SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-08 18:06:34 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add support for detecting Cucko (#132)

Browse Source 
* Add support for detecting Cucko

Add support for detecting Cucko.

* Remove debug line
This commit is contained in:
SilasLaspada
2022-07-12 23:57:22 -06:00
committed by GitHub
parent e9fa86343a
commit 42da9f4a82
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
BurnOutSharp/ProtectionType/ElectronicArts.cs
View File

@@ -13,6 +13,7 @@ namespace BurnOutSharp.ProtectionType
// - Look into `ccinstall`, `Services/EACOM`, `TSLHost`, `SIGS/UploadThread/exchangeAuthToken`,
// `blazeURL`, `psapi.dll`, `DasmX86Dll.dll`, `NVCPL.dll`, `iphlpapi.dll`, `dbghelp.dll`,
// `WS2_32.dll`,
// - Cucko is confirmed to, at least, use DMI checks.
public class ElectronicArts : IPortableExecutableCheck
{
/// <inheritdoc/>
@@ -88,6 +89,15 @@ namespace BurnOutSharp.ProtectionType
0x41, 0x00, 0x00, 0x00, 0x41, 0x63, 0x74, 0x69,
0x76, 0x61, 0x74, 0x69, 0x6F, 0x6E
}, "EA DRM Protection"),
// Confirmed to detect most examples known of Cucko. The only known exception is the version of "TSLHost.dll" included on Redump entry 36119.
// ŠU‰8...…™...ŠUŠ8T...
new ContentMatchSet(new byte?[]
{
0x8A, 0x55, 0x89, 0x38, 0x14, 0x1E, 0x0F, 0x85,
0x99, 0x00, 0x00, 0x00, 0x8A, 0x55, 0x8A, 0x38,
0x54, 0x1E, 0x01, 0x0F
}, "Cucko (Custom EA Protection)")
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);

2
README.md
View File

@@ -47,7 +47,7 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain
| DiscGuard | False | True | Unconfirmed¹ |
| DVD-Movie-PROTECT | False | True | Unconfirmed¹ |
| DVD Crypt | False | True | Unconfirmed¹ |
| EA Protections | True | False | Including EA CDKey and EA DRM. Cucko has been disabled due to invalid checks |
| EA Protections | True | False | Including Cucko, EA CDKey and EA DRM. |
| ~~Executable-Based CD Check~~ | True | False | Disabled due to overly-broad checks |
| Executable-Based Online Registration | True | False | Possibly too broad |
| Freelock | False | True | Unconfirmed¹ |