos16, filePart, pOptions, pPdStruct) 25 | { 26 | } 27 | -------------------------------------------------------------------------------- /modules/nfd_archive.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_archive.h" 22 | 23 | NFD_Archive::NFD_Archive(XArchive *pArchive, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 24 | : Archive_Script(pArchive, filePart, pOptions, pPdStruct) 25 | { 26 | } 27 | -------------------------------------------------------------------------------- /modules/nfd_machofat.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_machofat.h" 22 | 23 | NFD_MACHOFAT::NFD_MACHOFAT(XMACHOFat *pMachofat, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 24 | : MACHOFAT_Script(pMachofat, filePart, pOptions, pPdStruct) 25 | { 26 | } 27 | -------------------------------------------------------------------------------- /modules/nfd_png.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_PNG_H 22 | #define NFD_PNG_H 23 | 24 | #include "png_script.h" 25 | 26 | class NFD_PNG : public PNG_Script { 27 | Q_OBJECT 28 | public: 29 | explicit NFD_PNG(XPNG *pPNG, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 30 | }; 31 | 32 | #endif // NFD_PNG_H 33 | -------------------------------------------------------------------------------- /modules/nfd_ipa.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_IPA_H 22 | #define NFD_IPA_H 23 | 24 | #include "ipa_script.h" 25 | 26 | class NFD_IPA : public IPA_Script { 27 | Q_OBJECT 28 | 29 | public: 30 | explicit NFD_IPA(XIPA *pIPA, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 31 | }; 32 | 33 | #endif // NFD_IPA_H 34 | -------------------------------------------------------------------------------- /modules/nfd_npm.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_NPM_H 22 | #define NFD_NPM_H 23 | 24 | #include "npm_script.h" 25 | 26 | class NFD_NPM : public NPM_Script { 27 | Q_OBJECT 28 | 29 | public: 30 | explicit NFD_NPM(XNPM *pNpm, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 31 | }; 32 | 33 | #endif // NFD_NPM_H 34 | -------------------------------------------------------------------------------- /modules/nfd_image.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_IMAGE_H 22 | #define NFD_IMAGE_H 23 | 24 | #include "image_script.h" 25 | 26 | class NFD_IMAGE : public Image_Script { 27 | Q_OBJECT 28 | public: 29 | explicit NFD_IMAGE(XBinary *pImage, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 30 | }; 31 | 32 | #endif // NFD_IMAGE_H 33 | -------------------------------------------------------------------------------- /modules/nfd_dos4g.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_DOS4G_H 22 | #define NFD_DOS4G_H 23 | 24 | #include "dos4g_script.h" 25 | 26 | class NFD_DOS4G : public DOS4G_Script { 27 | Q_OBJECT 28 | 29 | public: 30 | explicit NFD_DOS4G(XDOS16 *pXdos16, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 31 | }; 32 | 33 | #endif // NFD_DOS4G_H 34 | -------------------------------------------------------------------------------- /modules/nfd_dos16m.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_DOS16M_H 22 | #define NFD_DOS16M_H 23 | 24 | #include "dos16m_script.h" 25 | 26 | class NFD_DOS16M : public DOS16M_Script { 27 | Q_OBJECT 28 | 29 | public: 30 | explicit NFD_DOS16M(XDOS16 *pXdos16, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 31 | }; 32 | 33 | #endif // NFD_DOS16M_H 34 | -------------------------------------------------------------------------------- /modules/nfd_archive.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_ARCHIVE_H 22 | #define NFD_ARCHIVE_H 23 | 24 | #include "archive_script.h" 25 | 26 | class NFD_Archive : public Archive_Script { 27 | Q_OBJECT 28 | 29 | public: 30 | explicit NFD_Archive(XArchive *pArchive, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 31 | }; 32 | 33 | #endif // NFD_ARCHIVE_H 34 | -------------------------------------------------------------------------------- /modules/nfd_text.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_TEXT_H 22 | #define NFD_TEXT_H 23 | 24 | #include "nfd_binary.h" 25 | 26 | class NFD_TEXT { 27 | public: 28 | // STRING_RECORD based tables (migrated from SpecAbstract/signatures.cpp) 29 | static NFD_Binary::STRING_RECORD *getTextExpRecords(); 30 | static qint32 getTextExpRecordsSize(); 31 | }; 32 | 33 | #endif // NFD_TEXT_H 34 | -------------------------------------------------------------------------------- /modules/nfd_machofat.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_MACHOFAT_H 22 | #define NFD_MACHOFAT_H 23 | 24 | #include "machofat_script.h" 25 | #include "nfd_binary.h" 26 | #include "xarchive.h" 27 | 28 | class NFD_MACHOFAT : public MACHOFAT_Script { 29 | Q_OBJECT 30 | 31 | public: 32 | explicit NFD_MACHOFAT(XMACHOFat *pMachofat, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 33 | 34 | struct MACHOFATINFO_STRUCT { 35 | NFD_Binary::BASIC_INFO basic_info; 36 | QList listArchiveRecords; 37 | }; 38 | }; 39 | 40 | #endif // NFD_MACHOFAT_H 41 | -------------------------------------------------------------------------------- /modules/nfd_jpeg.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_JPEG_H 22 | #define NFD_JPEG_H 23 | 24 | #include "jpeg_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_JPEG : public Jpeg_Script { 30 | Q_OBJECT 31 | public: 32 | explicit NFD_JPEG(XJpeg *pJpeg, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 33 | 34 | struct JPEGINFO_STRUCT { 35 | NFD_Binary::BASIC_INFO basic_info; 36 | }; 37 | 38 | static JPEGINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 39 | }; 40 | 41 | #endif // NFD_JPEG_H 42 | -------------------------------------------------------------------------------- /modules/nfd_cfbf.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_CFBF_H 22 | #define NFD_CFBF_H 23 | 24 | #include "cfbf_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_CFBF : public CFBF_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | explicit NFD_CFBF(XCFBF *pCFBF, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 34 | 35 | struct CFBFINFO_STRUCT { 36 | NFD_Binary::BASIC_INFO basic_info; 37 | }; 38 | 39 | static CFBFINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 40 | }; 41 | 42 | #endif // NFD_CFBF_H 43 | -------------------------------------------------------------------------------- /modules/nfd_pdf.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_PDF_H 22 | #define NFD_PDF_H 23 | 24 | #include "pdf_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_PDF : public PDF_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | explicit NFD_PDF(XPDF *pPDF, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 34 | 35 | struct PDFINFO_STRUCT { 36 | NFD_Binary::BASIC_INFO basic_info; 37 | QList listObjects; 38 | }; 39 | 40 | static PDFINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 41 | }; 42 | 43 | #endif // NFD_PDF_H 44 | -------------------------------------------------------------------------------- /modules/nfd_amiga.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_AMIGA_H 22 | #define NFD_AMIGA_H 23 | 24 | #include "amiga_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_Amiga : public Amiga_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | explicit NFD_Amiga(XAmigaHunk *pAmiga, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 34 | 35 | struct AMIGAHUNKINFO_STRUCT { 36 | NFD_Binary::BASIC_INFO basic_info; 37 | }; 38 | 39 | static AMIGAHUNKINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 40 | XBinary::PDSTRUCT *pPdStruct); 41 | }; 42 | 43 | #endif // NFD_AMIGA_H 44 | -------------------------------------------------------------------------------- /modules/nfd_atarist.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_ATARIST_H 22 | #define NFD_ATARIST_H 23 | 24 | #include "atarist_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_AtariST : public AtariST_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | explicit NFD_AtariST(XAtariST *pAtariST, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 34 | 35 | struct ATARISTINFO_STRUCT { 36 | NFD_Binary::BASIC_INFO basic_info; 37 | }; 38 | 39 | static ATARISTINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 40 | XBinary::PDSTRUCT *pPdStruct); 41 | }; 42 | 43 | #endif // NFD_ATARIST_H 44 | -------------------------------------------------------------------------------- /modules/nfd_jar.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_JAR_H 22 | #define NFD_JAR_H 23 | 24 | #include "jar_script.h" 25 | #include "nfd_binary.h" 26 | #include "xarchive.h" 27 | 28 | class QIODevice; 29 | 30 | class NFD_JAR : public JAR_Script { 31 | Q_OBJECT 32 | 33 | public: 34 | explicit NFD_JAR(XZip *pZip, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 35 | 36 | struct JARINFO_STRUCT { 37 | NFD_Binary::BASIC_INFO basic_info; 38 | 39 | QList listArchiveRecords; 40 | 41 | bool bIsJava; 42 | bool bIsKotlin; 43 | }; 44 | 45 | static JARINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 46 | }; 47 | 48 | #endif // NFD_JAR_H 49 | -------------------------------------------------------------------------------- /modules/nfd_javaclass.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_JAVACLASS_H 22 | #define NFD_JAVACLASS_H 23 | 24 | #include "javaclass_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_JavaClass : public JavaClass_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | explicit NFD_JavaClass(XJavaClass *pJavaClass, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 34 | 35 | struct JAVACLASSINFO_STRUCT { 36 | NFD_Binary::BASIC_INFO basic_info; 37 | // Reserved for future JavaClass-specific fields 38 | }; 39 | 40 | static JAVACLASSINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 41 | XBinary::PDSTRUCT *pPdStruct); 42 | }; 43 | 44 | #endif // NFD_JAVACLASS_H 45 | -------------------------------------------------------------------------------- /modules/nfd_ne.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_NE_H 22 | #define NFD_NE_H 23 | 24 | #include "ne_script.h" 25 | #include "nfd_binary.h" 26 | #include "nfd_msdos.h" 27 | 28 | class QIODevice; 29 | 30 | class NFD_NE : public NE_Script { 31 | Q_OBJECT 32 | 33 | public: 34 | explicit NFD_NE(XNE *pNE, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 35 | 36 | struct NEINFO_STRUCT { 37 | NFD_Binary::BASIC_INFO basic_info; 38 | qint64 nEntryPointOffset; 39 | QString sEntryPointSignature; 40 | QString sOverlaySignature; 41 | qint64 nOverlayOffset; 42 | qint64 nOverlaySize; 43 | }; 44 | 45 | static NEINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 46 | }; 47 | 48 | #endif // NFD_NE_H 49 | -------------------------------------------------------------------------------- /modules/nfd_rar.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_RAR_H 22 | #define NFD_RAR_H 23 | 24 | #include "rar_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_RAR : public RAR_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | explicit NFD_RAR(XRar *pRar, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 34 | 35 | struct RARINFO_STRUCT { 36 | NFD_Binary::BASIC_INFO basic_info; 37 | QList listArchiveRecords; 38 | }; 39 | 40 | static RARINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 41 | static void handle_formats(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, RARINFO_STRUCT *pRARInfo, XBinary::PDSTRUCT *pPdStruct); 42 | }; 43 | 44 | #endif // NFD_RAR_H 45 | -------------------------------------------------------------------------------- /modules/nfd_le.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_LE_H 22 | #define NFD_LE_H 23 | 24 | #include "le_script.h" 25 | #include "nfd_binary.h" 26 | #include "nfd_msdos.h" 27 | 28 | class QIODevice; 29 | 30 | class NFD_LE : public LE_Script { 31 | Q_OBJECT 32 | 33 | public: 34 | explicit NFD_LE(XLE *pLE, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 35 | 36 | struct LEINFO_STRUCT { 37 | NFD_Binary::BASIC_INFO basic_info; 38 | qint64 nEntryPointOffset; 39 | QString sEntryPointSignature; 40 | QString sOverlaySignature; 41 | qint64 nOverlayOffset; 42 | qint64 nOverlaySize; 43 | QList listRichSignatures; 44 | }; 45 | 46 | static LEINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 47 | }; 48 | 49 | #endif // NFD_LE_H 50 | -------------------------------------------------------------------------------- /modules/nfd_lx.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_LX_H 22 | #define NFD_LX_H 23 | 24 | #include "lx_script.h" 25 | #include "nfd_binary.h" 26 | #include "nfd_msdos.h" 27 | 28 | class QIODevice; 29 | 30 | class NFD_LX : public LX_Script { 31 | Q_OBJECT 32 | 33 | public: 34 | explicit NFD_LX(XLE *pLX, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 35 | 36 | struct LXINFO_STRUCT { 37 | NFD_Binary::BASIC_INFO basic_info; 38 | qint64 nEntryPointOffset; 39 | QString sEntryPointSignature; 40 | QString sOverlaySignature; 41 | qint64 nOverlayOffset; 42 | qint64 nOverlaySize; 43 | QList listRichSignatures; 44 | }; 45 | 46 | static LXINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 47 | }; 48 | 49 | #endif // NFD_LX_H 50 | -------------------------------------------------------------------------------- /modules/nfd_javaclass.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_javaclass.h" 22 | 23 | NFD_JavaClass::NFD_JavaClass(XJavaClass *pJavaClass, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 24 | : JavaClass_Script(pJavaClass, filePart, pOptions, pPdStruct) 25 | { 26 | } 27 | 28 | NFD_JavaClass::JAVACLASSINFO_STRUCT NFD_JavaClass::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 29 | XBinary::PDSTRUCT *pPdStruct) 30 | { 31 | QElapsedTimer timer; 32 | timer.start(); 33 | 34 | JAVACLASSINFO_STRUCT result = {}; 35 | 36 | XJavaClass javaClass(pDevice); 37 | 38 | if (javaClass.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 39 | result.basic_info = NFD_Binary::_initBasicInfo(&javaClass, parentId, pOptions, nOffset, pPdStruct); 40 | 41 | // TODO: Add JavaClass-specific analysis here using scripts when needed 42 | 43 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 44 | } 45 | 46 | result.basic_info.nElapsedTime = timer.elapsed(); 47 | 48 | return result; 49 | } 50 | -------------------------------------------------------------------------------- /modules/nfd_text.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_text.h" 22 | 23 | // Text header regex-based detections (migrated from SpecAbstract/signatures.cpp) 24 | static NFD_Binary::STRING_RECORD g_TEXT_Exp_records[] = { 25 | {{0, XBinary::FT_TEXT, XScanEngine::RECORD_TYPE_SOURCECODE, XScanEngine::RECORD_NAME_CCPP, "", ""}, "#include [\"<].*?[>\"]"}, 26 | {{0, XBinary::FT_TEXT, XScanEngine::RECORD_TYPE_SOURCECODE, XScanEngine::RECORD_NAME_CCPP, "", "header"}, "#ifndef (\\w+).*\\s+#define \\1"}, 27 | {{0, XBinary::FT_TEXT, XScanEngine::RECORD_TYPE_SOURCECODE, XScanEngine::RECORD_NAME_HTML, "", ""}, "^<(!DOCTYPE )?[Hh][Tt][Mm][Ll]"}, 28 | {{0, XBinary::FT_TEXT, XScanEngine::RECORD_TYPE_SOURCECODE, XScanEngine::RECORD_NAME_PHP, "", ""}, "^<\\?php"}, 29 | {{0, XBinary::FT_TEXT, XScanEngine::RECORD_TYPE_SOURCECODE, XScanEngine::RECORD_NAME_PYTHON, "", ""}, "import"}, 30 | {{0, XBinary::FT_TEXT, XScanEngine::RECORD_TYPE_SOURCECODE, XScanEngine::RECORD_NAME_XML, "", ""}, "^<\\?xml"}, 31 | {{0, XBinary::FT_TEXT, XScanEngine::RECORD_TYPE_SOURCECODE, XScanEngine::RECORD_NAME_SHELL, "", ""}, "#!"}, 32 | }; 33 | 34 | NFD_Binary::STRING_RECORD *NFD_TEXT::getTextExpRecords() 35 | { 36 | return g_TEXT_Exp_records; 37 | } 38 | 39 | qint32 NFD_TEXT::getTextExpRecordsSize() 40 | { 41 | return sizeof(g_TEXT_Exp_records); 42 | } 43 | -------------------------------------------------------------------------------- /modules/nfd_jpeg.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_jpeg.h" 22 | 23 | NFD_JPEG::NFD_JPEG(XJpeg *pJpeg, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : Jpeg_Script(pJpeg, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | NFD_JPEG::JPEGINFO_STRUCT NFD_JPEG::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 28 | XBinary::PDSTRUCT *pPdStruct) 29 | { 30 | QElapsedTimer timer; 31 | timer.start(); 32 | 33 | JPEGINFO_STRUCT result = {}; 34 | 35 | XJpeg jpeg(pDevice); 36 | 37 | if (jpeg.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 38 | // Initialize BASIC_INFO via shared utility 39 | result.basic_info = NFD_Binary::_initBasicInfo(&jpeg, parentId, pOptions, nOffset, pPdStruct); 40 | 41 | // Formats: reuse generic format detection mapping 42 | NFD_Binary::SCANS_STRUCT ssFormat = NFD_Binary::getFormatScansStruct(jpeg.getFileFormatInfo(pPdStruct)); 43 | result.basic_info.mapResultFormats.insert(ssFormat.name, NFD_Binary::scansToScan(&(result.basic_info), &ssFormat)); 44 | 45 | // Aggregate and finalize result lists 46 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 47 | } 48 | 49 | result.basic_info.nElapsedTime = timer.elapsed(); 50 | 51 | return result; 52 | } 53 | -------------------------------------------------------------------------------- /modules/nfd_com.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_COM_H 22 | #define NFD_COM_H 23 | 24 | #include "com_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_COM : public COM_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | explicit NFD_COM(XCOM *pCOM, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 34 | 35 | struct COMINFO_STRUCT { 36 | NFD_Binary::BASIC_INFO basic_info; 37 | qint64 nEntryPointOffset; 38 | QString sEntryPointSignature; 39 | QString sOverlaySignature; 40 | qint64 nOverlayOffset; 41 | qint64 nOverlaySize; 42 | }; 43 | 44 | static COMINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 45 | 46 | // Handlers migrated from SpecAbstract 47 | static void handle_OperationSystem(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, COMINFO_STRUCT *pCOMInfo, XBinary::PDSTRUCT *pPdStruct); 48 | static void handle_Protection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, COMINFO_STRUCT *pCOMInfo, XBinary::PDSTRUCT *pPdStruct); 49 | 50 | static NFD_Binary::SIGNATURE_RECORD *getHeaderRecords(); 51 | static qint32 getHeaderRecordsSize(); // size in bytes 52 | static NFD_Binary::SIGNATURE_RECORD *getHeaderExpRecords(); 53 | static qint32 getHeaderExpRecordsSize(); // size in bytes 54 | }; 55 | 56 | #endif // NFD_COM_H 57 | -------------------------------------------------------------------------------- /specabstract.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef SPECABSTRACT_H 22 | #define SPECABSTRACT_H 23 | 24 | #ifndef USE_ARCHIVE 25 | #define USE_ARCHIVE 26 | #endif 27 | #ifndef USE_DEX 28 | #define USE_DEX 29 | #endif 30 | #ifndef USE_PDF 31 | #define USE_PDF 32 | #endif 33 | 34 | #include "xscanengine.h" 35 | #include "modules/nfd_binary.h" 36 | #include "modules/nfd_amiga.h" 37 | #include "modules/nfd_jpeg.h" 38 | #include "modules/nfd_cfbf.h" 39 | #include "modules/nfd_pdf.h" 40 | #include "modules/nfd_elf.h" 41 | #include "modules/nfd_com.h" 42 | #include "modules/nfd_msdos.h" 43 | // Newly delegated NFD modules 44 | #include "modules/nfd_javaclass.h" 45 | #include "modules/nfd_rar.h" 46 | #include "modules/nfd_le.h" 47 | #include "modules/nfd_lx.h" 48 | #include "modules/nfd_ne.h" 49 | #include "modules/nfd_dex.h" 50 | #include "modules/nfd_zip.h" 51 | #include "modules/nfd_jar.h" 52 | #include "modules/nfd_apk.h" 53 | #include "modules/nfd_machofat.h" 54 | #include "modules/nfd_mach.h" 55 | #include "modules/nfd_pe.h" 56 | 57 | class SpecAbstract : public XScanEngine { 58 | Q_OBJECT 59 | 60 | public: 61 | explicit SpecAbstract(QObject *pParent = nullptr); 62 | 63 | protected: 64 | virtual void _processDetect(XScanEngine::SCANID *pScanID, XScanEngine::SCAN_RESULT *pScanResult, QIODevice *pDevice, const XScanEngine::SCANID &parentId, 65 | XBinary::FT fileType, XScanEngine::SCAN_OPTIONS *pScanOptions, bool bAddUnknown, XBinary::PDSTRUCT *pPdStruct); 66 | }; 67 | 68 | #endif // SPECABSTRACT_H 69 | -------------------------------------------------------------------------------- /modules/nfd_mach.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_MACH_H 22 | #define NFD_MACH_H 23 | 24 | #include "xscanengine.h" 25 | #include "nfd_binary.h" 26 | #include "xmach.h" 27 | 28 | class NFD_MACH : public MACH_Script { 29 | Q_OBJECT 30 | 31 | public: 32 | explicit NFD_MACH(XMACH *pMACH, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 33 | 34 | struct MACHOINFO_STRUCT { 35 | NFD_Binary::BASIC_INFO basic_info; 36 | QString sEntryPointSignature; 37 | bool bIs64; 38 | bool bIsBigEndian; 39 | QList listCommandRecords; 40 | QList listLibraryRecords; 41 | QList listSegmentRecords; 42 | QList listSectionRecords; 43 | }; 44 | 45 | static MACHOINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 46 | 47 | // Handlers migrated from SpecAbstract 48 | static void handle_Tools(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MACHOINFO_STRUCT *pMACHInfo, XBinary::PDSTRUCT *pPdStruct); 49 | static void handle_Protection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MACHOINFO_STRUCT *pMACHInfo, XBinary::PDSTRUCT *pPdStruct); 50 | static void handle_FixDetects(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MACHOINFO_STRUCT *pMACHInfo, XBinary::PDSTRUCT *pPdStruct); 51 | }; 52 | 53 | #endif // NFD_MACH_H 54 | -------------------------------------------------------------------------------- /modules/nfd_amiga.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_amiga.h" 22 | 23 | NFD_Amiga::NFD_Amiga(XAmigaHunk *pAmiga, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 24 | : Amiga_Script(pAmiga, filePart, pOptions, pPdStruct) 25 | { 26 | } 27 | 28 | NFD_Amiga::AMIGAHUNKINFO_STRUCT NFD_Amiga::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 29 | XBinary::PDSTRUCT *pPdStruct) 30 | { 31 | QElapsedTimer timer; 32 | timer.start(); 33 | 34 | AMIGAHUNKINFO_STRUCT result = {}; 35 | 36 | XAmigaHunk amigaHunk(pDevice); 37 | 38 | if (amigaHunk.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 39 | // Initialize BASIC_INFO via shared utility 40 | result.basic_info = NFD_Binary::_initBasicInfo(&amigaHunk, parentId, pOptions, nOffset, pPdStruct); 41 | 42 | // Delegate OS detection to NFD 43 | Binary_Script::OPTIONS opts = NFD_Binary::toOptions(pOptions); 44 | 45 | NFD_Binary::SCANS_STRUCT ssOperationSystem = NFD_Binary::detectOperationSystem(&amigaHunk, pPdStruct); 46 | // Convert and store via shared utility 47 | result.basic_info.mapResultOperationSystems.insert(ssOperationSystem.name, NFD_Binary::scansToScan(&(result.basic_info), &ssOperationSystem)); 48 | 49 | // Aggregate and finalize result lists 50 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 51 | } 52 | 53 | result.basic_info.nElapsedTime = timer.elapsed(); 54 | 55 | return result; 56 | } 57 | -------------------------------------------------------------------------------- /modules/nfd_atarist.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_atarist.h" 22 | 23 | NFD_AtariST::NFD_AtariST(XAtariST *pAtariST, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 24 | : AtariST_Script(pAtariST, filePart, pOptions, pPdStruct) 25 | { 26 | } 27 | 28 | NFD_AtariST::ATARISTINFO_STRUCT NFD_AtariST::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 29 | XBinary::PDSTRUCT *pPdStruct) 30 | { 31 | QElapsedTimer timer; 32 | timer.start(); 33 | 34 | ATARISTINFO_STRUCT result = {}; 35 | 36 | XAtariST atariST(pDevice); 37 | 38 | if (atariST.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 39 | // Initialize BASIC_INFO via shared utility 40 | result.basic_info = NFD_Binary::_initBasicInfo(&atariST, parentId, pOptions, nOffset, pPdStruct); 41 | 42 | // Delegate OS detection to NFD 43 | Binary_Script::OPTIONS opts = NFD_Binary::toOptions(pOptions); 44 | 45 | NFD_Binary::SCANS_STRUCT ssOperationSystem = NFD_Binary::detectOperationSystem(&atariST, pPdStruct); 46 | // Convert and store via shared utility 47 | result.basic_info.mapResultOperationSystems.insert(ssOperationSystem.name, NFD_Binary::scansToScan(&(result.basic_info), &ssOperationSystem)); 48 | 49 | // Aggregate and finalize result lists 50 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 51 | } 52 | 53 | result.basic_info.nElapsedTime = timer.elapsed(); 54 | 55 | return result; 56 | } 57 | -------------------------------------------------------------------------------- /modules/nfd_apk.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_APK_H 22 | #define NFD_APK_H 23 | 24 | #include "nfd_binary.h" 25 | #include "apk_script.h" // Removed - not needed for static functions 26 | #include "xarchive.h" 27 | #include "nfd_dex.h" 28 | 29 | class NFD_APK : public APK_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | struct APKINFO_STRUCT { 34 | NFD_Binary::BASIC_INFO basic_info; 35 | 36 | QList listArchiveRecords; 37 | 38 | bool bIsJava; 39 | bool bIsKotlin; 40 | 41 | NFD_DEX::DEXINFO_STRUCT dexInfoClasses; 42 | }; 43 | 44 | // STRING_RECORD based tables (migrated from SpecAbstract/signatures.cpp) 45 | static NFD_Binary::STRING_RECORD *getFileRecords(); 46 | static qint32 getFileRecordsSize(); 47 | static NFD_Binary::STRING_RECORD *getFileExpRecords(); 48 | static qint32 getFileExpRecordsSize(); 49 | 50 | // Main APK analysis function 51 | static APKINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 52 | 53 | // APK handling functions 54 | static void APK_handle(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, APKINFO_STRUCT *pApkInfo, XBinary::PDSTRUCT *pPdStruct); 55 | static void APK_handle_FixDetects(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, APKINFO_STRUCT *pApkInfo, XBinary::PDSTRUCT *pPdStruct); 56 | static NFD_DEX::DEXINFO_STRUCT APK_scan_DEX(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, APKINFO_STRUCT *pApkInfo, XBinary::PDSTRUCT *pPdStruct, 57 | const QString &sFileName); 58 | }; 59 | #endif // NFD_APK_H 60 | -------------------------------------------------------------------------------- /modules/nfd_dex.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_DEX_H 22 | #define NFD_DEX_H 23 | 24 | #include "dex_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class NFD_DEX : public DEX_Script { 28 | Q_OBJECT 29 | 30 | public: 31 | explicit NFD_DEX(XDEX *pDex, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 32 | 33 | struct DEXINFO_STRUCT { 34 | NFD_Binary::BASIC_INFO basic_info; 35 | 36 | XDEX_DEF::HEADER header; 37 | QList mapItems; 38 | QList listStrings; 39 | QList listTypeItemStrings; 40 | QList listFieldIDs; 41 | QList listMethodIDs; 42 | bool bIsStringPoolSorted; 43 | bool bIsOverlayPresent; 44 | }; 45 | 46 | // Accessors for DEX string/type signature records (moved from SpecAbstract/signatures.cpp) 47 | static NFD_Binary::STRING_RECORD *getStringRecords(); 48 | static qint32 getStringRecordsSize(); 49 | static NFD_Binary::STRING_RECORD *getTypeRecords(); 50 | static qint32 getTypeRecordsSize(); 51 | 52 | // Main DEX analysis function 53 | static DEXINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 54 | 55 | // Handlers migrated from SpecAbstract 56 | static void handle_Tools(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, DEXINFO_STRUCT *pDEXInfo, XBinary::PDSTRUCT *pPdStruct); 57 | static void handle_Dexguard(QIODevice *pDevice, DEXINFO_STRUCT *pDEXInfo, XBinary::PDSTRUCT *pPdStruct); 58 | static void handle_Protection(QIODevice *pDevice, DEXINFO_STRUCT *pDEXInfo, XBinary::PDSTRUCT *pPdStruct); 59 | }; 60 | 61 | #endif // NFD_DEX_H 62 | -------------------------------------------------------------------------------- /specabstract.pri: -------------------------------------------------------------------------------- 1 | INCLUDEPATH += $$PWD 2 | DEPENDPATH += $$PWD 3 | INCLUDEPATH += $$PWD/modules 4 | DEPENDPATH += $$PWD/modules 5 | 6 | HEADERS += \ 7 | $$PWD/specabstract.h \ 8 | $$PWD/modules/nfd_binary.h \ 9 | $$PWD/modules/nfd_msdos.h \ 10 | $$PWD/modules/nfd_pe.h \ 11 | $$PWD/modules/nfd_elf.h \ 12 | $$PWD/modules/nfd_mach.h \ 13 | $$PWD/modules/nfd_zip.h \ 14 | $$PWD/modules/nfd_jar.h \ 15 | $$PWD/modules/nfd_archive.h \ 16 | $$PWD/modules/nfd_rar.h \ 17 | $$PWD/modules/nfd_npm.h \ 18 | $$PWD/modules/nfd_machofat.h \ 19 | $$PWD/modules/nfd_dex.h \ 20 | $$PWD/modules/nfd_cfbf.h \ 21 | $$PWD/modules/nfd_com.h \ 22 | $$PWD/modules/nfd_image.h \ 23 | $$PWD/modules/nfd_jpeg.h \ 24 | $$PWD/modules/nfd_png.h \ 25 | $$PWD/modules/nfd_ne.h \ 26 | $$PWD/modules/nfd_le.h \ 27 | $$PWD/modules/nfd_lx.h \ 28 | $$PWD/modules/nfd_amiga.h \ 29 | $$PWD/modules/nfd_atarist.h \ 30 | $$PWD/modules/nfd_dos16m.h \ 31 | $$PWD/modules/nfd_dos4g.h \ 32 | $$PWD/modules/nfd_apk.h \ 33 | $$PWD/modules/nfd_ipa.h \ 34 | $$PWD/modules/nfd_pdf.h \ 35 | $$PWD/modules/nfd_text.h \ 36 | $$PWD/modules/nfd_javaclass.h 37 | 38 | SOURCES += \ 39 | $$PWD/signatures.cpp \ 40 | $$PWD/specabstract.cpp \ 41 | $$PWD/modules/nfd_binary.cpp \ 42 | $$PWD/modules/nfd_msdos.cpp \ 43 | $$PWD/modules/nfd_pe.cpp \ 44 | $$PWD/modules/nfd_elf.cpp \ 45 | $$PWD/modules/nfd_mach.cpp \ 46 | $$PWD/modules/nfd_zip.cpp \ 47 | $$PWD/modules/nfd_jar.cpp \ 48 | $$PWD/modules/nfd_archive.cpp \ 49 | $$PWD/modules/nfd_rar.cpp \ 50 | $$PWD/modules/nfd_npm.cpp \ 51 | $$PWD/modules/nfd_machofat.cpp \ 52 | $$PWD/modules/nfd_dex.cpp \ 53 | $$PWD/modules/nfd_cfbf.cpp \ 54 | $$PWD/modules/nfd_com.cpp \ 55 | $$PWD/modules/nfd_image.cpp \ 56 | $$PWD/modules/nfd_jpeg.cpp \ 57 | $$PWD/modules/nfd_png.cpp \ 58 | $$PWD/modules/nfd_ne.cpp \ 59 | $$PWD/modules/nfd_le.cpp \ 60 | $$PWD/modules/nfd_lx.cpp \ 61 | $$PWD/modules/nfd_amiga.cpp \ 62 | $$PWD/modules/nfd_atarist.cpp \ 63 | $$PWD/modules/nfd_dos16m.cpp \ 64 | $$PWD/modules/nfd_dos4g.cpp \ 65 | $$PWD/modules/nfd_apk.cpp \ 66 | $$PWD/modules/nfd_ipa.cpp \ 67 | $$PWD/modules/nfd_pdf.cpp \ 68 | $$PWD/modules/nfd_text.cpp \ 69 | $$PWD/modules/nfd_javaclass.cpp 70 | 71 | contains(XCONFIG, use_capstone_x86) { 72 | !contains(XCONFIG, xcapstone_x86) { 73 | XCONFIG += xcapstone_x86 74 | include($$PWD/../XCapstone/xcapstone_x86.pri) 75 | } 76 | } 77 | 78 | !contains(XCONFIG, use_capstone_x86) { 79 | !contains(XCONFIG, xcapstone) { 80 | XCONFIG += xcapstone 81 | include($$PWD/../XCapstone/xcapstone.pri) 82 | } 83 | } 84 | 85 | !contains(XCONFIG, xscanengine) { 86 | XCONFIG += xscanengine 87 | include($$PWD/../XScanEngine/xscanengine.pri) 88 | } 89 | 90 | DISTFILES += \ 91 | $$PWD/LICENSE \ 92 | $$PWD/README.md \ 93 | $$PWD/import_hashes.txt \ 94 | $$PWD/specabstract.cmake 95 | -------------------------------------------------------------------------------- /modules/nfd_zip.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_ZIP_H 22 | #define NFD_ZIP_H 23 | 24 | #include "zip_script.h" 25 | #include "nfd_binary.h" 26 | #include "xarchive.h" 27 | #include "xjar.h" 28 | #include 29 | 30 | using BASIC_INFO = NFD_Binary::BASIC_INFO; 31 | using _SCANS_STRUCT = NFD_Binary::SCANS_STRUCT; 32 | 33 | class NFD_ZIP : public ZIP_Script { 34 | Q_OBJECT 35 | 36 | public: 37 | explicit NFD_ZIP(XZip *pZip, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 38 | 39 | struct ZIPINFO_STRUCT { 40 | NFD_Binary::BASIC_INFO basic_info; 41 | 42 | QList listArchiveRecords; 43 | 44 | bool bIsJAR; 45 | bool bIsIPA; 46 | bool bIsAPKS; 47 | bool bIsJava; 48 | bool bIsKotlin; 49 | }; 50 | 51 | static ZIPINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 52 | 53 | static void handle_Microsoftoffice(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct); 54 | static void handle_OpenOffice(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct); 55 | static void handle_Metainfos(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BASIC_INFO *pBasicInfo, QList *pListArchiveRecords, 56 | XBinary::PDSTRUCT *pPdStruct); 57 | static void handle_JAR(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct); 58 | static void handle_IPA(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct); 59 | static void handle_FixDetects(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct); 60 | }; 61 | 62 | #endif // NFD_ZIP_H 63 | -------------------------------------------------------------------------------- /modules/nfd_rar.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_rar.h" 22 | 23 | NFD_RAR::NFD_RAR(XRar *pRar, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : RAR_Script(pRar, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | void NFD_RAR::handle_formats(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, RARINFO_STRUCT *pRARInfo, XBinary::PDSTRUCT *pPdStruct) 28 | { 29 | XRar xrar(pDevice); 30 | 31 | if (xrar.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 32 | if (XBinary::getDeviceFileSuffix(pDevice).toLower() == "cbr") { 33 | NFD_Binary::SCANS_STRUCT recordSS = 34 | NFD_Binary::getScansStruct(0, XBinary::FT_RAR, XScanEngine::RECORD_TYPE_FORMAT, XScanEngine::RECORD_NAME_COMICBOOKARCHIVE, "", "", 0); 35 | pRARInfo->basic_info.mapResultProtectors.insert(recordSS.name, NFD_Binary::scansToScan(&(pRARInfo->basic_info), &recordSS)); 36 | } 37 | } 38 | } 39 | 40 | NFD_RAR::RARINFO_STRUCT NFD_RAR::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 41 | XBinary::PDSTRUCT *pPdStruct) 42 | { 43 | QElapsedTimer timer; 44 | timer.start(); 45 | 46 | RARINFO_STRUCT result = {}; 47 | 48 | XRar rar(pDevice); 49 | 50 | if (rar.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 51 | result.basic_info = NFD_Binary::_initBasicInfo(&rar, parentId, pOptions, nOffset, pPdStruct); 52 | 53 | // Populate 54 | result.listArchiveRecords = rar.getRecords(20000, pPdStruct); 55 | 56 | NFD_Binary::SCANS_STRUCT ssFormat = NFD_Binary::getFormatScansStruct(rar.getFileFormatInfo(pPdStruct)); 57 | result.basic_info.mapResultFormats.insert(ssFormat.name, NFD_Binary::scansToScan(&(result.basic_info), &ssFormat)); 58 | 59 | handle_formats(pDevice, pOptions, &result, pPdStruct); 60 | 61 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 62 | } 63 | 64 | result.basic_info.nElapsedTime = timer.elapsed(); 65 | 66 | return result; 67 | } 68 | -------------------------------------------------------------------------------- /modules/nfd_cfbf.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_cfbf.h" 22 | 23 | NFD_CFBF::NFD_CFBF(XCFBF *pCFBF, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : CFBF_Script(pCFBF, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | NFD_CFBF::CFBFINFO_STRUCT NFD_CFBF::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 28 | XBinary::PDSTRUCT *pPdStruct) 29 | { 30 | QElapsedTimer timer; 31 | timer.start(); 32 | 33 | CFBFINFO_STRUCT result = {}; 34 | 35 | XCFBF cfbf(pDevice); 36 | 37 | if (cfbf.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 38 | // Initialize BASIC_INFO 39 | result.basic_info = NFD_Binary::_initBasicInfo(&cfbf, parentId, pOptions, nOffset, pPdStruct); 40 | 41 | // Generic format record 42 | NFD_Binary::SCANS_STRUCT ssFormat = NFD_Binary::getFormatScansStruct(cfbf.getFileFormatInfo(pPdStruct)); 43 | 44 | // CFBF sub-detection (MSI, Word 97-2003) replicating legacy logic 45 | // Read a couple of offsets used historically for differentiation 46 | const quint16 sub1 = cfbf.read_uint16(0x200); 47 | const quint16 sub2 = cfbf.read_uint16(0x1000); 48 | 49 | if ((sub1 == 0) && (sub2 == 0xFFFD)) { 50 | ssFormat.type = XScanEngine::RECORD_TYPE_INSTALLER; 51 | ssFormat.name = XScanEngine::RECORD_NAME_MICROSOFTINSTALLER; 52 | ssFormat.sVersion = ""; 53 | ssFormat.sInfo = ""; 54 | } else if (sub1 == 0xA5EC) { 55 | ssFormat.type = XScanEngine::RECORD_TYPE_FORMAT; 56 | ssFormat.name = XScanEngine::RECORD_NAME_MICROSOFTOFFICEWORD; 57 | ssFormat.sVersion = "97-2003"; 58 | ssFormat.sInfo = ""; 59 | } 60 | 61 | result.basic_info.mapResultFormats.insert(ssFormat.name, NFD_Binary::scansToScan(&(result.basic_info), &ssFormat)); 62 | 63 | // Finalize 64 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 65 | } 66 | 67 | result.basic_info.nElapsedTime = timer.elapsed(); 68 | 69 | return result; 70 | } 71 | -------------------------------------------------------------------------------- /specabstract.cmake: -------------------------------------------------------------------------------- 1 | include_directories(${CMAKE_CURRENT_LIST_DIR}) 2 | include_directories(${CMAKE_CURRENT_LIST_DIR}/modules) 3 | 4 | if (NOT DEFINED XSCANENGINE_SOURCES) 5 | include(${CMAKE_CURRENT_LIST_DIR}/../XScanEngine/xscanengine.cmake) 6 | set(SPECABSTRACT_SOURCES ${SPECABSTRACT_SOURCES} ${XSCANENGINE_SOURCES}) 7 | endif() 8 | 9 | # TODO Check includes 10 | set(SPECABSTRACT_SOURCES 11 | ${SPECABSTRACT_SOURCES} 12 | ${CMAKE_CURRENT_LIST_DIR}/specabstract.cpp 13 | ${CMAKE_CURRENT_LIST_DIR}/specabstract.h 14 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_binary.cpp 15 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_binary.h 16 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_msdos.cpp 17 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_msdos.h 18 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_pe.cpp 19 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_pe.h 20 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_elf.cpp 21 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_elf.h 22 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_mach.cpp 23 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_mach.h 24 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_zip.cpp 25 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_zip.h 26 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_jar.cpp 27 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_jar.h 28 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_archive.cpp 29 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_archive.h 30 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_rar.cpp 31 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_rar.h 32 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_npm.cpp 33 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_npm.h 34 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_machofat.cpp 35 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_machofat.h 36 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_dex.cpp 37 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_dex.h 38 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_cfbf.cpp 39 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_cfbf.h 40 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_com.cpp 41 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_com.h 42 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_image.cpp 43 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_image.h 44 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_jpeg.cpp 45 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_jpeg.h 46 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_png.cpp 47 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_png.h 48 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_ne.cpp 49 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_ne.h 50 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_le.cpp 51 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_le.h 52 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_lx.cpp 53 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_lx.h 54 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_amiga.cpp 55 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_amiga.h 56 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_atarist.cpp 57 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_atarist.h 58 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_dos16m.cpp 59 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_dos16m.h 60 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_dos4g.cpp 61 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_dos4g.h 62 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_apk.cpp 63 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_apk.h 64 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_ipa.cpp 65 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_ipa.h 66 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_pdf.cpp 67 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_pdf.h 68 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_javaclass.cpp 69 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_javaclass.h 70 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_text.cpp 71 | ${CMAKE_CURRENT_LIST_DIR}/modules/nfd_text.h 72 | ) 73 | -------------------------------------------------------------------------------- /modules/nfd_elf.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_ELF_H 22 | #define NFD_ELF_H 23 | 24 | #include "elf_script.h" 25 | #include "nfd_binary.h" 26 | 27 | class QIODevice; 28 | 29 | class NFD_ELF : public ELF_Script { 30 | Q_OBJECT 31 | 32 | public: 33 | explicit NFD_ELF(XELF *pELF, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 34 | 35 | struct ELFINFO_STRUCT { 36 | NFD_Binary::BASIC_INFO basic_info; 37 | QString sEntryPointSignature; 38 | bool bIs64; 39 | bool bIsBigEndian; 40 | 41 | QList listTags; 42 | QList listLibraries; 43 | QList listComments; 44 | QList listSectionHeaders; 45 | QList listProgramHeaders; 46 | QList listSectionRecords; 47 | QList listNotes; 48 | 49 | qint32 nSymTabSection; 50 | qint64 nSymTabOffset; 51 | qint32 nDebugSection; 52 | qint64 nDWARFDebugOffset; 53 | qint64 nDWARFDebugSize; 54 | 55 | qint32 nCommentSection; 56 | qint32 nStringTableSection; 57 | QByteArray baStringTable; 58 | QString sRunPath; 59 | 60 | XBinary::OFFSETSIZE osCommentSection; 61 | }; 62 | 63 | static ELFINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 64 | 65 | static NFD_Binary::SIGNATURE_RECORD *getEntrypointRecords(); 66 | static qint32 getEntrypointRecordsSize(); 67 | 68 | static void handle_OperationSystem(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ELFINFO_STRUCT *pELFInfo, XBinary::PDSTRUCT *pPdStruct); 69 | static void handle_CommentSection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ELFINFO_STRUCT *pELFInfo, XBinary::PDSTRUCT *pPdStruct); 70 | static void handle_Tools(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ELFINFO_STRUCT *pELFInfo, XBinary::PDSTRUCT *pPdStruct); 71 | static void handle_GCC(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ELFINFO_STRUCT *pELFInfo, XBinary::PDSTRUCT *pPdStruct); 72 | static void handle_DebugData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ELFINFO_STRUCT *pELFInfo, XBinary::PDSTRUCT *pPdStruct); 73 | static void handle_Protection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ELFINFO_STRUCT *pELFInfo, XBinary::PDSTRUCT *pPdStruct); 74 | static void handle_UnknownProtection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ELFINFO_STRUCT *pELFInfo, XBinary::PDSTRUCT *pPdStruct); 75 | static void handle_FixDetects(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ELFINFO_STRUCT *pELFInfo, XBinary::PDSTRUCT *pPdStruct); 76 | }; 77 | 78 | #endif // NFD_ELF_H 79 | -------------------------------------------------------------------------------- /staticscan.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef STATICSCAN_H 22 | #define STATICSCAN_H 23 | 24 | #include 25 | #include 26 | 27 | #include "specabstract.h" 28 | 29 | #define SSE_VERSION __DATE__ 30 | 31 | class StaticScan : public QObject { 32 | Q_OBJECT 33 | 34 | public: 35 | explicit StaticScan(QObject *pParent = nullptr); 36 | 37 | void setData(const QString &sFileName, XScanEngine::SCAN_OPTIONS *pOptions, XScanEngine::SCAN_RESULT *pScanResult, XBinary::PDSTRUCT *pPdStruct); 38 | void setData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, XScanEngine::SCAN_RESULT *pScanResult, XBinary::PDSTRUCT *pPdStruct); 39 | void setData(char *pData, qint32 nDataSize, XScanEngine::SCAN_OPTIONS *pOptions, XScanEngine::SCAN_RESULT *pScanResult, XBinary::PDSTRUCT *pPdStruct); 40 | void setData(const QString &sDirectoryName, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 41 | 42 | static XScanEngine::SCAN_RESULT processDevice(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct = nullptr); 43 | static XScanEngine::SCAN_RESULT processFile(const QString &sFileName, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct = nullptr); 44 | static XScanEngine::SCAN_RESULT processMemory(char *pData, qint32 nDataSize, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct = nullptr); 45 | static XScanEngine::SCAN_RESULT processSubdevice(QIODevice *pDevice, qint64 nOffset, qint64 nSize, XScanEngine::SCAN_OPTIONS *pOptions, 46 | XBinary::PDSTRUCT *pPdStruct = nullptr); 47 | 48 | static QString getEngineVersion(); 49 | 50 | private: 51 | enum SCAN_TYPE { 52 | SCAN_TYPE_UNKNOWN = 0, 53 | SCAN_TYPE_DEVICE, 54 | SCAN_TYPE_DIRECTORY, 55 | SCAN_TYPE_FILE, 56 | SCAN_TYPE_MEMORY 57 | }; 58 | 59 | void _process(QIODevice *pDevice, XScanEngine::SCAN_RESULT *pScanResult, qint64 nOffset, qint64 nSize, XScanEngine::SCANID parentId, 60 | XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct = nullptr); 61 | XScanEngine::SCAN_RESULT scanFile(const QString &sFileName, XBinary::PDSTRUCT *pPdStruct = nullptr); 62 | XScanEngine::SCAN_RESULT scanDevice(QIODevice *pDevice, XBinary::PDSTRUCT *pPdStruct = nullptr); 63 | XScanEngine::SCAN_RESULT scanMemory(char *pData, qint32 nSize, XBinary::PDSTRUCT *pPdStruct = nullptr); 64 | 65 | signals: 66 | // TODO error and info signals !!! 67 | void scanFileStarted(const QString &sFileName); 68 | void completed(qint64 nElapsedTime); 69 | void scanResult(const XScanEngine::SCAN_RESULT &scanResult); 70 | 71 | public slots: 72 | void process(); 73 | 74 | private: 75 | QString m_sFileName; 76 | QString m_sDirectoryName; 77 | QIODevice *m_pDevice; 78 | char *m_pData; 79 | qint32 m_nDataSize; 80 | XScanEngine::SCAN_OPTIONS *m_pOptions; 81 | XScanEngine::SCAN_RESULT *m_pScanResult; 82 | SCAN_TYPE m_scanType; 83 | XBinary::PDSTRUCT *m_pPdStruct; 84 | }; 85 | 86 | #endif // STATICSCAN_H 87 | -------------------------------------------------------------------------------- /modules/nfd_pdf.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_pdf.h" 22 | 23 | NFD_PDF::NFD_PDF(XPDF *pPDF, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : PDF_Script(pPDF, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | NFD_PDF::PDFINFO_STRUCT NFD_PDF::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 28 | XBinary::PDSTRUCT *pPdStruct) 29 | { 30 | QElapsedTimer timer; 31 | timer.start(); 32 | 33 | PDFINFO_STRUCT result = {}; 34 | 35 | XPDF pdf(pDevice); 36 | 37 | if (pdf.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 38 | // Basic info via shared utility 39 | result.basic_info = NFD_Binary::_initBasicInfo(&pdf, parentId, pOptions, nOffset, pPdStruct); 40 | 41 | // Collect objects 42 | result.listObjects = pdf.getParts(20, pPdStruct); 43 | 44 | // Format mapping 45 | NFD_Binary::SCANS_STRUCT ssFormat = NFD_Binary::getFormatScansStruct(pdf.getFileFormatInfo(pPdStruct)); 46 | result.basic_info.mapResultFormats.insert(ssFormat.name, NFD_Binary::scansToScan(&(result.basic_info), &ssFormat)); 47 | 48 | // Tags: Producer 49 | QList listProd = pdf.getValuesByKey(&(result.listObjects), QString("/Producer")); 50 | qint32 nProdCount = listProd.count(); 51 | for (qint32 i = 0; (i < nProdCount) && XBinary::isPdStructNotCanceled(pPdStruct); i++) { 52 | if (listProd.at(i).varType == XBinary::VT_STRING) { 53 | NFD_Binary::SCANS_STRUCT ssTool = {}; 54 | ssTool.type = XScanEngine::RECORD_TYPE_TOOL; 55 | ssTool.name = (XScanEngine::RECORD_NAME)((qint32)XScanEngine::RECORD_NAME_UNKNOWN0 + i); 56 | ssTool.sVersion = listProd.at(i).var.toString(); 57 | ssTool.sInfo = ""; 58 | result.basic_info.mapResultTools.insert(ssTool.name, NFD_Binary::scansToScan(&(result.basic_info), &ssTool)); 59 | } 60 | } 61 | 62 | // Tags: Creator 63 | QList listCreator = pdf.getValuesByKey(&(result.listObjects), QString("/Creator")); 64 | qint32 nCreatorCount = listCreator.count(); 65 | for (qint32 i = 0; (i < nCreatorCount) && XBinary::isPdStructNotCanceled(pPdStruct); i++) { 66 | if (listCreator.at(i).varType == XBinary::VT_STRING) { 67 | NFD_Binary::SCANS_STRUCT ssTool = {}; 68 | ssTool.type = XScanEngine::RECORD_TYPE_TOOL; 69 | ssTool.name = (XScanEngine::RECORD_NAME)((qint32)XScanEngine::RECORD_NAME_UNKNOWN0 + i); 70 | ssTool.sVersion = listCreator.at(i).var.toString(); 71 | ssTool.sInfo = ""; 72 | result.basic_info.mapResultTools.insert(ssTool.name, NFD_Binary::scansToScan(&(result.basic_info), &ssTool)); 73 | } 74 | } 75 | 76 | // Hook: Tags/Producer/etc. could be added here if desired in the future. 77 | 78 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 79 | } 80 | 81 | result.basic_info.nElapsedTime = timer.elapsed(); 82 | 83 | #ifdef QT_DEBUG 84 | qDebug("%lld msec", result.basic_info.nElapsedTime); 85 | #endif 86 | 87 | return result; 88 | } 89 | -------------------------------------------------------------------------------- /modules/nfd_msdos.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_MSDOS_H 22 | #define NFD_MSDOS_H 23 | 24 | #include "msdos_script.h" 25 | #include "nfd_binary.h" 26 | #include "xscanengine.h" 27 | 28 | class NFD_MSDOS : public MSDOS_Script { 29 | Q_OBJECT 30 | 31 | public: 32 | explicit NFD_MSDOS(XMSDOS *pMSDOS, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 33 | 34 | struct MSDOSINFO_STRUCT { 35 | NFD_Binary::BASIC_INFO basic_info; 36 | qint64 nEntryPointOffset; 37 | QString sEntryPointSignature; 38 | QString sOverlaySignature; 39 | qint64 nOverlayOffset; 40 | qint64 nOverlaySize; 41 | }; 42 | 43 | // Move of SpecAbstract::MSDOS_richScan 44 | static void MSDOS_richScan(QMap *pMapRecords, quint16 nID, quint32 nBuild, quint32 nCount, 45 | NFD_Binary::MSRICH_RECORD *pRecords, qint32 nRecordsSize, XBinary::FT fileType1, XBinary::FT fileType2, NFD_Binary::BASIC_INFO *pBasicInfo, 46 | DETECTTYPE detectType, XBinary::PDSTRUCT *pPdStruct); 47 | 48 | static QList MSDOS_richScan(quint16 nID, quint32 nBuild, quint32 nCount, NFD_Binary::MSRICH_RECORD *pRecords, qint32 nRecordsSize, 49 | XBinary::FT fileType1, XBinary::FT fileType2, NFD_Binary::BASIC_INFO *pBasicInfo, DETECTTYPE detectType, 50 | XBinary::PDSTRUCT *pPdStruct); 51 | 52 | // Accessors for MSDOS linker header signature records (moved from SpecAbstract/signatures.cpp) 53 | static NFD_Binary::SIGNATURE_RECORD *getHeaderLinkerRecords(); 54 | static qint32 getHeaderLinkerRecordsSize(); 55 | 56 | // Accessors for generic MSDOS header signature records (moved from SpecAbstract/signatures.cpp) 57 | static NFD_Binary::SIGNATURE_RECORD *getHeaderRecords(); 58 | static qint32 getHeaderRecordsSize(); 59 | 60 | // Accessors for Microsoft Rich signature records (moved from SpecAbstract/signatures.cpp) 61 | static NFD_Binary::MSRICH_RECORD *getRichRecords(); 62 | static qint32 getRichRecordsSize(); 63 | 64 | // Accessors for MSDOS entrypoint signature records (moved from SpecAbstract/signatures.cpp) 65 | static NFD_Binary::SIGNATURE_RECORD *getEntryPointRecords(); 66 | static qint32 getEntryPointRecordsSize(); 67 | static NFD_Binary::SIGNATURE_RECORD *getEntryPointExpRecords(); 68 | static qint32 getEntryPointExpRecordsSize(); 69 | 70 | // Handlers migrated from SpecAbstract 71 | static void handle_OperationSystem(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MSDOSINFO_STRUCT *pMSDOSInfo, XBinary::PDSTRUCT *pPdStruct); 72 | static void handle_Tools(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MSDOSINFO_STRUCT *pMSDOSInfo, XBinary::PDSTRUCT *pPdStruct); 73 | static void handle_Borland(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MSDOSINFO_STRUCT *pMSDOSInfo, XBinary::PDSTRUCT *pPdStruct); 74 | static void handle_Protection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MSDOSINFO_STRUCT *pMSDOSInfo, XBinary::PDSTRUCT *pPdStruct); 75 | static void handle_SFX(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MSDOSINFO_STRUCT *pMSDOSInfo, XBinary::PDSTRUCT *pPdStruct); 76 | static void handle_DosExtenders(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, MSDOSINFO_STRUCT *pMSDOSInfo, XBinary::PDSTRUCT *pPdStruct); 77 | 78 | // Core info extractor migrated from SpecAbstract::getMSDOSInfo 79 | static MSDOSINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 80 | 81 | static QString getMsRichString(quint16 nId, quint16 nBuild, quint32 nCount, XBinary::PDSTRUCT *pPdStruct); 82 | }; 83 | 84 | #endif // NFD_MSDOS_H 85 | -------------------------------------------------------------------------------- /modules/nfd_ne.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_ne.h" 22 | 23 | NFD_NE::NFD_NE(XNE *pNE, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : NE_Script(pNE, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | NFD_NE::NEINFO_STRUCT NFD_NE::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct) 28 | { 29 | QElapsedTimer timer; 30 | timer.start(); 31 | 32 | NEINFO_STRUCT result = {}; 33 | 34 | XNE ne(pDevice, pOptions->bIsImage); 35 | 36 | if (ne.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 37 | result.basic_info = NFD_Binary::_initBasicInfo(&ne, parentId, pOptions, nOffset, pPdStruct); 38 | 39 | result.nEntryPointOffset = ne.getEntryPointOffset(&(result.basic_info.memoryMap)); 40 | result.sEntryPointSignature = ne.getSignature(result.nEntryPointOffset, 150); 41 | 42 | result.nOverlayOffset = ne.getOverlayOffset(&(result.basic_info.memoryMap), pPdStruct); 43 | result.nOverlaySize = ne.getOverlaySize(&(result.basic_info.memoryMap), pPdStruct); 44 | if (result.nOverlaySize) { 45 | result.sOverlaySignature = ne.getSignature(result.nOverlayOffset, 150); 46 | } 47 | 48 | // MSDOS header linker signatures (moved from SpecAbstract) 49 | NFD_Binary::signatureScan(&result.basic_info.mapHeaderDetects, result.basic_info.sHeaderSignature, NFD_MSDOS::getHeaderLinkerRecords(), 50 | NFD_MSDOS::getHeaderLinkerRecordsSize(), result.basic_info.id.fileType, XBinary::FT_MSDOS, &(result.basic_info), DETECTTYPE_HEADER, 51 | pPdStruct); 52 | 53 | // Operation System 54 | { 55 | NFD_Binary::SCANS_STRUCT ssOperationSystem = NFD_Binary::getOperationSystemScansStruct(ne.getFileFormatInfo(pPdStruct)); 56 | result.basic_info.mapResultOperationSystems.insert(ssOperationSystem.name, NFD_Binary::scansToScan(&(result.basic_info), &ssOperationSystem)); 57 | } 58 | 59 | // Borland Turbo Linker (version from VI if available) 60 | { 61 | NFD_Binary::VI_STRUCT vi = NFD_Binary::get_TurboLinker_vi(pDevice, pOptions); 62 | if (vi.bIsValid) { 63 | NFD_Binary::SCANS_STRUCT ssLinker = {}; 64 | ssLinker.nVariant = 0; 65 | ssLinker.fileType = XBinary::FT_MSDOS; // parity with previous implementation for NE block 66 | ssLinker.type = XScanEngine::RECORD_TYPE_LINKER; 67 | ssLinker.name = XScanEngine::RECORD_NAME_TURBOLINKER; 68 | ssLinker.sVersion = vi.sVersion; 69 | ssLinker.sInfo = vi.sInfo; 70 | result.basic_info.mapResultLinkers.insert(ssLinker.name, NFD_Binary::scansToScan(&(result.basic_info), &ssLinker)); 71 | } 72 | } 73 | 74 | // Watcom C/C++ toolchain (compiler + linker) 75 | { 76 | NFD_Binary::VI_STRUCT vi = NFD_Binary::get_Watcom_vi(pDevice, pOptions, result.nEntryPointOffset, 0x100, pPdStruct); 77 | if (vi.bIsValid) { 78 | // Compiler 79 | NFD_Binary::SCANS_STRUCT ssCompiler = {}; 80 | ssCompiler.nVariant = 0; 81 | ssCompiler.fileType = XBinary::FT_MSDOS; 82 | ssCompiler.type = XScanEngine::RECORD_TYPE_COMPILER; 83 | ssCompiler.name = static_cast(vi.vValue.toUInt()); 84 | ssCompiler.sVersion = vi.sVersion; 85 | ssCompiler.sInfo = vi.sInfo; 86 | result.basic_info.mapResultCompilers.insert(ssCompiler.name, NFD_Binary::scansToScan(&(result.basic_info), &ssCompiler)); 87 | 88 | // Linker 89 | NFD_Binary::SCANS_STRUCT ssLinker = {}; 90 | ssLinker.nVariant = 0; 91 | ssLinker.fileType = XBinary::FT_MSDOS; 92 | ssLinker.type = XScanEngine::RECORD_TYPE_LINKER; 93 | ssLinker.name = XScanEngine::RECORD_NAME_WATCOMLINKER; 94 | result.basic_info.mapResultLinkers.insert(ssLinker.name, NFD_Binary::scansToScan(&(result.basic_info), &ssLinker)); 95 | } 96 | } 97 | 98 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 99 | } 100 | 101 | result.basic_info.nElapsedTime = timer.elapsed(); 102 | 103 | return result; 104 | } 105 | -------------------------------------------------------------------------------- /modules/nfd_le.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_le.h" 22 | 23 | NFD_LE::NFD_LE(XLE *pLE, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : LE_Script(pLE, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | NFD_LE::LEINFO_STRUCT NFD_LE::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct) 28 | { 29 | QElapsedTimer timer; 30 | timer.start(); 31 | 32 | LEINFO_STRUCT result = {}; 33 | 34 | XLE le(pDevice, pOptions->bIsImage); 35 | 36 | if (le.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 37 | result.basic_info = NFD_Binary::_initBasicInfo(&le, parentId, pOptions, nOffset, pPdStruct); 38 | 39 | result.nEntryPointOffset = le.getEntryPointOffset(&(result.basic_info.memoryMap)); 40 | result.sEntryPointSignature = le.getSignature(result.nEntryPointOffset, 150); 41 | result.listRichSignatures = le.getRichSignatureRecords(); 42 | 43 | result.nOverlayOffset = le.getOverlayOffset(&(result.basic_info.memoryMap), pPdStruct); 44 | result.nOverlaySize = le.getOverlaySize(&(result.basic_info.memoryMap), pPdStruct); 45 | if (result.nOverlaySize) { 46 | result.sOverlaySignature = le.getSignature(result.nOverlayOffset, 150); 47 | } 48 | 49 | // MSDOS header linker signatures (moved from SpecAbstract) 50 | NFD_Binary::signatureScan(&result.basic_info.mapHeaderDetects, result.basic_info.sHeaderSignature, NFD_MSDOS::getHeaderLinkerRecords(), 51 | NFD_MSDOS::getHeaderLinkerRecordsSize(), result.basic_info.id.fileType, XBinary::FT_MSDOS, &(result.basic_info), DETECTTYPE_HEADER, 52 | pPdStruct); 53 | 54 | // Operation System 55 | { 56 | NFD_Binary::SCANS_STRUCT ssOperationSystem = NFD_Binary::getOperationSystemScansStruct(le.getFileFormatInfo(pPdStruct)); 57 | result.basic_info.mapResultOperationSystems.insert(ssOperationSystem.name, NFD_Binary::scansToScan(&(result.basic_info), &ssOperationSystem)); 58 | } 59 | 60 | // Borland Turbo Linker (version from VI if available) 61 | { 62 | NFD_Binary::VI_STRUCT vi = NFD_Binary::get_TurboLinker_vi(pDevice, pOptions); 63 | if (vi.bIsValid) { 64 | NFD_Binary::SCANS_STRUCT ssLinker = {}; 65 | ssLinker.nVariant = 0; 66 | ssLinker.fileType = XBinary::FT_LX; // keep parity with previous implementation 67 | ssLinker.type = XScanEngine::RECORD_TYPE_LINKER; 68 | ssLinker.name = XScanEngine::RECORD_NAME_TURBOLINKER; 69 | ssLinker.sVersion = vi.sVersion; 70 | ssLinker.sInfo = vi.sInfo; 71 | result.basic_info.mapResultLinkers.insert(ssLinker.name, NFD_Binary::scansToScan(&(result.basic_info), &ssLinker)); 72 | } 73 | } 74 | 75 | // Watcom C/C++ toolchain (compiler + linker) 76 | { 77 | NFD_Binary::VI_STRUCT vi = NFD_Binary::get_Watcom_vi(pDevice, pOptions, result.nEntryPointOffset, 0x100, pPdStruct); 78 | if (vi.bIsValid) { 79 | // Compiler 80 | NFD_Binary::SCANS_STRUCT ssCompiler = {}; 81 | ssCompiler.nVariant = 0; 82 | ssCompiler.fileType = XBinary::FT_LX; // keep parity with previous implementation 83 | ssCompiler.type = XScanEngine::RECORD_TYPE_COMPILER; 84 | ssCompiler.name = static_cast(vi.vValue.toUInt()); 85 | ssCompiler.sVersion = vi.sVersion; 86 | ssCompiler.sInfo = vi.sInfo; 87 | result.basic_info.mapResultCompilers.insert(ssCompiler.name, NFD_Binary::scansToScan(&(result.basic_info), &ssCompiler)); 88 | 89 | // Linker 90 | NFD_Binary::SCANS_STRUCT ssLinker = {}; 91 | ssLinker.nVariant = 0; 92 | ssLinker.fileType = XBinary::FT_LX; // keep parity with previous implementation 93 | ssLinker.type = XScanEngine::RECORD_TYPE_LINKER; 94 | ssLinker.name = XScanEngine::RECORD_NAME_WATCOMLINKER; 95 | result.basic_info.mapResultLinkers.insert(ssLinker.name, NFD_Binary::scansToScan(&(result.basic_info), &ssLinker)); 96 | } 97 | } 98 | 99 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 100 | } 101 | 102 | result.basic_info.nElapsedTime = timer.elapsed(); 103 | 104 | return result; 105 | } 106 | -------------------------------------------------------------------------------- /specabstract.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "specabstract.h" 22 | #include "modules/nfd_binary.h" 23 | #include "modules/nfd_elf.h" 24 | #include "modules/nfd_javaclass.h" 25 | #include "modules/nfd_rar.h" 26 | #include "modules/nfd_apk.h" 27 | #include "modules/nfd_le.h" 28 | #include "modules/nfd_lx.h" 29 | #include "modules/nfd_ne.h" 30 | #include "modules/nfd_dex.h" 31 | #include "modules/nfd_pe.h" 32 | #include "modules/nfd_text.h" 33 | #include "modules/nfd_dex.h" 34 | 35 | #include "signatures.cpp" // Do not include in CMAKE files! 36 | 37 | SpecAbstract::SpecAbstract(QObject *pParent) : XScanEngine(pParent) 38 | { 39 | } 40 | 41 | void SpecAbstract::_processDetect(XScanEngine::SCANID *pScanID, XScanEngine::SCAN_RESULT *pScanResult, QIODevice *pDevice, const XScanEngine::SCANID &parentId, 42 | XBinary::FT fileType, XScanEngine::SCAN_OPTIONS *pScanOptions, bool bAddUnknown, XBinary::PDSTRUCT *pPdStruct) 43 | { 44 | BASIC_INFO basic_info = {}; 45 | 46 | if ((fileType == XBinary::FT_PE32) || (fileType == XBinary::FT_PE64)) { 47 | NFD_PE::PEINFO_STRUCT pe_info = NFD_PE::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 48 | basic_info = pe_info.basic_info; 49 | } else if ((fileType == XBinary::FT_ELF32) || (fileType == XBinary::FT_ELF64)) { 50 | NFD_ELF::ELFINFO_STRUCT elf_info = NFD_ELF::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 51 | basic_info = elf_info.basic_info; 52 | } else if ((fileType == XBinary::FT_MACHO32) || (fileType == XBinary::FT_MACHO64)) { 53 | NFD_MACH::MACHOINFO_STRUCT mach_info = NFD_MACH::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 54 | basic_info = mach_info.basic_info; 55 | } else if (fileType == XBinary::FT_LE) { 56 | NFD_LE::LEINFO_STRUCT le_info = NFD_LE::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 57 | basic_info = le_info.basic_info; 58 | } else if (fileType == XBinary::FT_LX) { 59 | NFD_LX::LXINFO_STRUCT lx_info = NFD_LX::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 60 | basic_info = lx_info.basic_info; 61 | } else if (fileType == XBinary::FT_NE) { 62 | NFD_NE::NEINFO_STRUCT ne_info = NFD_NE::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 63 | basic_info = ne_info.basic_info; 64 | } else if (fileType == XBinary::FT_MSDOS) { 65 | NFD_MSDOS::MSDOSINFO_STRUCT msdos_info = NFD_MSDOS::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 66 | basic_info = msdos_info.basic_info; 67 | } else if (fileType == XBinary::FT_JAR) { 68 | NFD_JAR::JARINFO_STRUCT jar_info = NFD_JAR::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 69 | basic_info = jar_info.basic_info; 70 | } else if (fileType == XBinary::FT_APK) { 71 | NFD_APK::APKINFO_STRUCT apk_info = NFD_APK::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 72 | basic_info = apk_info.basic_info; 73 | } else if ((fileType == XBinary::FT_ZIP) || (fileType == XBinary::FT_IPA)) { 74 | // mb TODO split detects 75 | NFD_ZIP::ZIPINFO_STRUCT zip_info = NFD_ZIP::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 76 | basic_info = zip_info.basic_info; 77 | } else if (fileType == XBinary::FT_RAR) { 78 | NFD_RAR::RARINFO_STRUCT rar_info = NFD_RAR::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 79 | basic_info = rar_info.basic_info; 80 | } else if (fileType == XBinary::FT_JAVACLASS) { 81 | NFD_JavaClass::JAVACLASSINFO_STRUCT javaclass_info = NFD_JavaClass::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 82 | basic_info = javaclass_info.basic_info; 83 | } else if (fileType == XBinary::FT_DEX) { 84 | NFD_DEX::DEXINFO_STRUCT dex_info = NFD_DEX::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 85 | basic_info = dex_info.basic_info; 86 | } else if (fileType == XBinary::FT_AMIGAHUNK) { 87 | NFD_Amiga::AMIGAHUNKINFO_STRUCT amigaHunk_info = NFD_Amiga::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 88 | basic_info = amigaHunk_info.basic_info; 89 | } else if (fileType == XBinary::FT_PDF) { 90 | NFD_PDF::PDFINFO_STRUCT pdf_info = NFD_PDF::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 91 | basic_info = pdf_info.basic_info; 92 | } else if (fileType == XBinary::FT_JPEG) { 93 | NFD_JPEG::JPEGINFO_STRUCT jpeg_info = NFD_JPEG::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 94 | basic_info = jpeg_info.basic_info; 95 | } else if (fileType == XBinary::FT_CFBF) { 96 | NFD_CFBF::CFBFINFO_STRUCT cfbf_info = NFD_CFBF::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 97 | basic_info = cfbf_info.basic_info; 98 | } else if (fileType == XBinary::FT_COM) { 99 | NFD_COM::COMINFO_STRUCT com_info = NFD_COM::getInfo(pDevice, parentId, pScanOptions, 0, pPdStruct); 100 | basic_info = com_info.basic_info; 101 | } else { 102 | NFD_Binary::BINARYINFO_STRUCT binary_info = NFD_Binary::getInfo(pDevice, fileType, parentId, pScanOptions, 0, pPdStruct); 103 | basic_info = binary_info.basic_info; 104 | } 105 | 106 | if (bAddUnknown) { 107 | if (!basic_info.listDetects.count()) { 108 | _SCANS_STRUCT ssUnknown = {}; 109 | 110 | ssUnknown.type = SpecAbstract::RECORD_TYPE_UNKNOWN; 111 | ssUnknown.name = SpecAbstract::RECORD_NAME_UNKNOWN; 112 | ssUnknown.bIsUnknown = true; 113 | 114 | basic_info.listDetects.append(NFD_Binary::scansToScan(&basic_info, &ssUnknown)); 115 | } 116 | } 117 | 118 | QList listScanStructs = NFD_Binary::convert(&(basic_info.listDetects)); 119 | 120 | if (pScanOptions->bIsSort) { 121 | sortRecords(&listScanStructs); 122 | } 123 | 124 | pScanResult->listRecords.append(listScanStructs); 125 | pScanResult->listDebugRecords.append(NFD_Binary::convertHeur(&(basic_info.listHeurs))); 126 | 127 | if (pScanID) { 128 | *pScanID = basic_info.id; 129 | } 130 | } 131 | -------------------------------------------------------------------------------- /modules/nfd_zip.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_zip.h" 22 | 23 | NFD_ZIP::NFD_ZIP(XZip *pZip, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : ZIP_Script(pZip, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | NFD_ZIP::ZIPINFO_STRUCT NFD_ZIP::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 28 | XBinary::PDSTRUCT *pPdStruct) 29 | { 30 | QElapsedTimer timer; 31 | timer.start(); 32 | 33 | ZIPINFO_STRUCT result = {}; 34 | 35 | XZip xzip(pDevice); 36 | 37 | if (xzip.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 38 | result.basic_info = NFD_Binary::_initBasicInfo(&xzip, parentId, pOptions, nOffset, pPdStruct); 39 | 40 | // setStatus(pOptions,XBinary::fileTypeIdToString(result.basic_info.id.fileType)); 41 | result.listArchiveRecords = xzip.getRecords(20000, pPdStruct); 42 | 43 | if (pOptions->fileType == XBinary::FT_UNKNOWN) { 44 | QSet stFT = XFormats::getFileTypesZIP(pDevice, &(result.listArchiveRecords), pPdStruct); 45 | 46 | result.bIsJAR = stFT.contains(XBinary::FT_JAR); 47 | result.bIsAPKS = stFT.contains(XBinary::FT_APKS); 48 | result.bIsIPA = stFT.contains(XBinary::FT_IPA); 49 | } else if (pOptions->fileType == XBinary::FT_JAR) { 50 | result.bIsJAR = true; 51 | } else if (pOptions->fileType == XBinary::FT_IPA) { 52 | result.bIsIPA = true; 53 | } else if (pOptions->fileType == XBinary::FT_APKS) { 54 | result.bIsAPKS = true; 55 | } 56 | 57 | result.bIsKotlin = XArchive::isArchiveRecordPresent("META-INF/androidx.core_core-ktx.version", &(result.listArchiveRecords), pPdStruct) || 58 | XArchive::isArchiveRecordPresent("kotlin/kotlin.kotlin_builtins", &(result.listArchiveRecords), pPdStruct); 59 | 60 | if (result.bIsIPA) { 61 | result.basic_info.id.fileType = XBinary::FT_IPA; 62 | } else if (result.bIsJAR) { 63 | result.basic_info.id.fileType = XBinary::FT_JAR; 64 | } else if (result.bIsAPKS) { 65 | result.basic_info.id.fileType = XBinary::FT_APKS; 66 | } 67 | 68 | NFD_ZIP::handle_Metainfos(pDevice, pOptions, &(result.basic_info), &(result.listArchiveRecords), pPdStruct); 69 | NFD_ZIP::handle_Microsoftoffice(pDevice, pOptions, &result, pPdStruct); 70 | NFD_ZIP::handle_OpenOffice(pDevice, pOptions, &result, pPdStruct); 71 | 72 | if (result.bIsJAR) { 73 | NFD_ZIP::handle_JAR(pDevice, pOptions, &result, pPdStruct); 74 | } 75 | 76 | if (result.bIsIPA) { 77 | NFD_ZIP::handle_IPA(pDevice, pOptions, &result, pPdStruct); 78 | } 79 | 80 | NFD_ZIP::handle_FixDetects(pDevice, pOptions, &result, pPdStruct); 81 | 82 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 83 | } 84 | 85 | result.basic_info.nElapsedTime = timer.elapsed(); 86 | 87 | return result; 88 | } 89 | 90 | void NFD_ZIP::handle_Microsoftoffice(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct) 91 | { 92 | Q_UNUSED(pOptions) 93 | 94 | XZip xzip(pDevice); 95 | 96 | if (xzip.isValid(pPdStruct)) { 97 | XArchive::RECORD record = XArchive::getArchiveRecord("docProps/app.xml", &(pZipInfo->listArchiveRecords)); 98 | 99 | if (!record.spInfo.sRecordName.isEmpty()) { 100 | if ((record.spInfo.nUncompressedSize) && (record.spInfo.nUncompressedSize <= 0x4000)) { 101 | pZipInfo->basic_info.id.fileType = XBinary::FT_DOCUMENT; 102 | 103 | QString sData = xzip.decompress(&record, pPdStruct).data(); 104 | QString sApplication = XBinary::regExp("(.*?)", sData, 1); 105 | 106 | _SCANS_STRUCT ss = 107 | NFD_Binary::getScansStruct(0, XBinary::FT_BINARY, XScanEngine::RECORD_TYPE_FORMAT, XScanEngine::RECORD_NAME_MICROSOFTOFFICE, "", "", 0); 108 | 109 | if (sApplication == "Microsoft Office Word") { 110 | ss.name = XScanEngine::RECORD_NAME_MICROSOFTOFFICEWORD; 111 | } else if (sApplication == "Microsoft Excel") { 112 | ss.name = XScanEngine::RECORD_NAME_MICROSOFTEXCEL; 113 | } else if (sApplication == "Microsoft Visio") { 114 | ss.name = XScanEngine::RECORD_NAME_MICROSOFTVISIO; 115 | } else if (sApplication == "SheetJS") { 116 | ss.name = XScanEngine::RECORD_NAME_MICROSOFTEXCEL; 117 | ss.sInfo = "SheetJS"; 118 | } 119 | 120 | ss.sVersion = XBinary::regExp("(.*?)", sData, 1); 121 | pZipInfo->basic_info.mapResultFormats.insert(ss.name, NFD_Binary::scansToScan(&(pZipInfo->basic_info), &ss)); 122 | } 123 | } 124 | } 125 | } 126 | 127 | void NFD_ZIP::handle_OpenOffice(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct) 128 | { 129 | Q_UNUSED(pOptions) 130 | 131 | XZip xzip(pDevice); 132 | 133 | if (xzip.isValid(pPdStruct)) { 134 | XArchive::RECORD record = XArchive::getArchiveRecord("meta.xml", &(pZipInfo->listArchiveRecords)); 135 | 136 | if (!record.spInfo.sRecordName.isEmpty()) { 137 | if ((record.spInfo.nUncompressedSize) && (record.spInfo.nUncompressedSize <= 0x4000)) { 138 | QString sData = xzip.decompress(&record, pPdStruct).data(); 139 | 140 | // TODO 141 | if (sData.contains(":opendocument:")) { 142 | pZipInfo->basic_info.id.fileType = XBinary::FT_DOCUMENT; 143 | 144 | _SCANS_STRUCT ss = 145 | NFD_Binary::getScansStruct(0, XBinary::FT_BINARY, XScanEngine::RECORD_TYPE_FORMAT, XScanEngine::RECORD_NAME_OPENDOCUMENT, "", "", 0); 146 | 147 | pZipInfo->basic_info.mapResultFormats.insert(ss.name, NFD_Binary::scansToScan(&(pZipInfo->basic_info), &ss)); 148 | } 149 | } 150 | } 151 | } 152 | } 153 | 154 | void NFD_ZIP::handle_Metainfos(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BASIC_INFO *pBasicInfo, QList *pListArchiveRecords, 155 | XBinary::PDSTRUCT *pPdStruct) 156 | { 157 | Q_UNUSED(pOptions) 158 | 159 | XJAR xjar(pDevice); 160 | 161 | if (xjar.isValid(pListArchiveRecords, pPdStruct)) { 162 | QString sDataManifest = xjar.decompress(pListArchiveRecords, "META-INF/MANIFEST.MF", pPdStruct).data(); 163 | 164 | if (sDataManifest != "") { 165 | // ... existing code for manifest processing ... 166 | } 167 | } 168 | } 169 | 170 | void NFD_ZIP::handle_JAR(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct) 171 | { 172 | Q_UNUSED(pOptions) 173 | 174 | XJAR xjar(pDevice); 175 | 176 | if (xjar.isValid(pPdStruct)) { 177 | // ... existing JAR handling code ... 178 | } 179 | } 180 | 181 | void NFD_ZIP::handle_IPA(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct) 182 | { 183 | Q_UNUSED(pOptions) 184 | 185 | XZip xzip(pDevice); 186 | 187 | if (xzip.isValid(pPdStruct)) { 188 | if (pZipInfo->bIsIPA) { 189 | // ... existing IPA handling code ... 190 | } 191 | } 192 | } 193 | 194 | void NFD_ZIP::handle_FixDetects(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, ZIPINFO_STRUCT *pZipInfo, XBinary::PDSTRUCT *pPdStruct) 195 | { 196 | Q_UNUSED(pOptions) 197 | 198 | XZip xzip(pDevice); 199 | 200 | if (xzip.isValid(pPdStruct)) { 201 | // ... existing fix detects code ... 202 | } 203 | } 204 | -------------------------------------------------------------------------------- /modules/nfd_lx.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_lx.h" 22 | 23 | NFD_LX::NFD_LX(XLE *pLX, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : LX_Script(pLX, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | NFD_LX::LXINFO_STRUCT NFD_LX::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct) 28 | { 29 | QElapsedTimer timer; 30 | timer.start(); 31 | 32 | LXINFO_STRUCT result = {}; 33 | 34 | XLE lx(pDevice, pOptions->bIsImage); 35 | 36 | if (lx.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 37 | result.basic_info = NFD_Binary::_initBasicInfo(&lx, parentId, pOptions, nOffset, pPdStruct); 38 | 39 | result.nEntryPointOffset = lx.getEntryPointOffset(&(result.basic_info.memoryMap)); 40 | result.sEntryPointSignature = lx.getSignature(result.nEntryPointOffset, 150); 41 | result.listRichSignatures = lx.getRichSignatureRecords(); 42 | 43 | result.nOverlayOffset = lx.getOverlayOffset(&(result.basic_info.memoryMap), pPdStruct); 44 | result.nOverlaySize = lx.getOverlaySize(&(result.basic_info.memoryMap), pPdStruct); 45 | if (result.nOverlaySize) { 46 | result.sOverlaySignature = lx.getSignature(result.nOverlayOffset, 150); 47 | } 48 | 49 | // MSDOS header linker signatures (moved from SpecAbstract) 50 | NFD_Binary::signatureScan(&result.basic_info.mapHeaderDetects, result.basic_info.sHeaderSignature, NFD_MSDOS::getHeaderLinkerRecords(), 51 | NFD_MSDOS::getHeaderLinkerRecordsSize(), result.basic_info.id.fileType, XBinary::FT_MSDOS, &(result.basic_info), DETECTTYPE_HEADER, 52 | pPdStruct); 53 | 54 | // Operation System 55 | { 56 | NFD_Binary::SCANS_STRUCT ssOperationSystem = NFD_Binary::getOperationSystemScansStruct(lx.getFileFormatInfo(pPdStruct)); 57 | result.basic_info.mapResultOperationSystems.insert(ssOperationSystem.name, NFD_Binary::scansToScan(&(result.basic_info), &ssOperationSystem)); 58 | } 59 | 60 | // Borland Turbo Linker (version from VI if available) 61 | { 62 | NFD_Binary::VI_STRUCT vi = NFD_Binary::get_TurboLinker_vi(pDevice, pOptions); 63 | if (vi.bIsValid) { 64 | NFD_Binary::SCANS_STRUCT ssLinker = {}; 65 | ssLinker.nVariant = 0; 66 | ssLinker.fileType = XBinary::FT_LX; // parity with previous implementation 67 | ssLinker.type = XScanEngine::RECORD_TYPE_LINKER; 68 | ssLinker.name = XScanEngine::RECORD_NAME_TURBOLINKER; 69 | ssLinker.sVersion = vi.sVersion; 70 | ssLinker.sInfo = vi.sInfo; 71 | result.basic_info.mapResultLinkers.insert(ssLinker.name, NFD_Binary::scansToScan(&(result.basic_info), &ssLinker)); 72 | } 73 | } 74 | 75 | // Watcom C/C++ toolchain (compiler + linker) 76 | { 77 | NFD_Binary::VI_STRUCT vi = NFD_Binary::get_Watcom_vi(pDevice, pOptions, result.nEntryPointOffset, 0x100, pPdStruct); 78 | if (vi.bIsValid) { 79 | // Compiler 80 | NFD_Binary::SCANS_STRUCT ssCompiler = {}; 81 | ssCompiler.nVariant = 0; 82 | ssCompiler.fileType = XBinary::FT_LX; 83 | ssCompiler.type = XScanEngine::RECORD_TYPE_COMPILER; 84 | ssCompiler.name = static_cast(vi.vValue.toUInt()); 85 | ssCompiler.sVersion = vi.sVersion; 86 | ssCompiler.sInfo = vi.sInfo; 87 | result.basic_info.mapResultCompilers.insert(ssCompiler.name, NFD_Binary::scansToScan(&(result.basic_info), &ssCompiler)); 88 | 89 | // Linker 90 | NFD_Binary::SCANS_STRUCT ssLinker = {}; 91 | ssLinker.nVariant = 0; 92 | ssLinker.fileType = XBinary::FT_LX; 93 | ssLinker.type = XScanEngine::RECORD_TYPE_LINKER; 94 | ssLinker.name = XScanEngine::RECORD_NAME_WATCOMLINKER; 95 | result.basic_info.mapResultLinkers.insert(ssLinker.name, NFD_Binary::scansToScan(&(result.basic_info), &ssLinker)); 96 | } 97 | } 98 | 99 | // Microsoft-specific handling (moved from SpecAbstract::LX_handle_Microsoft) 100 | { 101 | NFD_Binary::SCANS_STRUCT recordLinker = {}; 102 | NFD_Binary::SCANS_STRUCT recordCompiler = {}; 103 | 104 | if ((result.basic_info.mapHeaderDetects.contains(XScanEngine::RECORD_NAME_MICROSOFTLINKER)) && 105 | (!result.basic_info.mapHeaderDetects.contains(XScanEngine::RECORD_NAME_GENERICLINKER))) { 106 | recordLinker.type = XScanEngine::RECORD_TYPE_LINKER; 107 | recordLinker.name = XScanEngine::RECORD_NAME_MICROSOFTLINKER; 108 | } 109 | 110 | // Rich signatures 111 | qint32 nRichSignaturesCount = result.listRichSignatures.count(); 112 | if (nRichSignaturesCount) { 113 | recordLinker.name = XScanEngine::RECORD_NAME_MICROSOFTLINKER; 114 | recordLinker.type = XScanEngine::RECORD_TYPE_LINKER; 115 | } 116 | 117 | QList listRichDescriptions; 118 | for (qint32 i = 0; (i < nRichSignaturesCount) && (XBinary::isPdStructNotCanceled(pPdStruct)); i++) { 119 | const XMSDOS::MS_RICH_RECORD &rr = result.listRichSignatures.at(i); 120 | listRichDescriptions.append(NFD_MSDOS::MSDOS_richScan(rr.nId, rr.nVersion, rr.nCount, NFD_MSDOS::getRichRecords(), NFD_MSDOS::getRichRecordsSize(), 121 | result.basic_info.id.fileType, XBinary::FT_MSDOS, &(result.basic_info), DETECTTYPE_RICH, 122 | pPdStruct)); 123 | } 124 | 125 | for (qint32 i = listRichDescriptions.count() - 1; (i >= 0) && (XBinary::isPdStructNotCanceled(pPdStruct)); i--) { 126 | const NFD_Binary::SCANS_STRUCT &desc = listRichDescriptions.at(i); 127 | if (desc.type == XScanEngine::RECORD_TYPE_LINKER) { 128 | recordLinker.name = desc.name; 129 | recordLinker.sVersion = desc.sVersion; 130 | recordLinker.sInfo = desc.sInfo; 131 | recordLinker.type = desc.type; 132 | } 133 | if (desc.type == XScanEngine::RECORD_TYPE_COMPILER) { 134 | if (desc.name == XScanEngine::RECORD_NAME_UNIVERSALTUPLECOMPILER) { 135 | recordCompiler.name = XScanEngine::RECORD_NAME_VISUALCCPP; 136 | recordCompiler.sVersion = desc.sVersion; 137 | recordCompiler.sInfo = desc.sInfo; 138 | recordCompiler.type = desc.type; 139 | } else { 140 | recordCompiler.name = desc.name; 141 | recordCompiler.sVersion = desc.sVersion; 142 | recordCompiler.sInfo = desc.sInfo; 143 | recordCompiler.type = desc.type; 144 | } 145 | } 146 | } 147 | 148 | if (recordLinker.type != XScanEngine::RECORD_TYPE_UNKNOWN) { 149 | result.basic_info.mapResultLinkers.insert(recordLinker.name, NFD_Binary::scansToScan(&(result.basic_info), &recordLinker)); 150 | } 151 | if (recordCompiler.type != XScanEngine::RECORD_TYPE_UNKNOWN) { 152 | result.basic_info.mapResultCompilers.insert(recordCompiler.name, NFD_Binary::scansToScan(&(result.basic_info), &recordCompiler)); 153 | } 154 | } 155 | 156 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 157 | } 158 | 159 | result.basic_info.nElapsedTime = timer.elapsed(); 160 | 161 | return result; 162 | } 163 | -------------------------------------------------------------------------------- /modules/nfd_jar.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_jar.h" 22 | 23 | NFD_JAR::NFD_JAR(XZip *pZip, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : JAR_Script(pZip, filePart, pOptions, pPdStruct) 24 | { 25 | } 26 | 27 | NFD_JAR::JARINFO_STRUCT NFD_JAR::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 28 | XBinary::PDSTRUCT *pPdStruct) 29 | { 30 | QElapsedTimer timer; 31 | timer.start(); 32 | 33 | JARINFO_STRUCT result = {}; 34 | 35 | XZip jar(pDevice); 36 | 37 | if (jar.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 38 | result.basic_info = NFD_Binary::_initBasicInfo(&jar, parentId, pOptions, nOffset, pPdStruct); 39 | 40 | // Populate archive records and language flags similarly to ZIP path 41 | result.listArchiveRecords = jar.getRecords(20000, pPdStruct); 42 | 43 | // Kotlin/Java hints 44 | result.bIsKotlin = XArchive::isArchiveRecordPresent("META-INF/androidx.core_core-ktx.version", &(result.listArchiveRecords), pPdStruct) || 45 | XArchive::isArchiveRecordPresent("kotlin/kotlin.kotlin_builtins", &(result.listArchiveRecords), pPdStruct); 46 | // Java presence heuristic 47 | result.bIsJava = XArchive::isArchiveRecordPresent("META-INF/MANIFEST.MF", &(result.listArchiveRecords), pPdStruct) || 48 | XArchive::isArchiveRecordPresent("module-info.class", &(result.listArchiveRecords), pPdStruct); 49 | 50 | // Operation System (JVM) result 51 | { 52 | NFD_Binary::SCANS_STRUCT ssOperationSystem = NFD_Binary::getOperationSystemScansStruct(jar.getFileFormatInfo(pPdStruct)); 53 | result.basic_info.mapResultOperationSystems.insert(ssOperationSystem.name, NFD_Binary::scansToScan(&(result.basic_info), &ssOperationSystem)); 54 | } 55 | 56 | // Derive tools from meta-infos if available via manifest Created-By etc. 57 | // Inline minimal subset of Zip_handle_Metainfos for JAR context 58 | { 59 | Binary_Script::OPTIONS binOpts = NFD_Binary::toOptions(pOptions); 60 | JAR_Script js(&jar, parentId.filePart, &binOpts, pPdStruct); 61 | QString sCreatedBy = js.getManifestRecord("Created-By"); 62 | QString sBuiltBy = js.getManifestRecord("Built-By"); 63 | QString sAntVersion = js.getManifestRecord("Ant-Version"); 64 | QString sBuiltJdk = js.getManifestRecord("Build-Jdk"); 65 | QString sProtectedBy = js.getManifestRecord("Protected-By"); 66 | 67 | if (sCreatedBy.contains("(Apple Inc.)")) { 68 | NFD_Binary::SCANS_STRUCT ss = {}; 69 | ss.nVariant = 0; 70 | ss.fileType = XBinary::FT_JAR; 71 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 72 | ss.name = XScanEngine::RECORD_NAME_APPLEJDK; 73 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 74 | } 75 | if (sCreatedBy.contains("(IBM Corporation)")) { 76 | NFD_Binary::SCANS_STRUCT ss = {}; 77 | ss.nVariant = 0; 78 | ss.fileType = XBinary::FT_JAR; 79 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 80 | ss.name = XScanEngine::RECORD_NAME_IBMJDK; 81 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 82 | } 83 | if (sCreatedBy.contains("(AdoptOpenJdk)")) { 84 | NFD_Binary::SCANS_STRUCT ss = {}; 85 | ss.nVariant = 0; 86 | ss.fileType = XBinary::FT_JAR; 87 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 88 | ss.name = XScanEngine::RECORD_NAME_OPENJDK; 89 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 90 | } 91 | // Generic JDK tool with version 92 | if (sCreatedBy.contains("(Sun Microsystems Inc.)") || sCreatedBy.contains("(BEA Systems, Inc.)") || sCreatedBy.contains("(The FreeBSD Foundation)") || 93 | sCreatedBy.contains("(Oracle Corporation)") || sCreatedBy.contains("(Apple Inc.)") || sCreatedBy.contains("(Google Inc.)") || 94 | sCreatedBy.contains("(Jeroen Frijters)") || sCreatedBy.contains("(IBM Corporation)") || sCreatedBy.contains("(JetBrains s.r.o)") || 95 | sCreatedBy.contains("(Alibaba)")) { 96 | NFD_Binary::SCANS_STRUCT ss = {}; 97 | ss.nVariant = 0; 98 | ss.fileType = XBinary::FT_JAR; 99 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 100 | ss.name = XScanEngine::RECORD_NAME_JDK; 101 | ss.sVersion = sCreatedBy.section(" ", 0, 0); 102 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 103 | } 104 | if (sBuiltJdk != "") { 105 | NFD_Binary::SCANS_STRUCT ss = {}; 106 | ss.nVariant = 0; 107 | ss.fileType = XBinary::FT_JAR; 108 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 109 | ss.name = XScanEngine::RECORD_NAME_JDK; 110 | ss.sVersion = sBuiltJdk; 111 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 112 | } 113 | if (sAntVersion.contains("Apache Ant")) { 114 | NFD_Binary::SCANS_STRUCT ss = {}; 115 | ss.nVariant = 0; 116 | ss.fileType = XBinary::FT_JAR; 117 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 118 | ss.name = XScanEngine::RECORD_NAME_APACHEANT; 119 | ss.sVersion = XBinary::regExp("Apache Ant (.*?)$", sAntVersion, 1); 120 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 121 | } 122 | if (sCreatedBy.contains("(JetBrains s.r.o)")) { 123 | NFD_Binary::SCANS_STRUCT ss = {}; 124 | ss.nVariant = 0; 125 | ss.fileType = XBinary::FT_JAR; 126 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 127 | ss.name = XScanEngine::RECORD_NAME_JETBRAINS; 128 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 129 | } 130 | if (sCreatedBy.contains("(Jeroen Frijters)")) { 131 | NFD_Binary::SCANS_STRUCT ss = {}; 132 | ss.nVariant = 0; 133 | ss.fileType = XBinary::FT_JAR; 134 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 135 | ss.name = XScanEngine::RECORD_NAME_IKVMDOTNET; 136 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 137 | } 138 | if (sCreatedBy.contains("(BEA Systems, Inc.)")) { 139 | NFD_Binary::SCANS_STRUCT ss = {}; 140 | ss.nVariant = 0; 141 | ss.fileType = XBinary::FT_JAR; 142 | ss.type = XScanEngine::RECORD_TYPE_TOOL; 143 | ss.name = XScanEngine::RECORD_NAME_BEAWEBLOGIC; 144 | result.basic_info.mapMetainfosDetects.insert(ss.name, ss); 145 | } 146 | // Promotion to result tools similar to Zip_handle_JAR 147 | const XScanEngine::RECORD_NAME names[] = {XScanEngine::RECORD_NAME_JDK, XScanEngine::RECORD_NAME_APPLEJDK, XScanEngine::RECORD_NAME_IBMJDK, 148 | XScanEngine::RECORD_NAME_OPENJDK, XScanEngine::RECORD_NAME_JETBRAINS, XScanEngine::RECORD_NAME_IKVMDOTNET, 149 | XScanEngine::RECORD_NAME_BEAWEBLOGIC}; 150 | for (XScanEngine::RECORD_NAME name : names) { 151 | if (result.basic_info.mapMetainfosDetects.contains(name)) { 152 | auto ss = result.basic_info.mapMetainfosDetects.value(name); 153 | result.basic_info.mapResultTools.insert(ss.name, NFD_Binary::scansToScan(&(result.basic_info), &ss)); 154 | } 155 | } 156 | } 157 | 158 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 159 | } 160 | 161 | result.basic_info.nElapsedTime = timer.elapsed(); 162 | 163 | return result; 164 | } 165 | -------------------------------------------------------------------------------- /staticscan.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "staticscan.h" 22 | 23 | StaticScan::StaticScan(QObject *pParent) : QObject(pParent) 24 | { 25 | m_pOptions = nullptr; 26 | m_pScanResult = nullptr; 27 | m_scanType = SCAN_TYPE_UNKNOWN; 28 | m_pDevice = nullptr; 29 | m_pData = nullptr; 30 | m_pPdStruct = nullptr; 31 | } 32 | 33 | void StaticScan::setData(const QString &sFileName, XScanEngine::SCAN_OPTIONS *pOptions, XScanEngine::SCAN_RESULT *pScanResult, XBinary::PDSTRUCT *pPdStruct) 34 | { 35 | m_sFileName = sFileName; 36 | m_pOptions = pOptions; 37 | m_pScanResult = pScanResult; 38 | m_pPdStruct = pPdStruct; 39 | 40 | m_scanType = SCAN_TYPE_FILE; 41 | } 42 | 43 | void StaticScan::setData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, XScanEngine::SCAN_RESULT *pScanResult, XBinary::PDSTRUCT *pPdStruct) 44 | { 45 | m_pDevice = pDevice; 46 | m_pOptions = pOptions; 47 | m_pScanResult = pScanResult; 48 | m_pPdStruct = pPdStruct; 49 | 50 | m_scanType = SCAN_TYPE_DEVICE; 51 | } 52 | 53 | void StaticScan::setData(char *pData, qint32 nDataSize, XScanEngine::SCAN_OPTIONS *pOptions, XScanEngine::SCAN_RESULT *pScanResult, XBinary::PDSTRUCT *pPdStruct) 54 | { 55 | m_pData = pData; 56 | m_nDataSize = nDataSize; 57 | m_pOptions = pOptions; 58 | m_pScanResult = pScanResult; 59 | m_pPdStruct = pPdStruct; 60 | 61 | m_scanType = SCAN_TYPE_MEMORY; 62 | } 63 | 64 | void StaticScan::setData(const QString &sDirectoryName, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 65 | { 66 | m_sDirectoryName = sDirectoryName; 67 | m_pOptions = pOptions; 68 | m_pPdStruct = pPdStruct; 69 | 70 | m_scanType = SCAN_TYPE_DIRECTORY; 71 | } 72 | 73 | void StaticScan::process() 74 | { 75 | XBinary::PDSTRUCT pdStructEmpty = XBinary::createPdStruct(); 76 | XBinary::PDSTRUCT *pPdStruct = m_pPdStruct; 77 | 78 | if (!pPdStruct) { 79 | pPdStruct = &pdStructEmpty; 80 | } 81 | 82 | QElapsedTimer scanTimer; 83 | scanTimer.start(); 84 | 85 | qint32 _nFreeIndex = XBinary::getFreeIndex(pPdStruct); 86 | XBinary::setPdStructInit(pPdStruct, _nFreeIndex, 0); 87 | 88 | if (m_scanType == SCAN_TYPE_FILE) { 89 | if ((m_pScanResult) && (m_sFileName != "")) { 90 | XBinary::setPdStructStatus(pPdStruct, _nFreeIndex, tr("File scan")); 91 | 92 | emit scanFileStarted(m_sFileName); 93 | 94 | *m_pScanResult = scanFile(m_sFileName, pPdStruct); 95 | 96 | emit scanResult(*m_pScanResult); 97 | } 98 | } else if (m_scanType == SCAN_TYPE_DEVICE) { 99 | if (m_pDevice) { 100 | XBinary::setPdStructStatus(pPdStruct, _nFreeIndex, tr("Device scan")); 101 | 102 | *m_pScanResult = scanDevice(m_pDevice, pPdStruct); 103 | 104 | emit scanResult(*m_pScanResult); 105 | } 106 | } else if (m_scanType == SCAN_TYPE_MEMORY) { 107 | XBinary::setPdStructStatus(pPdStruct, _nFreeIndex, tr("Memory scan")); 108 | 109 | *m_pScanResult = scanMemory(m_pData, m_nDataSize, pPdStruct); 110 | 111 | emit scanResult(*m_pScanResult); 112 | } else if (m_scanType == SCAN_TYPE_DIRECTORY) { 113 | if (m_sDirectoryName != "") { 114 | XBinary::setPdStructStatus(pPdStruct, _nFreeIndex, tr("Directory scan")); 115 | QList listFileNames; 116 | 117 | XBinary::findFiles(m_sDirectoryName, &listFileNames, m_pOptions->bSubdirectories, 0, pPdStruct); 118 | 119 | qint32 _nFreeIndexFiles = XBinary::getFreeIndex(pPdStruct); 120 | 121 | qint32 nTotal = listFileNames.count(); 122 | 123 | XBinary::setPdStructInit(pPdStruct, _nFreeIndexFiles, nTotal); 124 | 125 | for (qint32 i = 0; (i < nTotal) && (!(pPdStruct->bIsStop)); i++) { 126 | QString sFileName = listFileNames.at(i); 127 | 128 | XBinary::setPdStructCurrent(pPdStruct, _nFreeIndexFiles, i); 129 | XBinary::setPdStructStatus(pPdStruct, _nFreeIndexFiles, sFileName); 130 | 131 | emit scanFileStarted(sFileName); 132 | 133 | XScanEngine::SCAN_RESULT _scanResult = scanFile(sFileName, pPdStruct); 134 | 135 | emit scanResult(_scanResult); 136 | } 137 | 138 | XBinary::setPdStructFinished(pPdStruct, _nFreeIndexFiles); 139 | } 140 | } 141 | 142 | XBinary::setPdStructFinished(pPdStruct, _nFreeIndex); 143 | 144 | emit completed(scanTimer.elapsed()); 145 | } 146 | 147 | XScanEngine::SCAN_RESULT StaticScan::processDevice(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 148 | { 149 | XScanEngine::SCAN_RESULT result = {}; 150 | StaticScan scan; 151 | scan.setData(pDevice, pOptions, &result, pPdStruct); 152 | scan.process(); 153 | 154 | return result; 155 | } 156 | 157 | XScanEngine::SCAN_RESULT StaticScan::processFile(const QString &sFileName, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 158 | { 159 | XScanEngine::SCAN_RESULT result = {}; 160 | StaticScan scan; 161 | scan.setData(sFileName, pOptions, &result, pPdStruct); 162 | scan.process(); 163 | 164 | return result; 165 | } 166 | 167 | XScanEngine::SCAN_RESULT StaticScan::processMemory(char *pData, qint32 nDataSize, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 168 | { 169 | XScanEngine::SCAN_RESULT result = {}; 170 | StaticScan scan; 171 | scan.setData(pData, nDataSize, pOptions, &result, pPdStruct); 172 | scan.process(); 173 | 174 | return result; 175 | } 176 | 177 | XScanEngine::SCAN_RESULT StaticScan::processSubdevice(QIODevice *pDevice, qint64 nOffset, qint64 nSize, XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 178 | { 179 | XScanEngine::SCAN_RESULT result = {}; 180 | 181 | if (XBinary::isOffsetAndSizeValid(pDevice, nOffset, nSize)) { 182 | SubDevice sd(pDevice, nOffset, nSize); 183 | 184 | if (sd.open(QIODevice::ReadOnly)) { 185 | StaticScan scan; 186 | scan.setData(&sd, pOptions, &result, pPdStruct); 187 | scan.process(); 188 | 189 | sd.close(); 190 | } 191 | } 192 | 193 | return result; 194 | } 195 | 196 | QString StaticScan::getEngineVersion() 197 | { 198 | return SSE_VERSION; 199 | } 200 | 201 | // StaticScan::STATS StaticScan::getCurrentStats() 202 | //{ 203 | // if(g_pElapsedTimer) 204 | // { 205 | // if(g_pElapsedTimer->isValid()) 206 | // { 207 | // g_currentStats.nElapsed=g_pElapsedTimer->elapsed(); 208 | // } 209 | // else 210 | // { 211 | // g_currentStats.nElapsed=0; 212 | // } 213 | // } 214 | 215 | // if(g_pOptions) 216 | // { 217 | // g_currentStats.sStatus2=g_pOptions->sStatus; 218 | // } 219 | 220 | // return g_currentStats; 221 | //} 222 | 223 | void StaticScan::_process(QIODevice *pDevice, XScanEngine::SCAN_RESULT *pScanResult, qint64 nOffset, qint64 nSize, XScanEngine::SCANID parentId, 224 | XScanEngine::SCAN_OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) 225 | { 226 | XBinary::PDSTRUCT pdStructEmpty = XBinary::createPdStruct(); 227 | 228 | if (!pPdStruct) { 229 | pPdStruct = &pdStructEmpty; 230 | } 231 | 232 | *pScanResult = SpecAbstract::scanSubdevice(pDevice, nOffset, nSize, parentId, pOptions, true, pPdStruct); 233 | } 234 | 235 | XScanEngine::SCAN_RESULT StaticScan::scanFile(const QString &sFileName, XBinary::PDSTRUCT *pPdStruct) 236 | { 237 | XScanEngine::SCAN_RESULT result = {}; 238 | 239 | if (sFileName != "") { 240 | QFile file; 241 | file.setFileName(sFileName); 242 | 243 | if (file.open(QIODevice::ReadOnly)) { 244 | result = scanDevice(&file, pPdStruct); 245 | file.close(); 246 | } 247 | } 248 | 249 | return result; 250 | } 251 | 252 | XScanEngine::SCAN_RESULT StaticScan::scanDevice(QIODevice *pDevice, XBinary::PDSTRUCT *pPdStruct) 253 | { 254 | XScanEngine::SCAN_RESULT result = {}; 255 | 256 | XScanEngine::SCANID parentId = {}; 257 | parentId.fileType = XBinary::FT_UNKNOWN; 258 | 259 | if (m_pOptions->initFilePart == XBinary::FILEPART_UNKNOWN) { 260 | parentId.filePart = XBinary::FILEPART_HEADER; 261 | } else { 262 | parentId.filePart = m_pOptions->initFilePart; 263 | } 264 | 265 | _process(pDevice, &result, 0, pDevice->size(), parentId, m_pOptions, pPdStruct); 266 | 267 | return result; 268 | } 269 | 270 | XScanEngine::SCAN_RESULT StaticScan::scanMemory(char *pData, qint32 nSize, XBinary::PDSTRUCT *pPdStruct) 271 | { 272 | XScanEngine::SCAN_RESULT result = {}; 273 | 274 | QBuffer buffer; 275 | 276 | buffer.setData(pData, nSize); 277 | 278 | if (buffer.open(QIODevice::ReadOnly)) { 279 | result = scanDevice(&buffer, pPdStruct); 280 | 281 | buffer.close(); 282 | } 283 | 284 | return result; 285 | } 286 | -------------------------------------------------------------------------------- /modules/nfd_com.cpp: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #include "nfd_com.h" 22 | #include "nfd_binary.h" 23 | #include "xcom.h" 24 | #include "xscanengine.h" 25 | 26 | NFD_COM::NFD_COM(XCOM *pCOM, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct) : COM_Script(pCOM, filePart, pOptions, pPdStruct) 27 | { 28 | } 29 | 30 | // No local helper; use NFD_Binary::addHeaderDetectToResults 31 | 32 | // COM signature arrays moved from SpecAbstract/signatures.cpp 33 | static NFD_Binary::SIGNATURE_RECORD g_COM_records[] = { 34 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_PKLITE, "1.00, 1.03", "exe2com"}, 35 | "B8....BA....8CDB03D83B1E....73..83EB..FA8ED3BC....FB83EB..8EC353B9....33FF57BE....FCF3A5CB"}, 36 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_PKLITE, "1.00c", ""}, 37 | "BA....A1....2D....8CCB81C3....3BC377..05....3BC377..B4..BA....CD21CD20"}, 38 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_PKLITE, "1.12, 1.20", ""}, 39 | "B8....BA....3BC473..8BC42D....25....8BF8B9....BE....FCF3A58BD8B1..D3EB8CD903D95333DB53CB"}, 40 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_PKLITE, "1.15", ""}, 41 | "B8....BA....3BC473..8BC42D....9025....8BF8B9....90BE....FCF3A58BD8B1..D3EB8CD903D95333DB53CB"}, 42 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_PKLITE, "1.50", ""}, 43 | "50B8....BA....3BC473..8BC42D....25....8BF8B9....BE....FCF3A58BD8B1..D3EB8CD903D95333DB53CB"}, 44 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_PKLITE, "1.1x", ""}, 45 | "BA....B8....05....3B06....73..2D....FA8ED0FB2D....8EC050B9....33FF57BE....FCF3A5CB"}, 46 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_HACKSTOP, "1.13cs", ""}, "FABD....FFE5"}, 47 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_HACKSTOP, "1.14s", ""}, "FABB....FFE3"}, 48 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_HACKSTOP, "1.17cr", ""}, "FABE....FFE6"}, 49 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_UPX, "0.30-0.40", ""}, "B9....BE....BF....BD....FDF3A4FCF7E19387F783C6..57E9"}, 50 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_UPX, "0.50", ""}, "B9....BE....BF....FDF3A4FCF7E19387F783EE..19ED57"}, 51 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_UPX, "0.81-1.20", ""}, "81FC....77..CD20B9....BE....BF....BB....FDF3A4FC87F783EE"}, 52 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_CRYPTDISMEMBER, "1.7", ""}, 53 | "0E179C58F6C4..74..EB..90B4..BE....BF....B9....68....68....68....57F3A4C3"}, 54 | }; 55 | 56 | static NFD_Binary::SIGNATURE_RECORD g_COM_Exp_records[] = { 57 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_SPIRIT, "1.X", ""}, "E9$$$$B430CD21F6D12EA6E8....B462CD21E8....3636FB969034..C3"}, 58 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_SPIRIT, "1.5", ""}, "E9$$$$AEE8$$$$E4210C..FBE62190B8....FB5026509087C1"}, 59 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_SPIRIT, "1.5", ""}, 60 | "E9$$$$369F9F1C..E9$$$$E8$$$$E421F80C..E6218D06....FC505089C1FB"}, 61 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_SPIRIT, "1.5", ""}, 62 | "E9$$$$F8D72606B435CD2107E8$$$$1C..1C..33D226F6DA12DDFCF905....F8F5F6EA"}, 63 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_ICE, "1.0", ""}, "EB$$BE....8BFE8B0E....8B16....B8....50FCAD33C2AB8BD0E2"}, 64 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_DIET, "1.00", ""}, "BF....3BFC72$$FDBE....B9....F3A5FC8BF7BF....ADAD8BE8B2..E9"}, 65 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_DIET, "1.00, 1.00d", ""}, 66 | "BF....3BFC72$$BE....B9....FDF3A5FC8BF7BF....ADAD8BE8B2..E9"}, 67 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_DIET, "1.02b, 1.10a", ""}, 68 | "......BF....B9....3BFC72$$FDF3A5FC8BF7BF....ADAD8BE8B2..E9"}, 69 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_DIET, "1.20", ""}, 70 | "......BF....B9....3BFC72$$31DBEB$$FDF3A5FC8BF7BF....ADAD8BE8B2..E9"}, 71 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PACKER, XScanEngine::RECORD_NAME_DIET, "1.44-1.45", ""}, "F99CEB$$55061E575652515350E8$$$$59B1..D3E98CC803C18ED88EC0"}, 72 | {{0, XBinary::FT_COM, XScanEngine::RECORD_TYPE_PROTECTOR, XScanEngine::RECORD_NAME_CRYPTCOM, "2.0", ""}, 73 | "E9$$$$BE....56B9....C704....C644....8134....4646E2..31F631C9C3"}, 74 | }; 75 | 76 | NFD_Binary::SIGNATURE_RECORD *NFD_COM::getHeaderRecords() 77 | { 78 | return g_COM_records; 79 | } 80 | qint32 NFD_COM::getHeaderRecordsSize() 81 | { 82 | return sizeof(g_COM_records); 83 | } 84 | NFD_Binary::SIGNATURE_RECORD *NFD_COM::getHeaderExpRecords() 85 | { 86 | return g_COM_Exp_records; 87 | } 88 | qint32 NFD_COM::getHeaderExpRecordsSize() 89 | { 90 | return sizeof(g_COM_Exp_records); 91 | } 92 | 93 | NFD_COM::COMINFO_STRUCT NFD_COM::getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 94 | XBinary::PDSTRUCT *pPdStruct) 95 | { 96 | QElapsedTimer timer; 97 | timer.start(); 98 | 99 | COMINFO_STRUCT result = {}; 100 | 101 | XCOM com(pDevice, pOptions->bIsImage); 102 | 103 | if (com.isValid(pPdStruct) && XBinary::isPdStructNotCanceled(pPdStruct)) { 104 | // Initialize basic info via shared utility 105 | result.basic_info = NFD_Binary::_initBasicInfo(&com, parentId, pOptions, nOffset, pPdStruct); 106 | 107 | // Overlay info (COM may have an overlay when packaged inside MSDOS) 108 | result.nOverlayOffset = com.getOverlayOffset(pPdStruct); 109 | result.nOverlaySize = com.getOverlaySize(pPdStruct); 110 | if (result.nOverlaySize) { 111 | result.sOverlaySignature = com.getSignature(result.nOverlayOffset, 150); 112 | } 113 | 114 | // Entry point signature (offset 0 for plain COM; retain API parity) 115 | result.nEntryPointOffset = com.getEntryPointOffset(&(result.basic_info.memoryMap)); 116 | result.sEntryPointSignature = com.getSignature(result.nEntryPointOffset, 150); 117 | 118 | // Header signature scans (moved from SpecAbstract) 119 | NFD_Binary::signatureScan(&result.basic_info.mapHeaderDetects, result.basic_info.sHeaderSignature, g_COM_records, sizeof(g_COM_records), 120 | result.basic_info.id.fileType, XBinary::FT_COM, &(result.basic_info), DETECTTYPE_HEADER, pPdStruct); 121 | 122 | NFD_Binary::signatureExpScan(&com, &(result.basic_info.memoryMap), &result.basic_info.mapHeaderDetects, 0, g_COM_Exp_records, sizeof(g_COM_Exp_records), 123 | result.basic_info.id.fileType, XBinary::FT_COM, &(result.basic_info), DETECTTYPE_HEADER, pPdStruct); 124 | 125 | // Additional handlers formerly in SpecAbstract 126 | if (pOptions->bIsVerbose) { 127 | NFD_COM::handle_OperationSystem(pDevice, pOptions, &result, pPdStruct); 128 | } 129 | 130 | NFD_COM::handle_Protection(pDevice, pOptions, &result, pPdStruct); 131 | 132 | if (result.basic_info.mapResultProtectors.size() || result.basic_info.mapResultPackers.size()) { 133 | NFD_Binary::SCANS_STRUCT ssOperationSystem = NFD_Binary::getOperationSystemScansStruct(com.getFileFormatInfo(pPdStruct)); 134 | result.basic_info.mapResultOperationSystems.insert(ssOperationSystem.name, NFD_Binary::scansToScan(&(result.basic_info), &ssOperationSystem)); 135 | } 136 | 137 | // Finalize core info 138 | NFD_Binary::_handleResult(&(result.basic_info), pPdStruct); 139 | } 140 | 141 | result.basic_info.nElapsedTime = timer.elapsed(); 142 | 143 | return result; 144 | } 145 | 146 | void NFD_COM::handle_OperationSystem(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, COMINFO_STRUCT *pCOMInfo, XBinary::PDSTRUCT *pPdStruct) 147 | { 148 | XCOM xcom(pDevice, pOptions->bIsImage); 149 | 150 | if (xcom.isValid(pPdStruct)) { 151 | NFD_Binary::SCANS_STRUCT ssOperationSystem = NFD_Binary::getOperationSystemScansStruct(xcom.getFileFormatInfo(pPdStruct)); 152 | pCOMInfo->basic_info.mapResultOperationSystems.insert(ssOperationSystem.name, NFD_Binary::scansToScan(&(pCOMInfo->basic_info), &ssOperationSystem)); 153 | } 154 | } 155 | 156 | void NFD_COM::handle_Protection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, COMINFO_STRUCT *pCOMInfo, XBinary::PDSTRUCT *pPdStruct) 157 | { 158 | Q_UNUSED(pDevice) 159 | Q_UNUSED(pOptions) 160 | Q_UNUSED(pPdStruct) 161 | 162 | using RECORD_NAME = XScanEngine::RECORD_NAME; 163 | 164 | NFD_Binary::addHeaderDetectToResults(&pCOMInfo->basic_info, RECORD_NAME::RECORD_NAME_PKLITE, false); 165 | NFD_Binary::addHeaderDetectToResults(&pCOMInfo->basic_info, RECORD_NAME::RECORD_NAME_UPX, false); 166 | NFD_Binary::addHeaderDetectToResults(&pCOMInfo->basic_info, RECORD_NAME::RECORD_NAME_HACKSTOP, true); 167 | NFD_Binary::addHeaderDetectToResults(&pCOMInfo->basic_info, RECORD_NAME::RECORD_NAME_CRYPTDISMEMBER, true); 168 | NFD_Binary::addHeaderDetectToResults(&pCOMInfo->basic_info, RECORD_NAME::RECORD_NAME_SPIRIT, true); 169 | NFD_Binary::addHeaderDetectToResults(&pCOMInfo->basic_info, RECORD_NAME::RECORD_NAME_ICE, false); 170 | NFD_Binary::addHeaderDetectToResults(&pCOMInfo->basic_info, RECORD_NAME::RECORD_NAME_DIET, false); 171 | } 172 | -------------------------------------------------------------------------------- /modules/nfd_pe.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2019-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_PE_H 22 | #define NFD_PE_H 23 | 24 | #include "pe_script.h" 25 | #include "nfd_msdos.h" 26 | #include "nfd_binary.h" 27 | #include "xpe.h" 28 | #include "xmsdos.h" 29 | #include "xscanengine.h" 30 | 31 | class NFD_PE : public PE_Script { 32 | Q_OBJECT 33 | 34 | public: 35 | explicit NFD_PE(XPE *pPE, XBinary::FILEPART filePart, OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 36 | 37 | using _SCANS_STRUCT = NFD_Binary::SCANS_STRUCT; 38 | using VI_STRUCT = NFD_Binary::VI_STRUCT; 39 | 40 | struct VCL_STRUCT { 41 | quint32 nValue; 42 | qint64 nOffset; 43 | bool bIs64; 44 | }; 45 | 46 | struct VCL_PACKAGEINFO_MODULE { 47 | quint8 nFlags; 48 | quint8 nHashCode; 49 | QString sName; 50 | }; 51 | 52 | struct VCL_PACKAGEINFO { 53 | quint32 nFlags; 54 | quint32 nUnknown; 55 | quint32 nRequiresCount; 56 | QList listModules; 57 | }; 58 | 59 | struct PEINFO_STRUCT { 60 | NFD_Binary::BASIC_INFO basic_info; 61 | qint64 nEntryPointOffset; 62 | QString sEntryPointSignature; 63 | QString sOverlaySignature; 64 | qint64 nOverlayOffset; 65 | qint64 nOverlaySize; 66 | XMSDOS_DEF::IMAGE_DOS_HEADEREX dosHeader; 67 | XPE_DEF::IMAGE_FILE_HEADER fileHeader; 68 | union OPTIONAL_HEADER { 69 | XPE_DEF::IMAGE_OPTIONAL_HEADER32 optionalHeader32; 70 | XPE_DEF::IMAGE_OPTIONAL_HEADER64 optionalHeader64; 71 | } optional_header; 72 | QList listSectionHeaders; 73 | QList listSectionRecords; 74 | QList listSectionNames; 75 | QList listImports; 76 | QList listImportRecords; 77 | quint64 nImportHash64; 78 | quint32 nImportHash32; 79 | QList listImportPositionHashes; 80 | XPE::EXPORT_HEADER exportHeader; 81 | QList listExportFunctionNames; 82 | QList listResources; 83 | QList listRichSignatures; 84 | QString sResourceManifest; 85 | XPE::RESOURCES_VERSION resVersion; 86 | XPE::CLI_INFO cliInfo; 87 | QList listAnsiStrings; 88 | QList listUnicodeStrings; 89 | 90 | qint32 nEntryPointSection; 91 | qint32 nResourcesSection; 92 | qint32 nImportSection; 93 | qint32 nCodeSection; 94 | qint32 nDataSection; 95 | qint32 nConstDataSection; 96 | qint32 nRelocsSection; 97 | qint32 nTLSSection; 98 | qint32 nIATSection; 99 | QString sEntryPointSectionName; 100 | XADDR nEntryPointAddress; 101 | XADDR nImageBaseAddress; 102 | quint8 nMinorLinkerVersion; 103 | quint8 nMajorLinkerVersion; 104 | quint16 nMinorImageVersion; 105 | quint16 nMajorImageVersion; 106 | bool bIs64; 107 | bool bIsNetPresent; 108 | bool bIsTLSPresent; 109 | 110 | XBinary::OFFSETSIZE osHeader; 111 | XBinary::OFFSETSIZE osEntryPointSection; 112 | XBinary::OFFSETSIZE osCodeSection; 113 | XBinary::OFFSETSIZE osDataSection; 114 | XBinary::OFFSETSIZE osConstDataSection; 115 | XBinary::OFFSETSIZE osImportSection; 116 | XBinary::OFFSETSIZE osResourcesSection; 117 | }; 118 | 119 | static PEINFO_STRUCT getInfo(QIODevice *pDevice, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 120 | 121 | // SIGNATURE_RECORD based tables 122 | static NFD_Binary::SIGNATURE_RECORD *getHeaderRecords(); 123 | static qint32 getHeaderRecordsSize(); 124 | static NFD_Binary::SIGNATURE_RECORD *getEntrypointRecords(); 125 | static qint32 getEntrypointRecordsSize(); 126 | static NFD_Binary::SIGNATURE_RECORD *getEntrypointExpRecords(); 127 | static qint32 getEntrypointExpRecordsSize(); 128 | static NFD_Binary::SIGNATURE_RECORD *getCodeSectionRecords(); 129 | static qint32 getCodeSectionRecordsSize(); 130 | static NFD_Binary::SIGNATURE_RECORD *getEntrypointSectionRecords(); 131 | static qint32 getEntrypointSectionRecordsSize(); 132 | static NFD_Binary::SIGNATURE_RECORD *getDotCodeSectionRecords(); 133 | static qint32 getDotCodeSectionRecordsSize(); 134 | 135 | // CONST_RECORD based tables 136 | static NFD_Binary::CONST_RECORD *getImportHashRecords(); 137 | static qint32 getImportHashRecordsSize(); 138 | static NFD_Binary::CONST_RECORD *getImportHashArmadilloRecords(); 139 | static qint32 getImportHashArmadilloRecordsSize(); 140 | static NFD_Binary::CONST_RECORD *getImportPositionHashRecords(); 141 | static qint32 getImportPositionHashRecordsSize(); 142 | 143 | // PE_RESOURCES_RECORD based tables 144 | static NFD_Binary::PE_RESOURCES_RECORD *getResourcesRecords(); 145 | static qint32 getResourcesRecordsSize(); 146 | 147 | // STRING_RECORD based tables 148 | static NFD_Binary::STRING_RECORD *getExportExpRecords(); 149 | static qint32 getExportExpRecordsSize(); 150 | static NFD_Binary::STRING_RECORD *getSectionNamesRecords(); 151 | static qint32 getSectionNamesRecordsSize(); 152 | static NFD_Binary::STRING_RECORD *getDotAnsiStringsRecords(); 153 | static qint32 getDotAnsiStringsRecordsSize(); 154 | static NFD_Binary::STRING_RECORD *getDotUnicodeStringsRecords(); 155 | static qint32 getDotUnicodeStringsRecordsSize(); 156 | 157 | static void handle_import(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 158 | static void handle_OperationSystem(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 159 | static void handle_Protection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 160 | static void handle_VMProtect(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 161 | static void handle_VProtect(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 162 | static void handle_TTProtect(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 163 | static void handle_SafeengineShielden(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 164 | static void handle_tElock(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 165 | static void handle_Armadillo(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 166 | static void handle_Obsidium(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 167 | static void handle_Themida(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 168 | static void handle_StarForce(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 169 | static void handle_Petite(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 170 | static void handle_NETProtection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 171 | static void handle_Microsoft(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 172 | static void handle_Borland(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 173 | static void handle_Watcom(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 174 | static void handle_Tools(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 175 | static void handle_PETools(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 176 | static void handle_wxWidgets(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 177 | static void handle_GCC(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 178 | static void handle_Signtools(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 179 | static void handle_Installers(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 180 | static void handle_SFX(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 181 | static void handle_PolyMorph(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 182 | static void handle_DongleProtection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 183 | static void handle_NeoLite(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 184 | static void handle_PrivateEXEProtector(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 185 | static void handle_VisualBasicCryptors(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 186 | static void handle_DelphiCryptors(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 187 | static void handle_Joiners(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 188 | static void handle_DebugData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 189 | static void handle_UnknownProtection(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 190 | static void handle_FixDetects(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 191 | 192 | static bool isValid_UPX(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo); 193 | static void x86Emul(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo, XBinary::PDSTRUCT *pPdStruct); 194 | 195 | static QList getVCLstruct(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, bool bIs64, 196 | XBinary::PDSTRUCT *pPdStruct); 197 | static VCL_PACKAGEINFO getVCLPackageInfo(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, QList *pListResources, 198 | XBinary::PDSTRUCT *pPdStruct); 199 | static VI_STRUCT get_PECompact_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, PEINFO_STRUCT *pPEInfo); 200 | 201 | private: 202 | static void _fixRichSignatures(QList<_SCANS_STRUCT> *pListRichSignatures, qint32 nMajorLinkerVersion, qint32 nMinorLinkerVersion, XBinary::PDSTRUCT *pPdStruct); 203 | }; 204 | 205 | #endif // NFD_PE_H 206 | -------------------------------------------------------------------------------- /modules/nfd_binary.h: -------------------------------------------------------------------------------- 1 | /* Copyright (c) 2017-2025 hors 2 | * 3 | * Permission is hereby granted, free of charge, to any person obtaining a copy 4 | * of this software and associated documentation files (the "Software"), to deal 5 | * in the Software without restriction, including without limitation the rights 6 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 | * copies of the Software, and to permit persons to whom the Software is 8 | * furnished to do so, subject to the following conditions: 9 | * 10 | * The above copyright notice and this permission notice shall be included in all 11 | * copies or substantial portions of the Software. 12 | * 13 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 | * SOFTWARE. 20 | */ 21 | #ifndef NFD_BINARY_H 22 | #define NFD_BINARY_H 23 | 24 | #include "binary_script.h" 25 | #include "xscanengine.h" 26 | #include 27 | #include 28 | #include 29 | #include 30 | 31 | // Common detection type used across NFD and SpecAbstract 32 | // Kept as unscoped enum so legacy DETECTTYPE_* constants remain available 33 | enum DETECTTYPE { 34 | DETECTTYPE_UNKNOWN = 0, 35 | DETECTTYPE_ARCHIVE, 36 | DETECTTYPE_CODESECTION, 37 | DETECTTYPE_DEXSTRING, 38 | DETECTTYPE_DEXTYPE, 39 | DETECTTYPE_ENTRYPOINT, 40 | DETECTTYPE_ENTRYPOINTSECTION, 41 | DETECTTYPE_HEADER, 42 | DETECTTYPE_IMPORTHASH, 43 | DETECTTYPE_NETANSISTRING, 44 | DETECTTYPE_NETUNICODESTRING, 45 | DETECTTYPE_OVERLAY, 46 | DETECTTYPE_DEBUGDATA, 47 | DETECTTYPE_RESOURCES, 48 | DETECTTYPE_RICH, 49 | DETECTTYPE_SECTIONNAME 50 | }; 51 | 52 | // Forward declaration to use SpecAbstract::VI_STRUCT in prototypes without cyclic include 53 | class NFD_Binary : public Binary_Script { 54 | Q_OBJECT 55 | 56 | public: 57 | // Common detection/scan types used across NFD and SpecAbstract 58 | struct SCAN_STRUCT { 59 | bool bIsHeuristic; 60 | bool bIsUnknown; 61 | XScanEngine::SCANID id; 62 | XScanEngine::SCANID parentId; 63 | XScanEngine::RECORD_TYPE type; 64 | XScanEngine::RECORD_NAME name; 65 | QString sVersion; 66 | QString sInfo; 67 | }; 68 | 69 | // Generic version/info result used by vi helpers (moved from SpecAbstract) 70 | struct VI_STRUCT { 71 | bool bIsValid; 72 | QString sVersion; 73 | QString sInfo; 74 | QVariant vValue; 75 | }; 76 | 77 | struct DETECT_RECORD { 78 | qint64 nOffset; // memory scan 79 | XBinary::FILEPART filepart; 80 | DETECTTYPE detectType; 81 | QString sValue; // mb TODO variant 82 | quint32 nVariant; 83 | XBinary::FT fileType; 84 | XScanEngine::RECORD_TYPE type; 85 | XScanEngine::RECORD_NAME name; 86 | QString sVersion; 87 | QString sInfo; 88 | }; 89 | 90 | // Unified scan record structure moved from SpecAbstract 91 | struct SCANS_STRUCT { 92 | qint64 nOffset; 93 | quint32 nVariant; 94 | XBinary::FT fileType; 95 | XScanEngine::RECORD_TYPE type; 96 | XScanEngine::RECORD_NAME name; 97 | QString sVersion; 98 | QString sInfo; 99 | bool bIsHeuristic; 100 | bool bIsUnknown; 101 | QVariant varExtra; 102 | }; 103 | 104 | // Core scanning context moved from SpecAbstract 105 | struct BASIC_INFO { 106 | qint64 nElapsedTime; 107 | XScanEngine::SCANID parentId; 108 | XScanEngine::SCANID id; 109 | QString sHeaderSignature; 110 | XBinary::_MEMORY_MAP memoryMap; 111 | QList listDetects; 112 | QList listHeurs; 113 | XScanEngine::SCAN_OPTIONS scanOptions; 114 | 115 | QMap mapHeaderDetects; 116 | QMap mapTextHeaderDetects; 117 | QMap mapStringDetects; 118 | QMap mapTypeDetects; 119 | QMap mapArchiveDetects; 120 | QMap mapMetainfosDetects; 121 | QMap mapEntryPointDetects; 122 | QMap mapCommentSectionDetects; 123 | QMap mapOverlayDetects; 124 | QMap mapImportDetects; 125 | QMap mapExportDetects; 126 | QMap mapDotAnsiStringsDetects; 127 | QMap mapDotUnicodeStringsDetects; 128 | QMap mapCodeSectionDetects; 129 | QMap mapEntryPointSectionDetects; 130 | QMap mapSectionNamesDetects; 131 | QMap mapResourcesDetects; 132 | 133 | QMap mapResultTexts; 134 | QMap mapResultTools; 135 | QMap mapResultLanguages; 136 | QMap mapResultLibraries; 137 | QMap mapResultArchives; 138 | QMap mapResultCertificates; 139 | QMap mapResultDebugData; 140 | QMap mapResultInstallerData; 141 | QMap mapResultSFXData; 142 | QMap mapResultFormats; 143 | QMap mapResultDatabases; 144 | QMap mapResultImages; 145 | QMap mapResultProtectorData; 146 | QMap mapResultLibraryData; 147 | QMap mapResultResources; 148 | QMap mapResultOperationSystems; 149 | QMap mapResultLinkers; 150 | QMap mapResultCompilers; 151 | QMap mapResultProtectors; 152 | QMap mapResultSigntools; 153 | QMap mapResultAPKProtectors; 154 | QMap mapResultDosExtenders; 155 | QMap mapResultPackers; 156 | QMap mapResultSFX; 157 | QMap mapResultJoiners; 158 | QMap mapResultInstallers; 159 | QMap mapResultNETObfuscators; 160 | QMap mapResultNETCompressors; 161 | QMap mapResultDongleProtection; 162 | QMap mapResultPETools; 163 | }; 164 | 165 | // Generic binary info container moved from SpecAbstract 166 | struct BINARYINFO_STRUCT { 167 | BASIC_INFO basic_info; 168 | bool bIsPlainText; 169 | bool bIsUTF8; 170 | XBinary::UNICODE_TYPE unicodeType; 171 | QString sHeaderText; 172 | }; 173 | 174 | // Scan table descriptors (moved from SpecAbstract) 175 | struct _BASICINFO { 176 | quint32 nVariant; 177 | XBinary::FT fileType; 178 | XScanEngine::RECORD_TYPE type; 179 | XScanEngine::RECORD_NAME name; 180 | const char *pszVersion; 181 | const char *pszInfo; 182 | }; 183 | 184 | struct SIGNATURE_RECORD { 185 | _BASICINFO basicInfo; 186 | const char *pszSignature; 187 | }; 188 | 189 | struct STRING_RECORD { 190 | _BASICINFO basicInfo; 191 | const char *pszString; 192 | }; 193 | 194 | struct PE_RESOURCES_RECORD { 195 | _BASICINFO basicInfo; 196 | bool bIsString1; 197 | const char *pszName1; 198 | quint32 nID1; 199 | bool bIsString2; 200 | const char *pszName2; 201 | quint32 nID2; 202 | }; 203 | 204 | struct CONST_RECORD { 205 | _BASICINFO basicInfo; 206 | quint64 nConst1; 207 | quint64 nConst2; 208 | }; 209 | 210 | struct MSRICH_RECORD { 211 | _BASICINFO basicInfo; 212 | quint16 nID; 213 | quint32 nBuild; 214 | }; 215 | 216 | // Accessors for centralized signature tables used by Binary scans 217 | // These return pointers to the local g_* tables in nfd_binary.cpp and their byte sizes 218 | static SIGNATURE_RECORD *getBinaryRecords(); 219 | static qint32 getBinaryRecordsSize(); 220 | static SIGNATURE_RECORD *getDebugdataRecords(); 221 | static qint32 getDebugdataRecordsSize(); 222 | static SIGNATURE_RECORD *getArchiveRecords(); 223 | static qint32 getArchiveRecordsSize(); 224 | static SIGNATURE_RECORD *getPEOverlayRecords(); 225 | static qint32 getPEOverlayRecordsSize(); 226 | 227 | // Utility: stringify a scan struct (moved from SpecAbstract) 228 | static QString SCANS_STRUCT_toString(const SCANS_STRUCT *pScanStruct, bool bShowType = true); 229 | 230 | // Utility: convert SCANS_STRUCT + BASIC_INFO into a concrete SCAN_STRUCT (moved from SpecAbstract) 231 | static SCAN_STRUCT scansToScan(BASIC_INFO *pBasicInfo, SCANS_STRUCT *pScansStruct); 232 | 233 | // Convert SCAN_STRUCT list to XScanEngine::SCANSTRUCT list 234 | static QList convert(QList *pListScanStructs); 235 | // Convert DETECT_RECORD list to XScanEngine::DEBUG_RECORD list 236 | static QList convertHeur(QList *pListDetectRecords); 237 | 238 | // Filter scan results by record types 239 | static void filterResult(QList *pListRecords, const QSet &stRecordTypes, XBinary::PDSTRUCT *pPdStruct); 240 | 241 | // Derive Operation System directly from a binary instance 242 | static SCANS_STRUCT detectOperationSystem(XBinary *pBinary, XBinary::PDSTRUCT *pPdStruct); 243 | 244 | // Language aggregation helpers (moved from SpecAbstract) 245 | static void getLanguage(QMap *pMapDetects, QMap *pMapLanguages, 246 | XBinary::PDSTRUCT *pPdStruct); 247 | static void fixLanguage(QMap *pMapLanguages); 248 | 249 | // Converters from FILEFORMATINFO to scan records (moved from SpecAbstract) 250 | static SCANS_STRUCT getFormatScansStruct(const XBinary::FILEFORMATINFO &fileFormatInfo); 251 | static SCANS_STRUCT getOperationSystemScansStruct(const XBinary::FILEFORMATINFO &fileFormatInfo); 252 | 253 | // Insert a header-detected record into result maps (packers/protectors) if present 254 | static void addHeaderDetectToResults(BASIC_INFO *pBasicInfo, XScanEngine::RECORD_NAME rn, bool toProtector); 255 | 256 | // Moved from NFD_BinaryUtils: basic scan context init and final result synthesis 257 | static BASIC_INFO _initBasicInfo(XBinary *pBinary, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, XBinary::PDSTRUCT *pPdStruct); 258 | static void _handleResult(BASIC_INFO *pBasic_info, XBinary::PDSTRUCT *pPdStruct); 259 | 260 | // Utility: convert global scan options to Binary_Script options 261 | static Binary_Script::OPTIONS toOptions(const XScanEngine::SCAN_OPTIONS *pScanOptions); 262 | 263 | explicit NFD_Binary(XBinary *pBinary, XBinary::FILEPART filePart, Binary_Script::OPTIONS *pOptions, XBinary::PDSTRUCT *pPdStruct); 264 | 265 | // Scanning helpers moved from SpecAbstract 266 | static void memoryScan(QMap *pMapRecords, QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 267 | qint64 nSize, SIGNATURE_RECORD *pRecords, qint32 nRecordsSize, XBinary::FT fileType1, XBinary::FT fileType2, BASIC_INFO *pBasicInfo, 268 | DETECTTYPE detectType, XBinary::PDSTRUCT *pPdStruct); 269 | static void signatureScan(QMap *pMapRecords, const QString &sSignature, SIGNATURE_RECORD *pRecords, qint32 nRecordsSize, 270 | XBinary::FT fileType1, XBinary::FT fileType2, BASIC_INFO *pBasicInfo, DETECTTYPE detectType, XBinary::PDSTRUCT *pPdStruct); 271 | static void PE_resourcesScan(QMap *pMapRecords, QList *pListResources, PE_RESOURCES_RECORD *pRecords, 272 | qint32 nRecordsSize, XBinary::FT fileType1, XBinary::FT fileType2, BASIC_INFO *pBasicInfo, DETECTTYPE detectType, 273 | XBinary::PDSTRUCT *pPdStruct); 274 | static void stringScan(QMap *pMapRecords, QList *pListStrings, STRING_RECORD *pRecords, qint32 nRecordsSize, 275 | XBinary::FT fileType1, XBinary::FT fileType2, BASIC_INFO *pBasicInfo, DETECTTYPE detectType, XBinary::PDSTRUCT *pPdStruct); 276 | static void constScan(QMap *pMapRecords, quint64 nCost1, quint64 nCost2, CONST_RECORD *pRecords, qint32 nRecordsSize, 277 | XBinary::FT fileType1, XBinary::FT fileType2, BASIC_INFO *pBasicInfo, DETECTTYPE detectType, XBinary::PDSTRUCT *pPdStruct); 278 | // MSDOS Rich scan moved to NFD_MSDOS 279 | static void archiveScan(QMap *pMapRecords, QList *pListArchiveRecords, STRING_RECORD *pRecords, 280 | qint32 nRecordsSize, XBinary::FT fileType1, XBinary::FT fileType2, BASIC_INFO *pBasicInfo, DETECTTYPE detectType, 281 | XBinary::PDSTRUCT *pPdStruct); 282 | static void archiveExpScan(QMap *pMapRecords, QList *pListArchiveRecords, STRING_RECORD *pRecords, 283 | qint32 nRecordsSize, XBinary::FT fileType1, XBinary::FT fileType2, BASIC_INFO *pBasicInfo, DETECTTYPE detectType, 284 | XBinary::PDSTRUCT *pPdStruct); 285 | static void signatureExpScan(XBinary *pXBinary, XBinary::_MEMORY_MAP *pMemoryMap, QMap *pMapRecords, qint64 nOffset, 286 | SIGNATURE_RECORD *pRecords, qint32 nRecordsSize, XBinary::FT fileType1, XBinary::FT fileType2, BASIC_INFO *pBasicInfo, 287 | DETECTTYPE detectType, XBinary::PDSTRUCT *pPdStruct); 288 | 289 | // Version-info helpers moved from SpecAbstract 290 | static VI_STRUCT get_UPX_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::FT fileType, 291 | XBinary::PDSTRUCT *pPdStruct); 292 | static VI_STRUCT _get_UPX_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::FT fileType); 293 | 294 | // Version-info helpers moved from SpecAbstract (delegated wrappers remain there) 295 | static VI_STRUCT get_Enigma_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 296 | static VI_STRUCT get_DeepSea_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 297 | static VI_STRUCT get_SmartAssembly_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 298 | static VI_STRUCT get_R8_marker_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 299 | static VI_STRUCT get_Go_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 300 | static VI_STRUCT get_Rust_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 301 | static VI_STRUCT get_ObfuscatorLLVM_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 302 | static VI_STRUCT _get_ObfuscatorLLVM_string(const QString &sString); 303 | static VI_STRUCT get_AndroidClang_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 304 | static VI_STRUCT _get_AndroidClang_string(const QString &sString); 305 | 306 | // Version-info helpers moved from SpecAbstract (GCC/Nim/Zig) 307 | static VI_STRUCT get_GCC_vi1(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 308 | static VI_STRUCT get_GCC_vi2(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 309 | static VI_STRUCT get_Nim_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 310 | static VI_STRUCT get_Zig_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 311 | 312 | // String parsers moved from SpecAbstract 313 | static VI_STRUCT _get_GCC_string(const QString &sString); 314 | static VI_STRUCT _get_AlipayClang_string(const QString &sString); 315 | static VI_STRUCT _get_AlpineClang_string(const QString &sString); 316 | static VI_STRUCT _get_AlibabaClang_string(const QString &sString); 317 | static VI_STRUCT _get_PlexClang_string(const QString &sString); 318 | static VI_STRUCT _get_UbuntuClang_string(const QString &sString); 319 | static VI_STRUCT _get_DebianClang_string(const QString &sString); 320 | static VI_STRUCT _get_AlipayObfuscator_string(const QString &sString); 321 | static VI_STRUCT _get_wangzehuaLLVM_string(const QString &sString); 322 | static VI_STRUCT _get_ByteGuard_string(const QString &sString); 323 | static VI_STRUCT _get_TencentObfuscation_string(const QString &sString); 324 | static VI_STRUCT _get_AppImage_string(const QString &sString); 325 | static VI_STRUCT _get_HikariObfuscator_string(const QString &sString); 326 | static VI_STRUCT _get_SnapProtect_string(const QString &sString); 327 | static VI_STRUCT _get_ByteDanceSecCompiler_string(const QString &sString); 328 | static VI_STRUCT _get_DingbaozengNativeObfuscator_string(const QString &sString); 329 | static VI_STRUCT _get_SafeengineLLVM_string(const QString &sString); 330 | static VI_STRUCT _get_NagainLLVM_string(const QString &sString); 331 | static VI_STRUCT _get_iJiami_string(const QString &sString); 332 | static VI_STRUCT _get_AppleLLVM_string(const QString &sString); 333 | static VI_STRUCT _get_ApportableClang_string(const QString &sString); 334 | static VI_STRUCT _get_ARMAssembler_string(const QString &sString); 335 | static VI_STRUCT _get_ARMLinker_string(const QString &sString); 336 | static VI_STRUCT _get_ARMC_string(const QString &sString); 337 | static VI_STRUCT _get_ARMCCPP_string(const QString &sString); 338 | static VI_STRUCT _get_ARMNEONCCPP_string(const QString &sString); 339 | static VI_STRUCT _get_ARMThumbCCPP_string(const QString &sString); 340 | static VI_STRUCT _get_ARMThumbMacroAssembler_string(const QString &sString); 341 | static VI_STRUCT _get_ThumbC_string(const QString &sString); 342 | static VI_STRUCT _get_clang_string(const QString &sString); 343 | static VI_STRUCT _get_DynASM_string(const QString &sString); 344 | static VI_STRUCT _get_Delphi_string(const QString &sString); 345 | static VI_STRUCT _get_LLD_string(const QString &sString); 346 | static VI_STRUCT _get_mold_string(const QString &sString); 347 | static VI_STRUCT _get_OracleSolarisLinkEditors_string(const QString &sString); 348 | static VI_STRUCT _get_SunWorkShop_string(const QString &sString); 349 | static VI_STRUCT _get_SunWorkShopCompilers_string(const QString &sString); 350 | static VI_STRUCT _get_SnapdragonLLVMARM_string(const QString &sString); 351 | static VI_STRUCT _get_NASM_string(const QString &sString); 352 | static VI_STRUCT _get_TencentLegu_string(const QString &sString); 353 | static VI_STRUCT _get_OllvmTll_string(const QString &sString); 354 | static VI_STRUCT _get_DelphiVersionFromCompiler(const QString &sString); 355 | static VI_STRUCT _get_SourceryCodeBench_string(const QString &sString); 356 | static VI_STRUCT _get_Rust_string(const QString &sString); 357 | 358 | // Additional VI helpers moved from SpecAbstract 359 | static VI_STRUCT get_Watcom_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 360 | static VI_STRUCT get_PyInstaller_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 361 | static VI_STRUCT get_DWRAF_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 362 | static VI_STRUCT get_WindowsInstaller_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 363 | static VI_STRUCT get_gold_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, qint64 nSize, XBinary::PDSTRUCT *pPdStruct); 364 | static VI_STRUCT get_TurboLinker_vi(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions); 365 | 366 | static SCANS_STRUCT getScansStruct(quint32 nVariant, XBinary::FT fileType, XScanEngine::RECORD_TYPE type, XScanEngine::RECORD_NAME name, const QString &sVersion, 367 | const QString &sInfo, qint64 nOffset); 368 | 369 | // Check if any protection-related detections are present (moved from SpecAbstract) 370 | static bool isProtectionPresent(BASIC_INFO *pBasicInfo, XBinary::PDSTRUCT *pPdStruct); 371 | 372 | // Handle text-based file analysis (moved from SpecAbstract) 373 | static void handle_Texts(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo, XBinary::PDSTRUCT *pPdStruct); 374 | 375 | // Handle archive file analysis (moved from SpecAbstract) 376 | static void handle_Archives(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo, XBinary::PDSTRUCT *pPdStruct); 377 | 378 | // Handle certificate analysis (moved from SpecAbstract) 379 | static void handle_Certificates(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 380 | 381 | // Handle debug data analysis (moved from SpecAbstract) 382 | static void handle_DebugData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo, XBinary::PDSTRUCT *pPdStruct); 383 | 384 | // Handle format analysis (moved from SpecAbstract) 385 | static void handle_Formats(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 386 | 387 | // Handle database analysis (moved from SpecAbstract) 388 | static void handle_Databases(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 389 | 390 | // Handle image analysis (moved from SpecAbstract) 391 | static void handle_Images(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 392 | 393 | // Handle installer data analysis (moved from SpecAbstract) 394 | static void handle_InstallerData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 395 | 396 | // Handle SFX data analysis (moved from SpecAbstract) 397 | static void handle_SFXData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 398 | 399 | // Handle protector data analysis (moved from SpecAbstract) 400 | static void handle_ProtectorData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 401 | 402 | // Handle library data analysis (moved from SpecAbstract) 403 | static void handle_LibraryData(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 404 | 405 | // Handle resources analysis (moved from SpecAbstract) 406 | static void handle_Resources(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 407 | 408 | // Handle fix detects (moved from SpecAbstract) 409 | static void handle_FixDetects(QIODevice *pDevice, XScanEngine::SCAN_OPTIONS *pOptions, BINARYINFO_STRUCT *pBinaryInfo); 410 | 411 | // Get binary info (moved from SpecAbstract) 412 | static BINARYINFO_STRUCT getInfo(QIODevice *pDevice, XBinary::FT fileType, XScanEngine::SCANID parentId, XScanEngine::SCAN_OPTIONS *pOptions, qint64 nOffset, 413 | XBinary::PDSTRUCT *pPdStruct); 414 | 415 | signals: 416 | }; 417 | 418 | #endif // NFD_BINARY_H 419 | --------------------------------------------------------------------------------