SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-30 20:53:08 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Use content matching helper, part 4

Browse Source
This commit is contained in:
Matt Nadareski
2021-03-21 22:19:38 -07:00
parent d01826ffa4
commit cf9bd99f3d
33 changed files with 370 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
BurnOutSharp/ProtectionType/ThreePLock.cs
View File

@@ -1,27 +1,34 @@
namespace BurnOutSharp.ProtectionType
using System.Collections.Generic;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
{
public class ThreePLock : IContentCheck
{
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includePosition = false)
{
// .ldr
byte?[] check = new byte?[] { 0x2E, 0x6C, 0x64, 0x72 };
if (fileContent.FirstPosition(check, out int position))
var matchers = new List<Matcher>
{
// .ldt
byte?[] check2 = new byte?[] { 0x2E, 0x6C, 0x64, 0x74 };
if (fileContent.FirstPosition(check2, out int position2))
return "3PLock" + (includePosition ? $" (Index {position}, {position2})" : string.Empty);
}
new Matcher(new List<byte?[]>
{
// .ldr
new byte?[] { 0x2E, 0x6C, 0x64, 0x72 },
// This produced false positives in some DirectX 9.0c installer files
// "Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
//check = new byte?[] { 0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30, 0x53, 0x56, 0x57 };
//if (fileContent.Contains(check, out position))
// return "3PLock" + (includePosition ? $" (Index {position})" : string.Empty);
// .ldt
new byte?[] { 0x2E, 0x6C, 0x64, 0x74 },
}, "3PLock"),
return null;
// This produced false positives in some DirectX 9.0c installer files
// "Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// new Matcher(new byte?[]
// {
// 0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30,
// 0x53, 0x56, 0x57
// }, "3PLock"),
};
return Utilities.GetContentMatches(file, fileContent, matchers, includePosition);
}
}
}