From 92b3f14d7b11afb6a44a9e982f7ded558f171ac8 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Thu, 8 Dec 2022 16:53:43 -0800 Subject: [PATCH] Add SolidShield import directory table checks --- BurnOutSharp/ProtectionType/SolidShield.cs | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/BurnOutSharp/ProtectionType/SolidShield.cs b/BurnOutSharp/ProtectionType/SolidShield.cs index a3dfcbae..cbf2200b 100644 --- a/BurnOutSharp/ProtectionType/SolidShield.cs +++ b/BurnOutSharp/ProtectionType/SolidShield.cs @@ -62,9 +62,6 @@ namespace BurnOutSharp.ProtectionType // (char)0xEF + (char)0xBE + (char)0xAD + (char)0xDE new ContentMatchSet(new byte?[] { 0xEF, 0xBE, 0xAD, 0xDE }, GetExeWrapperVersion, "SolidShield EXE Wrapper"), - - // dvm.dll - new ContentMatchSet(new byte?[] { 0x64, 0x76, 0x6D, 0x2E, 0x64, 0x6C, 0x6C }, "SolidShield EXE Wrapper v1"), }; string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".init"), matchers, includeDebug); @@ -100,6 +97,22 @@ namespace BurnOutSharp.ProtectionType } } + // Get the import directory table, if it exists + if (pex.ImportTable?.ImportDirectoryTable != null) + { + bool match = pex.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "dvm.dll"); + if (match) + return "SolidShield EXE Wrapper v1"; + + match = pex.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "activation.x86.dll"); + if (match) + return "SolidShield EXE Wrapper v2"; + + match = pex.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "activation.x64.dll"); + if (match) + return "SolidShield EXE Wrapper v2"; + } + return null; }