diff --git a/BurnOutSharp/ProtectionType/CodeLock.cs b/BurnOutSharp/ProtectionType/CodeLock.cs index 32836e1e..da17a1ba 100644 --- a/BurnOutSharp/ProtectionType/CodeLock.cs +++ b/BurnOutSharp/ProtectionType/CodeLock.cs @@ -1,4 +1,7 @@ using System.Collections.Generic; +using System.Linq; +using System.Text; +using BurnOutSharp.ExecutableType.Microsoft; using BurnOutSharp.Matching; namespace BurnOutSharp.ProtectionType @@ -8,25 +11,33 @@ namespace BurnOutSharp.ProtectionType /// public List GetContentMatchSets() { - // TODO: Verify if these are OR or AND + // TODO: Obtain a sample to find where this string is in a typical executable return new List { - // icd1 + (char)0x00 - new ContentMatchSet(new byte?[] { 0x69, 0x63, 0x64, 0x31, 0x00 }, "Code Lock"), - - // icd2 + (char)0x00 - new ContentMatchSet(new byte?[] { 0x69, 0x63, 0x64, 0x32, 0x00 }, "Code Lock"), - // CODE-LOCK.OCX new ContentMatchSet(new byte?[] { 0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43, 0x4B, 0x2E, 0x4F, 0x43, 0x58 - }, "Code Lock"), + }, "CodeLock"), }; } /// - public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null; + public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) + { + // Get the sections from the executable, if possible + PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0); + var sections = pex?.SectionTable; + if (sections == null) + return null; + + // If there are more than 2 icd-prefixed sections, then we have a match + int icdSectionCount = sections.Count(s => Encoding.ASCII.GetString(s.Name).StartsWith("icd")); + if (icdSectionCount >= 2) + return "CodeLock"; + + return null; + } } }