@@ -47,7 +47,7 @@ public class Executable : IDetectable
47
47
public string ? Detect ( Stream stream , string file , bool includeDebug )
48
48
{
49
49
// Get all non-nested protections
50
- var protections = DetectDict ( stream , file , scanner : null , includeDebug ) ;
50
+ var protections = DetectDict ( stream , file , getProtections : null , includeDebug ) ;
51
51
if ( protections . Count == 0 )
52
52
return null ;
53
53
@@ -66,7 +66,10 @@ public class Executable : IDetectable
66
66
/// Ideally, we wouldn't need to circumvent the proper handling of file types just for Executable,
67
67
/// but due to the complexity of scanning, this is not currently possible.
68
68
/// </remarks>
69
- public ProtectionDictionary DetectDict ( Stream stream , string file , Scanner ? scanner , bool includeDebug )
69
+ public ProtectionDictionary DetectDict ( Stream stream ,
70
+ string file ,
71
+ Func < string , ProtectionDictionary > ? getProtections ,
72
+ bool includeDebug )
70
73
{
71
74
// Create the output dictionary
72
75
var protections = new ProtectionDictionary ( ) ;
@@ -99,7 +102,7 @@ public ProtectionDictionary DetectDict(Stream stream, string file, Scanner? scan
99
102
protections . Append ( file , subProtections . Values ) ;
100
103
101
104
// Extractable checks
102
- var extractedProtections = HandleExtractableProtections ( file , mz , subProtections . Keys , scanner , includeDebug ) ;
105
+ var extractedProtections = HandleExtractableProtections ( file , mz , subProtections . Keys , getProtections , includeDebug ) ;
103
106
protections . Append ( extractedProtections ) ;
104
107
}
105
108
else if ( wrapper is LinearExecutable lex )
@@ -109,7 +112,7 @@ public ProtectionDictionary DetectDict(Stream stream, string file, Scanner? scan
109
112
protections . Append ( file , subProtections . Values ) ;
110
113
111
114
// Extractable checks
112
- var extractedProtections = HandleExtractableProtections ( file , lex , subProtections . Keys , scanner , includeDebug ) ;
115
+ var extractedProtections = HandleExtractableProtections ( file , lex , subProtections . Keys , getProtections , includeDebug ) ;
113
116
protections . Append ( extractedProtections ) ;
114
117
}
115
118
else if ( wrapper is NewExecutable nex )
@@ -119,7 +122,7 @@ public ProtectionDictionary DetectDict(Stream stream, string file, Scanner? scan
119
122
protections . Append ( file , subProtections . Values ) ;
120
123
121
124
// Extractable checks
122
- var extractedProtections = HandleExtractableProtections ( file , nex , subProtections . Keys , scanner , includeDebug ) ;
125
+ var extractedProtections = HandleExtractableProtections ( file , nex , subProtections . Keys , getProtections , includeDebug ) ;
123
126
protections . Append ( extractedProtections ) ;
124
127
}
125
128
else if ( wrapper is PortableExecutable pex )
@@ -129,7 +132,7 @@ public ProtectionDictionary DetectDict(Stream stream, string file, Scanner? scan
129
132
protections . Append ( file , subProtections . Values ) ;
130
133
131
134
// Extractable checks
132
- var extractedProtections = HandleExtractableProtections ( file , pex , subProtections . Keys , scanner , includeDebug ) ;
135
+ var extractedProtections = HandleExtractableProtections ( file , pex , subProtections . Keys , getProtections , includeDebug ) ;
133
136
protections . Append ( extractedProtections ) ;
134
137
}
135
138
@@ -236,13 +239,13 @@ public IDictionary<U, string> RunExecutableChecks<T, U>(string file, T exe, List
236
239
/// <param name="file">Name of the source file of the stream, for tracking</param>
237
240
/// <param name="exe">Executable to scan the contents of</param>
238
241
/// <param name="checks">Set of classes returned from Exectuable scans</param>
239
- /// <param name="scanner">Scanner for handling recursive protections</param>
242
+ /// <param name="getProtections">Optional function for handling recursive protections</param>
240
243
/// <param name="includeDebug">True to include debug data, false otherwise</param>
241
244
/// <returns>Set of protections found from extraction, empty on error</returns>
242
245
private static ProtectionDictionary HandleExtractableProtections < T , U > ( string file ,
243
246
T exe ,
244
247
IEnumerable < U > checks ,
245
- Scanner ? scanner ,
248
+ Func < string , ProtectionDictionary > ? getProtections ,
246
249
bool includeDebug )
247
250
where T : WrapperBase
248
251
where U : IExecutableCheck < T >
@@ -260,7 +263,7 @@ private static ProtectionDictionary HandleExtractableProtections<T, U>(string fi
260
263
. Select ( c => c as IExtractableExecutable < T > ) ;
261
264
extractables . IterateWithAction ( extractable =>
262
265
{
263
- var subProtections = PerformExtractableCheck ( extractable ! , file , exe , scanner , includeDebug ) ;
266
+ var subProtections = PerformExtractableCheck ( extractable ! , file , exe , getProtections , includeDebug ) ;
264
267
protections . Append ( subProtections ) ;
265
268
} ) ;
266
269
@@ -273,13 +276,13 @@ private static ProtectionDictionary HandleExtractableProtections<T, U>(string fi
273
276
/// <param name="file">Name of the source file of the stream, for tracking</param>
274
277
/// <param name="exe">Executable to scan the contents of</param>
275
278
/// <param name="impl">IExtractableExecutable class representing the file type</param>
276
- /// <param name="scanner">Scanner for handling recursive protections</param>
279
+ /// <param name="getProtections">Optional function for handling recursive protections</param>
277
280
/// <param name="includeDebug">True to include debug data, false otherwise</param>
278
281
/// <returns>Set of protections in path, empty on error</returns>
279
282
private static ProtectionDictionary PerformExtractableCheck < T > ( IExtractableExecutable < T > impl ,
280
283
string file ,
281
284
T exe ,
282
- Scanner ? scanner ,
285
+ Func < string , ProtectionDictionary > ? getProtections ,
283
286
bool includeDebug )
284
287
where T : WrapperBase
285
288
{
@@ -296,8 +299,8 @@ private static ProtectionDictionary PerformExtractableCheck<T>(IExtractableExecu
296
299
297
300
// Collect and format all found protections
298
301
ProtectionDictionary ? subProtections = null ;
299
- if ( extracted )
300
- subProtections = scanner ? . GetProtections ( tempPath ) ;
302
+ if ( extracted && getProtections != null )
303
+ subProtections = getProtections ( tempPath ) ;
301
304
302
305
// If temp directory cleanup fails
303
306
try
0 commit comments