From d6a3a37d49fd213d0f45e5066387b581b12937a3 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Mon, 8 Sep 2025 17:51:43 -0400 Subject: [PATCH] Add investigation notes about weird SF version --- BinaryObjectScanner/Protection/StarForce.cs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/BinaryObjectScanner/Protection/StarForce.cs b/BinaryObjectScanner/Protection/StarForce.cs index 5cbbf3ad..5268403d 100644 --- a/BinaryObjectScanner/Protection/StarForce.cs +++ b/BinaryObjectScanner/Protection/StarForce.cs @@ -105,6 +105,13 @@ namespace BinaryObjectScanner.Protection if (exe.ContainsSection(".sforce", exact: false)) return "StarForce 3-5"; + // TODO: Investigate the .common and .ps4 sections found in apache.exe + // .common doesn't map to any table + // The section is largely empty with a 3 or 4 byte value at + // offset 0x40. Sample has "D4 DB DD 00" + // .ps4 has a virtual size of 4096 and a physical size of 0 + // The physical offset is the end of the file + return null; }