Re: [Selfext-user] SFX protection

[Mike W. <mik...@nt...>]

Hi Kei,

The mailing list system seems a little slow, appologies for that. Hopefully 
by now you will have received my previous reply (which includes a patch to do 
this for you).

Please post in plain text rather than html, if your system allows it.

> Last night I've decided that removing 4 bytes is too much of a hassle
> because it requires the offset to be corrected at later Fileread incidents,
> so instead I've not altered the cabinet size, instead changing the first
> byte from 'M' to a NULL. This is enough to trick other archivers :)

If you remove the 4 bytes then subtract 4 from nOffset in Extract() before 
the call to CheckValid(), though you're right, easier still is to modify them.

> This is the working code that I've got after struggling for a whole night..
> (g_iExeSize is the size of the EXE file, while g_bMutant is a BOOL which is
> true when we are dealing with the "mutant cabinet" (the Cabinet with a NULL
> in the first char))

You can use GetPtr() to get the offset to the cab's signature:

    const file_struct *pfs = GetPtr(hf);

where file_struct is:

    struct file_struct
    {
        HANDLE  m_hFile;    // the Windows file handle
        int     m_nOffset;  // the offset to the cab's signature
    };

> By the way... is there a way that I can extract data directly to memory or
> to a buffer instead of writing it physically to the disk? (Because the data
> is not supposed to be known by the user, it's for the SFX's internal use)

Yes you can do that. If you look at the switch statement in the notify() 
function, 'case fdintCOPY_FILE' is called to open each output file and 'case 
fdintCLOSE_FILE_INFO' is called to close it again. In between the 
'file_write' function is called to write the data. So by replacing these 
parts you can redirect the data somewhere else.

> I'd be glad if you can help me~

I'll do my best.

Mike