diff --git a/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs index b660be0a..3cd55763 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs @@ -84,8 +84,8 @@ namespace BurnOutSharp.ExecutableType.Microsoft // Here is a list of standard sections that are used in various protections: // - .bss *1 protection Uninitialized data (free format) // X - .data 14 protections Initialized data (free format) - // - .edata *1 protection Export tables - // - .idata 2 protections Import tables + // X - .edata *1 protection Export tables + // X - .idata *1 protection Import tables // X - .rdata 11 protections Read-only initialized data // - .rsrc *1 protection Resource directory [Mostly taken care of, last protection needs research] // X - .text 6 protections Executable code (free format) @@ -121,18 +121,29 @@ namespace BurnOutSharp.ExecutableType.Microsoft /// /// .data/DATA - Initialized data (free format) - // + /// public byte[] DataSectionRaw; + /// + /// .edata - Export tables + /// + /// Replace with ExportDataSection + public byte[] ExportDataSectionRaw; + + /// + /// .idata - Import tables + /// + /// Replace with ImportDataSection + public byte[] ImportDataSectionRaw; + /// /// .rdata - Read-only initialized data - // + /// public byte[] ResourceDataSectionRaw; /// /// .text - Executable code (free format) /// - /// TODO: To accomodate SecuROM, can this also include a bit of data before the section as well? public byte[] TextSectionRaw; #endregion @@ -342,6 +353,12 @@ namespace BurnOutSharp.ExecutableType.Microsoft // Data Section pex.DataSectionRaw = pex.ReadRawSection(stream, ".data", false) ?? pex.ReadRawSection(stream, "DATA", false); + // Export Table + pex.ImportDataSectionRaw = pex.ReadRawSection(stream, ".edata", false); + + // Import Table + pex.ImportDataSectionRaw = pex.ReadRawSection(stream, ".idata", false); + // Resource Data Section pex.ResourceDataSectionRaw = pex.ReadRawSection(stream, ".rdata", false); @@ -424,6 +441,12 @@ namespace BurnOutSharp.ExecutableType.Microsoft // Data Section pex.DataSectionRaw = pex.ReadRawSection(content, ".data", false) ?? pex.ReadRawSection(content, "DATA", false); + // Export Table + pex.ImportDataSectionRaw = pex.ReadRawSection(content, ".edata", false); + + // Import Table + pex.ImportDataSectionRaw = pex.ReadRawSection(content, ".idata", false); + // Resource Data Section pex.ResourceDataSectionRaw = pex.ReadRawSection(content, ".rdata", false); diff --git a/BurnOutSharp/ProtectionType/SmartE.cs b/BurnOutSharp/ProtectionType/SmartE.cs index 65eff0fd..665b430c 100644 --- a/BurnOutSharp/ProtectionType/SmartE.cs +++ b/BurnOutSharp/ProtectionType/SmartE.cs @@ -18,14 +18,12 @@ namespace BurnOutSharp.ProtectionType return null; // Get the .edata section, if it exists - var edataSection = pex.GetLastSection(".edata", exact: true); - string match = GetMatchForSection(edataSection, file, fileContent, includeDebug); + string match = GetMatchForSection(file, pex.ExportDataSectionRaw, includeDebug); if (!string.IsNullOrWhiteSpace(match)) return match; // Get the .idata section, if it exists - var idataSection = pex.GetLastSection(".idata", exact: true); - match = GetMatchForSection(idataSection, file, fileContent, includeDebug); + match = GetMatchForSection(file, pex.ImportDataSectionRaw, includeDebug); if (!string.IsNullOrWhiteSpace(match)) return match;