diff --git a/BurnOutSharp/ProtectionType/Cucko.cs b/BurnOutSharp/ProtectionType/Cucko.cs
new file mode 100644
index 00000000..c498cd6d
--- /dev/null
+++ b/BurnOutSharp/ProtectionType/Cucko.cs
@@ -0,0 +1,41 @@
+using System.Collections.Generic;
+using BurnOutSharp.ExecutableType.Microsoft.PE;
+using BurnOutSharp.Interfaces;
+using BurnOutSharp.Matching;
+
+namespace BurnOutSharp.ProtectionType
+{
+ // TODO: Do more research into the Cucko protection:
+ // - Reference to `EASTL` and `EAStdC` are standard for EA products and does not indicate Cucko by itself
+ // - There's little information outside of PiD detection that actually knows about Cucko
+ // - Cucko is confirmed to, at least, use DMI checks.
+ public class Cucko : IPortableExecutableCheck
+ {
+ ///
+ public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
+ {
+ // Get the sections from the executable, if possible
+ var sections = pex?.SectionTable;
+ if (sections == null)
+ return null;
+
+ // Get the .text section, if it exists
+ if (pex.TextSectionRaw == null)
+ return null;
+
+ var matchers = new List
+ {
+ // Confirmed to detect most examples known of Cucko. The only known exception is the version of "TSLHost.dll" included on Redump entry 36119.
+ // ŠU‰8...…™...ŠUŠ8T...
+ new ContentMatchSet(new byte?[]
+ {
+ 0x8A, 0x55, 0x89, 0x38, 0x14, 0x1E, 0x0F, 0x85,
+ 0x99, 0x00, 0x00, 0x00, 0x8A, 0x55, 0x8A, 0x38,
+ 0x54, 0x1E, 0x01, 0x0F
+ }, "Cucko (EA Custom)")
+ };
+
+ return MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
+ }
+ }
+}
diff --git a/BurnOutSharp/ProtectionType/ElectronicArts.cs b/BurnOutSharp/ProtectionType/ElectronicArts.cs
index fb908996..0b4b739f 100644
--- a/BurnOutSharp/ProtectionType/ElectronicArts.cs
+++ b/BurnOutSharp/ProtectionType/ElectronicArts.cs
@@ -7,13 +7,6 @@ using BurnOutSharp.Tools;
namespace BurnOutSharp.ProtectionType
{
- // TODO: Do more research into the Cucko protection:
- // - Reference to `EASTL` and `EAStdC` are standard for EA products and does not indicate Cucko by itself
- // - There's little information outside of PiD detection that actually knows about Cucko
- // - Look into `ccinstall`, `Services/EACOM`, `TSLHost`, `SIGS/UploadThread/exchangeAuthToken`,
- // `blazeURL`, `psapi.dll`, `DasmX86Dll.dll`, `NVCPL.dll`, `iphlpapi.dll`, `dbghelp.dll`,
- // `WS2_32.dll`,
- // - Cucko is confirmed to, at least, use DMI checks.
public class ElectronicArts : IPortableExecutableCheck
{
///
@@ -89,15 +82,6 @@ namespace BurnOutSharp.ProtectionType
0x41, 0x00, 0x00, 0x00, 0x41, 0x63, 0x74, 0x69,
0x76, 0x61, 0x74, 0x69, 0x6F, 0x6E
}, "EA DRM Protection"),
-
- // Confirmed to detect most examples known of Cucko. The only known exception is the version of "TSLHost.dll" included on Redump entry 36119.
- // ŠU‰8...…™...ŠUŠ8T...
- new ContentMatchSet(new byte?[]
- {
- 0x8A, 0x55, 0x89, 0x38, 0x14, 0x1E, 0x0F, 0x85,
- 0x99, 0x00, 0x00, 0x00, 0x8A, 0x55, 0x8A, 0x38,
- 0x54, 0x1E, 0x01, 0x0F
- }, "Cucko (Custom EA Protection)")
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
diff --git a/README.md b/README.md
index 94adae3c..74da9133 100644
--- a/README.md
+++ b/README.md
@@ -42,12 +42,13 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain
| Cenga ProtectDVD | True | True | |
| CodeLock / CodeLok / CopyLok | True | False | Partially unconfirmed² |
| CopyKiller | True | True | Unconfirmed¹ |
+| Cucko (EA Custom) | True | False | Does not detect all known cases |
| Denuvo | True | False | |
| Dinamic Multimedia Protection/LockBlocks | False | True | LockBlocks needs manual confirmation of the presence of 2 rings |
| DiscGuard | False | True | Unconfirmed¹ |
| DVD-Movie-PROTECT | False | True | Unconfirmed¹ |
| DVD Crypt | False | True | Unconfirmed¹ |
-| EA Protections | True | False | Including Cucko, EA CDKey and EA DRM. |
+| EA Protections | True | False | Including EA CDKey and EA DRM. |
| ~~Executable-Based CD Check~~ | True | False | Disabled due to overly-broad checks |
| Executable-Based Online Registration | True | False | Possibly too broad |
| Freelock | False | True | Unconfirmed¹ |