diff --git a/BurnOutSharp/ProtectionType/CodeLock.cs b/BurnOutSharp/ProtectionType/CodeLock.cs
index 32836e1e..da17a1ba 100644
--- a/BurnOutSharp/ProtectionType/CodeLock.cs
+++ b/BurnOutSharp/ProtectionType/CodeLock.cs
@@ -1,4 +1,7 @@
using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
@@ -8,25 +11,33 @@ namespace BurnOutSharp.ProtectionType
///
public List GetContentMatchSets()
{
- // TODO: Verify if these are OR or AND
+ // TODO: Obtain a sample to find where this string is in a typical executable
return new List
{
- // icd1 + (char)0x00
- new ContentMatchSet(new byte?[] { 0x69, 0x63, 0x64, 0x31, 0x00 }, "Code Lock"),
-
- // icd2 + (char)0x00
- new ContentMatchSet(new byte?[] { 0x69, 0x63, 0x64, 0x32, 0x00 }, "Code Lock"),
-
// CODE-LOCK.OCX
new ContentMatchSet(new byte?[]
{
0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43,
0x4B, 0x2E, 0x4F, 0x43, 0x58
- }, "Code Lock"),
+ }, "CodeLock"),
};
}
///
- public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
+ public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
+ {
+ // Get the sections from the executable, if possible
+ PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
+ var sections = pex?.SectionTable;
+ if (sections == null)
+ return null;
+
+ // If there are more than 2 icd-prefixed sections, then we have a match
+ int icdSectionCount = sections.Count(s => Encoding.ASCII.GetString(s.Name).StartsWith("icd"));
+ if (icdSectionCount >= 2)
+ return "CodeLock";
+
+ return null;
+ }
}
}