From 0a5ffd247c183a123dbc512d09d5cf4d4687e7f7 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Fri, 9 Dec 2022 11:11:18 -0800 Subject: [PATCH] Slightly update JoWooD --- BurnOutSharp/ProtectionType/JoWood.cs | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/BurnOutSharp/ProtectionType/JoWood.cs b/BurnOutSharp/ProtectionType/JoWood.cs index 876a67ae..88173e1e 100644 --- a/BurnOutSharp/ProtectionType/JoWood.cs +++ b/BurnOutSharp/ProtectionType/JoWood.cs @@ -21,19 +21,14 @@ namespace BurnOutSharp.ProtectionType return null; // Get the .ext section, if it exists - var extSection = pex.ContainsSection(".ext ", exact: true); - if (extSection) + if (pex.ContainsSection(".ext ", exact: true)) { - // Get the .dcrtext section, if it exists - if (pex.ContainsSection(".dcrtext")) - { - // TODO: This can't work yet because the version is embedded after the hint/name table - //if ((pex.ImportTable?.ImportDirectoryTable?.Any(idte => idte.Name == "kernel32.dll") ?? false) - // && (pex.ImportHintNameTable?.Any(s => s == "VirtualProtect") ?? false)) - //{ - // return $"JoWood X-Prot {GetVersion(pex)}" - //} + bool importTableMatches = (pex.ImportTable?.ImportDirectoryTable?.Any(idte => idte.Name == "kernel32.dll") ?? false) + && (pex.ImportHintNameTable?.Any(s => s == "VirtualProtect") ?? false); + // Get the .dcrtext section, if it exists + if (pex.ContainsSection(".dcrtext") && importTableMatches) + { var matchers = new List { // kernel32.dll + (char)0x00 + (char)0x00 + (char)0x00 + VirtualProtect