From 6661c48428de716fc558826122ad6cabcebc0d8f Mon Sep 17 00:00:00 2001 From: TheRogueArchivist <24215969+TheRogueArchivist@users.noreply.github.com> Date: Mon, 30 Dec 2024 20:16:55 -0700 Subject: [PATCH] Don't check files with ".srdata" section for Denuvo (#351) Prone to too many false positives. --- BinaryObjectScanner/Protection/Denuvo.cs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/BinaryObjectScanner/Protection/Denuvo.cs b/BinaryObjectScanner/Protection/Denuvo.cs index f108c1bf..eaff23a9 100644 --- a/BinaryObjectScanner/Protection/Denuvo.cs +++ b/BinaryObjectScanner/Protection/Denuvo.cs @@ -90,7 +90,9 @@ namespace BinaryObjectScanner.Protection // TODO: Re-enable all Entry Point checks after implementing if (pex.ContainsSection(".arch") - || pex.ContainsSection(".srdata") + // Disabled scanning in files with the ".srdata" section due to numerous false positives. + // These include Redump entry 112733 and Bus Hound 5.04 (https://web.archive.org/web/20070129204350/http://www.perisoft.net/bin/bhe504.exe). + // || pex.ContainsSection(".srdata") || !string.IsNullOrEmpty(timingMatch)) { if (pex.Model.OptionalHeader?.Magic == OHMN.PE32Plus)