Documentation
¶
Index ¶
- Constants
- Variables
- func CreateTempDir() (string, func(), error)
- func DetectBurnManifest(extractDir string) (string, error)
- func ExtractArchive(archiveType ArchiveType, filePath string, extractDir string) error
- func ExtractCAB(cabPath string, extractDir string) error
- func ExtractZIP(filePath string, extractDir string) error
- func IsCabextractAvailable() bool
- func IsExecutable(filename string) bool
- func IsExpandAvailable() bool
- type ArchiveType
- type BurnManifest
- type BurnPayloadInfo
- type Chain
- type CleanupFunc
- type ExecutableFile
- type ExecutableFileMetadata
- type Inventory
- type InventoryFile
- type MsiPackage
- type MsuPackage
- type PackageInfo
- type Payload
- type PayloadRef
- type ScanResult
- type UXElement
Constants ¶
const ( ArchiveCAB = "cab" ArchiveZIP = "zip" )
Variables ¶
var ( CABSignature = []byte("MSCF") // CAB header signature ZIPSignature = []byte("PK\x03\x04") // ZIP local file header signature )
Archive signatures
var PeExtensions = []string{
".acm", ".ax", ".cpl", ".dll", ".drv", ".efi", ".exe", ".mui", ".ocx",
".scr", ".sys", ".tsp", ".mun", ".msstyles",
}
PeExtensions - extensions for Portable Executable (PE) files. This list may not be exhaustive, as the PE standard does not mandate specific extensions. The empty string is intentionally included to handle files without extensions.
Functions ¶
func CreateTempDir ¶
CreateTempDir creates a secure temporary directory for archive extraction
func DetectBurnManifest ¶
DetectBurnManifest looks for a BurnManifest file in the extracted directory
func ExtractArchive ¶
func ExtractArchive(archiveType ArchiveType, filePath string, extractDir string) error
ExtractArchive extracts an embedded archive based on its type
func ExtractCAB ¶
ExtractCAB extracts a CAB archive to the specified directory using external tools
func ExtractZIP ¶
ExtractZIP extracts a ZIP archive to the specified directory using Go's standard library
func IsCabextractAvailable ¶
func IsCabextractAvailable() bool
func IsExecutable ¶
IsExecutable checks if the file is an executable based on its extension
func IsExpandAvailable ¶
func IsExpandAvailable() bool
Types ¶
type BurnManifest ¶
type BurnManifest struct {
XMLName xml.Name `xml:"BurnManifest"`
UX UXElement `xml:"UX"`
Chain Chain `xml:"Chain"`
Payloads []Payload `xml:"Payload"`
}
BurnManifest represents the WiX Burn manifest structure
func ParseBurnManifest ¶
func ParseBurnManifest(manifestPath string) (*BurnManifest, error)
ParseBurnManifest parses a BurnManifest XML file
func (*BurnManifest) GetPackageInfo ¶
func (m *BurnManifest) GetPackageInfo() []PackageInfo
GetPackageInfo returns information about packages in the manifest
func (*BurnManifest) GetPayloadInfo ¶
func (m *BurnManifest) GetPayloadInfo() (map[string]*BurnPayloadInfo, error)
GetPayloadInfo extracts comprehensive payload information from the manifest
type BurnPayloadInfo ¶
type BurnPayloadInfo struct {
ID string
FilePath string
FileSize int64
Hash string
SourcePath string
Container string
PackageType string // "UX", "MSI", "MSU", or "Unknown"
PackageID string
ProductCode string
Version string
}
BurnPayloadInfo contains enriched payload information
type Chain ¶
type Chain struct {
MsiPackages []MsiPackage `xml:"MsiPackage"`
MsuPackages []MsuPackage `xml:"MsuPackage"`
}
Chain contains the installation chain packages
type CleanupFunc ¶
type CleanupFunc func()
type ExecutableFile ¶
type ExecutableFile struct {
Metadata ExecutableFileMetadata
Path string
Includes []ExecutableFile
}
type ExecutableFileMetadata ¶
type ExecutableFileMetadata struct {
// Path to the executable file
FilePath string `json:"filePath,omitempty"`
// Original file name
OriginalFileName string `json:"originalFileName,omitempty"`
// Assembly name
AssemblyVersion string `json:"assemblyVersion,omitempty"`
// Internal name of the product
InternalName string `json:"internalName,omitempty"`
// Product name
ProductName string `json:"productName,omitempty"`
// Product version
ProductVersion string `json:"productVersion,omitempty"`
// File description
FileDescription string `json:"fileDescription,omitempty"`
// File version
FileVersion string `json:"fileVersion,omitempty"`
// Company that produced the file
CompanyName string `json:"companyName,omitempty"`
// Copyright information
LegalCopyright string `json:"legalCopyright,omitempty"`
// Trademark information
Trademark string `json:"trademark,omitempty"`
// Comments
Comments string `json:"comments,omitempty"`
// Language/locale
Language string `json:"language,omitempty"`
// PE architecture (e.g., x86, x64, ARM)
Architecture string `json:"architecture,omitempty"`
// Timestamp from PE header
Timestamp uint32 `json:"timestamp,omitempty"`
}
func ExtractPEMetadata ¶
func ExtractPEMetadata(filePath string) (*ExecutableFileMetadata, error)
type Inventory ¶
type Inventory []InventoryFile
Inventory represents a complete file inventory from extracted archives
func ScanDirectory ¶
type InventoryFile ¶
type InventoryFile struct {
Filename string
InstallationPath string
SHA256 string
Size int64
IsArchive bool
IsInstaller bool
ArchiveFormat ArchiveType
// PE data
Meta *ExecutableFileMetadata
SourceFilePath string // for debugging
Contents []InventoryFile
}
InventoryFile represents a single file in the inventory
func EnrichInventoryWithBurnManifest ¶
func EnrichInventoryWithBurnManifest(files []InventoryFile, extractDir string) ([]InventoryFile, error)
EnrichInventoryWithBurnManifest enriches inventory files with BurnManifest metadata
func ScanFile ¶
func ScanFile(filePath string) (InventoryFile, error)
ScanFile creates an InventoryFile from an absolute path to a file on disk (recursively)
type MsiPackage ¶
type MsiPackage struct {
ID string `xml:"Id,attr"`
ProductCode string `xml:"ProductCode,attr"`
Version string `xml:"Version,attr"`
PayloadRefs []PayloadRef `xml:"PayloadRef"`
}
MsiPackage represents an MSI package in the chain
type MsuPackage ¶
type MsuPackage struct {
ID string `xml:"Id,attr"`
KB string `xml:"KB,attr"`
PayloadRefs []PayloadRef `xml:"PayloadRef"`
}
MsuPackage represents an MSU package in the chain
type PackageInfo ¶
type PackageInfo struct {
ID string
Type string
ProductCode string
Version string
KB string
PayloadIDs []string
}
PackageInfo represents package information from the manifest
type Payload ¶
type Payload struct {
ID string `xml:"Id,attr"`
FilePath string `xml:"FilePath,attr"`
FileSize string `xml:"FileSize,attr"`
Hash string `xml:"Hash,attr"`
SourcePath string `xml:"SourcePath,attr"`
Container string `xml:"Container,attr"`
}
Payload represents a file payload in the manifest
type PayloadRef ¶
type PayloadRef struct {
ID string `xml:"Id,attr"`
}
PayloadRef references a payload by ID
type ScanResult ¶
type ScanResult struct {
Files []ExecutableFile
}