SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-17 06:14:59 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Reduce reliance on fileContent; add notes

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-11 22:27:52 -07:00
parent 44c44be412
commit d6fd0c4d2c
13 changed files with 49 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs
View File

@@ -82,17 +82,18 @@ namespace BurnOutSharp.ExecutableType.Microsoft
// https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#special-sections
// Here is a list of standard sections that are used in various protections:
// - .bss *1 protection Uninitialized data (free format)
// Y - .bss *1 protection Uninitialized data (free format)
// X - .data 14 protections Initialized data (free format)
// X - .edata *1 protection Export tables
// X - .idata *1 protection Import tables
// X - .rdata 11 protections Read-only initialized data
// - .rsrc *1 protection Resource directory [Mostly taken care of, last protection needs research]
// X - .text 6 protections Executable code (free format)
// - .tls *1 protection Thread-local storage (object only)
// Y - .tls *1 protection Thread-local storage (object only)
//
// Here is a list of non-standard sections whose contents are read by various protections:
// X - CODE 2 protections SafeDisc, WTM CD Protect
// X - .dcrtext *1 protection JoWood
// X - .grand *1 protection CD-Cops / DVD-Cops
// X - .init *1 protection SolidShield
// - .pec2 *1 protection PE Compact [Unconfirmed]
@@ -101,21 +102,24 @@ namespace BurnOutSharp.ExecutableType.Microsoft
// Here is a list of non-standard sections whose data is not read by various protections:
// - .brick 1 protection StarForce
// - .cenega 1 protection Cenega ProtectDVD
// - .ext 1 protection JoWood
// - HC09 1 protection JoWood
// - .icd* 1 protection CodeLock
// - .ldr 1 protection 3PLock
// - .ldt 1 protection 3PLock
// - .nicode 1 protection Armadillo
// - .NOS0 *1 protection UPX (NOS Variant) [Used as endpoint]
// - .NOS1 *1 protection UPX (NOS Variant) [Used as endpoint]
// - .NOS0 1 protection UPX (NOS Variant) [Used as endpoint]
// - .NOS1 1 protection UPX (NOS Variant) [Used as endpoint]
// - .pec1 1 protection PE Compact
// - .securom 1 protection SecuROM
// - .sforce 1 protection StarForce
// - stxt371 1 protection SafeDisc
// - stxt774 1 protection SafeDisc
// - .UPX0 *1 protection UPX [Used as endpoint]
// - .UPX1 *1 protection UPX [Used as endpoint]
// - .UPX0 1 protection UPX [Used as endpoint]
// - .UPX1 1 protection UPX [Used as endpoint]
// - .vob.pcd 1 protection VOB ProtectCD
// - _winzip_ 1 protection WinZip SFX
// - XPROT 1 protection JoWood
//
// * => Only used by 1 protection so it may be read in by that protection specifically

12
BurnOutSharp/PackerType/Armadillo.cs
View File

@@ -22,20 +22,18 @@ namespace BurnOutSharp.PackerType
if (nicodeSection)
return "Armadillo";
// Loop through all "extension" sections
// Loop through all "extension" sections -- usually .data1 or .text1
foreach (var section in sections.Where(s => s != null && Encoding.ASCII.GetString(s.Name).Trim('\0').EndsWith("1")))
{
int sectionAddr = (int)section.PointerToRawData;
int sectionEnd = sectionAddr + (int)section.VirtualSize;
string sectionName = Encoding.ASCII.GetString(section.Name).Trim('\0');
var sectionRaw = pex.ReadRawSection(fileContent, sectionName);
var matchers = new List<ContentMatchSet>
{
// ARMDEBUG
new ContentMatchSet(
new ContentMatch(new byte?[] { 0x41, 0x52, 0x4D, 0x44, 0x45, 0x42, 0x55, 0x47 }, start: sectionAddr, end: sectionEnd),
"Armadillo"),
new ContentMatchSet(new byte?[] { 0x41, 0x52, 0x4D, 0x44, 0x45, 0x42, 0x55, 0x47 }, $"Armadillo"),
};
string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, sectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

2
BurnOutSharp/PackerType/SetupFactory.cs
View File

@@ -28,7 +28,7 @@ namespace BurnOutSharp.PackerType
return $"Setup Factory {GetVersion(pex)}";
// Longer version of the check that can be used if false positves become an issue:
// Setup Factory is a trademark of Indigo Rose Corporation
// "Setup Factory is a trademark of Indigo Rose Corporation"
return null;
}

1
BurnOutSharp/PackerType/WinZipSFX.cs
View File

@@ -765,6 +765,7 @@ namespace BurnOutSharp.PackerType
/// </summary>
private string GetNEUnknownHeaderVersion(NewExecutable nex, string file, byte[] fileContent, bool includeDebug)
{
// TODO: Like with PE, convert this into a preread in the header code
int resourceStart = nex.DOSStubHeader.NewExeHeaderAddr + nex.NewExecutableHeader.ResourceTableOffset;
int resourceEnd = nex.DOSStubHeader.NewExeHeaderAddr + nex.NewExecutableHeader.ModuleReferenceTableOffset;
var matchers = new List<ContentMatchSet>

9
BurnOutSharp/PackerType/WiseInstaller.cs
View File

@@ -34,9 +34,12 @@ namespace BurnOutSharp.PackerType
var sections = pex?.SectionTable;
if (sections == null)
{
var neMatchSets = GetContentMatchSets();
if (neMatchSets != null && neMatchSets.Any())
return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug);
if (nex != null)
{
var neMatchSets = GetContentMatchSets();
if (neMatchSets != null && neMatchSets.Any())
return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug);
}
return null;
}

12
BurnOutSharp/ProtectionType/ActiveMARK.cs
View File

@@ -33,20 +33,16 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the last .bss section, if it exists
var bssSection = pex.GetLastSection(".bss", exact: true);
if (bssSection != null)
var bssSectionRaw = pex.ReadRawSection(fileContent, ".bss", true);
if (bssSectionRaw != null)
{
int sectionAddr = (int)bssSection.PointerToRawData;
int sectionEnd = sectionAddr + (int)bssSection.VirtualSize;
var matchers = new List<ContentMatchSet>
{
// TMSAMVOF
new ContentMatchSet(
new ContentMatch(new byte?[] { 0x54, 0x4D, 0x53, 0x41, 0x4D, 0x56, 0x4F, 0x46 }, start: sectionAddr, end: sectionEnd),
"ActiveMARK"),
new ContentMatchSet(new byte?[] { 0x54, 0x4D, 0x53, 0x41, 0x4D, 0x56, 0x4F, 0x46 }, "ActiveMARK"),
};
string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, bssSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

2
BurnOutSharp/ProtectionType/Bitpool.cs
View File

@@ -15,7 +15,7 @@ namespace BurnOutSharp.ProtectionType
public class Bitpool : IContentCheck, IPathCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
private List<ContentMatchSet> GetContentMatchSets()
{
// TODO: Obtain a sample to find where this string is in a typical executable
return new List<ContentMatchSet>

2
BurnOutSharp/ProtectionType/CDCheck.cs
View File

@@ -8,7 +8,7 @@ namespace BurnOutSharp.ProtectionType
public class CDCheck : IContentCheck
{
/// <inheritdoc/>
public List<ContentMatchSet> GetContentMatchSets()
private List<ContentMatchSet> GetContentMatchSets()
{
// TODO: Obtain a sample to find where this string is in a typical executable
// TODO: Is this too broad in general? It _does_ indicate a CD check, but there's no real

6
BurnOutSharp/ProtectionType/CodeLock.cs
View File

@@ -29,13 +29,7 @@ namespace BurnOutSharp.ProtectionType
// Get the sections from the executable, if possible
var sections = pex?.SectionTable;
if (sections == null)
{
var neMatchSets = GetContentMatchSets();
if (neMatchSets != null && neMatchSets.Any())
return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug);
return null;
}
// If there are more than 2 icd-prefixed sections, then we have a match
int icdSectionCount = sections.Count(s => Encoding.ASCII.GetString(s.Name).StartsWith("icd"));

37
BurnOutSharp/ProtectionType/JoWood.cs
View File

@@ -1,7 +1,6 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.Matching;
@@ -21,30 +20,26 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the .ext section, if it exists
var extSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Equals(".ext "));
if (extSection != null)
var extSection = pex.ContainsSection(".ext ", exact: true);
if (extSection)
{
// Get the .dcrtext section, if it exists
var dcrtextSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Equals(".dcrtext"));
if (dcrtextSection != null)
var dcrtextSectionRaw = pex.ReadRawSection(fileContent, ".dcrtext");
if (dcrtextSectionRaw != null)
{
int sectionAddr = (int)dcrtextSection.PointerToRawData;
int sectionEnd = sectionAddr + (int)dcrtextSection.VirtualSize;
var matchers = new List<ContentMatchSet>
{
// kernel32.dll + (char)0x00 + (char)0x00 + (char)0x00 + VirtualProtect
new ContentMatchSet(
new ContentMatch(new byte?[]
{
0x6B, 0x65, 0x72, 0x6E, 0x65, 0x6C, 0x33, 0x32,
0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x00, 0x00, 0x56,
0x69, 0x72, 0x74, 0x75, 0x61, 0x6C, 0x50, 0x72,
0x6F, 0x74, 0x65, 0x63, 0x74
}, start: sectionAddr, end: sectionEnd),
GetVersion, "JoWood X-Prot"),
new ContentMatchSet(new byte?[]
{
0x6B, 0x65, 0x72, 0x6E, 0x65, 0x6C, 0x33, 0x32,
0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x00, 0x00, 0x56,
0x69, 0x72, 0x74, 0x75, 0x61, 0x6C, 0x50, 0x72,
0x6F, 0x74, 0x65, 0x63, 0x74
}, GetVersion, "JoWood X-Prot"),
};
string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dcrtextSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
@@ -53,13 +48,13 @@ namespace BurnOutSharp.ProtectionType
}
// Get the HC09 section, if it exists
var hc09Section = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Equals("HC09 "));
if (hc09Section != null)
bool hc09Section = pex.ContainsSection("HC09 ", exact: true);
if (hc09Section)
return "JoWood X-Prot v2"; // TODO: Can we get more granular with the version?
// Get the XPROT section, if it exists
var xprotSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Equals("XPROT "));
if (xprotSection != null)
var xprotSection = pex.ContainsSection("XPROT ", exact: true);
if (xprotSection)
return "JoWood X-Prot v1.4+"; // TODO: Can we get more granular with the version?
return null;

1
BurnOutSharp/ProtectionType/Origin.cs
View File

@@ -14,6 +14,7 @@ namespace BurnOutSharp.ProtectionType
// TODO: Obtain a sample to find where this string is in a typical executable
return new List<ContentMatchSet>
{
// TODO: This looks like "OriginalFileName"
// O + (char)0x00 + r + (char)0x00 + i + (char)0x00 + g + (char)0x00 + i + (char)0x00 + n + (char)0x00 + S + (char)0x00 + e + (char)0x00 + t + (char)0x00 + u + (char)0x00 + p + (char)0x00 + . + (char)0x00 + e + (char)0x00 + x + (char)0x00 + e + (char)0x00
new ContentMatchSet(new byte?[]
{

4
BurnOutSharp/ProtectionType/SmartE.cs
View File

@@ -33,8 +33,8 @@ namespace BurnOutSharp.ProtectionType
return match;
// Get the .tls section, if it exists
var tlsSection = pex.GetLastSection(".tls", exact: true);
match = GetMatchForSection(tlsSection, file, fileContent, includeDebug);
var tlsSectionRaw = pex.ReadRawSection(fileContent, ".tls", first: false);
match = GetMatchForSection(file, tlsSectionRaw, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;

2
BurnOutSharp/ProtectionType/Tages.cs
View File

@@ -40,7 +40,7 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the last section
// Get the last section and read after it
var lastSection = sections.LastOrDefault();
if (lastSection != null)
{