diff --git a/BurnOutSharp/PackerType/EXEStealth.cs b/BurnOutSharp/PackerType/EXEStealth.cs index e546087e..89e957a3 100644 --- a/BurnOutSharp/PackerType/EXEStealth.cs +++ b/BurnOutSharp/PackerType/EXEStealth.cs @@ -1,4 +1,6 @@ -using BurnOutSharp.ExecutableType.Microsoft; +using System.Collections.Generic; +using BurnOutSharp.ExecutableType.Microsoft; +using BurnOutSharp.Matching; namespace BurnOutSharp.PackerType { @@ -30,23 +32,26 @@ namespace BurnOutSharp.PackerType if (rsrrSection) return "EXE Stealth 2.76"; - return null; + // TODO: Obtain a sample to find where this string is in a typical executable + if (includeDebug) + { + var contentMatchSets = new List + { + // ??[[__[[_ + (char)0x00 + {{ + (char)0x0 + (char)0x00 + {{ + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x0 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + ?;??;?? + new ContentMatchSet(new byte?[] + { + 0x3F, 0x3F, 0x5B, 0x5B, 0x5F, 0x5F, 0x5B, 0x5B, + 0x5F, 0x00, 0x7B, 0x7B, 0x00, 0x00, 0x7B, 0x7B, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x20, 0x3F, 0x3B, 0x3F, 0x3F, 0x3B, 0x3F, + 0x3F + }, "EXE Stealth"), + }; - // TODO: Could not be confirmed with any sample, so disabling for now - // var contentMatchSets = new List - // { - // // ??[[__[[_ + (char)0x00 + {{ + (char)0x0 + (char)0x00 + {{ + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x0 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + ?;??;?? - // new ContentMatchSet(new byte?[] - // { - // 0x3F, 0x3F, 0x5B, 0x5B, 0x5F, 0x5F, 0x5B, 0x5B, - // 0x5F, 0x00, 0x7B, 0x7B, 0x00, 0x00, 0x7B, 0x7B, - // 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - // 0x00, 0x20, 0x3F, 0x3B, 0x3F, 0x3F, 0x3B, 0x3F, - // 0x3F - // }, "EXE Stealth"), - // }; - - // return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } + + return null; } } } diff --git a/BurnOutSharp/ProtectionType/ActiveMARK.cs b/BurnOutSharp/ProtectionType/ActiveMARK.cs index c0987aac..efeb5a1c 100644 --- a/BurnOutSharp/ProtectionType/ActiveMARK.cs +++ b/BurnOutSharp/ProtectionType/ActiveMARK.cs @@ -31,18 +31,23 @@ namespace BurnOutSharp.ProtectionType } // TODO: Obtain a sample to find where this string is in a typical executable - var contentMatchSets = new List + if (includeDebug) { - // " " + (char)0xC2 + (char)0x16 + (char)0x00 + (char)0xA8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0xB8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x86 + (char)0xC8 + (char)0x16 + (char)0x00 + (char)0x9A + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x10 + (char)0xC2 + (char)0x16 + (char)0x00 - new ContentMatchSet(new byte?[] + var contentMatchSets = new List { - 0x20, 0xC2, 0x16, 0x00, 0xA8, 0xC1, 0x16, 0x00, - 0xB8, 0xC1, 0x16, 0x00, 0x86, 0xC8, 0x16, 0x00, - 0x9A, 0xC1, 0x16, 0x00, 0x10, 0xC2, 0x16, 0x00 - }, "ActiveMARK 5"), - }; - - return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + // " " + (char)0xC2 + (char)0x16 + (char)0x00 + (char)0xA8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0xB8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x86 + (char)0xC8 + (char)0x16 + (char)0x00 + (char)0x9A + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x10 + (char)0xC2 + (char)0x16 + (char)0x00 + new ContentMatchSet(new byte?[] + { + 0x20, 0xC2, 0x16, 0x00, 0xA8, 0xC1, 0x16, 0x00, + 0xB8, 0xC1, 0x16, 0x00, 0x86, 0xC8, 0x16, 0x00, + 0x9A, 0xC1, 0x16, 0x00, 0x10, 0xC2, 0x16, 0x00 + }, "ActiveMARK 5"), + }; + + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } + + return null; } } } diff --git a/BurnOutSharp/ProtectionType/CDDVDCops.cs b/BurnOutSharp/ProtectionType/CDDVDCops.cs index abf60b28..4a3e3d2b 100644 --- a/BurnOutSharp/ProtectionType/CDDVDCops.cs +++ b/BurnOutSharp/ProtectionType/CDDVDCops.cs @@ -47,25 +47,30 @@ namespace BurnOutSharp.ProtectionType } // TODO: Obtain a sample to find where this string is in a typical executable - var contentMatchSets = new List + if (includeDebug) { - // TODO: Remove from here once it's confirmed that no PE executables contain this string - // // CD-Cops, ver. - // new ContentMatchSet(new byte?[] - // { - // 0x43, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73, 0x2C, - // 0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20 - // }, GetVersion, "CD-Cops"), - - // // DVD-Cops, ver. - new ContentMatchSet(new byte?[] + var contentMatchSets = new List { - 0x44, 0x56, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73, - 0x2C, 0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20 - }, GetVersion, "DVD-Cops"), - }; - - return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + // TODO: Remove from here once it's confirmed that no PE executables contain this string + // CD-Cops, ver. + new ContentMatchSet(new byte?[] + { + 0x43, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73, 0x2C, + 0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20 + }, GetVersion, "CD-Cops"), + + // // DVD-Cops, ver. + new ContentMatchSet(new byte?[] + { + 0x44, 0x56, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73, + 0x2C, 0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20 + }, GetVersion, "DVD-Cops"), + }; + + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } + + return null; } /// diff --git a/BurnOutSharp/ProtectionType/CactusDataShield.cs b/BurnOutSharp/ProtectionType/CactusDataShield.cs index 4aa025d0..2270eef5 100644 --- a/BurnOutSharp/ProtectionType/CactusDataShield.cs +++ b/BurnOutSharp/ProtectionType/CactusDataShield.cs @@ -50,9 +50,14 @@ namespace BurnOutSharp.ProtectionType return match; } - var contentMatchSets = GetContentMatchSets(); - if (contentMatchSets != null && contentMatchSets.Any()) - return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + // TODO: Limit these checks to Mac binaries + // TODO: Obtain a sample to find where this string is in a typical executable + if (includeDebug) + { + var contentMatchSets = GetContentMatchSets(); + if (contentMatchSets != null && contentMatchSets.Any()) + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } return null; } diff --git a/BurnOutSharp/ProtectionType/CodeLock.cs b/BurnOutSharp/ProtectionType/CodeLock.cs index 3321d0dd..42aab973 100644 --- a/BurnOutSharp/ProtectionType/CodeLock.cs +++ b/BurnOutSharp/ProtectionType/CodeLock.cs @@ -1,5 +1,7 @@ -using System.Linq; +using System.Collections.Generic; +using System.Linq; using BurnOutSharp.ExecutableType.Microsoft; +using BurnOutSharp.Matching; namespace BurnOutSharp.ProtectionType { @@ -19,20 +21,23 @@ namespace BurnOutSharp.ProtectionType if (icdSectionCount >= 2) return "CodeLock / CodeLok / CopyLok"; + // TODO: Obtain a sample to find where this string is in a typical executable + if (includeDebug) + { + var contentMatchSets = new List + { + // CODE-LOCK.OCX + new ContentMatchSet(new byte?[] + { + 0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43, + 0x4B, 0x2E, 0x4F, 0x43, 0x58 + }, "CodeLock / CodeLok / CopyLok"), + }; + + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } + return null; - - // TODO: Could not be confirmed with any sample, so disabling for now - // var contentMatchSets = new List - // { - // // CODE-LOCK.OCX - // new ContentMatchSet(new byte?[] - // { - // 0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43, - // 0x4B, 0x2E, 0x4F, 0x43, 0x58 - // }, "CodeLock / CodeLok / CopyLok"), - // }; - - // return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); } } } diff --git a/BurnOutSharp/ProtectionType/CopyKiller.cs b/BurnOutSharp/ProtectionType/CopyKiller.cs index d7481b3c..48563d96 100644 --- a/BurnOutSharp/ProtectionType/CopyKiller.cs +++ b/BurnOutSharp/ProtectionType/CopyKiller.cs @@ -11,17 +11,22 @@ namespace BurnOutSharp.ProtectionType public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex) { // TODO: Obtain a sample to find where this string is in a typical executable - var contentMatchSets = new List + if (includeDebug) { - // Tom Commander - new ContentMatchSet(new byte?[] + var contentMatchSets = new List { - 0x54, 0x6F, 0x6D, 0x20, 0x43, 0x6F, 0x6D, 0x6D, - 0x61, 0x6E, 0x64, 0x65, 0x72 - }, "CopyKiller"), - }; - - return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + // Tom Commander + new ContentMatchSet(new byte?[] + { + 0x54, 0x6F, 0x6D, 0x20, 0x43, 0x6F, 0x6D, 0x6D, + 0x61, 0x6E, 0x64, 0x65, 0x72 + }, "CopyKiller"), + }; + + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } + + return null; } /// diff --git a/BurnOutSharp/ProtectionType/KeyLock.cs b/BurnOutSharp/ProtectionType/KeyLock.cs index e854c819..973265bd 100644 --- a/BurnOutSharp/ProtectionType/KeyLock.cs +++ b/BurnOutSharp/ProtectionType/KeyLock.cs @@ -10,17 +10,22 @@ namespace BurnOutSharp.ProtectionType public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex) { // TODO: Obtain a sample to find where this string is in a typical executable - var contentMatchSets = new List + if (includeDebug) { - // KEY-LOCK COMMAND - new ContentMatchSet(new byte?[] + var contentMatchSets = new List { - 0x4B, 0x45, 0x59, 0x2D, 0x4C, 0x4F, 0x43, 0x4B, - 0x20, 0x43, 0x4F, 0x4D, 0x4D, 0x41, 0x4E, 0x44 - }, "Key-Lock (Dongle)"), - }; - - return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + // KEY-LOCK COMMAND + new ContentMatchSet(new byte?[] + { + 0x4B, 0x45, 0x59, 0x2D, 0x4C, 0x4F, 0x43, 0x4B, + 0x20, 0x43, 0x4F, 0x4D, 0x4D, 0x41, 0x4E, 0x44 + }, "Key-Lock (Dongle)"), + }; + + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } + + return null; } } } diff --git a/BurnOutSharp/ProtectionType/RingPROTECH.cs b/BurnOutSharp/ProtectionType/RingPROTECH.cs index 0ada35bc..d480003b 100644 --- a/BurnOutSharp/ProtectionType/RingPROTECH.cs +++ b/BurnOutSharp/ProtectionType/RingPROTECH.cs @@ -12,17 +12,21 @@ namespace BurnOutSharp.ProtectionType public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex) { // TODO: Obtain a sample to find where this string is in a typical executable - // var contentMatchSets = new List - // { - // // (char)0x00 + Allocator + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 - // new ContentMatchSet(new byte?[] - // { - // 0x00, 0x41, 0x6C, 0x6C, 0x6F, 0x63, 0x61, 0x74, - // 0x6F, 0x72, 0x00, 0x00, 0x00, 0x00 - // }, "Ring PROTECH / ProRing [Check disc for physical ring]"), - // }; - - // return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + if (includeDebug) + { + var contentMatchSets = new List + { + // (char)0x00 + Allocator + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + new ContentMatchSet(new byte?[] + { + 0x00, 0x41, 0x6C, 0x6C, 0x6F, 0x63, 0x61, 0x74, + 0x6F, 0x72, 0x00, 0x00, 0x00, 0x00 + }, "Ring PROTECH / ProRing [Check disc for physical ring]"), + }; + + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } + return null; } diff --git a/BurnOutSharp/ProtectionType/Tages.cs b/BurnOutSharp/ProtectionType/Tages.cs index 3ca09810..d795ef3d 100644 --- a/BurnOutSharp/ProtectionType/Tages.cs +++ b/BurnOutSharp/ProtectionType/Tages.cs @@ -45,22 +45,27 @@ namespace BurnOutSharp.ProtectionType } // TODO: Obtain a sample to find where this string is in a typical executable - var contentMatchSets = new List + if (includeDebug) { - // protected-tages-runtime.exe - new ContentMatchSet(new byte?[] + var contentMatchSets = new List { - 0x70, 0x72, 0x6F, 0x74, 0x65, 0x63, 0x74, 0x65, - 0x64, 0x2D, 0x74, 0x61, 0x67, 0x65, 0x73, 0x2D, - 0x72, 0x75, 0x6E, 0x74, 0x69, 0x6D, 0x65, 0x2E, - 0x65, 0x78, 0x65 - }, Utilities.GetFileVersion, "TAGES"), + // protected-tages-runtime.exe + new ContentMatchSet(new byte?[] + { + 0x70, 0x72, 0x6F, 0x74, 0x65, 0x63, 0x74, 0x65, + 0x64, 0x2D, 0x74, 0x61, 0x67, 0x65, 0x73, 0x2D, + 0x72, 0x75, 0x6E, 0x74, 0x69, 0x6D, 0x65, 0x2E, + 0x65, 0x78, 0x65 + }, Utilities.GetFileVersion, "TAGES"), - // (char)0xE8 + u + (char)0x00 + (char)0x00 + (char)0x00 + (char)0xE8 - new ContentMatchSet(new byte?[] { 0xE8, 0x75, 0x00, 0x00, 0x00, 0xE8 }, GetVersion, "TAGES"), - }; - - return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + // (char)0xE8 + u + (char)0x00 + (char)0x00 + (char)0x00 + (char)0xE8 + new ContentMatchSet(new byte?[] { 0xE8, 0x75, 0x00, 0x00, 0x00, 0xE8 }, GetVersion, "TAGES"), + }; + + return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); + } + + return null; } /// diff --git a/BurnOutSharp/ProtectionType/WTMCDProtect.cs b/BurnOutSharp/ProtectionType/WTMCDProtect.cs index 3383fb5f..e76079a8 100644 --- a/BurnOutSharp/ProtectionType/WTMCDProtect.cs +++ b/BurnOutSharp/ProtectionType/WTMCDProtect.cs @@ -84,7 +84,7 @@ namespace BurnOutSharp.ProtectionType /// public string CheckFilePath(string path) { - // TODO: Add ImageX.imp as a wildcard, if possilbe + // TODO: Add ImageX.imp as a wildcard, if possible var matchers = new List { new PathMatchSet(new PathMatch("Image.imp", useEndsWith: true), "WTM CD Protect"),