_IsUPX() - Checks if a supported file is UPX'd.

[KaFu]

That's a great piece of code there, thanks for the clarification m8 !

[Skitty]

Mobius's example was very relevant to what I was after, I added a few other compressor signature strings to his function.

expandcollapse popup

$Test = _IsPKD(@DesktopDir & "\1.exe", 1)
MsgBox(0, "compressor detector", $Test[0] & @CRLF & $Test[1])
 
Func _IsPKD($sFilePath, $iDeep = 0)
Local $iValue[2] = [0, False], $sData, _
$hFileOpen = FileOpen($sFilePath, 16)
If $hFileOpen = -1 Then Return SetError(1, 0, -1)
If FileRead($hFileOpen, 2) <> "MZ" Then
FileClose($hFileOpen)
Return SetError(2, 0, 0)
EndIf
FileSetPos($hFileOpen, 0, 0)
Switch $iDeep
Case True
$sData = FileRead($hFileOpen)
Case Else
$sData = FileRead($hFileOpen, 1024)
EndSwitch
FileClose($hFileOpen)
Select
Case StringInStr($sData, '58436F6D70', 2, 1) ;XCompw
StringReplace($sData, 'C00000D02E58436F6D70', 'C00000D02E58436F6D70', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "XCompw"
Case StringInStr($sData, '585061636B', 2, 1) ;XPackw
StringReplace($sData, 'D02E585061636B', 'D02E585061636B', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "XPackw"
Case StringInStr($sData, '5757503332', 2, 1) ;wwpack
StringReplace($sData, '57575061636B3332', '57575061636B3332', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "wwpack"
Case StringInStr($sData, '2E524C5061636B00', 2, 1) ;RLPack
StringReplace($sData, '7061636B6564', '7061636B6564', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "RLPack"
Case StringInStr($sData, '6E737061636B', 2, 1) ;nSpack
StringReplace($sData, '6E737030', '6E737030', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "nSpack"
Case StringInStr($sData, '557061636B', 2, 1) Or StringInStr($sData, 'C80346382BC7ABE2E55E', 2, 1);WinUpackE
StringReplace($sData, 'C075FB380674EA8B', 'C075FB380674EA8B', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "WinUpackE"
Case StringInStr($sData, '65786533327061636B20', 2, 1);exe32pack
StringReplace($sData, '65786533327061636B20', '65786533327061636B20', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "exe32pack"
Case StringInStr($sData, '46534721', 2, 1);FSG
StringReplace($sData, 'C073FA753A', 'C073FA753A', 0, 2);Maybe shouldn't use this value
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "FSG"
Case StringInStr($sData, '61737061636B', 2, 1);ASPack
StringReplace($sData, '00400000E000', '00400000E000', 0, 2);Maybe shouldn't use this value
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "ASPack"
Case StringInStr($sData, '50454332', 2, 1);PECompact
StringReplace($sData, '5045436F6D70616374', '5045436F6D70616374', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "PECompact"
Case StringInStr($sData, '555058', 2, 1);UPX
StringReplace($sData, '555058', '555058', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "UPX"
Case StringInStr($sData, '4D5052455353', 2, 1);MPress
StringReplace($sData, '4D5052455353', '4D5052455353', 0, 2)
If $iDeep = 0 Then
Return SetError(0, @extended, 1)
EndIf
$iValue[0] += 1
$iValue[1] = "MPress"
Case Else
If $iDeep = 0 Then
Return SetError(3, 0, 0)
EndIf
EndSelect
If @extended Then
$iValue[0] += 1
EndIf
Return SetError(0, @extended, $iValue)
EndFunc   ;==>_IsPKD

[Skitty]

I came up with another method using work done by trancexx, is this a good way about doing this? in the process I even added other miscellaneous detentions, but aside from that, it seems to detect most packed PE files I've encountered.

PACKED file detector.rar

[guinness]

I've updated the syntax of both functions as well as the documentation headers. See the original post for more details.