diff --git a/BurnOutSharp/ProtectionType/ElectronicArts.cs b/BurnOutSharp/ProtectionType/ElectronicArts.cs index 529e73ad..fb908996 100644 --- a/BurnOutSharp/ProtectionType/ElectronicArts.cs +++ b/BurnOutSharp/ProtectionType/ElectronicArts.cs @@ -13,6 +13,7 @@ namespace BurnOutSharp.ProtectionType // - Look into `ccinstall`, `Services/EACOM`, `TSLHost`, `SIGS/UploadThread/exchangeAuthToken`, // `blazeURL`, `psapi.dll`, `DasmX86Dll.dll`, `NVCPL.dll`, `iphlpapi.dll`, `dbghelp.dll`, // `WS2_32.dll`, + // - Cucko is confirmed to, at least, use DMI checks. public class ElectronicArts : IPortableExecutableCheck { /// @@ -88,6 +89,15 @@ namespace BurnOutSharp.ProtectionType 0x41, 0x00, 0x00, 0x00, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x69, 0x6F, 0x6E }, "EA DRM Protection"), + + // Confirmed to detect most examples known of Cucko. The only known exception is the version of "TSLHost.dll" included on Redump entry 36119. + // ŠU‰8...…™...ŠUŠ8T... + new ContentMatchSet(new byte?[] + { + 0x8A, 0x55, 0x89, 0x38, 0x14, 0x1E, 0x0F, 0x85, + 0x99, 0x00, 0x00, 0x00, 0x8A, 0x55, 0x8A, 0x38, + 0x54, 0x1E, 0x01, 0x0F + }, "Cucko (Custom EA Protection)") }; string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug); diff --git a/README.md b/README.md index 067a2723..94adae3c 100644 --- a/README.md +++ b/README.md @@ -47,7 +47,7 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain | DiscGuard | False | True | Unconfirmed¹ | | DVD-Movie-PROTECT | False | True | Unconfirmed¹ | | DVD Crypt | False | True | Unconfirmed¹ | -| EA Protections | True | False | Including EA CDKey and EA DRM. Cucko has been disabled due to invalid checks | +| EA Protections | True | False | Including Cucko, EA CDKey and EA DRM. | | ~~Executable-Based CD Check~~ | True | False | Disabled due to overly-broad checks | | Executable-Based Online Registration | True | False | Possibly too broad | | Freelock | False | True | Unconfirmed¹ |