diff --git a/BurnOutSharp/ProtectionType/Tages.cs b/BurnOutSharp/ProtectionType/Tages.cs
index 6b7a802b..12ed1c5d 100644
--- a/BurnOutSharp/ProtectionType/Tages.cs
+++ b/BurnOutSharp/ProtectionType/Tages.cs
@@ -3,17 +3,19 @@ using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Linq;
+using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
namespace BurnOutSharp.ProtectionType
{
// TODO: Figure out how to use path check framework here
- public class Tages : IContentCheck, IPathCheck
+ public class TAGES : IContentCheck, IPathCheck
{
///
public List GetContentMatchSets()
{
+ // TODO: Obtain a sample to find where this string is in a typical executable
return new List
{
// protected-tages-runtime.exe
@@ -25,21 +27,46 @@ namespace BurnOutSharp.ProtectionType
0x65, 0x78, 0x65
}, Utilities.GetFileVersion, "TAGES"),
- // tagesprotection.com
- new ContentMatchSet(new byte?[]
- {
- 0x74, 0x61, 0x67, 0x65, 0x73, 0x70, 0x72, 0x6F,
- 0x74, 0x65, 0x63, 0x74, 0x69, 0x6F, 0x6E, 0x2E,
- 0x63, 0x6F, 0x6D
- }, Utilities.GetFileVersion, "TAGES"),
-
// (char)0xE8 + u + (char)0x00 + (char)0x00 + (char)0x00 + (char)0xE8
new ContentMatchSet(new byte?[] { 0xE8, 0x75, 0x00, 0x00, 0x00, 0xE8 }, GetVersion, "TAGES"),
};
}
///
- public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
+ public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
+ {
+ // Get the sections from the executable, if possible
+ PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
+ var sections = pex?.SectionTable;
+ if (sections == null)
+ return null;
+
+ // Get the last section
+ var lastSection = sections.LastOrDefault();
+ if (lastSection != null)
+ {
+ int sectionAddr = (int)lastSection.PointerToRawData;
+ int sectionEnd = sectionAddr + (int)lastSection.VirtualSize;
+ var matchers = new List
+ {
+ // tagesprotection.com
+ new ContentMatchSet(
+ new ContentMatch(new byte?[]
+ {
+ 0x74, 0x61, 0x67, 0x65, 0x73, 0x70, 0x72, 0x6F,
+ 0x74, 0x65, 0x63, 0x74, 0x69, 0x6F, 0x6E, 0x2E,
+ 0x63, 0x6F, 0x6D
+ }, start: sectionEnd),
+ Utilities.GetFileVersion, "TAGES [tagesprotection.com]"),
+ };
+
+ string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
+ if (!string.IsNullOrWhiteSpace(match))
+ return match;
+ }
+
+ return null;
+ }
///
public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files)