Pre-read 3 most commonly-used section data

This also adds comprehensive notes around the sections used in various protections, how they're used, and what we can do with them. It also adds a couple of various notes based on the findings from the protection audit
This commit is contained in:
Matt Nadareski
2021-09-11 16:47:25 -07:00
parent bd9f583659
commit 214e8d41c7
28 changed files with 626 additions and 712 deletions

View File

@@ -32,8 +32,7 @@ namespace BurnOutSharp.ProtectionType
return match;
// Get the .rdata section, if it exists
var rdataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rdata"));
match = GetMatchForSection(rdataSection, file, fileContent, includeDebug);
match = GetMatchForSection(file, pex.ResourceDataSectionRaw, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
@@ -93,5 +92,22 @@ namespace BurnOutSharp.ProtectionType
return MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
}
/// <summary>
/// Check a section for the SmartE string(s)
/// </summary>
private string GetMatchForSection(string file, byte[] sectionContent, bool includeDebug)
{
if (sectionContent == null)
return null;
var matchers = new List<ContentMatchSet>
{
// BITARTS
new ContentMatchSet(new byte?[] { 0x42, 0x49, 0x54, 0x41, 0x52, 0x54, 0x53 }, "SmartE"),
};
return MatchUtil.GetFirstMatch(file, sectionContent, matchers, includeDebug);
}
}
}