SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-02-14 21:33:08 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Convert SmartE to section based

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-03 13:26:52 -07:00
parent 0dc83739e7
commit 53088b4e60
1 changed files with 65 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
BurnOutSharp/ProtectionType/SmartE.cs
View File

@@ -1,6 +1,10 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.ExecutableType.Microsoft.Headers;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
@@ -8,26 +12,54 @@ namespace BurnOutSharp.ProtectionType
public class SmartE : IContentCheck, IPathCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
{
return new List<ContentMatchSet>
{
// BITARTS
new ContentMatchSet(new byte?[] { 0x42, 0x49, 0x54, 0x41, 0x52, 0x54, 0x53 }, "SmartE"),
};
}
public List<ContentMatchSet> GetContentMatchSets() => null;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;
// Get the .edata section, if it exists
var edataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".edata"));
string match = GetMatchForSection(edataSection, file, fileContent, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Get the .idata section, if it exists
var idataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".idata"));
match = GetMatchForSection(idataSection, file, fileContent, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Get the .rdata section, if it exists
var rdataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rdata"));
match = GetMatchForSection(rdataSection, file, fileContent, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Get the .tls section, if it exists
var tlsSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".tls"));
match = GetMatchForSection(tlsSection, file, fileContent, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
return null;
}
/// <inheritdoc/>
public ConcurrentQueue<string> CheckDirectoryPath(string path, IEnumerable<string> files)
{
// TODO: Verify if these are OR or AND
var matchers = new List<PathMatchSet>
{
new PathMatchSet(new PathMatch($"{Path.DirectorySeparatorChar}00001.TMP", useEndsWith: true), "SmartE"),
new PathMatchSet(new PathMatch($"{Path.DirectorySeparatorChar}00002.TMP", useEndsWith: true), "SmartE"),
new PathMatchSet(new List<PathMatch>
{
new PathMatch($"{Path.DirectorySeparatorChar}00001.TMP", useEndsWith: true),
new PathMatch($"{Path.DirectorySeparatorChar}00002.TMP", useEndsWith: true)
}, "SmartE"),
};
return MatchUtil.GetAllMatches(files, matchers, any: true);
@@ -44,5 +76,26 @@ namespace BurnOutSharp.ProtectionType
return MatchUtil.GetFirstMatch(path, matchers, any: true);
}
/// <summary>
/// Check a section for the SmartE string(s)
/// </summary>
private string GetMatchForSection(SectionHeader section, string file, byte[] fileContent, bool includeDebug)
{
if (section == null)
return null;
int sectionAddr = (int)section.PointerToRawData;
int sectionEnd = sectionAddr + (int)section.VirtualSize;
var matchers = new List<ContentMatchSet>
{
// BITARTS
new ContentMatchSet(
new ContentMatch(new byte?[] { 0x42, 0x49, 0x54, 0x41, 0x52, 0x54, 0x53 }, start: sectionAddr, end: sectionEnd),
"SmartE"),
};
return MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
}
}
}