SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-22 23:05:03 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Cleanup and notes for 3P-Lock

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-20 11:26:22 -08:00
parent dbf1f6dcca
commit 0c37932631
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
BurnOutSharp/ProtectionType/ThreePLock.cs
View File

@@ -3,6 +3,11 @@ using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
/// <remarks>
/// PiD only looks for the `.ldr` section, from testing
/// There don't seem to be any other signs that this is 3P-Lock anywhere in the example files
/// No website has been found for 3P-Lock yet
/// </remarks>
public class ThreePLock : IPortableExecutableCheck
{
/// <inheritdoc/>
@@ -16,11 +21,9 @@ namespace BurnOutSharp.ProtectionType
//This produced false positives in some DirectX 9.0c installer files
//"Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// Get the .ldr and .ldt sections, if they exist -- TODO: Confirm if both are needed or either/or is fine
bool cmsdSection = pex.ContainsSection(".ldr", exact: true);
bool cmstSection = pex.ContainsSection(".ldt", exact: true);
if (cmsdSection || cmstSection)
return $"3PLock";
// Get the .ldr and .ldt sections, if they exist
if (pex.ContainsSection(".ldr", exact: true) && pex.ContainsSection(".ldt", exact: true))
return $"3P-Lock Copy Protection";
return null;
}