From a03bf60ca5923cf45dea5581972f43666dd33f7b Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Fri, 9 Dec 2022 11:21:27 -0800 Subject: [PATCH] Tweak LaserLok check to pre-screen --- BurnOutSharp/ProtectionType/LaserLok.cs | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/BurnOutSharp/ProtectionType/LaserLok.cs b/BurnOutSharp/ProtectionType/LaserLok.cs index bd26a111..db29a776 100644 --- a/BurnOutSharp/ProtectionType/LaserLok.cs +++ b/BurnOutSharp/ProtectionType/LaserLok.cs @@ -67,18 +67,16 @@ namespace BurnOutSharp.ProtectionType int endDosStub = (int)pex.Stub_NewExeHeaderAddr; bool containsCheck = pex.StubExecutableData.FirstPosition(check, out int position); - // TODO: Can't use this because of the "SNIF/MPVI" check at the end - //// Check the executable tables - //bool containsCheck2 = (pex.ImportTable?.HintNameTable.Any(hnte => hnte.Name == "GetModuleHandleA") ?? false) - // && (pex.ImportTable?.HintNameTable.Any(hnte => hnte.Name == "GetProcAddress") ?? false) - // && (pex.ImportTable?.HintNameTable.Any(hnte => hnte.Name == "LoadLibraryA") ?? false) - // && (pex.ImportTable?.ImportDirectoryTable.Any(idte => idte.Name == "KERNEL32.dll") ?? false); + // Check the executable tables + bool containsCheck2 = (pex.ImportTable?.HintNameTable.Any(hnte => hnte.Name == "GetModuleHandleA") ?? false) + && (pex.ImportTable?.HintNameTable.Any(hnte => hnte.Name == "GetProcAddress") ?? false) + && (pex.ImportTable?.HintNameTable.Any(hnte => hnte.Name == "LoadLibraryA") ?? false) + && (pex.ImportTable?.ImportDirectoryTable.Any(idte => idte.Name == "KERNEL32.dll") ?? false); - bool containsCheck2 = false; int position2 = -1; // Get the .text section, if it exists - if (pex.ContainsSection(".text")) + if (containsCheck2 && pex.ContainsSection(".text")) { // GetModuleHandleA + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + GetProcAddress + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + LoadLibraryA + (char)0x00 + (char)0x00 + KERNEL32.dll + (char)0x00 + ëy + (char)0x01 + SNIF/MPVI byte?[] check2 = new byte?[]