SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-09-22 23:05:03 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Update CodeLock with a few things; notes

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-14 22:57:17 -07:00
parent 1eb07c52e5
commit a84ac8d3cc
2 changed files with 16 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
BurnOutSharp/ProtectionType/CodeLock.cs
View File

@@ -1,10 +1,9 @@
using System.Collections.Generic;
using System.Linq;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
{
// CodeLock / CodeLok / CopyLok
public class CodeLock : IContentCheck
{
/// <inheritdoc/>
@@ -18,20 +17,22 @@ namespace BurnOutSharp.ProtectionType
// If there are more than 2 icd-prefixed sections, then we have a match
int icdSectionCount = pex.GetSectionNames().Count(s => s.StartsWith("icd"));
if (icdSectionCount >= 2)
return "CodeLock";
return "CodeLock / CodeLok / CopyLok";
return null;
// TODO: Obtain a sample to find where this string is in a typical executable
var contentMatchSets = new List<ContentMatchSet>
{
// CODE-LOCK.OCX
new ContentMatchSet(new byte?[]
{
0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43,
0x4B, 0x2E, 0x4F, 0x43, 0x58
}, "CodeLock"),
};
// TODO: Could not be confirmed with any sample, so disabling for now
// var contentMatchSets = new List<ContentMatchSet>
// {
// // CODE-LOCK.OCX
// new ContentMatchSet(new byte?[]
// {
// 0x43, 0x4F, 0x44, 0x45, 0x2D, 0x4C, 0x4F, 0x43,
// 0x4B, 0x2E, 0x4F, 0x43, 0x58
// }, "CodeLock / CodeLok / CopyLok"),
// };
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
// return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
}
}

7
BurnOutSharp/ProtectionType/CopyLok.cs
View File

@@ -1,7 +0,0 @@
namespace BurnOutSharp.ProtectionType
{
public class CopyLok
{
// TODO: Implement - http://web.archive.org/web/20041215075727/http://www.panlok.com/codelok2.htm
}
}