From 040aa8daf6ecb8cc23a3b814c0fa96edb986d139 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Wed, 1 Sep 2021 14:06:19 -0700 Subject: [PATCH] Convert MediaMax CD-3 to section based --- BurnOutSharp/ProtectionType/MediaMaxCD3.cs | 95 ++++++++++++++++++---- 1 file changed, 79 insertions(+), 16 deletions(-) diff --git a/BurnOutSharp/ProtectionType/MediaMaxCD3.cs b/BurnOutSharp/ProtectionType/MediaMaxCD3.cs index c9a270fc..56aa7d3e 100644 --- a/BurnOutSharp/ProtectionType/MediaMaxCD3.cs +++ b/BurnOutSharp/ProtectionType/MediaMaxCD3.cs @@ -1,5 +1,8 @@ using System.Collections.Concurrent; using System.Collections.Generic; +using System.Linq; +using System.Text; +using BurnOutSharp.ExecutableType.Microsoft; using BurnOutSharp.Matching; namespace BurnOutSharp.ProtectionType @@ -7,24 +10,84 @@ namespace BurnOutSharp.ProtectionType public class MediaMaxCD3 : IContentCheck, IPathCheck { /// - public List GetContentMatchSets() - { - return new List - { - // Cd3Ctl - new ContentMatchSet(new byte?[] { 0x43, 0x64, 0x33, 0x43, 0x74, 0x6C }, "MediaMax CD-3"), - - // DllInstallSbcp - new ContentMatchSet(new byte?[] - { - 0x44, 0x6C, 0x6C, 0x49, 0x6E, 0x73, 0x74, 0x61, - 0x6C, 0x6C, 0x53, 0x62, 0x63, 0x70 - }, "MediaMax CD-3"), - }; - } + public List GetContentMatchSets() => null; /// - public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null; + public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) + { + // Get the sections from the executable, if possible + PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0); + var sections = pex?.SectionTable; + if (sections == null) + return null; + + // Get the .rdata section, if it exists + var rdataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rdata")); + if (rdataSection != null) + { + int sectionAddr = (int)rdataSection.PointerToRawData; + int sectionEnd = sectionAddr + (int)rdataSection.VirtualSize; + var matchers = new List + { + // DllInstallSbcp + new ContentMatchSet( + new ContentMatch(new byte?[] + { + 0x44, 0x6C, 0x6C, 0x49, 0x6E, 0x73, 0x74, 0x61, + 0x6C, 0x6C, 0x53, 0x62, 0x63, 0x70 + }, start: sectionAddr, end: sectionEnd), + "MediaMax CD-3"), + }; + + string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug); + if (!string.IsNullOrWhiteSpace(match)) + return match; + } + + // Get the .rsrc section, if it exists + var rsrcSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rsrc")); + if (rsrcSection != null) + { + int sectionAddr = (int)rsrcSection.PointerToRawData; + int sectionEnd = sectionAddr + (int)rsrcSection.VirtualSize; + var matchers = new List + { + // Cd3Ctl + new ContentMatchSet( + new ContentMatch(new byte?[] { 0x43, 0x64, 0x33, 0x43, 0x74, 0x6C }, start: sectionAddr, end: sectionEnd), + "MediaMax CD-3"), + }; + + string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug); + if (!string.IsNullOrWhiteSpace(match)) + return match; + } + + // Get the .data section, if it exists + var dataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".data")); + if (dataSection != null) + { + int sectionAddr = (int)dataSection.PointerToRawData; + int sectionEnd = sectionAddr + (int)dataSection.VirtualSize; + var matchers = new List + { + // CD3 Launch Error + new ContentMatchSet( + new ContentMatch(new byte?[] + { + 0x43, 0x44, 0x33, 0x20, 0x4C, 0x61, 0x75, 0x6E, + 0x63, 0x68, 0x20, 0x45, 0x72, 0x72, 0x6F, 0x72 + }, start: sectionAddr, end: sectionEnd), + "MediaMax CD-3"), + }; + + string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug); + if (!string.IsNullOrWhiteSpace(match)) + return match; + } + + return null; + } /// public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files)