More IBM weirdness: ARDI self extractor and one more compressed SurePath signature

This commit is contained in:
RichardG867
2022-05-15 14:36:38 -03:00
parent 90b9f4fd0a
commit 04770a0539
2 changed files with 7 additions and 2 deletions

View File

@@ -1518,7 +1518,7 @@ class IBMSurePathAnalyzer(Analyzer):
b'''\\(\\(CC\\)\\) CCOOPPYYRRIIGGHHTT (?:IIBBMM CCOORRPPOORRAATTIIOONN 11998811,, ([0-9])\\1([0-9])\\2([0-9])\\3([0-9])\\4|11998811,, ([0-9])\\5([0-9])\\6([0-9])\\7([0-9])\\8 IIBBMM CCOORRPPOORRAATTIIOONN) (?:-- )?AALLLL RRIIGGHHTTSS RREESSEERRVVEEDD|'''
b'''\\(C\\) COPYRIGHT (?:IBM CORPORATION 1981, [0-9]{4}|1981, [0-9]{4} IBM CORPORATION) (?:- )?ALL RIGHTS RESERVED[ \\x0D\\x0A]*(?:[\\x00\\xFF]|US Government Users)'''
)
self._ibm_later_pattern = re.compile(b'''\\xAA{8}\\x55{8}IBM PC Co\\. BIOS |PS/1 POWER MANAGEMENT\\x00| IBM Hibernation Code ''')
self._ibm_later_pattern = re.compile(b'''\\xAA{8}\\x55{8}IBM PC Co\\. BIOS |PS/1 POWER MANAGEMENT\\x00| IBM Hibernation Code |SERIAL#SYSTEMBOARDMACHINE''')
self._surepath_pattern = re.compile(b'''SurePath BIOS Version ([\\x20-\\x7E]+)(?:[\\x0D\\x0A\\x00]+([\\x20-\\x7E]+)?)?''')
self._apricot_pattern = re.compile(b'''@\\(#\\)(?:Apricot .*|XEN-PC) BIOS [\\x20-\\x7E]+''')
self._apricot_version_pattern = re.compile(b'''@\\(#\\)Version [\\x20-\\x7E]+''')

View File

@@ -2374,7 +2374,8 @@ class VMExtractor(ArchiveExtractor):
b'''( FastPacket V[0-9])|''' # Siemens Nixdorf FastPacket
b''', Sydex, Inc\\. All Rights Reserved\\.|''' # IBM Sydex
b'''Disk eXPress Self-Extracting Diskette Image|''' # HP DXP
b'''(\\x00Diskette Image Decompression Utility\\.\\x00)''' # NEC in-house
b'''(\\x00Diskette Image Decompression Utility\\.\\x00)|''' # NEC in-house
b'''(Copyright Daniel Valot |\\x00ARDI - \\x00)''' # IBM ARDI
)
self._eti_pattern = re.compile(b'''[0-9\\.\\x00]{10}[0-9]{2}/[0-9]{2}/[0-9]{2}\\x00{2}[0-9]{2}:[0-9]{2}:[0-9]{2}\\x00{3}''')
@@ -2487,9 +2488,13 @@ class VMExtractor(ArchiveExtractor):
f.write(b'exit\r\n') # just in case
f.write(b':sfx\r\n')
f.write(b'move /y config.old config.sys\r\n') # just in case again (snapshot shouldn't persist changes)
elif match.group(3): # ARDI
f.write(b'echo.|')
f.write(b'd:' + exe_name.encode('cp437', 'ignore'))
if match.group(1): # FastPacket
f.write(b' /b a:\r\n')
elif match.group(3): # ARDI
f.write(b'\r\n')
else:
f.write(b' a: <c:\\y.txt\r\n')
f.close()