View Single Post
  #1  
Old 04-21-2022, 10:36
WhoCares's Avatar
WhoCares WhoCares is offline
who cares
 
Join Date: Jan 2002
Location: Here
Posts: 410
Rept. Given: 10
Rept. Rcvd 17 Times in 15 Posts
Thanks Given: 42
Thanks Rcvd at 155 Times in 61 Posts
WhoCares Reputation: 17
Extract exe/dll from EXE compressed by Netz Compressor

Netz Compressor is a packager for .Net assemblies.
https://github.com/madebits/msnet-netz-compressor

The following code extracts exe/dll from the manifest resource of target EXE.
tested with .NetCore 3.1. You can add error handling yourself.

target for testing:
https://www.apowersoft.com

Code:
using System;
using System.IO;

// NuGet console command: dotnet add package SharpZipLib
using ICSharpCode.SharpZipLib.Zip.Compression.Streams;
using ICSharpCode.SharpZipLib.Zip.Compression;

// NuGet console command: Install-Package System.Reflection.MetadataLoadContext
using System.Reflection;

using System.Resources;
using System.Runtime.InteropServices;
using System.Collections.Generic;
using System.Collections;

namespace NetzStarter
{
    internal class Program
    {
        private static MemoryStream Zip(byte[] data)
        {
            if (data == null)
            {
                return null;
            }

            MemoryStream outStream = null;
            DeflaterOutputStream zipStream = null;

            try
            {
                outStream = new MemoryStream();
                var defl = new Deflater(Deflater.BEST_COMPRESSION, true);
                defl.SetLevel(Deflater.BEST_COMPRESSION);
                defl.SetStrategy(DeflateStrategy.Filtered);
                zipStream = new DeflaterOutputStream(outStream, defl);
                zipStream.Write(data, 0, data.Length);
                zipStream.Flush();
                zipStream.Finish();
            }
            finally
            {
                if (zipStream != null)
                {
                    zipStream.Close();
                    zipStream = null;
                }
            }

            return outStream;
        }

        private static void Zip(string srcFile, string destFile)
        {
            byte[] b = File.ReadAllBytes(srcFile);

            try
            {
                using (MemoryStream stream = Zip(b))
                {
                    stream.Seek(0L, SeekOrigin.Begin);
                    File.WriteAllBytes(destFile, stream.ToArray());
                }
            }
            catch (Exception exception)
            {
                string error = string.Concat(new object[] { "#Error: ", exception.GetType().ToString(), Environment.NewLine, exception.Message, Environment.NewLine, exception.StackTrace, Environment.NewLine, exception.InnerException, Environment.NewLine, "Using  .NET Runtime: ", Environment.Version.ToString(), Environment.NewLine, "Created with", " .NET Runtime: 2.0.50727.4927" });
            }
        }

        private static MemoryStream UnZip(byte[] data)
        {
            if (data == null)
            {
                return null;
            }

            MemoryStream inputStream = null;
            MemoryStream outputStream = null;
            InflaterInputStream unzipStream = null;

            try
            {
                outputStream = new MemoryStream(data.Length);

                inputStream = new MemoryStream(data);
                unzipStream = new InflaterInputStream(inputStream);
                byte[] buffer = new byte[data.Length];
                while (true)
                {
                    int count = unzipStream.Read(buffer, 0, buffer.Length);
                    if (count <= 0)
                    {
                        break;
                    }
                    outputStream.Write(buffer, 0, count);
                }

                outputStream.Flush();
            }
            finally
            {
                if (inputStream != null)
                {
                    inputStream.Close();
                    inputStream = null;
                }

                if (unzipStream != null)
                {
                    unzipStream.Close();
                    unzipStream = null;
                }
            }

            return outputStream;
        }


        private static void Unzip(string srcFile, string destFile)
        {
            byte[] b = File.ReadAllBytes(srcFile);

            try
            {
                using (MemoryStream stream = UnZip(b))
                {
                    stream.Seek(0L, SeekOrigin.Begin);
                    File.WriteAllBytes(destFile, stream.ToArray());
                }
            }
            catch (Exception exception)
            {
                string error = string.Concat(new object[] { "#Error: ", exception.GetType().ToString(), Environment.NewLine, exception.Message, Environment.NewLine, exception.StackTrace, Environment.NewLine, exception.InnerException, Environment.NewLine, "Using  .NET Runtime: ", Environment.Version.ToString(), Environment.NewLine, "Created with", " .NET Runtime: 2.0.50727.4927" });
            }
        }

        private static string DemangleDllName(string dll)
        {
            string text = dll.Replace("!1", " ");
            text = text.Replace("!2", ",");
            text = text.Replace("!3", ".Resources");
            return text.Replace("!4", "Culture");
        }

        private static void ExtractManifestResources(string file, string outDir)
        {
            var resolver = new PathAssemblyResolver(new List(Directory.GetFiles(RuntimeEnvironment.GetRuntimeDirectory(), "*.dll")) {
                file
            });

            using (var metadataContext = new MetadataLoadContext(resolver))
            {
                Assembly assembly = metadataContext.LoadFromAssemblyPath(file);
                var names = assembly.GetManifestResourceNames();
                foreach (var name in names)
                {
                    using (var stream = assembly.GetManifestResourceStream(name))
                    {
                        ResourceSet set = new ResourceSet(stream);
                        IDictionaryEnumerator enumerator = set.GetEnumerator();
                        while (enumerator.MoveNext())
                        {
                            if (enumerator.Value.GetType() != typeof(byte[]))
                                continue;
                            
                            string outFileName;
                            
                            string resName = DemangleDllName(enumerator.Key.ToString());
                            if (resName == "zip.dll")
                            {
                                continue;
                            }
                            else if (resName == "A6C24BF5-3690-4982-887E-11E1B159B249")
                            {
                                outFileName = outDir + "\\APowerMirror.exe";
                            }
                            else
                            {
                                Int32 pos = resName.IndexOf(',');
                                outFileName = outDir + "\\" + resName.Substring(0, pos) + ".dll";
                            }

                            byte[] data = (enumerator.Value as byte[]);
                            Console.WriteLine("try extracting: {0} ({1} bytes)", outFileName, data.Length);
                            MemoryStream fileStream = UnZip(data);
                            File.WriteAllBytes(outFileName, fileStream.ToArray());
                        }
                    }
                }
            }
        }

        static void Main(string[] args)
        {
            ExtractManifestResources("C:\\Program Files (x86)\\Apowersoft\\ApowerMirror\\APowerMirror.exe", "e:\\temp\\netz");
        }
    }
}
__________________
AKA Solomon/blowfish.
Reply With Quote
The Following User Gave Reputation+1 to WhoCares For This Useful Post:
user1 (04-21-2022)
The Following 10 Users Say Thank You to WhoCares For This Useful Post:
besoeso (04-24-2022), Mahmoudnia (04-30-2022), MarcElBichon (04-21-2022), niculaita (04-21-2022), NoneForce (04-21-2022), T-rad (04-22-2022), tonyweb (04-21-2022), user1 (04-21-2022), yoza (04-21-2022)