From ba97abed4417646eb6bf3f8c5f8c2fa2cb727f60 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Wed, 15 Sep 2021 11:45:35 -0700
Subject: [PATCH] Convert dotFuscator to section based

---
 BurnOutSharp/PackerType/dotFuscator.cs | 34 +++++++++++++++++---------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/BurnOutSharp/PackerType/dotFuscator.cs b/BurnOutSharp/PackerType/dotFuscator.cs
index 4cdf1579..89a32f58 100644
--- a/BurnOutSharp/PackerType/dotFuscator.cs
+++ b/BurnOutSharp/PackerType/dotFuscator.cs
@@ -9,19 +9,31 @@ namespace BurnOutSharp.PackerType
         /// <inheritdoc/>
         public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex)
         {
-            // TODO: Obtain a sample to find where this string is in a typical executable
-            var contentMatchSets = new List<ContentMatchSet>
+            // Get the sections from the executable, if possible
+            var sections = pex?.SectionTable;
+            if (sections == null)
+                return null;
+
+            // Get the .text section, if it exists
+            if (pex.TextSectionRaw != null)
             {
-                // DotfuscatorAttribute
-                new ContentMatchSet(new byte?[]
+                var matchers = new List<ContentMatchSet>
                 {
-                    0x44, 0x6F, 0x74, 0x66, 0x75, 0x73, 0x63, 0x61,
-                    0x74, 0x6F, 0x72, 0x41, 0x74, 0x74, 0x72, 0x69,
-                    0x62, 0x75, 0x74, 0x65
-                }, "dotFuscator"),
-            };
-            
-            return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
+                    // DotfuscatorAttribute
+                    new ContentMatchSet(new byte?[]
+                    {
+                        0x44, 0x6F, 0x74, 0x66, 0x75, 0x73, 0x63, 0x61,
+                        0x74, 0x6F, 0x72, 0x41, 0x74, 0x74, 0x72, 0x69,
+                        0x62, 0x75, 0x74, 0x65
+                    }, "dotFuscator"),
+                };
+
+                string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
+                if (!string.IsNullOrWhiteSpace(match))
+                    return match;
+            }
+
+            return null;
         }
     }
 }