SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-08 18:06:34 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Improve Hexalock detection slightly (#347)

Browse Source 
* Improve Hexalock detection via checking different known sections for mfint.dll

* Add sabre's suggestion

Improve code with sabre's code suggestion

Co-authored-by: Matt Nadareski <mnadareski@outlook.com>

* Add extra check for instances in UPX executables.

* Add newlines between if blocks.

---------

Co-authored-by: Matt Nadareski <mnadareski@outlook.com>
This commit is contained in:
HeroponRikiBestest
2024-12-29 11:40:24 -08:00
committed by GitHub
parent d505707dee
commit 5f5dc7d0de
1 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
BinaryObjectScanner/Protection/HexalockAutoLock.cs
View File

@@ -57,7 +57,25 @@ namespace BinaryObjectScanner.Protection
if (strs.Exists(s => s.Contains("mfint.dll")))
return "Hexalock Autolock";
}
// Get the code/CODE section strings, if they exist
strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)
{
// Found in "launcher.exe" in "Sea Adventure / Adventure de la Mer" by Compedia.
if (strs.Exists(s => s.Contains("mfint.dll")))
return "Hexalock Autolock";
}
// Get the UPX1 section strings, if they exist
strs = pex.GetFirstSectionStrings("UPX1");
if (strs != null)
{
// Found in "postmanpat.exe" in "Postman Pat" by Compedia.
if (strs.Exists(s => s.Contains("mfint.dll")))
return "Hexalock Autolock";
}
return null;
}