SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-29 01:50:24 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Make SmartE checks even simpler

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-05 10:21:15 -08:00
parent 3a63755d96
commit 95fa8681fe
1 changed files with 18 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
BurnOutSharp/ProtectionType/SmartE.cs
View File

@@ -17,29 +17,25 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// TODO: Export table instead of .edata
// Get the .edata section, if it exists
string match = GetMatchForSection(file, pex.GetFirstSectionData(".edata"), includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Get the last section
var lastSetionData = pex.GetSectionData(sections.Length);
if (lastSetionData != null)
{
var matchers = new List<ContentMatchSet>
{
// BITARTS
new ContentMatchSet(
new ContentMatch(
new byte?[] { 0x42, 0x49, 0x54, 0x41, 0x52, 0x54, 0x53 },
start: 18319,
end: 18320),
"SmartE"),
};
// TODO: Import table instead of .idata
// Get the .idata section, if it exists
match = GetMatchForSection(file, pex.GetFirstSectionData(".idata"), includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Get the .rdata section, if it exists
match = GetMatchForSection(file, pex.GetFirstSectionData(".rdata"), includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// TODO: TLS directory instead of .tls
// Get the .tls section, if it exists
var tlsSectionRaw = pex.GetLastSectionData(".tls");
match = GetMatchForSection(file, tlsSectionRaw, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
string match = MatchUtil.GetFirstMatch(file, lastSetionData, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
return null;
}
@@ -70,43 +66,5 @@ namespace BurnOutSharp.ProtectionType
return MatchUtil.GetFirstMatch(path, matchers, any: true);
}
/// <summary>
/// Check a section for the SmartE string(s)
/// </summary>
private string GetMatchForSection(Models.PortableExecutable.SectionHeader section, string file, byte[] sectionContent, bool includeDebug)
{
if (section == null)
return null;
int sectionAddr = (int)section.PointerToRawData;
int sectionEnd = sectionAddr + (int)section.VirtualSize;
var matchers = new List<ContentMatchSet>
{
// BITARTS
new ContentMatchSet(
new ContentMatch(new byte?[] { 0x42, 0x49, 0x54, 0x41, 0x52, 0x54, 0x53 }, start: sectionAddr, end: sectionEnd),
"SmartE"),
};
return MatchUtil.GetFirstMatch(file, sectionContent, matchers, includeDebug);
}
/// <summary>
/// Check a section for the SmartE string(s)
/// </summary>
private string GetMatchForSection(string file, byte[] sectionContent, bool includeDebug)
{
if (sectionContent == null)
return null;
var matchers = new List<ContentMatchSet>
{
// BITARTS
new ContentMatchSet(new byte?[] { 0x42, 0x49, 0x54, 0x41, 0x52, 0x54, 0x53 }, "SmartE"),
};
return MatchUtil.GetFirstMatch(file, sectionContent, matchers, includeDebug);
}
}
}