From 95770c63afdaa7ac3147eb311d42af7b90d59b75 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Tue, 7 Sep 2021 21:02:52 -0700
Subject: [PATCH] Convert 3PLock to section based

---
 BurnOutSharp/ProtectionType/ThreePLock.cs | 55 +++++++++++++----------
 1 file changed, 32 insertions(+), 23 deletions(-)

diff --git a/BurnOutSharp/ProtectionType/ThreePLock.cs b/BurnOutSharp/ProtectionType/ThreePLock.cs
index 3c6f933a..5572f760 100644
--- a/BurnOutSharp/ProtectionType/ThreePLock.cs
+++ b/BurnOutSharp/ProtectionType/ThreePLock.cs
@@ -1,4 +1,7 @@
 using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using BurnOutSharp.ExecutableType.Microsoft;
 using BurnOutSharp.Matching;
 
 namespace BurnOutSharp.ProtectionType
@@ -6,30 +9,36 @@ namespace BurnOutSharp.ProtectionType
     public class ThreePLock : IContentCheck
     {
         /// <inheritdoc/>
-        public List<ContentMatchSet> GetContentMatchSets()
-        {
-            return new List<ContentMatchSet>
-            {
-                new ContentMatchSet(new List<byte?[]>
-                {
-                    // .ldr
-                    new byte?[] { 0x2E, 0x6C, 0x64, 0x72 },
-
-                    // .ldt
-                    new byte?[] { 0x2E, 0x6C, 0x64, 0x74 },
-                }, "3PLock"),
-
-                // This produced false positives in some DirectX 9.0c installer files
-                // "Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
-                // new ContentMatchSet(new byte?[]
-                // {
-                //     0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30,
-                //     0x53, 0x56, 0x57
-                // }, "3PLock"),
-            };
-        }
+        public List<ContentMatchSet> GetContentMatchSets() => null;
+        // {
+        //     return new List<ContentMatchSet>
+        //     {
+        //         //This produced false positives in some DirectX 9.0c installer files
+        //         //"Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
+        //         new ContentMatchSet(new byte?[]
+        //         {
+        //             0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30,
+        //             0x53, 0x56, 0x57
+        //         }, "3PLock"),
+        //     };
+        // }
 
         /// <inheritdoc/>
-        public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
+        public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
+        {
+            // Get the sections from the executable, if possible
+            PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
+            var sections = pex?.SectionTable;
+            if (sections == null)
+                return null;
+
+            // Get the .ldr and .ldt sections, if they exist -- TODO: Confirm if both are needed or either/or is fine
+            var cmsdSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".ldr"));
+            var cmstSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".ldt"));
+            if (cmsdSection != null || cmstSection != null)
+                return $"3PLock";
+
+            return null;
+        }
     }
 }