SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-31 21:19:22 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Lock unknown checks behind debug flag

Browse Source 
This also re-enables some previously commented out checks that could not be verified.
This commit is contained in:
Matt Nadareski
2022-03-02 08:56:26 -08:00
parent 7b73cc9d9b
commit 1b1f64c2de
10 changed files with 148 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
BurnOutSharp/PackerType/EXEStealth.cs
View File

@@ -1,4 +1,6 @@
using BurnOutSharp.ExecutableType.Microsoft;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.PackerType
{
@@ -30,23 +32,26 @@ namespace BurnOutSharp.PackerType
if (rsrrSection)
return "EXE Stealth 2.76";
return null;
// TODO: Obtain a sample to find where this string is in a typical executable
if (includeDebug)
{
var contentMatchSets = new List<ContentMatchSet>
{
// ??[[__[[_ + (char)0x00 + {{ + (char)0x0 + (char)0x00 + {{ + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x0 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + ?;??;??
new ContentMatchSet(new byte?[]
{
0x3F, 0x3F, 0x5B, 0x5B, 0x5F, 0x5F, 0x5B, 0x5B,
0x5F, 0x00, 0x7B, 0x7B, 0x00, 0x00, 0x7B, 0x7B,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x20, 0x3F, 0x3B, 0x3F, 0x3F, 0x3B, 0x3F,
0x3F
}, "EXE Stealth"),
};
// TODO: Could not be confirmed with any sample, so disabling for now
// var contentMatchSets = new List<ContentMatchSet>
// {
// // ??[[__[[_ + (char)0x00 + {{ + (char)0x0 + (char)0x00 + {{ + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x0 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + ?;??;??
// new ContentMatchSet(new byte?[]
// {
// 0x3F, 0x3F, 0x5B, 0x5B, 0x5F, 0x5F, 0x5B, 0x5B,
// 0x5F, 0x00, 0x7B, 0x7B, 0x00, 0x00, 0x7B, 0x7B,
// 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
// 0x00, 0x20, 0x3F, 0x3B, 0x3F, 0x3F, 0x3B, 0x3F,
// 0x3F
// }, "EXE Stealth"),
// };
// return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}
}
}

25
BurnOutSharp/ProtectionType/ActiveMARK.cs
View File

@@ -31,18 +31,23 @@ namespace BurnOutSharp.ProtectionType
}
// TODO: Obtain a sample to find where this string is in a typical executable
var contentMatchSets = new List<ContentMatchSet>
if (includeDebug)
{
// " " + (char)0xC2 + (char)0x16 + (char)0x00 + (char)0xA8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0xB8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x86 + (char)0xC8 + (char)0x16 + (char)0x00 + (char)0x9A + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x10 + (char)0xC2 + (char)0x16 + (char)0x00
new ContentMatchSet(new byte?[]
var contentMatchSets = new List<ContentMatchSet>
{
0x20, 0xC2, 0x16, 0x00, 0xA8, 0xC1, 0x16, 0x00,
0xB8, 0xC1, 0x16, 0x00, 0x86, 0xC8, 0x16, 0x00,
0x9A, 0xC1, 0x16, 0x00, 0x10, 0xC2, 0x16, 0x00
}, "ActiveMARK 5"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
// " " + (char)0xC2 + (char)0x16 + (char)0x00 + (char)0xA8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0xB8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x86 + (char)0xC8 + (char)0x16 + (char)0x00 + (char)0x9A + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x10 + (char)0xC2 + (char)0x16 + (char)0x00
new ContentMatchSet(new byte?[]
{
0x20, 0xC2, 0x16, 0x00, 0xA8, 0xC1, 0x16, 0x00,
0xB8, 0xC1, 0x16, 0x00, 0x86, 0xC8, 0x16, 0x00,
0x9A, 0xC1, 0x16, 0x00, 0x10, 0xC2, 0x16, 0x00
}, "ActiveMARK 5"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}
}
}

39
BurnOutSharp/ProtectionType/CDDVDCops.cs
View File

@@ -47,25 +47,30 @@ namespace BurnOutSharp.ProtectionType
}
// TODO: Obtain a sample to find where this string is in a typical executable
var contentMatchSets = new List<ContentMatchSet>
if (includeDebug)
{
// TODO: Remove from here once it's confirmed that no PE executables contain this string
// // CD-Cops, ver.
// new ContentMatchSet(new byte?[]
// {
// 0x43, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73, 0x2C,
// 0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20
// }, GetVersion, "CD-Cops"),
// // DVD-Cops, ver.
new ContentMatchSet(new byte?[]
var contentMatchSets = new List<ContentMatchSet>
{
0x44, 0x56, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73,
0x2C, 0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20
}, GetVersion, "DVD-Cops"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
// TODO: Remove from here once it's confirmed that no PE executables contain this string
// CD-Cops, ver.
new ContentMatchSet(new byte?[]
{
0x43, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73, 0x2C,
0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20
}, GetVersion, "CD-Cops"),
// // DVD-Cops, ver.
new ContentMatchSet(new byte?[]
{
0x44, 0x56, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73,
0x2C, 0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20
}, GetVersion, "DVD-Cops"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}
/// <inheritdoc/>

11
BurnOutSharp/ProtectionType/CactusDataShield.cs
View File

@@ -50,9 +50,14 @@ namespace BurnOutSharp.ProtectionType
return match;
}
var contentMatchSets = GetContentMatchSets();
if (contentMatchSets != null && contentMatchSets.Any())
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
// TODO: Limit these checks to Mac binaries
// TODO: Obtain a sample to find where this string is in a typical executable
if (includeDebug)
{
var contentMatchSets = GetContentMatchSets();
if (contentMatchSets != null && contentMatchSets.Any())
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}

33
BurnOutSharp/ProtectionType/CodeLock.cs
View File

@@ -1,5 +1,7 @@
using System.Linq;
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
{
@@ -19,20 +21,23 @@ namespace BurnOutSharp.ProtectionType
if (icdSectionCount >= 2)
return "CodeLock / CodeLok / CopyLok";
// TODO: Obtain a sample to find where this string is in a typical executable
if (includeDebug)
{
var contentMatchSets = new List<ContentMatchSet>
{
// CODE-LOCK.OCX
new ContentMatchSet(new byte?[]
{
0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43,
0x4B, 0x2E, 0x4F, 0x43, 0x58
}, "CodeLock / CodeLok / CopyLok"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
// TODO: Could not be confirmed with any sample, so disabling for now
// var contentMatchSets = new List<ContentMatchSet>
// {
// // CODE-LOCK.OCX
// new ContentMatchSet(new byte?[]
// {
// 0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43,
// 0x4B, 0x2E, 0x4F, 0x43, 0x58
// }, "CodeLock / CodeLok / CopyLok"),
// };
// return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
}
}

23
BurnOutSharp/ProtectionType/CopyKiller.cs
View File

@@ -11,17 +11,22 @@ namespace BurnOutSharp.ProtectionType
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// TODO: Obtain a sample to find where this string is in a typical executable
var contentMatchSets = new List<ContentMatchSet>
if (includeDebug)
{
// Tom Commander
new ContentMatchSet(new byte?[]
var contentMatchSets = new List<ContentMatchSet>
{
0x54, 0x6F, 0x6D, 0x20, 0x43, 0x6F, 0x6D, 0x6D,
0x61, 0x6E, 0x64, 0x65, 0x72
}, "CopyKiller"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
// Tom Commander
new ContentMatchSet(new byte?[]
{
0x54, 0x6F, 0x6D, 0x20, 0x43, 0x6F, 0x6D, 0x6D,
0x61, 0x6E, 0x64, 0x65, 0x72
}, "CopyKiller"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}
/// <inheritdoc/>

23
BurnOutSharp/ProtectionType/KeyLock.cs
View File

@@ -10,17 +10,22 @@ namespace BurnOutSharp.ProtectionType
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// TODO: Obtain a sample to find where this string is in a typical executable
var contentMatchSets = new List<ContentMatchSet>
if (includeDebug)
{
// KEY-LOCK COMMAND
new ContentMatchSet(new byte?[]
var contentMatchSets = new List<ContentMatchSet>
{
0x4B, 0x45, 0x59, 0x2D, 0x4C, 0x4F, 0x43, 0x4B,
0x20, 0x43, 0x4F, 0x4D, 0x4D, 0x41, 0x4E, 0x44
}, "Key-Lock (Dongle)"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
// KEY-LOCK COMMAND
new ContentMatchSet(new byte?[]
{
0x4B, 0x45, 0x59, 0x2D, 0x4C, 0x4F, 0x43, 0x4B,
0x20, 0x43, 0x4F, 0x4D, 0x4D, 0x41, 0x4E, 0x44
}, "Key-Lock (Dongle)"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}
}
}

26
BurnOutSharp/ProtectionType/RingPROTECH.cs
View File

@@ -12,17 +12,21 @@ namespace BurnOutSharp.ProtectionType
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// TODO: Obtain a sample to find where this string is in a typical executable
// var contentMatchSets = new List<ContentMatchSet>
// {
// // (char)0x00 + Allocator + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00
// new ContentMatchSet(new byte?[]
// {
// 0x00, 0x41, 0x6C, 0x6C, 0x6F, 0x63, 0x61, 0x74,
// 0x6F, 0x72, 0x00, 0x00, 0x00, 0x00
// }, "Ring PROTECH / ProRing [Check disc for physical ring]"),
// };
// return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
if (includeDebug)
{
var contentMatchSets = new List<ContentMatchSet>
{
// (char)0x00 + Allocator + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00
new ContentMatchSet(new byte?[]
{
0x00, 0x41, 0x6C, 0x6C, 0x6F, 0x63, 0x61, 0x74,
0x6F, 0x72, 0x00, 0x00, 0x00, 0x00
}, "Ring PROTECH / ProRing [Check disc for physical ring]"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}

31
BurnOutSharp/ProtectionType/Tages.cs
View File

@@ -45,22 +45,27 @@ namespace BurnOutSharp.ProtectionType
}
// TODO: Obtain a sample to find where this string is in a typical executable
var contentMatchSets = new List<ContentMatchSet>
if (includeDebug)
{
// protected-tages-runtime.exe
new ContentMatchSet(new byte?[]
var contentMatchSets = new List<ContentMatchSet>
{
0x70, 0x72, 0x6F, 0x74, 0x65, 0x63, 0x74, 0x65,
0x64, 0x2D, 0x74, 0x61, 0x67, 0x65, 0x73, 0x2D,
0x72, 0x75, 0x6E, 0x74, 0x69, 0x6D, 0x65, 0x2E,
0x65, 0x78, 0x65
}, Utilities.GetFileVersion, "TAGES"),
// protected-tages-runtime.exe
new ContentMatchSet(new byte?[]
{
0x70, 0x72, 0x6F, 0x74, 0x65, 0x63, 0x74, 0x65,
0x64, 0x2D, 0x74, 0x61, 0x67, 0x65, 0x73, 0x2D,
0x72, 0x75, 0x6E, 0x74, 0x69, 0x6D, 0x65, 0x2E,
0x65, 0x78, 0x65
}, Utilities.GetFileVersion, "TAGES"),
// (char)0xE8 + u + (char)0x00 + (char)0x00 + (char)0x00 + (char)0xE8
new ContentMatchSet(new byte?[] { 0xE8, 0x75, 0x00, 0x00, 0x00, 0xE8 }, GetVersion, "TAGES"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
// (char)0xE8 + u + (char)0x00 + (char)0x00 + (char)0x00 + (char)0xE8
new ContentMatchSet(new byte?[] { 0xE8, 0x75, 0x00, 0x00, 0x00, 0xE8 }, GetVersion, "TAGES"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}
/// <inheritdoc/>

2
BurnOutSharp/ProtectionType/WTMCDProtect.cs
View File

@@ -84,7 +84,7 @@ namespace BurnOutSharp.ProtectionType
/// <inheritdoc/>
public string CheckFilePath(string path)
{
// TODO: Add ImageX.imp as a wildcard, if possilbe
// TODO: Add ImageX.imp as a wildcard, if possible
var matchers = new List<PathMatchSet>
{
new PathMatchSet(new PathMatch("Image.imp", useEndsWith: true), "WTM CD Protect"),