SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-25 00:04:57 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Fix static matcher issues (fixes #51)

Browse Source 
Note: This may result in slower, but more accurate, scans
This commit is contained in:
Matt Nadareski
2021-07-17 23:40:16 -07:00
parent 957d82b2f7
commit 3ac57b1c0c
53 changed files with 1053 additions and 1208 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
BurnOutSharp/ProtectionType/ThreePLock.cs
View File

@@ -5,33 +5,30 @@ namespace BurnOutSharp.ProtectionType
{
public class ThreePLock : IContentCheck
{
/// <summary>
/// Set of all ContentMatchSets for this protection
/// </summary>
private static readonly List<ContentMatchSet> contentMatchers = new List<ContentMatchSet>
{
new ContentMatchSet(new List<byte?[]>
{
// .ldr
new byte?[] { 0x2E, 0x6C, 0x64, 0x72 },
// .ldt
new byte?[] { 0x2E, 0x6C, 0x64, 0x74 },
}, "3PLock"),
// This produced false positives in some DirectX 9.0c installer files
// "Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// new ContentMatchSet(new byte?[]
// {
// 0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30,
// 0x53, 0x56, 0x57
// }, "3PLock"),
};
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includePosition = false)
{
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchers, includePosition);
var matchers = new List<ContentMatchSet>
{
new ContentMatchSet(new List<byte?[]>
{
// .ldr
new byte?[] { 0x2E, 0x6C, 0x64, 0x72 },
// .ldt
new byte?[] { 0x2E, 0x6C, 0x64, 0x74 },
}, "3PLock"),
// This produced false positives in some DirectX 9.0c installer files
// "Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// new ContentMatchSet(new byte?[]
// {
// 0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30,
// 0x53, 0x56, 0x57
// }, "3PLock"),
};
return MatchUtil.GetFirstMatch(file, fileContent, matchers, includePosition);
}
}
}