SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-10-01 03:01:43 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Split Cucko into separate file

Browse Source
This commit is contained in:
Matt Nadareski
2022-07-13 11:52:49 -07:00
parent 42da9f4a82
commit 47845a2409
3 changed files with 43 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
BurnOutSharp/ProtectionType/Cucko.cs Normal file
View File

@@ -0,0 +1,41 @@
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
{
// TODO: Do more research into the Cucko protection:
// - Reference to `EASTL` and `EAStdC` are standard for EA products and does not indicate Cucko by itself
// - There's little information outside of PiD detection that actually knows about Cucko
// - Cucko is confirmed to, at least, use DMI checks.
public class Cucko : IPortableExecutableCheck
{
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex?.SectionTable;
if (sections == null)
return null;
// Get the .text section, if it exists
if (pex.TextSectionRaw == null)
return null;
var matchers = new List<ContentMatchSet>
{
// Confirmed to detect most examples known of Cucko. The only known exception is the version of "TSLHost.dll" included on Redump entry 36119.
// ŠU‰8...…™...ŠUŠ8T...
new ContentMatchSet(new byte?[]
{
0x8A, 0x55, 0x89, 0x38, 0x14, 0x1E, 0x0F, 0x85,
0x99, 0x00, 0x00, 0x00, 0x8A, 0x55, 0x8A, 0x38,
0x54, 0x1E, 0x01, 0x0F
}, "Cucko (EA Custom)")
};
return MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
}
}
}

16
BurnOutSharp/ProtectionType/ElectronicArts.cs
View File

@@ -7,13 +7,6 @@ using BurnOutSharp.Tools;
namespace BurnOutSharp.ProtectionType
{
// TODO: Do more research into the Cucko protection:
// - Reference to `EASTL` and `EAStdC` are standard for EA products and does not indicate Cucko by itself
// - There's little information outside of PiD detection that actually knows about Cucko
// - Look into `ccinstall`, `Services/EACOM`, `TSLHost`, `SIGS/UploadThread/exchangeAuthToken`,
// `blazeURL`, `psapi.dll`, `DasmX86Dll.dll`, `NVCPL.dll`, `iphlpapi.dll`, `dbghelp.dll`,
// `WS2_32.dll`,
// - Cucko is confirmed to, at least, use DMI checks.
public class ElectronicArts : IPortableExecutableCheck
{
/// <inheritdoc/>
@@ -89,15 +82,6 @@ namespace BurnOutSharp.ProtectionType
0x41, 0x00, 0x00, 0x00, 0x41, 0x63, 0x74, 0x69,
0x76, 0x61, 0x74, 0x69, 0x6F, 0x6E
}, "EA DRM Protection"),
// Confirmed to detect most examples known of Cucko. The only known exception is the version of "TSLHost.dll" included on Redump entry 36119.
// ŠU‰8...…™...ŠUŠ8T...
new ContentMatchSet(new byte?[]
{
0x8A, 0x55, 0x89, 0x38, 0x14, 0x1E, 0x0F, 0x85,
0x99, 0x00, 0x00, 0x00, 0x8A, 0x55, 0x8A, 0x38,
0x54, 0x1E, 0x01, 0x0F
}, "Cucko (Custom EA Protection)")
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);