diff --git a/BinaryObjectScanner/Protection/ActiveMARK.cs b/BinaryObjectScanner/Protection/ActiveMARK.cs index 7471357c..b92a1246 100644 --- a/BinaryObjectScanner/Protection/ActiveMARK.cs +++ b/BinaryObjectScanner/Protection/ActiveMARK.cs @@ -31,6 +31,10 @@ namespace BinaryObjectScanner.Protection /// public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) { + // Investigation notes: + // - After the section table, "Code_Name=ActiveMARK[TM]_R5.41" was found. It's not in a section. + // - In the stub data, there's a string for the download: "http://d.trymedia.com/dd/..." + // Get the entry point data, if it exists if (exe.EntryPointData != null) {