SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-29 01:50:24 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Slightly update JoWooD

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-09 11:11:18 -08:00
parent 3f4f6a2d07
commit 0a5ffd247c
1 changed files with 6 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
BurnOutSharp/ProtectionType/JoWood.cs
View File

@@ -21,19 +21,14 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the .ext section, if it exists
var extSection = pex.ContainsSection(".ext ", exact: true);
if (extSection)
if (pex.ContainsSection(".ext ", exact: true))
{
// Get the .dcrtext section, if it exists
if (pex.ContainsSection(".dcrtext"))
{
// TODO: This can't work yet because the version is embedded after the hint/name table
//if ((pex.ImportTable?.ImportDirectoryTable?.Any(idte => idte.Name == "kernel32.dll") ?? false)
// && (pex.ImportHintNameTable?.Any(s => s == "VirtualProtect") ?? false))
//{
// return $"JoWood X-Prot {GetVersion(pex)}"
//}
bool importTableMatches = (pex.ImportTable?.ImportDirectoryTable?.Any(idte => idte.Name == "kernel32.dll") ?? false)
&& (pex.ImportHintNameTable?.Any(s => s == "VirtualProtect") ?? false);
// Get the .dcrtext section, if it exists
if (pex.ContainsSection(".dcrtext") && importTableMatches)
{
var matchers = new List<ContentMatchSet>
{
// kernel32.dll + (char)0x00 + (char)0x00 + (char)0x00 + VirtualProtect