diff --git a/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs index 55437574..723c800a 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs @@ -82,17 +82,18 @@ namespace BurnOutSharp.ExecutableType.Microsoft // https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#special-sections // Here is a list of standard sections that are used in various protections: - // - .bss *1 protection Uninitialized data (free format) + // Y - .bss *1 protection Uninitialized data (free format) // X - .data 14 protections Initialized data (free format) // X - .edata *1 protection Export tables // X - .idata *1 protection Import tables // X - .rdata 11 protections Read-only initialized data // - .rsrc *1 protection Resource directory [Mostly taken care of, last protection needs research] // X - .text 6 protections Executable code (free format) - // - .tls *1 protection Thread-local storage (object only) + // Y - .tls *1 protection Thread-local storage (object only) // // Here is a list of non-standard sections whose contents are read by various protections: // X - CODE 2 protections SafeDisc, WTM CD Protect + // X - .dcrtext *1 protection JoWood // X - .grand *1 protection CD-Cops / DVD-Cops // X - .init *1 protection SolidShield // - .pec2 *1 protection PE Compact [Unconfirmed] @@ -101,21 +102,24 @@ namespace BurnOutSharp.ExecutableType.Microsoft // Here is a list of non-standard sections whose data is not read by various protections: // - .brick 1 protection StarForce // - .cenega 1 protection Cenega ProtectDVD + // - .ext 1 protection JoWood + // - HC09 1 protection JoWood // - .icd* 1 protection CodeLock // - .ldr 1 protection 3PLock // - .ldt 1 protection 3PLock // - .nicode 1 protection Armadillo - // - .NOS0 *1 protection UPX (NOS Variant) [Used as endpoint] - // - .NOS1 *1 protection UPX (NOS Variant) [Used as endpoint] + // - .NOS0 1 protection UPX (NOS Variant) [Used as endpoint] + // - .NOS1 1 protection UPX (NOS Variant) [Used as endpoint] // - .pec1 1 protection PE Compact // - .securom 1 protection SecuROM // - .sforce 1 protection StarForce // - stxt371 1 protection SafeDisc // - stxt774 1 protection SafeDisc - // - .UPX0 *1 protection UPX [Used as endpoint] - // - .UPX1 *1 protection UPX [Used as endpoint] + // - .UPX0 1 protection UPX [Used as endpoint] + // - .UPX1 1 protection UPX [Used as endpoint] // - .vob.pcd 1 protection VOB ProtectCD // - _winzip_ 1 protection WinZip SFX + // - XPROT 1 protection JoWood // // * => Only used by 1 protection so it may be read in by that protection specifically diff --git a/BurnOutSharp/PackerType/Armadillo.cs b/BurnOutSharp/PackerType/Armadillo.cs index 504336ab..5254c16f 100644 --- a/BurnOutSharp/PackerType/Armadillo.cs +++ b/BurnOutSharp/PackerType/Armadillo.cs @@ -22,20 +22,18 @@ namespace BurnOutSharp.PackerType if (nicodeSection) return "Armadillo"; - // Loop through all "extension" sections + // Loop through all "extension" sections -- usually .data1 or .text1 foreach (var section in sections.Where(s => s != null && Encoding.ASCII.GetString(s.Name).Trim('\0').EndsWith("1"))) { - int sectionAddr = (int)section.PointerToRawData; - int sectionEnd = sectionAddr + (int)section.VirtualSize; + string sectionName = Encoding.ASCII.GetString(section.Name).Trim('\0'); + var sectionRaw = pex.ReadRawSection(fileContent, sectionName); var matchers = new List { // ARMDEBUG - new ContentMatchSet( - new ContentMatch(new byte?[] { 0x41, 0x52, 0x4D, 0x44, 0x45, 0x42, 0x55, 0x47 }, start: sectionAddr, end: sectionEnd), - "Armadillo"), + new ContentMatchSet(new byte?[] { 0x41, 0x52, 0x4D, 0x44, 0x45, 0x42, 0x55, 0x47 }, $"Armadillo"), }; - string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug); + string match = MatchUtil.GetFirstMatch(file, sectionRaw, matchers, includeDebug); if (!string.IsNullOrWhiteSpace(match)) return match; } diff --git a/BurnOutSharp/PackerType/SetupFactory.cs b/BurnOutSharp/PackerType/SetupFactory.cs index 7c5ad7e8..0e2bf74e 100644 --- a/BurnOutSharp/PackerType/SetupFactory.cs +++ b/BurnOutSharp/PackerType/SetupFactory.cs @@ -28,7 +28,7 @@ namespace BurnOutSharp.PackerType return $"Setup Factory {GetVersion(pex)}"; // Longer version of the check that can be used if false positves become an issue: - // Setup Factory is a trademark of Indigo Rose Corporation + // "Setup Factory is a trademark of Indigo Rose Corporation" return null; } diff --git a/BurnOutSharp/PackerType/WinZipSFX.cs b/BurnOutSharp/PackerType/WinZipSFX.cs index cb235ba4..90ca53be 100644 --- a/BurnOutSharp/PackerType/WinZipSFX.cs +++ b/BurnOutSharp/PackerType/WinZipSFX.cs @@ -765,6 +765,7 @@ namespace BurnOutSharp.PackerType /// private string GetNEUnknownHeaderVersion(NewExecutable nex, string file, byte[] fileContent, bool includeDebug) { + // TODO: Like with PE, convert this into a preread in the header code int resourceStart = nex.DOSStubHeader.NewExeHeaderAddr + nex.NewExecutableHeader.ResourceTableOffset; int resourceEnd = nex.DOSStubHeader.NewExeHeaderAddr + nex.NewExecutableHeader.ModuleReferenceTableOffset; var matchers = new List diff --git a/BurnOutSharp/PackerType/WiseInstaller.cs b/BurnOutSharp/PackerType/WiseInstaller.cs index d4eab78e..fc374bc6 100644 --- a/BurnOutSharp/PackerType/WiseInstaller.cs +++ b/BurnOutSharp/PackerType/WiseInstaller.cs @@ -34,9 +34,12 @@ namespace BurnOutSharp.PackerType var sections = pex?.SectionTable; if (sections == null) { - var neMatchSets = GetContentMatchSets(); - if (neMatchSets != null && neMatchSets.Any()) - return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug); + if (nex != null) + { + var neMatchSets = GetContentMatchSets(); + if (neMatchSets != null && neMatchSets.Any()) + return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug); + } return null; } diff --git a/BurnOutSharp/ProtectionType/ActiveMARK.cs b/BurnOutSharp/ProtectionType/ActiveMARK.cs index a9438c56..6a197c43 100644 --- a/BurnOutSharp/ProtectionType/ActiveMARK.cs +++ b/BurnOutSharp/ProtectionType/ActiveMARK.cs @@ -33,20 +33,16 @@ namespace BurnOutSharp.ProtectionType return null; // Get the last .bss section, if it exists - var bssSection = pex.GetLastSection(".bss", exact: true); - if (bssSection != null) + var bssSectionRaw = pex.ReadRawSection(fileContent, ".bss", true); + if (bssSectionRaw != null) { - int sectionAddr = (int)bssSection.PointerToRawData; - int sectionEnd = sectionAddr + (int)bssSection.VirtualSize; var matchers = new List { // TMSAMVOF - new ContentMatchSet( - new ContentMatch(new byte?[] { 0x54, 0x4D, 0x53, 0x41, 0x4D, 0x56, 0x4F, 0x46 }, start: sectionAddr, end: sectionEnd), - "ActiveMARK"), + new ContentMatchSet(new byte?[] { 0x54, 0x4D, 0x53, 0x41, 0x4D, 0x56, 0x4F, 0x46 }, "ActiveMARK"), }; - string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug); + string match = MatchUtil.GetFirstMatch(file, bssSectionRaw, matchers, includeDebug); if (!string.IsNullOrWhiteSpace(match)) return match; } diff --git a/BurnOutSharp/ProtectionType/Bitpool.cs b/BurnOutSharp/ProtectionType/Bitpool.cs index cfda7a3c..3e7f46c8 100644 --- a/BurnOutSharp/ProtectionType/Bitpool.cs +++ b/BurnOutSharp/ProtectionType/Bitpool.cs @@ -15,7 +15,7 @@ namespace BurnOutSharp.ProtectionType public class Bitpool : IContentCheck, IPathCheck { /// - public List GetContentMatchSets() + private List GetContentMatchSets() { // TODO: Obtain a sample to find where this string is in a typical executable return new List diff --git a/BurnOutSharp/ProtectionType/CDCheck.cs b/BurnOutSharp/ProtectionType/CDCheck.cs index e8e1f3e0..14e50ac2 100644 --- a/BurnOutSharp/ProtectionType/CDCheck.cs +++ b/BurnOutSharp/ProtectionType/CDCheck.cs @@ -8,7 +8,7 @@ namespace BurnOutSharp.ProtectionType public class CDCheck : IContentCheck { /// - public List GetContentMatchSets() + private List GetContentMatchSets() { // TODO: Obtain a sample to find where this string is in a typical executable // TODO: Is this too broad in general? It _does_ indicate a CD check, but there's no real diff --git a/BurnOutSharp/ProtectionType/CodeLock.cs b/BurnOutSharp/ProtectionType/CodeLock.cs index 78484172..aa33258c 100644 --- a/BurnOutSharp/ProtectionType/CodeLock.cs +++ b/BurnOutSharp/ProtectionType/CodeLock.cs @@ -29,13 +29,7 @@ namespace BurnOutSharp.ProtectionType // Get the sections from the executable, if possible var sections = pex?.SectionTable; if (sections == null) - { - var neMatchSets = GetContentMatchSets(); - if (neMatchSets != null && neMatchSets.Any()) - return MatchUtil.GetFirstMatch(file, fileContent, neMatchSets, includeDebug); - return null; - } // If there are more than 2 icd-prefixed sections, then we have a match int icdSectionCount = sections.Count(s => Encoding.ASCII.GetString(s.Name).StartsWith("icd")); diff --git a/BurnOutSharp/ProtectionType/JoWood.cs b/BurnOutSharp/ProtectionType/JoWood.cs index 60f6ab4d..0616aca2 100644 --- a/BurnOutSharp/ProtectionType/JoWood.cs +++ b/BurnOutSharp/ProtectionType/JoWood.cs @@ -1,7 +1,6 @@ using System; using System.Collections.Generic; using System.Linq; -using System.Text; using BurnOutSharp.ExecutableType.Microsoft; using BurnOutSharp.Matching; @@ -21,30 +20,26 @@ namespace BurnOutSharp.ProtectionType return null; // Get the .ext section, if it exists - var extSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Equals(".ext ")); - if (extSection != null) + var extSection = pex.ContainsSection(".ext ", exact: true); + if (extSection) { // Get the .dcrtext section, if it exists - var dcrtextSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Equals(".dcrtext")); - if (dcrtextSection != null) + var dcrtextSectionRaw = pex.ReadRawSection(fileContent, ".dcrtext"); + if (dcrtextSectionRaw != null) { - int sectionAddr = (int)dcrtextSection.PointerToRawData; - int sectionEnd = sectionAddr + (int)dcrtextSection.VirtualSize; var matchers = new List { // kernel32.dll + (char)0x00 + (char)0x00 + (char)0x00 + VirtualProtect - new ContentMatchSet( - new ContentMatch(new byte?[] - { - 0x6B, 0x65, 0x72, 0x6E, 0x65, 0x6C, 0x33, 0x32, - 0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x00, 0x00, 0x56, - 0x69, 0x72, 0x74, 0x75, 0x61, 0x6C, 0x50, 0x72, - 0x6F, 0x74, 0x65, 0x63, 0x74 - }, start: sectionAddr, end: sectionEnd), - GetVersion, "JoWood X-Prot"), + new ContentMatchSet(new byte?[] + { + 0x6B, 0x65, 0x72, 0x6E, 0x65, 0x6C, 0x33, 0x32, + 0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x00, 0x00, 0x56, + 0x69, 0x72, 0x74, 0x75, 0x61, 0x6C, 0x50, 0x72, + 0x6F, 0x74, 0x65, 0x63, 0x74 + }, GetVersion, "JoWood X-Prot"), }; - string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug); + string match = MatchUtil.GetFirstMatch(file, dcrtextSectionRaw, matchers, includeDebug); if (!string.IsNullOrWhiteSpace(match)) return match; } @@ -53,13 +48,13 @@ namespace BurnOutSharp.ProtectionType } // Get the HC09 section, if it exists - var hc09Section = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Equals("HC09 ")); - if (hc09Section != null) + bool hc09Section = pex.ContainsSection("HC09 ", exact: true); + if (hc09Section) return "JoWood X-Prot v2"; // TODO: Can we get more granular with the version? // Get the XPROT section, if it exists - var xprotSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Equals("XPROT ")); - if (xprotSection != null) + var xprotSection = pex.ContainsSection("XPROT ", exact: true); + if (xprotSection) return "JoWood X-Prot v1.4+"; // TODO: Can we get more granular with the version? return null; diff --git a/BurnOutSharp/ProtectionType/Origin.cs b/BurnOutSharp/ProtectionType/Origin.cs index ba06171e..e8db4d1e 100644 --- a/BurnOutSharp/ProtectionType/Origin.cs +++ b/BurnOutSharp/ProtectionType/Origin.cs @@ -14,6 +14,7 @@ namespace BurnOutSharp.ProtectionType // TODO: Obtain a sample to find where this string is in a typical executable return new List { + // TODO: This looks like "OriginalFileName" // O + (char)0x00 + r + (char)0x00 + i + (char)0x00 + g + (char)0x00 + i + (char)0x00 + n + (char)0x00 + S + (char)0x00 + e + (char)0x00 + t + (char)0x00 + u + (char)0x00 + p + (char)0x00 + . + (char)0x00 + e + (char)0x00 + x + (char)0x00 + e + (char)0x00 new ContentMatchSet(new byte?[] { diff --git a/BurnOutSharp/ProtectionType/SmartE.cs b/BurnOutSharp/ProtectionType/SmartE.cs index 665b430c..f0f8872b 100644 --- a/BurnOutSharp/ProtectionType/SmartE.cs +++ b/BurnOutSharp/ProtectionType/SmartE.cs @@ -33,8 +33,8 @@ namespace BurnOutSharp.ProtectionType return match; // Get the .tls section, if it exists - var tlsSection = pex.GetLastSection(".tls", exact: true); - match = GetMatchForSection(tlsSection, file, fileContent, includeDebug); + var tlsSectionRaw = pex.ReadRawSection(fileContent, ".tls", first: false); + match = GetMatchForSection(file, tlsSectionRaw, includeDebug); if (!string.IsNullOrWhiteSpace(match)) return match; diff --git a/BurnOutSharp/ProtectionType/Tages.cs b/BurnOutSharp/ProtectionType/Tages.cs index 92dd06c3..8c669534 100644 --- a/BurnOutSharp/ProtectionType/Tages.cs +++ b/BurnOutSharp/ProtectionType/Tages.cs @@ -40,7 +40,7 @@ namespace BurnOutSharp.ProtectionType if (sections == null) return null; - // Get the last section + // Get the last section and read after it var lastSection = sections.LastOrDefault(); if (lastSection != null) {