diff --git a/BurnOutSharp/ProtectionType/XCP.cs b/BurnOutSharp/ProtectionType/XCP.cs
index cf471980..f5dffa2a 100644
--- a/BurnOutSharp/ProtectionType/XCP.cs
+++ b/BurnOutSharp/ProtectionType/XCP.cs
@@ -3,6 +3,8 @@ using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
+using System.Text;
+using BurnOutSharp.ExecutableType.Microsoft;
 using BurnOutSharp.FileType;
 using BurnOutSharp.Matching;
 
@@ -14,28 +16,9 @@ namespace BurnOutSharp.ProtectionType
         /// <inheritdoc/>
         public List<ContentMatchSet> GetContentMatchSets()
         {
+            // TODO: Obtain a sample to find where this string is in a typical executable
             return new List<ContentMatchSet>
             {
-                // Found in GO.EXE
-                // XCP.DAT
-                new ContentMatchSet(new byte?[] { 0x58, 0x43, 0x50, 0x2E, 0x44, 0x41, 0x54 }, "XCP"),
-
-                // Found in GO.EXE
-                // XCPPlugins.dll
-                new ContentMatchSet(new byte?[]
-                {
-                    0x58, 0x43, 0x50, 0x50, 0x6C, 0x75, 0x67, 0x69,
-                    0x6E, 0x73, 0x2E, 0x64, 0x6C, 0x6C
-                }, "XCP"),
-
-                // Found in GO.EXE
-                // XCPPhoenix.dll
-                new ContentMatchSet(new byte?[]
-                {
-                    0x58, 0x43, 0x50, 0x50, 0x68, 0x6F, 0x65, 0x6E,
-                    0x69, 0x78, 0x2E, 0x64, 0x6C, 0x6C
-                }, "XCP"),
-
                 // xcpdrive
                 new ContentMatchSet(new byte?[]
                 {
@@ -45,7 +28,53 @@ namespace BurnOutSharp.ProtectionType
         }
 
         /// <inheritdoc/>
-        public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
+        public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
+        {
+            // Get the sections from the executable, if possible
+            PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
+            var sections = pex?.SectionTable;
+            if (sections == null)
+                return null;
+
+            // Get the .rdata section, if it exists
+            var rdataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rdata"));
+            if (rdataSection != null)
+            {
+                int sectionAddr = (int)rdataSection.PointerToRawData;
+                int sectionEnd = sectionAddr + (int)rdataSection.VirtualSize;
+                var matchers = new List<ContentMatchSet>
+                {
+                    // XCP.DAT
+                    new ContentMatchSet(
+                        new ContentMatch(new byte?[] { 0x58, 0x43, 0x50, 0x2E, 0x44, 0x41, 0x54 }, start: sectionAddr, end: sectionEnd),
+                    "XCP"),
+
+                    // XCPPlugins.dll
+                    new ContentMatchSet(
+                        new ContentMatch(new byte?[]
+                        {
+                            0x58, 0x43, 0x50, 0x50, 0x6C, 0x75, 0x67, 0x69,
+                            0x6E, 0x73, 0x2E, 0x64, 0x6C, 0x6C
+                        }, start: sectionAddr, end: sectionEnd),
+                    "XCP"),
+
+                    // XCPPhoenix.dll
+                    new ContentMatchSet(
+                        new ContentMatch(new byte?[]
+                        {
+                            0x58, 0x43, 0x50, 0x50, 0x68, 0x6F, 0x65, 0x6E,
+                            0x69, 0x78, 0x2E, 0x64, 0x6C, 0x6C
+                        }, start: sectionAddr, end: sectionEnd),
+                    "XCP"),
+                };
+
+                string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
+                if (!string.IsNullOrWhiteSpace(match))
+                    return match;
+            }
+
+            return null;
+        }
 
         /// <inheritdoc/>
         public ConcurrentQueue<string> CheckDirectoryPath(string path, IEnumerable<string> files)