diff --git a/BurnOutSharp.Wrappers/PortableExecutable.cs b/BurnOutSharp.Wrappers/PortableExecutable.cs index 14e02134..4e7c6df0 100644 --- a/BurnOutSharp.Wrappers/PortableExecutable.cs +++ b/BurnOutSharp.Wrappers/PortableExecutable.cs @@ -2341,6 +2341,24 @@ namespace BurnOutSharp.Wrappers }); } + /// + /// Find string table resources by contained string entry + /// + /// String entry to check for + /// Enumerable of matching resources + public IEnumerable> FindStringTableByEntry(string entry) + { + // Ensure that we have the resource data cached + if (ResourceData == null) + return Enumerable.Empty>(); + + return ResourceData.Select(r => r.Value) + .Select(r => r as Dictionary) + .Where(st => st != null) + .Where(st => st.Select(kvp => kvp.Value) + .Any(s => s.Contains(entry))); + } + /// /// Find unparsed resources by type name /// diff --git a/BurnOutSharp/ProtectionType/DiscGuard.cs b/BurnOutSharp/ProtectionType/DiscGuard.cs index 0e13f95a..f1b41ae0 100644 --- a/BurnOutSharp/ProtectionType/DiscGuard.cs +++ b/BurnOutSharp/ProtectionType/DiscGuard.cs @@ -1,6 +1,7 @@ using System; using System.Collections.Concurrent; using System.Collections.Generic; +using System.Linq; using BurnOutSharp.Interfaces; using BurnOutSharp.Matching; using BurnOutSharp.Wrappers; @@ -41,17 +42,25 @@ namespace BurnOutSharp.ProtectionType // Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374). string name = pex.FileDescription; if (name?.StartsWith("IOSLinkNT", StringComparison.OrdinalIgnoreCase) == true) - return $"DiscGuard"; + return "DiscGuard"; // Found in "T29.dll" (Redump entry 31914). name = pex.ProductName; if (name?.StartsWith("DiscGuard (tm)", StringComparison.OrdinalIgnoreCase) == true) - return $"DiscGuard"; + return "DiscGuard"; // Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374). name = pex.ProductName; if (name?.StartsWith("TTR Technologies Ltd. DiscGuard (tm)", StringComparison.OrdinalIgnoreCase) == true) - return $"DiscGuard"; + return "DiscGuard"; + + // Found in "Alternate.exe" (Redump entry 31914) and "Alt.exe" (Redump entries 46743, 46961, 79284, and 79374). + var resources = pex.FindStringTableByEntry("DiscGuard") + .Concat(pex.FindStringTableByEntry("The file Dg.vbn was not found.")) + .Concat(pex.FindStringTableByEntry("The file IosLink.VxD was not found.")) + .Concat(pex.FindStringTableByEntry("The file IosLink.sys was not found.")); + if (resources.Any()) + return "DiscGuard"; // Get the .vbn section, if it exists if (pex.ContainsSection(".vbn")) @@ -110,30 +119,6 @@ namespace BurnOutSharp.ProtectionType return match; } - // Get the .rsrc section, if it exists - var rsrcSection = pex.GetFirstSectionData(".rsrc"); - if (rsrcSection != null) - { - var matchers = new List - { - // Found in "Alternate.exe" (Redump entry 31914) and "Alt.exe" (Redump entries 46743, 46961, 79284, and 79374). - // T.h.e. .f.i.l.e. .I.o.s.L.i.n.k...V.x.D. .w.a.s. .n.o.t. .f.o.u.n.d. - new ContentMatchSet(new byte?[] - { - 0x54, 0x00, 0x68, 0x00, 0x65, 0x00, 0x20, 0x00, 0x66, 0x00, 0x69, 0x00, - 0x6C, 0x00, 0x65, 0x00, 0x20, 0x00, 0x49, 0x00, 0x6F, 0x00, 0x73, 0x00, - 0x4C, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x6B, 0x00, 0x2E, 0x00, 0x56, 0x00, - 0x78, 0x00, 0x44, 0x00, 0x20, 0x00, 0x77, 0x00, 0x61, 0x00, 0x73, 0x00, - 0x20, 0x00, 0x6E, 0x00, 0x6F, 0x00, 0x74, 0x00, 0x20, 0x00, 0x66, 0x00, - 0x6F, 0x00, 0x75, 0x00, 0x6E, 0x00, 0x64, 0x00 - }, "DiscGuard"), - }; - - string match = MatchUtil.GetFirstMatch(file, rsrcSection, matchers, includeDebug); - if (!string.IsNullOrWhiteSpace(match)) - return match; - } - return null; }