SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-17 14:25:12 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Update DiscGuard

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-04 21:11:55 -08:00
parent e824428e0f
commit ce1c74aec3
2 changed files with 30 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
BurnOutSharp.Wrappers/PortableExecutable.cs
View File

@@ -2341,6 +2341,24 @@ namespace BurnOutSharp.Wrappers
});
}
/// <summary>
/// Find string table resources by contained string entry
/// </summary>
/// <param name="entry">String entry to check for</param>
/// <returns>Enumerable of matching resources</returns>
public IEnumerable<Dictionary<int, string>> FindStringTableByEntry(string entry)
{
// Ensure that we have the resource data cached
if (ResourceData == null)
return Enumerable.Empty<Dictionary<int, string>>();
return ResourceData.Select(r => r.Value)
.Select(r => r as Dictionary<int, string>)
.Where(st => st != null)
.Where(st => st.Select(kvp => kvp.Value)
.Any(s => s.Contains(entry)));
}
/// <summary>
/// Find unparsed resources by type name
/// </summary>

39
BurnOutSharp/ProtectionType/DiscGuard.cs
View File

@@ -1,6 +1,7 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
@@ -41,17 +42,25 @@ namespace BurnOutSharp.ProtectionType
// Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374).
string name = pex.FileDescription;
if (name?.StartsWith("IOSLinkNT", StringComparison.OrdinalIgnoreCase) == true)
return $"DiscGuard";
return "DiscGuard";
// Found in "T29.dll" (Redump entry 31914).
name = pex.ProductName;
if (name?.StartsWith("DiscGuard (tm)", StringComparison.OrdinalIgnoreCase) == true)
return $"DiscGuard";
return "DiscGuard";
// Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374).
name = pex.ProductName;
if (name?.StartsWith("TTR Technologies Ltd. DiscGuard (tm)", StringComparison.OrdinalIgnoreCase) == true)
return $"DiscGuard";
return "DiscGuard";
// Found in "Alternate.exe" (Redump entry 31914) and "Alt.exe" (Redump entries 46743, 46961, 79284, and 79374).
var resources = pex.FindStringTableByEntry("DiscGuard")
.Concat(pex.FindStringTableByEntry("The file Dg.vbn was not found."))
.Concat(pex.FindStringTableByEntry("The file IosLink.VxD was not found."))
.Concat(pex.FindStringTableByEntry("The file IosLink.sys was not found."));
if (resources.Any())
return "DiscGuard";
// Get the .vbn section, if it exists
if (pex.ContainsSection(".vbn"))
@@ -110,30 +119,6 @@ namespace BurnOutSharp.ProtectionType
return match;
}
// Get the .rsrc section, if it exists
var rsrcSection = pex.GetFirstSectionData(".rsrc");
if (rsrcSection != null)
{
var matchers = new List<ContentMatchSet>
{
// Found in "Alternate.exe" (Redump entry 31914) and "Alt.exe" (Redump entries 46743, 46961, 79284, and 79374).
// T.h.e. .f.i.l.e. .I.o.s.L.i.n.k...V.x.D. .w.a.s. .n.o.t. .f.o.u.n.d.
new ContentMatchSet(new byte?[]
{
0x54, 0x00, 0x68, 0x00, 0x65, 0x00, 0x20, 0x00, 0x66, 0x00, 0x69, 0x00,
0x6C, 0x00, 0x65, 0x00, 0x20, 0x00, 0x49, 0x00, 0x6F, 0x00, 0x73, 0x00,
0x4C, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x6B, 0x00, 0x2E, 0x00, 0x56, 0x00,
0x78, 0x00, 0x44, 0x00, 0x20, 0x00, 0x77, 0x00, 0x61, 0x00, 0x73, 0x00,
0x20, 0x00, 0x6E, 0x00, 0x6F, 0x00, 0x74, 0x00, 0x20, 0x00, 0x66, 0x00,
0x6F, 0x00, 0x75, 0x00, 0x6E, 0x00, 0x64, 0x00
}, "DiscGuard"),
};
string match = MatchUtil.GetFirstMatch(file, rsrcSection, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
return null;
}