From 47845a2409d019e8aff39c81e03f5c76b8a9f749 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Wed, 13 Jul 2022 11:52:49 -0700
Subject: [PATCH] Split Cucko into separate file

---
 BurnOutSharp/ProtectionType/Cucko.cs          | 41 +++++++++++++++++++
 BurnOutSharp/ProtectionType/ElectronicArts.cs | 16 --------
 README.md                                     |  3 +-
 3 files changed, 43 insertions(+), 17 deletions(-)
 create mode 100644 BurnOutSharp/ProtectionType/Cucko.cs

diff --git a/BurnOutSharp/ProtectionType/Cucko.cs b/BurnOutSharp/ProtectionType/Cucko.cs
new file mode 100644
index 00000000..c498cd6d
--- /dev/null
+++ b/BurnOutSharp/ProtectionType/Cucko.cs
@@ -0,0 +1,41 @@
+using System.Collections.Generic;
+using BurnOutSharp.ExecutableType.Microsoft.PE;
+using BurnOutSharp.Interfaces;
+using BurnOutSharp.Matching;
+
+namespace BurnOutSharp.ProtectionType
+{
+    // TODO: Do more research into the Cucko protection:
+    //      - Reference to `EASTL` and `EAStdC` are standard for EA products and does not indicate Cucko by itself
+    //      - There's little information outside of PiD detection that actually knows about Cucko
+    //      - Cucko is confirmed to, at least, use DMI checks.
+    public class Cucko : IPortableExecutableCheck
+    {
+        /// <inheritdoc/>
+        public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
+        {
+            // Get the sections from the executable, if possible
+            var sections = pex?.SectionTable;
+            if (sections == null)
+                return null;
+
+            // Get the .text section, if it exists
+            if (pex.TextSectionRaw == null)
+                return null;
+
+            var matchers = new List<ContentMatchSet>
+            {
+                // Confirmed to detect most examples known of Cucko. The only known exception is the version of "TSLHost.dll" included on Redump entry 36119.
+                // ŠU‰8...…™...ŠUŠ8T...
+                new ContentMatchSet(new byte?[]
+                {
+                    0x8A, 0x55, 0x89, 0x38, 0x14, 0x1E, 0x0F, 0x85,
+                    0x99, 0x00, 0x00, 0x00, 0x8A, 0x55, 0x8A, 0x38,
+                    0x54, 0x1E, 0x01, 0x0F
+                }, "Cucko (EA Custom)")
+            };
+
+            return MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
+        }
+    }
+}
diff --git a/BurnOutSharp/ProtectionType/ElectronicArts.cs b/BurnOutSharp/ProtectionType/ElectronicArts.cs
index fb908996..0b4b739f 100644
--- a/BurnOutSharp/ProtectionType/ElectronicArts.cs
+++ b/BurnOutSharp/ProtectionType/ElectronicArts.cs
@@ -7,13 +7,6 @@ using BurnOutSharp.Tools;
 
 namespace BurnOutSharp.ProtectionType
 {
-    // TODO: Do more research into the Cucko protection:
-    //      - Reference to `EASTL` and `EAStdC` are standard for EA products and does not indicate Cucko by itself
-    //      - There's little information outside of PiD detection that actually knows about Cucko
-    //      - Look into `ccinstall`, `Services/EACOM`, `TSLHost`, `SIGS/UploadThread/exchangeAuthToken`,
-    //          `blazeURL`, `psapi.dll`, `DasmX86Dll.dll`, `NVCPL.dll`, `iphlpapi.dll`, `dbghelp.dll`,
-    //          `WS2_32.dll`, 
-    //      - Cucko is confirmed to, at least, use DMI checks.
     public class ElectronicArts : IPortableExecutableCheck
     {
         /// <inheritdoc/>
@@ -89,15 +82,6 @@ namespace BurnOutSharp.ProtectionType
                         0x41, 0x00, 0x00, 0x00, 0x41, 0x63, 0x74, 0x69,
                         0x76, 0x61, 0x74, 0x69, 0x6F, 0x6E
                     }, "EA DRM Protection"),
-
-                    // Confirmed to detect most examples known of Cucko. The only known exception is the version of "TSLHost.dll" included on Redump entry 36119.
-                    // ŠU‰8...…™...ŠUŠ8T...
-                    new ContentMatchSet(new byte?[]
-                    {
-                        0x8A, 0x55, 0x89, 0x38, 0x14, 0x1E, 0x0F, 0x85, 
-                        0x99, 0x00, 0x00, 0x00, 0x8A, 0x55, 0x8A, 0x38, 
-                        0x54, 0x1E, 0x01, 0x0F
-                    }, "Cucko (Custom EA Protection)")
                 };
 
                 string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
diff --git a/README.md b/README.md
index 94adae3c..74da9133 100644
--- a/README.md
+++ b/README.md
@@ -42,12 +42,13 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain
 | Cenga ProtectDVD | True | True | |
 | CodeLock / CodeLok / CopyLok | True | False | Partially unconfirmed² |
 | CopyKiller | True | True | Unconfirmed¹ |
+| Cucko (EA Custom) | True | False | Does not detect all known cases |
 | Denuvo | True | False | |
 | Dinamic Multimedia Protection/LockBlocks | False | True | LockBlocks needs manual confirmation of the presence of 2 rings |
 | DiscGuard | False | True | Unconfirmed¹ |
 | DVD-Movie-PROTECT | False | True | Unconfirmed¹ |
 | DVD Crypt | False | True | Unconfirmed¹ |
-| EA Protections | True | False | Including Cucko, EA CDKey and EA DRM. |
+| EA Protections | True | False | Including EA CDKey and EA DRM. |
 | ~~Executable-Based CD Check~~ | True | False | Disabled due to overly-broad checks |
 | Executable-Based Online Registration | True | False | Possibly too broad |
 | Freelock | False | True | Unconfirmed¹ |