From da01668cbefce25e415f523c89f5d2498d60e200 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Tue, 7 Sep 2021 21:08:25 -0700
Subject: [PATCH] Convert 321Studios Activation to section based

---
 .../ProtectionType/ThreeTwoOneStudios.cs      | 62 +++++++++++++------
 1 file changed, 44 insertions(+), 18 deletions(-)

diff --git a/BurnOutSharp/ProtectionType/ThreeTwoOneStudios.cs b/BurnOutSharp/ProtectionType/ThreeTwoOneStudios.cs
index 8d443f1d..4ddde647 100644
--- a/BurnOutSharp/ProtectionType/ThreeTwoOneStudios.cs
+++ b/BurnOutSharp/ProtectionType/ThreeTwoOneStudios.cs
@@ -1,29 +1,55 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using BurnOutSharp.ExecutableType.Microsoft;
 using BurnOutSharp.Matching;
+using BurnOutSharp.Tools;
 
 namespace BurnOutSharp.ProtectionType
 {
     public class ThreeTwoOneStudios : IContentCheck
     {
         /// <inheritdoc/>
-        public List<ContentMatchSet> GetContentMatchSets()
-        {
-            return new List<ContentMatchSet>
-            {
-                // 3 + (char)0x00 + 1 + 2 + (char)0x00 + 1 + (char)0x00 + S + (char)0x00 + t + (char)0x00 + u + (char)0x00 + d + (char)0x00 + i + (char)0x00 + o + (char)0x00 + s + (char)0x00 +   + (char)0x00 + A + (char)0x00 + c + (char)0x00 + t + (char)0x00 + i + (char)0x00 + v + (char)0x00 + a + (char)0x00 + t + (char)0x00 + i + (char)0x00 + o + (char)0x00 + n + (char)0x00
-                new ContentMatchSet(new byte?[]
-                {
-                    0x33, 0x00, 0x32, 0x00, 0x31, 0x00, 0x53, 0x00,
-                    0x74, 0x00, 0x75, 0x00, 0x64, 0x00, 0x69, 0x00,
-                    0x6F, 0x00, 0x73, 0x00, 0x20, 0x00, 0x41, 0x00,
-                    0x63, 0x00, 0x74, 0x00, 0x69, 0x00, 0x76, 0x00,
-                    0x61, 0x00, 0x74, 0x00, 0x69, 0x00, 0x6F, 0x00,
-                    0x6E, 0x00
-                }, "321Studios Online Activation"),
-            };
-        }
+        public List<ContentMatchSet> GetContentMatchSets() => null;
 
         /// <inheritdoc/>
-        public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) => null;
+        public string CheckContents(string file, byte[] fileContent, bool includeDebug = false)
+        {
+            // Get the sections from the executable, if possible
+            PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0);
+            var sections = pex?.SectionTable;
+            if (sections == null)
+                return null;
+            
+            // Get the .rsrc section, if it exists
+            var rsrcSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".rsrc"));
+            if (rsrcSection != null)
+            {
+                int sectionAddr = (int)rsrcSection.PointerToRawData;
+                int sectionEnd = sectionAddr + (int)rsrcSection.VirtualSize;
+                var matchers = new List<ContentMatchSet>
+                {
+                    // 3 + (char)0x00 + 2 + (char)0x00 + 1 + (char)0x00 + S + (char)0x00 + t + (char)0x00 + u + (char)0x00 + d + (char)0x00 + i + (char)0x00 + o + (char)0x00 + s + (char)0x00 +   + (char)0x00 + A + (char)0x00 + c + (char)0x00 + t + (char)0x00 + i + (char)0x00 + v + (char)0x00 + a + (char)0x00 + t + (char)0x00 + i + (char)0x00 + o + (char)0x00 + n + (char)0x00
+                    new ContentMatchSet(
+                        new ContentMatch(new byte?[]
+                        {
+                            0x33, 0x00, 0x32, 0x00, 0x31, 0x00, 0x53, 0x00,
+                            0x74, 0x00, 0x75, 0x00, 0x64, 0x00, 0x69, 0x00,
+                            0x6F, 0x00, 0x73, 0x00, 0x20, 0x00, 0x41, 0x00,
+                            0x63, 0x00, 0x74, 0x00, 0x69, 0x00, 0x76, 0x00,
+                            0x61, 0x00, 0x74, 0x00, 0x69, 0x00, 0x6F, 0x00,
+                            0x6E, 0x00
+                        }, start: sectionAddr, end: sectionEnd),
+                    "321Studios Online Activation"),
+                };
+
+                string match = MatchUtil.GetFirstMatch(file, fileContent, matchers, includeDebug);
+                if (!string.IsNullOrWhiteSpace(match))
+                    return match;
+            }
+
+            return null;
+        }
     }
 }