Add Access Methods strings as well

This commit is contained in:
RichardG867
2022-03-15 19:47:52 -03:00
parent ee63d6e865
commit 3cc1a80dc9

View File

@@ -332,8 +332,11 @@ class AMIAnalyzer(Analyzer):
self._precolor_block_pattern = re.compile(b'''\(C\)(?:[0-9]{4}(?:AMI,404-263-8181|TGem-HCS,PSC,JGS)|( Access Methods Inc\.))''')
# "Date:-" might not have a space after it (Intel AMI)
self._precolor_date_pattern = re.compile(b'''(?:(?: Date:- ?|AMI- )[0-9]{2}/[0-9]{2}/[0-9]{2}|DDaattee(?:::| )--(?: )?([0-9])\\1([0-9])\\2//([0-9])\\3([0-9])\\4//([0-9])\\5([0-9])\\6)''')
self._precolor_string_pattern = re.compile(b'''\\xFE{4}((?:[\\x00-\\xFF]{4}\\x96){2}[\\x00-\\xFF]{6})''')
# Decoded: "\xFE([^-]{4}-(?:[^-]{4}-)?[^-]{6})"
self._precolor_string_pattern = re.compile(b'''\\xFE([\\x00-\\x95\\x97-\\xFF]{4}\\x96(?:[\\x00-\\x95\\x97-\\xFF]{4}\\x96)?[\\x00-\\x95\\x97-\\xFF]{6})''')
self._precolor_signon_pattern = re.compile(b'''BIOS \(C\).*(?:AMI|American Megatrends Inc), for ([\\x0D\\x0A\\x20-\\x7E]+)''')
# Decoded: "\(C\)AMI, \(([^\)]{11})\)"
self._8088_string_pattern = re.compile(b'''\\xEC\\x5F\\x6C\\x60\\x5A\\x5C\\xEA\\xF0\\xEC([\\x00-\\x6B\\x6D-\\xFF]{11})\\x6C''')
self.register_check_list([
(self._string_pcchips, RegexChecker),
@@ -416,39 +419,46 @@ class AMIAnalyzer(Analyzer):
# Determine location of the identification block.
id_block_index = match.start(0)
# Access Methods doesn't have the setup type and chipset.
if not match.group(1):
# Locate the encoded string.
match = self._precolor_string_pattern.search(file_data)
if match:
# Extract string.
self.string = ''
for c in match.group(1):
c = ~c & 0xff
c = ((c << 5) | (c >> 3)) & 0xff
self.string += chr(c)
return True
else:
# Fallback if we can't find the encoded string.
self.string = '????-'
# Add vendor ID.
self.string += codecs.encode(file_data[id_block_index - 0xbb:id_block_index - 0xb9], 'hex').decode('ascii', 'ignore').upper()
# Add date.
self.string += '-' + util.read_string(file_data[id_block_index + 0x9c:id_block_index + 0xa4]).replace('/', '').strip()
# Invalidate string if the identification block doesn't
# appear to be valid. (Intel AMI post-Color without string)
if self.string[:10] in ('????-0000-', '????-0166-'):
# Locate the encoded string.
match = self._precolor_string_pattern.search(file_data)
if match:
# Extract string.
self.string = ''
return True
for c in match.group(1):
c = ~c & 0xff
c = ((c << 5) | (c >> 3)) & 0x7f
self.string += chr(c)
else:
# Fallback if we can't find the encoded string.
self.string = '????-'
# Add vendor ID.
self.string += codecs.encode(file_data[id_block_index - 0xbb:id_block_index - 0xb9], 'hex').decode('ascii', 'ignore').upper()
# Add date.
self.string += '-' + util.read_string(file_data[id_block_index + 0x9c:id_block_index + 0xa4]).replace('/', '').strip()
# Invalidate string if the identification block doesn't
# appear to be valid. (Intel AMI post-Color without string)
if self.string[:10] in ('????-0000-', '????-0166-'):
self.string = ''
return True
elif check_match.group(1): # 8088-BIOS header
# Extract version.
self.version = check_match.group(1).decode('cp437', 'ignore')
# More string guesswork, but in this case, the vendor ID is nowhere to be seen.
self.string = '????-' + self.version.replace('/', '')
# Locate the encoded string.
match = self._8088_string_pattern.search(file_data)
if match:
# Extract string.
self.string = ''
for c in match.group(1):
c = -c & 0xff
c = ((c << 1) | (c >> 7)) & 0x7f
self.string += chr(c)
else:
# Fallback if we can't find the encoded string.
self.string = '????-' + self.version.replace('/', '')
# Extract additional information after the copyright as a sign-on.
# (Shuttle 386SX, CDTEK 286, Flying Triumph Access Methods)