SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-22 06:45:03 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Convert 3PLock to section based

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-07 21:02:52 -07:00
parent af6e5d7441
commit 95770c63af
1 changed files with 32 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
BurnOutSharp/ProtectionType/ThreePLock.cs
View File

@@ -1,4 +1,7 @@
using System.Collections.Generic;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
@@ -6,30 +9,36 @@ namespace BurnOutSharp.ProtectionType
public class ThreePLock : IContentCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
{
return new List<ContentMatchSet>
{
new ContentMatchSet(new List<byte?[]>
{
// .ldr
new byte?[] { 0x2E, 0x6C, 0x64, 0x72 },
// .ldt
new byte?[] { 0x2E, 0x6C, 0x64, 0x74 },
}, "3PLock"),
// This produced false positives in some DirectX 9.0c installer files
// "Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// new ContentMatchSet(new byte?[]
// {
// 0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30,
// 0x53, 0x56, 0x57
// }, "3PLock"),
};
}
public List<ContentMatchSet> GetContentMatchSets() => null;
// {
// return new List<ContentMatchSet>
// {
// //This produced false positives in some DirectX 9.0c installer files
// //"Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// new ContentMatchSet(new byte?[]
// {
// 0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30,
// 0x53, 0x56, 0x57
// }, "3PLock"),
// };
// }
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;
// Get the .ldr and .ldt sections, if they exist -- TODO: Confirm if both are needed or either/or is fine
var cmsdSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".ldr"));
var cmstSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".ldt"));
if (cmsdSection != null || cmstSection != null)
return $"3PLock";
return null;
}
}
}