Massively improve compressed IBM SurePath detection

This commit is contained in:
RichardG867
2022-05-17 11:34:29 -03:00
parent 6c10e8001f
commit edaef20ca8

View File

@@ -1517,7 +1517,7 @@ class IBMSurePathAnalyzer(Analyzer):
b'''\\(\\(CC\\)\\) CCOOPPYYRRIIGGHHTT (?:IIBBMM CCOORRPPOORRAATTIIOONN 11998811,, ([0-9])\\1([0-9])\\2([0-9])\\3([0-9])\\4|11998811,, ([0-9])\\5([0-9])\\6([0-9])\\7([0-9])\\8 IIBBMM CCOORRPPOORRAATTIIOONN) (?:-- )?AALLLL RRIIGGHHTTSS RREESSEERRVVEEDD|'''
b'''\\(C\\) COPYRIGHT (?:IBM CORPORATION 1981, [0-9]{4}|1981, [0-9]{4} IBM CORPORATION) (?:- )?ALL RIGHTS RESERVED[ \\x0D\\x0A]*(?:[\\x00\\xFF]|US Government Users)'''
)
self._ibm_later_pattern = re.compile(b'''\\xAA{8}\\x55{8}IBM PC Co\\. BIOS |PS/1 POWER MANAGEMENT\\x00| IBM Hibernation Code |SERIAL#SYSTEMBOARDMACHINE''')
self._ibm_later_pattern = re.compile(b'''\\xAA\\x55VPD0RESERVE([0-9A-Z]{7})''')
self._surepath_pattern = re.compile(b'''SurePath BIOS Version ([\\x20-\\x7E]+)(?:[\\x0D\\x0A\\x00]+([\\x20-\\x7E]+)?)?''')
self._apricot_pattern = re.compile(b'''@\\(#\\)(?:Apricot .*|XEN-PC) BIOS [\\x20-\\x7E]+''')
self._apricot_version_pattern = re.compile(b'''@\\(#\\)Version [\\x20-\\x7E]+''')
@@ -1530,11 +1530,14 @@ class IBMSurePathAnalyzer(Analyzer):
match = self._surepath_pattern.search(file_data)
if match:
# Extract version.
self.version = 'SurePath ' + match.group(1).decode('cp437', 'ignore').strip()
self.version = match.group(1)
self._debug_print('Found uncompressed version:', self.version)
self.version = 'SurePath ' + self.version.decode('cp437', 'ignore').strip()
# Extract customization as a sign-on if found. (AT&T Globalyst)
customization = match.group(2)
if customization:
self._debug_print('Found AT&T customization:', customization)
self.signon = customization.decode('cp437', 'ignore')
else:
# Special case for Apricot-licensed SurePath.
@@ -1545,18 +1548,35 @@ class IBMSurePathAnalyzer(Analyzer):
self.version = 'SurePath'
# Extract Apricot customization as a sign-on.
self.signon = match.group(0).decode('cp437', 'ignore')[4:]
customization = match.group(0)
self._debug_print('Found Apricot customization:', customization)
self.signon = customization.decode('cp437', 'ignore')[4:]
match = self._apricot_version_pattern.search(file_data)
if match:
self.signon = self.signon.strip() + '\n' + match.group(0).decode('cp437', 'ignore')[4:].strip()
elif self._ibm_later_pattern.search(file_data):
# Later compressed SurePath. No further information.
self.version = 'SurePath'
else:
return False
match = self._ibm_later_pattern.search(file_data)
if match:
# Later compressed SurePath. No further information,
# except for an ID string at the end of some of them.
self.version = 'SurePath'
id_string = match.group(1)
self.debug_print('Found VPD ID string:', id_string)
self.string = id_string.decode('cp437', 'ignore')
else:
return False
# Look for entrypoint dates.
old_string = self.string
self.string = ''
NoInfoAnalyzer.get_entrypoint_dates(self, file_data)
if old_string:
if self.string:
self.debug_print('Found entry point date:', self.string)
self.string = old_string + '\n' + self.string
else:
self.string = old_string
return True