diff --git a/BurnOutSharp/ProtectionType/ActiveMARK.cs b/BurnOutSharp/ProtectionType/ActiveMARK.cs
index 6a197c43..0718a39c 100644
--- a/BurnOutSharp/ProtectionType/ActiveMARK.cs
+++ b/BurnOutSharp/ProtectionType/ActiveMARK.cs
@@ -1,5 +1,4 @@
using System.Collections.Generic;
-using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
@@ -8,22 +7,6 @@ namespace BurnOutSharp.ProtectionType
// TODO: Figure out how to get version numbers
public class ActiveMARK : IContentCheck
{
- ///
- private List GetContentMatchSets()
- {
- // TODO: Obtain a sample to find where this string is in a typical executable
- return new List
- {
- // " " + (char)0xC2 + (char)0x16 + (char)0x00 + (char)0xA8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0xB8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x86 + (char)0xC8 + (char)0x16 + (char)0x00 + (char)0x9A + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x10 + (char)0xC2 + (char)0x16 + (char)0x00
- new ContentMatchSet(new byte?[]
- {
- 0x20, 0xC2, 0x16, 0x00, 0xA8, 0xC1, 0x16, 0x00,
- 0xB8, 0xC1, 0x16, 0x00, 0x86, 0xC8, 0x16, 0x00,
- 0x9A, 0xC1, 0x16, 0x00, 0x10, 0xC2, 0x16, 0x00
- }, "ActiveMARK 5"),
- };
- }
-
///
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
@@ -47,11 +30,19 @@ namespace BurnOutSharp.ProtectionType
return match;
}
- var contentMatchSets = GetContentMatchSets();
- if (contentMatchSets != null && contentMatchSets.Any())
- return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
-
- return null;
+ // TODO: Obtain a sample to find where this string is in a typical executable
+ var contentMatchSets = new List
+ {
+ // " " + (char)0xC2 + (char)0x16 + (char)0x00 + (char)0xA8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0xB8 + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x86 + (char)0xC8 + (char)0x16 + (char)0x00 + (char)0x9A + (char)0xC1 + (char)0x16 + (char)0x00 + (char)0x10 + (char)0xC2 + (char)0x16 + (char)0x00
+ new ContentMatchSet(new byte?[]
+ {
+ 0x20, 0xC2, 0x16, 0x00, 0xA8, 0xC1, 0x16, 0x00,
+ 0xB8, 0xC1, 0x16, 0x00, 0x86, 0xC8, 0x16, 0x00,
+ 0x9A, 0xC1, 0x16, 0x00, 0x10, 0xC2, 0x16, 0x00
+ }, "ActiveMARK 5"),
+ };
+
+ return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
}
}