SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-20 07:45:07 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add SolidShield import directory table checks

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-08 16:53:43 -08:00
parent 2dcd30e346
commit 92b3f14d7b
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
BurnOutSharp/ProtectionType/SolidShield.cs
View File

@@ -62,9 +62,6 @@ namespace BurnOutSharp.ProtectionType
// (char)0xEF + (char)0xBE + (char)0xAD + (char)0xDE
new ContentMatchSet(new byte?[] { 0xEF, 0xBE, 0xAD, 0xDE }, GetExeWrapperVersion, "SolidShield EXE Wrapper"),
// dvm.dll
new ContentMatchSet(new byte?[] { 0x64, 0x76, 0x6D, 0x2E, 0x64, 0x6C, 0x6C }, "SolidShield EXE Wrapper v1"),
};
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".init"), matchers, includeDebug);
@@ -100,6 +97,22 @@ namespace BurnOutSharp.ProtectionType
}
}
// Get the import directory table, if it exists
if (pex.ImportTable?.ImportDirectoryTable != null)
{
bool match = pex.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "dvm.dll");
if (match)
return "SolidShield EXE Wrapper v1";
match = pex.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "activation.x86.dll");
if (match)
return "SolidShield EXE Wrapper v2";
match = pex.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "activation.x64.dll");
if (match)
return "SolidShield EXE Wrapper v2";
}
return null;
}