From 5425578f7853ad2c65edaca8fd0d051db45119db Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Sun, 12 Sep 2021 13:40:29 -0700
Subject: [PATCH] Clean up Origin

---
 BurnOutSharp/ProtectionType/Origin.cs | 35 +++++++++++----------------
 1 file changed, 14 insertions(+), 21 deletions(-)

diff --git a/BurnOutSharp/ProtectionType/Origin.cs b/BurnOutSharp/ProtectionType/Origin.cs
index e8db4d1e..0b20b810 100644
--- a/BurnOutSharp/ProtectionType/Origin.cs
+++ b/BurnOutSharp/ProtectionType/Origin.cs
@@ -1,37 +1,30 @@
+using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Linq;
 using BurnOutSharp.ExecutableType.Microsoft;
 using BurnOutSharp.Matching;
+using BurnOutSharp.Tools;
 
 namespace BurnOutSharp.ProtectionType
 {
     public class Origin : IContentCheck, IPathCheck
     {
-        /// <inheritdoc/>
-        private List<ContentMatchSet> GetContentMatchSets()
-        {
-            // TODO: Obtain a sample to find where this string is in a typical executable
-            return new List<ContentMatchSet>
-            {
-                // TODO: This looks like "OriginalFileName"
-                // O + (char)0x00 + r + (char)0x00 + i + (char)0x00 + g + (char)0x00 + i + (char)0x00 + n + (char)0x00 + S + (char)0x00 + e + (char)0x00 + t + (char)0x00 + u + (char)0x00 + p + (char)0x00 + . + (char)0x00 + e + (char)0x00 + x + (char)0x00 + e + (char)0x00
-                new ContentMatchSet(new byte?[]
-                {
-                    0x4F, 0x00, 0x72, 0x00, 0x69, 0x00, 0x67, 0x00,
-                    0x69, 0x00, 0x6E, 0x00, 0x53, 0x00, 0x65, 0x00,
-                    0x74, 0x00, 0x75, 0x00, 0x70, 0x00, 0x2E, 0x00,
-                    0x65, 0x00, 0x78, 0x00, 0x65, 0x00
-                }, "Origin"),
-            };
-        }
-
         /// <inheritdoc/>
         public string CheckContents(string file, byte[] fileContent,bool includeDebug, PortableExecutable pex, NewExecutable nex)
         {
-            var contentMatchSets = GetContentMatchSets();
-            if (contentMatchSets != null && contentMatchSets.Any())
-                return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
+            // Get the sections from the executable, if possible
+            var sections = pex?.SectionTable;
+            if (sections == null)
+                return null;
+
+            string name = Utilities.GetFileDescription(pex);
+            if (!string.IsNullOrWhiteSpace(name) && name.Equals("Origin", StringComparison.OrdinalIgnoreCase))
+                return "Origin";
+
+            name = Utilities.GetProductName(pex);
+            if (!string.IsNullOrWhiteSpace(name) && name.Equals("Origin", StringComparison.OrdinalIgnoreCase))
+                return "Origin";
 
             return null;
         }