From 981a5bb7b56764821bd45587ac9e7e84cb31765a Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Sat, 20 Sep 2025 18:03:09 -0400 Subject: [PATCH] Introduce OptionalEndsWith --- BinaryObjectScanner/Extensions.cs | 13 +++++++++++++ BinaryObjectScanner/Protection/Armadillo.cs | 15 ++++++--------- 2 files changed, 19 insertions(+), 9 deletions(-) diff --git a/BinaryObjectScanner/Extensions.cs b/BinaryObjectScanner/Extensions.cs index 9db76899..9641d4a2 100644 --- a/BinaryObjectScanner/Extensions.cs +++ b/BinaryObjectScanner/Extensions.cs @@ -68,6 +68,19 @@ namespace BinaryObjectScanner #endif } + /// + public static bool OptionalEndsWith(this string? self, string value) + => OptionalEndsWith(self, value, StringComparison.Ordinal); + + /// + public static bool OptionalEndsWith(this string? self, string value, StringComparison comparisonType) + { + if (self == null) + return false; + + return self.EndsWith(value, comparisonType); + } + /// public static bool OptionalEquals(this string? self, string value) => OptionalEquals(self, value, StringComparison.Ordinal); diff --git a/BinaryObjectScanner/Protection/Armadillo.cs b/BinaryObjectScanner/Protection/Armadillo.cs index 8cb7b0ed..61b16860 100644 --- a/BinaryObjectScanner/Protection/Armadillo.cs +++ b/BinaryObjectScanner/Protection/Armadillo.cs @@ -28,17 +28,14 @@ namespace BinaryObjectScanner.Protection return "Armadillo"; // Loop through all "extension" sections -- usually .data1 or .text1 - if (exe.SectionNames != null) + foreach (var sectionName in Array.FindAll(exe.SectionNames, s => s.OptionalEndsWith("1"))) { - foreach (var sectionName in Array.FindAll(exe.SectionNames ?? [], s => s != null && s.EndsWith("1"))) + // Get the section strings, if they exist + var strs = exe.GetFirstSectionStrings(sectionName); + if (strs != null) { - // Get the section strings, if they exist - var strs = exe.GetFirstSectionStrings(sectionName); - if (strs != null) - { - if (strs.Exists(s => s.Contains("ARMDEBUG"))) - return "Armadillo"; - } + if (strs.Exists(s => s.Contains("ARMDEBUG"))) + return "Armadillo"; } }