SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-17 06:14:59 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Use exposed model directly in more places

Browse Source
This commit is contained in:
Matt Nadareski
2023-09-15 22:21:05 -04:00
parent 57eaa1f04c
commit a52d45f7c2
117 changed files with 876 additions and 7138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
BinaryObjectScanner.Protection/Engine32.cs
View File

@@ -19,17 +19,17 @@ namespace BinaryObjectScanner.Protection
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex?.SectionTable;
var sections = pex?.Model.SectionTable;
if (sections == null)
return null;
// Most every tested sample of "engine32.dll" has a product name of "engine32", and the file description typically follows the naming pattern of "[Game Name] DLL-helper".
// Detects Engine32 within the game executables that contain it.
if (pex.ImportTable?.ImportDirectoryTable != null && pex.ImportHintNameTable != null)
if (pex.Model.ImportTable?.ImportDirectoryTable != null && pex.Model.ImportTable?.HintNameTable != null)
{
bool importDirectoryTableMatch = pex.ImportTable.ImportDirectoryTable.Any(idte => idte.Name?.Equals("ENGINE32.DLL", StringComparison.OrdinalIgnoreCase) == true);
bool hintNameTableMatch = pex.ImportHintNameTable.Any(ihne => ihne == "InitEngine");
bool importDirectoryTableMatch = pex.Model.ImportTable.ImportDirectoryTable.Any(idte => idte.Name?.Equals("ENGINE32.DLL", StringComparison.OrdinalIgnoreCase) == true);
bool hintNameTableMatch = pex.Model.ImportTable?.HintNameTable.Any(ihne => ihne.Name == "InitEngine") ?? false;
// The Hint/Name Table Entry "DeinitEngine" is present in every tested sample, aside from TOCA Race Driver 2 (Redump entries 104593-104596).
@@ -38,10 +38,10 @@ namespace BinaryObjectScanner.Protection
}
// Detects Engine32 within the file "engine32.dll".
if (pex.ExportNameTable != null)
if (pex.Model.ExportTable?.ExportNameTable?.Strings != null)
{
bool exportNameTableMatch1 = pex.ExportNameTable.Any(s => s == "engine32.dll");
bool exportNameTableMatch2 = pex.ExportNameTable.Any(s => s == "DeinitEngine");
bool exportNameTableMatch1 = pex.Model.ExportTable.ExportNameTable.Strings.Any(s => s == "engine32.dll");
bool exportNameTableMatch2 = pex.Model.ExportTable.ExportNameTable.Strings.Any(s => s == "DeinitEngine");
if (exportNameTableMatch1 && exportNameTableMatch2)
return "Engine32";