SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-10-02 03:28:34 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Cleanup and bugfixes; additional notes

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-10 15:32:37 -07:00
parent 1e70d960ba
commit 5344de96b2
67 changed files with 261 additions and 229 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
BurnOutSharp/ProtectionType/CodeLock.cs
View File

@@ -9,7 +9,7 @@ namespace BurnOutSharp.ProtectionType
public class CodeLock : IContentCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
private List<ContentMatchSet> GetContentMatchSets()
{
// TODO: Obtain a sample to find where this string is in a typical executable
return new List<ContentMatchSet>
@@ -30,13 +30,23 @@ namespace BurnOutSharp.ProtectionType
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
{
var neMatchSets = GetContentMatchSets();
if (neMatchSets != null && neMatchSets.Any())
return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug);
return null;
}
// If there are more than 2 icd-prefixed sections, then we have a match
int icdSectionCount = sections.Count(s => Encoding.ASCII.GetString(s.Name).StartsWith("icd"));
if (icdSectionCount >= 2)
return "CodeLock";
var contentMatchSets = GetContentMatchSets();
if (contentMatchSets != null && contentMatchSets.Any())
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
return null;
}
}