2989 / Sayonara safe reconstruction

This repository contains a static-analysis-backed, contained reconstruction of the supplied 2989 sample. The sample itself is never needed at build time and must not be executed.

The supplied filename contains a hidden U+202E RIGHT-TO-LEFT OVERRIDE character. Treat any file beginning with 2989 in this workspace as the original sample, regardless of how Explorer renders its extension.

What this reconstruction does

• Preserves the original multi-resolution icon and five audio payloads.
• Recreates the Explorer-like view with the original SayonaraExplorer class and the original table of target locations as a read-only listing.
• Recreates notifications with an explicit “safe simulation” label.
• Constrains the visual glitch effect to the application window.
• Simulates deletion by hiding a list row; it never changes the real file.
• Runs without administrator rights and exits normally.

It does not enable privileges, terminate or launch Explorer, become a critical process, write the registry, open raw volumes, schedule deletions, delete files, install shortcuts, or draw directly onto the desktop.

The unsafe original branches are represented structurally in src/core/original_actions.cpp: original strings, constants, ordering, and call-site hooks are preserved, while the live privileged, destructive, or persistence-related API calls are omitted.

Build

From a regular Command Prompt or PowerShell:

src\build.bat

The supported build script initializes the Visual Studio 2022 x64 environment and invokes rc.exe and cl.exe directly. It does not use CMake/Ninja because their compiler-probe process deadlocked in this workspace. The output is:

build\Sayonara.exe

The build script does not launch the output.

The main window class is SayonaraApple, matching the original static string. The executable still carries safe labels in its UI so it cannot be confused with the destructive sample during testing.

Audio helper

The old helper concatenated raw MP3 frames even though the supplied files change from mono to stereo. That can only produce a malformed stream. The repaired helper decodes each input through Windows Media Foundation and writes one valid stereo PCM WAVE:

tools\mp3joiner\build.bat
tools\mp3joiner\build\mp3joiner.exe ^
  src\res\audio_0.mp3 src\res\audio_1.mp3 src\res\audio_2.mp3 ^
  src\res\audio_3.mp3 src\res\audio_4.mp3 --out joined.wav

Static inspection

tools/static_pe/analyze.py parses PE64 files as bytes. It does not load or execute them. It can list imports/resources, reconstruct a group icon, locate string references, and disassemble a selected function when Capstone is installed. See the reverse-engineering notes for the confirmed findings and safety deviations.