SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-22 06:45:03 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Partially convert CodeLock to section based; add note

Browse Source
This commit is contained in:
Matt Nadareski
2021-08-29 22:26:58 -07:00
parent 2d8a25178e
commit 7be5916041
1 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
BurnOutSharp/ProtectionType/CodeLock.cs
View File

@@ -1,4 +1,7 @@
using System.Collections.Generic;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
@@ -8,25 +11,33 @@ namespace BurnOutSharp.ProtectionType
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
{
// TODO: Verify if these are OR or AND
// TODO: Obtain a sample to find where this string is in a typical executable
return new List<ContentMatchSet>
{
// icd1 + (char)0x00
new ContentMatchSet(new byte?[] { 0x69, 0x63, 0x64, 0x31, 0x00 }, "Code Lock"),
// icd2 + (char)0x00
new ContentMatchSet(new byte?[] { 0x69, 0x63, 0x64, 0x32, 0x00 }, "Code Lock"),
// CODE-LOCK.OCX
new ContentMatchSet(new byte?[]
{
0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43,
0x4B, 0x2E, 0x4F, 0x43, 0x58
}, "Code Lock"),
}, "CodeLock"),
};
}
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;
// If there are more than 2 icd-prefixed sections, then we have a match
int icdSectionCount = sections.Count(s => Encoding.ASCII.GetString(s.Name).StartsWith("icd"));
if (icdSectionCount >= 2)
return "CodeLock";
return null;
}
}
}