From 8c39adcc04d990fa23ce5186649112ebad1e5ca8 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Sat, 11 Sep 2021 23:03:56 -0700 Subject: [PATCH] Simplify EA checks, add note to Registration --- BurnOutSharp/ProtectionType/ElectronicArts.cs | 41 ++++--------------- .../ProtectionType/OnlineRegistration.cs | 1 + 2 files changed, 10 insertions(+), 32 deletions(-) diff --git a/BurnOutSharp/ProtectionType/ElectronicArts.cs b/BurnOutSharp/ProtectionType/ElectronicArts.cs index 2e35f702..b1afeba1 100644 --- a/BurnOutSharp/ProtectionType/ElectronicArts.cs +++ b/BurnOutSharp/ProtectionType/ElectronicArts.cs @@ -1,40 +1,19 @@ using System; using System.Collections.Generic; -using System.Linq; using BurnOutSharp.ExecutableType.Microsoft; using BurnOutSharp.Matching; using BurnOutSharp.Tools; namespace BurnOutSharp.ProtectionType { + // TODO: Do more research into the Cucko protection: + // - Reference to `EASTL` and `EAStdC` are standard for EA products and does not indicate Cucko by itself + // - There's little information outside of PiD detection that actually knows about Cucko + // - Look into `ccinstall`, `Services/EACOM`, `TSLHost`, `SIGS/UploadThread/exchangeAuthToken`, + // `blazeURL`, `psapi.dll`, `DasmX86Dll.dll`, `NVCPL.dll`, `iphlpapi.dll`, `dbghelp.dll`, + // `WS2_32.dll`, public class ElectronicArts : IContentCheck { - // TODO: Verify this doesn't over-match - // TODO: Do more research into the Cucko protection: - // - Reference to `EASTL` and `EAStdC` are standard for EA products and does not indicate Cucko by itself - // - There's little information outside of PiD detection that actually knows about Cucko - // - Look into `ccinstall`, `Services/EACOM`, `TSLHost`, `SIGS/UploadThread/exchangeAuthToken`, - // `blazeURL`, `psapi.dll`, `DasmX86Dll.dll`, `NVCPL.dll`, `iphlpapi.dll`, `dbghelp.dll`, - // `WS2_32.dll`, - /// - private List GetContentMatchSets() - { - // TODO: Obtain a sample to find where this string is in a typical executable - return new List - { - // EASTL - //new ContentMatchSet(new byte?[] { 0x45, 0x41, 0x53, 0x54, 0x4C }, "Cucko (EA Custom)"), - - // ereg.ea-europe.com - new ContentMatchSet(new byte?[] - { - 0x65, 0x72, 0x65, 0x67, 0x2E, 0x65, 0x61, 0x2D, - 0x65, 0x75, 0x72, 0x6F, 0x70, 0x65, 0x2E, 0x63, - 0x6F, 0x6D - }, Utilities.GetFileVersion, "EA CdKey Registration Module"), - }; - } - /// public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex) { @@ -44,7 +23,9 @@ namespace BurnOutSharp.ProtectionType return null; string name = Utilities.GetFileDescription(pex); - if (!string.IsNullOrWhiteSpace(name) && name.Contains("Registration code installer program")) + if (!string.IsNullOrWhiteSpace(name) && name.Contains("EReg MFC Application")) + return $"EA CdKey Registration Module {Utilities.GetFileVersion(pex)}"; + else if (!string.IsNullOrWhiteSpace(name) && name.Contains("Registration code installer program")) return $"EA CdKey Registration Module {Utilities.GetFileVersion(pex)}"; else if (!string.IsNullOrWhiteSpace(name) && name.Equals("EA DRM Helper", StringComparison.OrdinalIgnoreCase)) return $"EA DRM Protection {Utilities.GetFileVersion(pex)}"; @@ -113,10 +94,6 @@ namespace BurnOutSharp.ProtectionType return match; } - var contentMatchSets = GetContentMatchSets(); - if (contentMatchSets != null && contentMatchSets.Any()) - return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); - return null; } } diff --git a/BurnOutSharp/ProtectionType/OnlineRegistration.cs b/BurnOutSharp/ProtectionType/OnlineRegistration.cs index bdaabeb0..17299d7f 100644 --- a/BurnOutSharp/ProtectionType/OnlineRegistration.cs +++ b/BurnOutSharp/ProtectionType/OnlineRegistration.cs @@ -14,6 +14,7 @@ namespace BurnOutSharp.ProtectionType if (sections == null) return null; + // TODO: Is this too broad in general? string name = Utilities.GetInternalName(pex); if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("EReg", StringComparison.OrdinalIgnoreCase)) return $"Executable-Based Online Registration {Utilities.GetFileVersion(pex)}";