Convert SVKP to header based; add note

This commit is contained in:
Matt Nadareski
2021-09-05 23:31:10 -07:00
parent 0fe30392d8
commit 0fc415fb34
2 changed files with 30 additions and 21 deletions

View File

@@ -0,0 +1,30 @@
using System.Collections.Generic;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
{
// TODO: Figure out how versions/version ranges work for this protection
public class SVKProtector : IContentCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets() => null;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
if (pex?.ImageFileHeader == null)
return null;
// 0x504B5653 is "SVKP"
if (pex.ImageFileHeader.PointerToSymbolTable == 0x504B5653)
return "SVKP (Slovak Protector)";
return null;
}
}
}

View File

@@ -1,21 +0,0 @@
using System.Collections.Generic;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
{
public class SVKProtector : IContentCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
{
return new List<ContentMatchSet>
{
// ?SVKP + (char)0x00 + (char)0x00
new ContentMatchSet(new byte?[] { 0x3F, 0x53, 0x56, 0x4B, 0x50, 0x00, 0x00 }, "SVK Protector"),
};
}
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
}
}