SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-17 11:42:40 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add content matches to SafeCast; add notes

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-02 09:30:37 -07:00
parent cbb4cdddfa
commit a5f21adeee
1 changed files with 61 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
BurnOutSharp/ProtectionType/SafeCast.cs
View File

@@ -1,11 +1,45 @@
using System.Collections.Concurrent;
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
{
public class SafeCast : IPathCheck
// TODO: Add the content checks from SafeDisc here
// TODO: Investigate if this entire file should be wrapped into SafeDisc
public class SafeCast : IContentCheck, IPathCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
{
// TODO: Obtain a sample to find where this string is in a typical executable
return new List<ContentMatchSet>
{
new ContentMatchSet(new List<byte?[]>
{
// BoG_ *90.0&!! Yy>
new byte?[]
{
0x42, 0x6F, 0x47, 0x5F, 0x20, 0x2A, 0x39, 0x30,
0x2E, 0x30, 0x26, 0x21, 0x21, 0x20, 0x20, 0x59,
0x79, 0x3E
},
// product activation library
new byte?[]
{
0x70, 0x72, 0x6F, 0x64, 0x75, 0x63, 0x74, 0x20,
0x61, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x69,
0x6F, 0x6E, 0x20, 0x6C, 0x69, 0x62, 0x72, 0x61,
0x72, 0x79
},
}, GetVersion, "SafeCast"),
};
}
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
/// <inheritdoc/>
public ConcurrentQueue<string> CheckDirectoryPath(string path, IEnumerable<string> files)
{
@@ -27,5 +61,30 @@ namespace BurnOutSharp.ProtectionType
return MatchUtil.GetFirstMatch(path, matchers, any: true);
}
public static string GetVersion(string file, byte[] fileContent, List<int> positions)
{
int index = positions[0] + 20; // Begin reading after "BoG_ *90.0&!! Yy>" for old SafeDisc
int version = BitConverter.ToInt32(fileContent, index);
index += 4;
int subVersion = BitConverter.ToInt32(fileContent, index);
index += 4;
int subsubVersion = BitConverter.ToInt32(fileContent, index);
if (version != 0)
return $"{version}.{subVersion:00}.{subsubVersion:000}";
index = positions[0] + 18 + 14; // Begin reading after "BoG_ *90.0&!! Yy>" for newer SafeDisc
version = BitConverter.ToInt32(fileContent, index);
index += 4;
subVersion = BitConverter.ToInt32(fileContent, index);
index += 4;
subsubVersion = BitConverter.ToInt32(fileContent, index);
if (version == 0)
return string.Empty;
return $"{version}.{subVersion:00}.{subsubVersion:000}";
}
}
}