mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-09-24 07:44:55 +00:00
Static list of content matchers
This also includes some more path matcher conversions that I couldn't reasonably split out
This commit is contained in:
Matt Nadareski
@@ -9,78 +9,81 @@ namespace BurnOutSharp.ProtectionType
|
||||
{
|
||||
public class SolidShield : IContentCheck, IPathCheck
|
||||
{
|
||||
/// <summary>
|
||||
/// Set of all ContentMatchSets for this protection
|
||||
/// </summary>
|
||||
private static List<ContentMatchSet> contentMatchers = new List<ContentMatchSet>
|
||||
{
|
||||
// D + (char)0x00 + V + (char)0x00 + M + (char)0x00 + + (char)0x00 + L + (char)0x00 + i + (char)0x00 + b + (char)0x00 + r + (char)0x00 + a + (char)0x00 + r + (char)0x00 + y + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x44, 0x00, 0x56, 0x00, 0x4D, 0x00, 0x20, 0x00,
|
||||
0x4C, 0x00, 0x69, 0x00, 0x62, 0x00, 0x72, 0x00,
|
||||
0x61, 0x00, 0x72, 0x00, 0x79, 0x00
|
||||
}, Utilities.GetFileVersion, "SolidShield"),
|
||||
|
||||
// S + (char)0x00 + o + (char)0x00 + l + (char)0x00 + i + (char)0x00 + d + (char)0x00 + s + (char)0x00 + h + (char)0x00 + i + (char)0x00 + e + (char)0x00 + l + (char)0x00 + d + (char)0x00 + + (char)0x00 + L + (char)0x00 + i + (char)0x00 + b + (char)0x00 + r + (char)0x00 + a + (char)0x00 + r + (char)0x00 + y + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x53, 0x00, 0x6F, 0x00, 0x6C, 0x00, 0x69, 0x00,
|
||||
0x64, 0x00, 0x73, 0x00, 0x68, 0x00, 0x69, 0x00,
|
||||
0x65, 0x00, 0x6C, 0x00, 0x64, 0x00, 0x20, 0x00,
|
||||
0x4C, 0x00, 0x69, 0x00, 0x62, 0x00, 0x72, 0x00,
|
||||
0x61, 0x00, 0x72, 0x00, 0x79, 0x00
|
||||
}, GetFileVersion, "SolidShield Core.dll"),
|
||||
|
||||
// S + (char)0x00 + o + (char)0x00 + l + (char)0x00 + i + (char)0x00 + d + (char)0x00 + s + (char)0x00 + h + (char)0x00 + i + (char)0x00 + e + (char)0x00 + l + (char)0x00 + d + (char)0x00 + + (char)0x00 + A + (char)0x00 + c + (char)0x00 + t + (char)0x00 + i + (char)0x00 + v + (char)0x00 + a + (char)0x00 + t + (char)0x00 + i + (char)0x00 + o + (char)0x00 + n + (char)0x00 + + (char)0x00 + L + (char)0x00 + i + (char)0x00 + b + (char)0x00 + r + (char)0x00 + a + (char)0x00 + r + (char)0x00 + y + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x53, 0x00, 0x6F, 0x00, 0x6C, 0x00, 0x69, 0x00,
|
||||
0x64, 0x00, 0x73, 0x00, 0x68, 0x00, 0x69, 0x00,
|
||||
0x65, 0x00, 0x6C, 0x00, 0x64, 0x00, 0x20, 0x00,
|
||||
0x41, 0x00, 0x63, 0x00, 0x74, 0x00, 0x69, 0x00,
|
||||
0x76, 0x00, 0x61, 0x00, 0x74, 0x00, 0x69, 0x00,
|
||||
0x6F, 0x00, 0x6E, 0x00, 0x20, 0x00, 0x4C, 0x00,
|
||||
0x69, 0x00, 0x62, 0x00, 0x72, 0x00, 0x61, 0x00,
|
||||
0x72, 0x00, 0x79, 0x00
|
||||
}, GetFileVersion, "SolidShield Core.dll"),
|
||||
|
||||
// (char)0xEF + (char)0xBE + (char)0xAD + (char)0xDE
|
||||
new ContentMatchSet(new byte?[] { 0xEF, 0xBE, 0xAD, 0xDE }, GetExeWrapperVersion, "SolidShield"),
|
||||
|
||||
// A + (char)0x00 + c + (char)0x00 + t + (char)0x00 + i + (char)0x00 + v + (char)0x00 + a + (char)0x00 + t + (char)0x00 + i + (char)0x00 + o + (char)0x00 + n + (char)0x00 + + (char)0x00 + M + (char)0x00 + a + (char)0x00 + n + (char)0x00 + a + (char)0x00 + g + (char)0x00 + e + (char)0x00 + r + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x41, 0x00, 0x63, 0x00, 0x74, 0x00, 0x69, 0x00,
|
||||
0x76, 0x00, 0x61, 0x00, 0x74, 0x00, 0x69, 0x00,
|
||||
0x6f, 0x00, 0x6e, 0x00, 0x20, 0x00, 0x4d, 0x00,
|
||||
0x61, 0x00, 0x6e, 0x00, 0x61, 0x00, 0x67, 0x00,
|
||||
0x65, 0x00, 0x72, 0x00
|
||||
}, GetFileVersion, "SolidShield Activation Manager Module"),
|
||||
|
||||
// dvm.dll
|
||||
new ContentMatchSet(new byte?[] { 0x64, 0x76, 0x6D, 0x2E, 0x64, 0x6C, 0x6C }, "SolidShield EXE Wrapper"),
|
||||
|
||||
// (char)0xAD + (char)0xDE + (char)0xFE + (char)0xCA
|
||||
new ContentMatchSet(new byte?[] { 0xAD, 0xDE, 0xFE, 0xCA }, GetVersionPlusTages, "SolidShield"),
|
||||
|
||||
// Solidshield
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x53, 0x6F, 0x6C, 0x69, 0x64, 0x73, 0x68, 0x69,
|
||||
0x65, 0x6C, 0x64
|
||||
}, GetVersion, "SolidShield"),
|
||||
|
||||
// B + (char)0x00 + I + (char)0x00 + N + (char)0x00 + (char)0x7 + (char)0x00 + I + (char)0x00 + D + (char)0x00 + R + (char)0x00 + _ + (char)0x00 + S + (char)0x00 + G + (char)0x00 + T + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x42, 0x00, 0x49, 0x00, 0x4E, 0x00, 0x07, 0x00,
|
||||
0x49, 0x00, 0x44, 0x00, 0x52, 0x00, 0x5F, 0x00,
|
||||
0x53, 0x00, 0x47, 0x00, 0x54, 0x00
|
||||
}, "SolidShield"),
|
||||
};
|
||||
|
||||
/// <inheritdoc/>
|
||||
public string CheckContents(string file, byte[] fileContent, bool includePosition = false)
|
||||
{
|
||||
var matchers = new List<ContentMatchSet>
|
||||
{
|
||||
// D + (char)0x00 + V + (char)0x00 + M + (char)0x00 + + (char)0x00 + L + (char)0x00 + i + (char)0x00 + b + (char)0x00 + r + (char)0x00 + a + (char)0x00 + r + (char)0x00 + y + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x44, 0x00, 0x56, 0x00, 0x4D, 0x00, 0x20, 0x00,
|
||||
0x4C, 0x00, 0x69, 0x00, 0x62, 0x00, 0x72, 0x00,
|
||||
0x61, 0x00, 0x72, 0x00, 0x79, 0x00
|
||||
}, Utilities.GetFileVersion, "SolidShield"),
|
||||
|
||||
// S + (char)0x00 + o + (char)0x00 + l + (char)0x00 + i + (char)0x00 + d + (char)0x00 + s + (char)0x00 + h + (char)0x00 + i + (char)0x00 + e + (char)0x00 + l + (char)0x00 + d + (char)0x00 + + (char)0x00 + L + (char)0x00 + i + (char)0x00 + b + (char)0x00 + r + (char)0x00 + a + (char)0x00 + r + (char)0x00 + y + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x53, 0x00, 0x6F, 0x00, 0x6C, 0x00, 0x69, 0x00,
|
||||
0x64, 0x00, 0x73, 0x00, 0x68, 0x00, 0x69, 0x00,
|
||||
0x65, 0x00, 0x6C, 0x00, 0x64, 0x00, 0x20, 0x00,
|
||||
0x4C, 0x00, 0x69, 0x00, 0x62, 0x00, 0x72, 0x00,
|
||||
0x61, 0x00, 0x72, 0x00, 0x79, 0x00
|
||||
}, GetFileVersion, "SolidShield Core.dll"),
|
||||
|
||||
// S + (char)0x00 + o + (char)0x00 + l + (char)0x00 + i + (char)0x00 + d + (char)0x00 + s + (char)0x00 + h + (char)0x00 + i + (char)0x00 + e + (char)0x00 + l + (char)0x00 + d + (char)0x00 + + (char)0x00 + A + (char)0x00 + c + (char)0x00 + t + (char)0x00 + i + (char)0x00 + v + (char)0x00 + a + (char)0x00 + t + (char)0x00 + i + (char)0x00 + o + (char)0x00 + n + (char)0x00 + + (char)0x00 + L + (char)0x00 + i + (char)0x00 + b + (char)0x00 + r + (char)0x00 + a + (char)0x00 + r + (char)0x00 + y + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x53, 0x00, 0x6F, 0x00, 0x6C, 0x00, 0x69, 0x00,
|
||||
0x64, 0x00, 0x73, 0x00, 0x68, 0x00, 0x69, 0x00,
|
||||
0x65, 0x00, 0x6C, 0x00, 0x64, 0x00, 0x20, 0x00,
|
||||
0x41, 0x00, 0x63, 0x00, 0x74, 0x00, 0x69, 0x00,
|
||||
0x76, 0x00, 0x61, 0x00, 0x74, 0x00, 0x69, 0x00,
|
||||
0x6F, 0x00, 0x6E, 0x00, 0x20, 0x00, 0x4C, 0x00,
|
||||
0x69, 0x00, 0x62, 0x00, 0x72, 0x00, 0x61, 0x00,
|
||||
0x72, 0x00, 0x79, 0x00
|
||||
}, GetFileVersion, "SolidShield Core.dll"),
|
||||
|
||||
// (char)0xEF + (char)0xBE + (char)0xAD + (char)0xDE
|
||||
new ContentMatchSet(new byte?[] { 0xEF, 0xBE, 0xAD, 0xDE }, GetExeWrapperVersion, "SolidShield"),
|
||||
|
||||
// A + (char)0x00 + c + (char)0x00 + t + (char)0x00 + i + (char)0x00 + v + (char)0x00 + a + (char)0x00 + t + (char)0x00 + i + (char)0x00 + o + (char)0x00 + n + (char)0x00 + + (char)0x00 + M + (char)0x00 + a + (char)0x00 + n + (char)0x00 + a + (char)0x00 + g + (char)0x00 + e + (char)0x00 + r + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x41, 0x00, 0x63, 0x00, 0x74, 0x00, 0x69, 0x00,
|
||||
0x76, 0x00, 0x61, 0x00, 0x74, 0x00, 0x69, 0x00,
|
||||
0x6f, 0x00, 0x6e, 0x00, 0x20, 0x00, 0x4d, 0x00,
|
||||
0x61, 0x00, 0x6e, 0x00, 0x61, 0x00, 0x67, 0x00,
|
||||
0x65, 0x00, 0x72, 0x00
|
||||
}, GetFileVersion, "SolidShield Activation Manager Module"),
|
||||
|
||||
// dvm.dll
|
||||
new ContentMatchSet(new byte?[] { 0x64, 0x76, 0x6D, 0x2E, 0x64, 0x6C, 0x6C }, "SolidShield EXE Wrapper"),
|
||||
|
||||
// (char)0xAD + (char)0xDE + (char)0xFE + (char)0xCA
|
||||
new ContentMatchSet(new byte?[] { 0xAD, 0xDE, 0xFE, 0xCA }, GetVersionPlusTages, "SolidShield"),
|
||||
|
||||
// Solidshield
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x53, 0x6F, 0x6C, 0x69, 0x64, 0x73, 0x68, 0x69,
|
||||
0x65, 0x6C, 0x64
|
||||
}, GetVersion, "SolidShield"),
|
||||
|
||||
// B + (char)0x00 + I + (char)0x00 + N + (char)0x00 + (char)0x7 + (char)0x00 + I + (char)0x00 + D + (char)0x00 + R + (char)0x00 + _ + (char)0x00 + S + (char)0x00 + G + (char)0x00 + T + (char)0x00
|
||||
new ContentMatchSet(new byte?[]
|
||||
{
|
||||
0x42, 0x00, 0x49, 0x00, 0x4E, 0x00, 0x07, 0x00,
|
||||
0x49, 0x00, 0x44, 0x00, 0x52, 0x00, 0x5F, 0x00,
|
||||
0x53, 0x00, 0x47, 0x00, 0x54, 0x00
|
||||
}, "SolidShield"),
|
||||
};
|
||||
|
||||
return MatchUtil.GetFirstMatch(file, fileContent, matchers, includePosition);
|
||||
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchers, includePosition);
|
||||
}
|
||||
|
||||
/// <inheritdoc/>
|
||||
|
||||
Reference in New Issue
Block a user