Skip to content

Commit c6e04f4

Browse files
JusterZhuclaude
andauthored
feat: 补丁包生成前增加加密文件扫描 (Encryption file scan before packaging) (#82)
* feat: add encryption file scanning before patch packaging - Add EncryptionDetectionService with multi-layered detection: - Extension blacklist matching (40+ known encrypted extensions) - PE file deep analysis (section name fingerprinting for 50+ protectors like .NET Reactor, ConfuserEx, VMProtect, Themida, UPX, etc.) - PE CLR/COR20 header integrity check for .NET assemblies - ELF file section analysis (, ) - JAR/Class CAFEBABE magic number validation - Python .pyc magic number range check - Full-file Shannon entropy analysis (threshold 7.8, auto-skip compressed/media formats like .zip, .png, .mp4) - Risk level classification: High / Medium / Low - Toggle switch in PatchView UI, enabled by default - Dialog prompt with grouped results when suspicious files found (Skip / Include All / Cancel) - Full i18n support (zh-CN / en-US) Closes #TBD * fix: address Copilot review suggestions - Fix dialog hang when user closes window via X button (set TCS result before Close, register Closed event as fallback) - Replace hardcoded 'cancelled by user' with localized string - Add ConfigureAwait(false) in scan loop to avoid UI thread context switching on every file iteration Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 parent 07358a7 commit c6e04f4

6 files changed

Lines changed: 1064 additions & 2 deletions

File tree

src/Models/EncryptionScanResult.cs

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
using System.Collections.Generic;
2+
3+
namespace GeneralUpdate.Tools.Models;
4+
5+
public enum RiskLevel
6+
{
7+
/// <summary>Statistically anomalous but no explicit signature — informational only.</summary>
8+
Low,
9+
10+
/// <summary>High entropy or structural anomaly — worth reviewing.</summary>
11+
Medium,
12+
13+
/// <summary>Known protector signature or encryption container — strongly suggest exclusion.</summary>
14+
High
15+
}
16+
17+
public enum DetectionMethod
18+
{
19+
ExtensionBlacklist,
20+
PeProtectorSection,
21+
PeClrHeader,
22+
PeSectionEntropy,
23+
ElfSectionEntropy,
24+
JarClassMagic,
25+
FullFileEntropy
26+
}
27+
28+
public class SuspiciousFile
29+
{
30+
public string RelativePath { get; set; } = "";
31+
public string FilePath { get; set; } = "";
32+
public RiskLevel Level { get; set; }
33+
public string Reason { get; set; } = "";
34+
public double Entropy { get; set; }
35+
public DetectionMethod Method { get; set; }
36+
public string? DetectionDetail { get; set; }
37+
}
38+
39+
public class EncryptionScanResult
40+
{
41+
public List<SuspiciousFile> SuspiciousFiles { get; set; } = new();
42+
public int TotalFilesScanned { get; set; }
43+
public bool HasSuspiciousFiles => SuspiciousFiles.Count > 0;
44+
public bool HasHighRisk => SuspiciousFiles.Exists(f => f.Level == RiskLevel.High);
45+
}

src/Models/PatchConfigModel.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,5 @@ public partial class PatchConfigModel : ObservableObject
1010
[ObservableProperty] private string _version = "1.0.0";
1111
[ObservableProperty] private string _format = ".zip";
1212
[ObservableProperty] private string _outputPath = "";
13+
[ObservableProperty] private bool _enableEncryptionCheck = true;
1314
}

0 commit comments

Comments
 (0)