From 5f5dc7d0de61e38ff6a0419665998ee85f534645 Mon Sep 17 00:00:00 2001 From: HeroponRikiBestest <50224630+HeroponRikiBestest@users.noreply.github.com> Date: Sun, 29 Dec 2024 11:40:24 -0800 Subject: [PATCH] Improve Hexalock detection slightly (#347) * Improve Hexalock detection via checking different known sections for mfint.dll * Add sabre's suggestion Improve code with sabre's code suggestion Co-authored-by: Matt Nadareski * Add extra check for instances in UPX executables. * Add newlines between if blocks. --------- Co-authored-by: Matt Nadareski --- .../Protection/HexalockAutoLock.cs | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/BinaryObjectScanner/Protection/HexalockAutoLock.cs b/BinaryObjectScanner/Protection/HexalockAutoLock.cs index 1ac5bdd9..a09d0011 100644 --- a/BinaryObjectScanner/Protection/HexalockAutoLock.cs +++ b/BinaryObjectScanner/Protection/HexalockAutoLock.cs @@ -57,7 +57,25 @@ namespace BinaryObjectScanner.Protection if (strs.Exists(s => s.Contains("mfint.dll"))) return "Hexalock Autolock"; } - + + // Get the code/CODE section strings, if they exist + strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE"); + if (strs != null) + { + // Found in "launcher.exe" in "Sea Adventure / Adventure de la Mer" by Compedia. + if (strs.Exists(s => s.Contains("mfint.dll"))) + return "Hexalock Autolock"; + } + + // Get the UPX1 section strings, if they exist + strs = pex.GetFirstSectionStrings("UPX1"); + if (strs != null) + { + // Found in "postmanpat.exe" in "Postman Pat" by Compedia. + if (strs.Exists(s => s.Contains("mfint.dll"))) + return "Hexalock Autolock"; + } + return null; }