From 5613cf9aae7e22c0df552f1e9385b8731490918e Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Fri, 9 Dec 2022 14:17:01 -0800
Subject: [PATCH] Convert dotFuscator to string finding

---
 BurnOutSharp/PackerType/dotFuscator.cs | 23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/BurnOutSharp/PackerType/dotFuscator.cs b/BurnOutSharp/PackerType/dotFuscator.cs
index 7febc04d..5e4a589a 100644
--- a/BurnOutSharp/PackerType/dotFuscator.cs
+++ b/BurnOutSharp/PackerType/dotFuscator.cs
@@ -1,8 +1,8 @@
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
+using System.Linq;
 using BurnOutSharp.Interfaces;
-using BurnOutSharp.Matching;
 using BurnOutSharp.Wrappers;
 
 namespace BurnOutSharp.PackerType
@@ -18,23 +18,12 @@ namespace BurnOutSharp.PackerType
             if (sections == null)
                 return null;
 
-            // Get the .text section, if it exists
-            if (pex.ContainsSection(".text"))
+            // Get the .text section strings, if they exist
+            List<string> strs = pex.GetFirstSectionStrings(".text");
+            if (strs != null)
             {
-                var matchers = new List<ContentMatchSet>
-                {
-                    // DotfuscatorAttribute
-                    new ContentMatchSet(new byte?[]
-                    {
-                        0x44, 0x6F, 0x74, 0x66, 0x75, 0x73, 0x63, 0x61,
-                        0x74, 0x6F, 0x72, 0x41, 0x74, 0x74, 0x72, 0x69,
-                        0x62, 0x75, 0x74, 0x65
-                    }, "dotFuscator"),
-                };
-
-                string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".text"), matchers, includeDebug);
-                if (!string.IsNullOrWhiteSpace(match))
-                    return match;
+                if (strs.Any(s => s.Contains("DotfuscatorAttribute")))
+                    return "dotFuscator";
             }
 
             return null;