Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- using CommandLine;
- using CommandLine.Text;
- using System;
- using System.IO;
- using System.Runtime.InteropServices;
- using System.Text;
- // Facebook: -b "C:\Users\Fela\Downloads\Smandruppo\Facebook\mainBundle.dll" -o "Facebook"
- // Messenger: -b "C:\Users\Fela\Downloads\Smandruppo\Messenger\mainBundle.dll" -o "Messenger"
- // Instagram: -b "C:\Users\Fela\Downloads\Smandruppo\Instagram\mainBundle.dll" -o "Instagram"
- namespace TestMainBundle
- {
- class Program
- {
- const int PKZip = 67324752; // 50 4B 03 04
- static void Main(string[] args)
- {
- var options = new Options();
- if (Parser.Default.ParseArguments(args, options))
- {
- if (File.Exists(options.MainBundle))
- {
- if (options.Output == null)
- {
- options.Output = Path.GetDirectoryName(options.MainBundle);
- options.Output = Path.GetFileName(options.Output);
- }
- Directory.CreateDirectory(options.Output);
- using (var stream = new FileStream(options.MainBundle, FileMode.Open, FileAccess.Read))
- {
- var reader = new BinaryReader(stream);
- var dosHeader = reader.ReadStruct<IMAGE_DOS_HEADER>();
- stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);
- var ntHeadersSignature = reader.ReadUInt32();
- var fileHeader = reader.ReadStruct<IMAGE_FILE_HEADER>();
- if ((0x0100 & fileHeader.Characteristics) == 0x0100) // IMAGE_FILE_32BIT_MACHINE
- {
- stream.Seek(224, SeekOrigin.Current); // IMAGE_OPTIONAL_HEADER32 size
- }
- else
- {
- stream.Seek(240, SeekOrigin.Current); // IMAGE_OPTIONAL_HEADER64 size
- }
- for (int i = 0; i < fileHeader.NumberOfSections; ++i)
- {
- var dataSegment = reader.ReadStruct<IMAGE_SECTION_HEADER>();
- if (dataSegment.Section.StartsWith(".data"))
- {
- stream.Seek(dataSegment.PointerToRawData, SeekOrigin.Begin);
- var length = reader.ReadUInt32();
- var reserved = reader.ReadUInt32();
- while (stream.Position - dataSegment.PointerToRawData < length)
- {
- var pkzip = reader.ReadStruct<PKZIP_FILE_HEADER>();
- if (pkzip.Signature == PKZip)
- {
- var fileNameBuffer = reader.ReadBytes(pkzip.FileNameLength);
- var fileName = Encoding.Default.GetString(fileNameBuffer);
- if (pkzip.ExtraFieldLength > 0)
- {
- reader.ReadBytes(pkzip.ExtraFieldLength); // SKIP
- }
- var fileBuffer = reader.ReadBytes((int)pkzip.CompressedSize);
- if (fileName.EndsWith("/"))
- {
- Directory.CreateDirectory(Path.Combine(options.Output, fileName.TrimEnd('/')));
- }
- else
- {
- File.WriteAllBytes(Path.Combine(options.Output, fileName.Replace("/", "\\")), fileBuffer);
- }
- }
- else
- {
- stream.Seek(stream.Length, SeekOrigin.Begin);
- Console.WriteLine("No a PKZip, ending at: {0:X}", stream.Position);
- }
- }
- Console.WriteLine("Done");
- }
- }
- }
- }
- }
- }
- }
- static class Extensions
- {
- public static T ReadStruct<T>(this BinaryReader reader)
- {
- byte[] bytes = reader.ReadBytes(Marshal.SizeOf(typeof(T)));
- GCHandle handle = GCHandle.Alloc(bytes, GCHandleType.Pinned);
- T theStructure = (T)Marshal.PtrToStructure(handle.AddrOfPinnedObject(), typeof(T));
- handle.Free();
- return theStructure;
- }
- }
- class Options
- {
- [Option('b', "bundle", Required = true, HelpText = "Main bundle to be processed.")]
- public string MainBundle { get; set; }
- [Option('o', "output", HelpText = "Prints all messages to standard output.")]
- public string Output { get; set; }
- [ParserState]
- public IParserState LastParserState { get; set; }
- [HelpOption]
- public string GetUsage()
- {
- return HelpText.AutoBuild(this, (current) => HelpText.DefaultParsingErrorsHandler(this, current));
- }
- }
- #region PKZip Header Structures
- [StructLayout(LayoutKind.Sequential, Pack = 1)]
- public struct PKZIP_FILE_HEADER
- {
- public UInt32 Signature;
- public UInt16 Version;
- public UInt16 Flags;
- public UInt16 Compression;
- public UInt16 ModificationTime;
- public UInt16 ModificationDate;
- public UInt32 Crc32;
- public UInt32 CompressedSize;
- public UInt32 UncompressedSize;
- public UInt16 FileNameLength;
- public UInt16 ExtraFieldLength;
- }
- #endregion
- #region Portable Executable Header Structures
- public struct IMAGE_DOS_HEADER
- {
- public UInt16 e_magic; // Magic number
- public UInt16 e_cblp; // Bytes on last page of file
- public UInt16 e_cp; // Pages in file
- public UInt16 e_crlc; // Relocations
- public UInt16 e_cparhdr; // Size of header in paragraphs
- public UInt16 e_minalloc; // Minimum extra paragraphs needed
- public UInt16 e_maxalloc; // Maximum extra paragraphs needed
- public UInt16 e_ss; // Initial (relative) SS value
- public UInt16 e_sp; // Initial SP value
- public UInt16 e_csum; // Checksum
- public UInt16 e_ip; // Initial IP value
- public UInt16 e_cs; // Initial (relative) CS value
- public UInt16 e_lfarlc; // File address of relocation table
- public UInt16 e_ovno; // Overlay number
- public UInt16 e_res_0; // Reserved words
- public UInt16 e_res_1; // Reserved words
- public UInt16 e_res_2; // Reserved words
- public UInt16 e_res_3; // Reserved words
- public UInt16 e_oemid; // OEM identifier (for e_oeminfo)
- public UInt16 e_oeminfo; // OEM information; e_oemid specific
- public UInt16 e_res2_0; // Reserved words
- public UInt16 e_res2_1; // Reserved words
- public UInt16 e_res2_2; // Reserved words
- public UInt16 e_res2_3; // Reserved words
- public UInt16 e_res2_4; // Reserved words
- public UInt16 e_res2_5; // Reserved words
- public UInt16 e_res2_6; // Reserved words
- public UInt16 e_res2_7; // Reserved words
- public UInt16 e_res2_8; // Reserved words
- public UInt16 e_res2_9; // Reserved words
- public UInt32 e_lfanew; // File address of new exe header
- }
- [StructLayout(LayoutKind.Sequential, Pack = 1)]
- public struct IMAGE_FILE_HEADER
- {
- public UInt16 Machine;
- public UInt16 NumberOfSections;
- public UInt32 TimeDateStamp;
- public UInt32 PointerToSymbolTable;
- public UInt32 NumberOfSymbols;
- public UInt16 SizeOfOptionalHeader;
- public UInt16 Characteristics;
- }
- [StructLayout(LayoutKind.Explicit)]
- public struct IMAGE_SECTION_HEADER
- {
- [FieldOffset(0)]
- [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
- public char[] Name;
- [FieldOffset(8)]
- public UInt32 VirtualSize;
- [FieldOffset(12)]
- public UInt32 VirtualAddress;
- [FieldOffset(16)]
- public UInt32 SizeOfRawData;
- [FieldOffset(20)]
- public UInt32 PointerToRawData;
- [FieldOffset(24)]
- public UInt32 PointerToRelocations;
- [FieldOffset(28)]
- public UInt32 PointerToLinenumbers;
- [FieldOffset(32)]
- public UInt16 NumberOfRelocations;
- [FieldOffset(34)]
- public UInt16 NumberOfLinenumbers;
- [FieldOffset(36)]
- public UInt32 Characteristics;
- public string Section
- {
- get { return new string(Name); }
- }
- }
- #endregion File Header Structures
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement