SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-21 13:43:26 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Convert dotFuscator to section based

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-15 11:45:35 -07:00
parent 9fe6b101bd
commit ba97abed44
1 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
BurnOutSharp/PackerType/dotFuscator.cs
View File

@@ -9,19 +9,31 @@ namespace BurnOutSharp.PackerType
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
{
// TODO: Obtain a sample to find where this string is in a typical executable
var contentMatchSets = new List<ContentMatchSet>
// Get the sections from the executable, if possible
var sections = pex?.SectionTable;
if (sections == null)
return null;
// Get the .text section, if it exists
if (pex.TextSectionRaw != null)
{
// DotfuscatorAttribute
new ContentMatchSet(new byte?[]
var matchers = new List<ContentMatchSet>
{
0x44, 0x6F, 0x74, 0x66, 0x75, 0x73, 0x63, 0x61,
0x74, 0x6F, 0x72, 0x41, 0x74, 0x74, 0x72, 0x69,
0x62, 0x75, 0x74, 0x65
}, "dotFuscator"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
// DotfuscatorAttribute
new ContentMatchSet(new byte?[]
{
0x44, 0x6F, 0x74, 0x66, 0x75, 0x73, 0x63, 0x61,
0x74, 0x6F, 0x72, 0x41, 0x74, 0x74, 0x72, 0x69,
0x62, 0x75, 0x74, 0x65
}, "dotFuscator"),
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
return null;
}
}
}