mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-02-12 13:45:35 +00:00
Convert SVKP to header based; add note
This commit is contained in:
30
BurnOutSharp/ProtectionType/SVKP.cs
Normal file
30
BurnOutSharp/ProtectionType/SVKP.cs
Normal file
@@ -0,0 +1,30 @@
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using System.Text;
|
||||
using BurnOutSharp.ExecutableType.Microsoft;
|
||||
using BurnOutSharp.Matching;
|
||||
|
||||
namespace BurnOutSharp.ProtectionType
|
||||
{
|
||||
// TODO: Figure out how versions/version ranges work for this protection
|
||||
public class SVKProtector : IContentCheck
|
||||
{
|
||||
/// <inheritdoc/>
|
||||
public List<ContentMatchSet> GetContentMatchSets() => null;
|
||||
|
||||
/// <inheritdoc/>
|
||||
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
|
||||
{
|
||||
// Get the sections from the executable, if possible
|
||||
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
|
||||
if (pex?.ImageFileHeader == null)
|
||||
return null;
|
||||
|
||||
// 0x504B5653 is "SVKP"
|
||||
if (pex.ImageFileHeader.PointerToSymbolTable == 0x504B5653)
|
||||
return "SVKP (Slovak Protector)";
|
||||
|
||||
return null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
using System.Collections.Generic;
|
||||
using BurnOutSharp.Matching;
|
||||
|
||||
namespace BurnOutSharp.ProtectionType
|
||||
{
|
||||
public class SVKProtector : IContentCheck
|
||||
{
|
||||
/// <inheritdoc/>
|
||||
public List<ContentMatchSet> GetContentMatchSets()
|
||||
{
|
||||
return new List<ContentMatchSet>
|
||||
{
|
||||
// ?SVKP + (char)0x00 + (char)0x00
|
||||
new ContentMatchSet(new byte?[] { 0x3F, 0x53, 0x56, 0x4B, 0x50, 0x00, 0x00 }, "SVK Protector"),
|
||||
};
|
||||
}
|
||||
|
||||
/// <inheritdoc/>
|
||||
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user