mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-09-22 23:05:03 +00:00
Pre-read 3 most commonly-used section data
This also adds comprehensive notes around the sections used in various protections, how they're used, and what we can do with them. It also adds a couple of various notes based on the findings from the protection audit
This commit is contained in:
@@ -32,8 +32,7 @@ namespace BurnOutSharp.ProtectionType
|
||||
return match;
|
||||
|
||||
// Get the .rdata section, if it exists
|
||||
var rdataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rdata"));
|
||||
match = GetMatchForSection(rdataSection, file, fileContent, includeDebug);
|
||||
match = GetMatchForSection(file, pex.ResourceDataSectionRaw, includeDebug);
|
||||
if (!string.IsNullOrWhiteSpace(match))
|
||||
return match;
|
||||
|
||||
@@ -93,5 +92,22 @@ namespace BurnOutSharp.ProtectionType
|
||||
|
||||
return MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Check a section for the SmartE string(s)
|
||||
/// </summary>
|
||||
private string GetMatchForSection(string file, byte[] sectionContent, bool includeDebug)
|
||||
{
|
||||
if (sectionContent == null)
|
||||
return null;
|
||||
|
||||
var matchers = new List<ContentMatchSet>
|
||||
{
|
||||
// BITARTS
|
||||
new ContentMatchSet(new byte?[] { 0x42, 0x49, 0x54, 0x41, 0x52, 0x54, 0x53 }, "SmartE"),
|
||||
};
|
||||
|
||||
return MatchUtil.GetFirstMatch(file, sectionContent, matchers, includeDebug);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user