SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-22 06:03:34 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Convert Sisiphus to section based

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-06 13:58:16 -07:00
parent 0fc415fb34
commit ae5bdcc97a
1 changed files with 56 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

85
BurnOutSharp/ProtectionType/Sysiphus.cs
View File

@@ -1,4 +1,8 @@
using System.Collections.Generic;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
@@ -6,41 +10,64 @@ namespace BurnOutSharp.ProtectionType
public class Sysiphus : IContentCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
{
return new List<ContentMatchSet>
{
// V SUHPISYSDVD
new ContentMatchSet(new byte?[]
{
0x56, 0x20, 0x53, 0x55, 0x48, 0x50, 0x49, 0x53,
0x59, 0x53, 0x44, 0x56, 0x44
}, GetVersion, "Sysiphus DVD"),
// V SUHPISYSDVD
new ContentMatchSet(new byte?[]
{
0x56, 0x20, 0x53, 0x55, 0x48, 0x50, 0x49, 0x53,
0x59, 0x53
}, GetVersion, "Sysiphus"),
};
}
public List<ContentMatchSet> GetContentMatchSets() => null;
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
{
// Get the sections from the executable, if possible
PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
var sections = pex?.SectionTable;
if (sections == null)
return null;
// Get the .data section, if it exists
var dataSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".data"));
if (dataSection != null)
{
int sectionAddr = (int)dataSection.PointerToRawData;
int sectionEnd = sectionAddr + (int)dataSection.VirtualSize;
var matchers = new List<ContentMatchSet>
{
// V SUHPISYS
new ContentMatchSet(
new ContentMatch(new byte?[]
{
0x56, 0x20, 0x53, 0x55, 0x48, 0x50, 0x49, 0x53,
0x59, 0x53
}, start: sectionAddr, end: sectionEnd),
GetVersion, "Sysiphus"),
};
string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
return null;
}
public static string GetVersion(string file, byte[] fileContent, List<int> positions)
{
int index = positions[0] - 3;
char subVersion = (char)fileContent[index];
index++;
index++;
char version = (char)fileContent[index];
// The version is reversed
string version = new string(
new ArraySegment<byte>(fileContent, positions[0] - 4, 4)
.Reverse()
.Select(b => (char)b)
.ToArray())
.Trim();
if (char.IsNumber(version) && char.IsNumber(subVersion))
return $"{version}.{subVersion}";
// Check for the DVD extra string
string extra = new string(
new ArraySegment<byte>(fileContent, positions[0] + "V SUHPISYS".Length, 3)
.Select(b => (char)b)
.ToArray());
bool isDVD = extra == "DVD";
return string.Empty;
if (char.IsNumber(version[0]) && char.IsNumber(version[2]))
return isDVD ? $"DVD {version}" : version;
return isDVD ? "DVD" : string.Empty;
}
}
}