SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-09 02:16:46 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Attempt to use new executable framework

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-03 22:17:48 -08:00
parent f420434fd3
commit f78b3daf8b
81 changed files with 1214 additions and 1228 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
BurnOutSharp/BurnOutSharp.csproj
View File

@@ -73,6 +73,8 @@
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
<PrivateAssets>all</PrivateAssets>
</ProjectReference>
<ProjectReference Include="..\BurnOutSharp.Wrappers\BurnOutSharp.Wrappers.csproj" />
<ProjectReference Include="..\BurnOutSharp.Models\BurnOutSharp.Models.csproj" />
</ItemGroup>
<ItemGroup>

11
BurnOutSharp/FileType/Executable.cs
View File

@@ -3,10 +3,9 @@ using System.Collections.Concurrent;
using System.IO;
using System.Text;
using System.Threading.Tasks;
using BurnOutSharp.ExecutableType.Microsoft.NE;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.FileType
{
@@ -86,9 +85,9 @@ namespace BurnOutSharp.FileType
// Create PortableExecutable and NewExecutable objects for use in the checks
stream.Seek(0, SeekOrigin.Begin);
PortableExecutable pex = new PortableExecutable(stream);
PortableExecutable pex = PortableExecutable.Create(stream);
stream.Seek(0, SeekOrigin.Begin);
NewExecutable nex = new NewExecutable(stream);
NewExecutable nex = NewExecutable.Create(stream);
stream.Seek(0, SeekOrigin.Begin);
// Iterate through all generic content checks
@@ -114,7 +113,7 @@ namespace BurnOutSharp.FileType
}
// If we have a NE executable, iterate through all NE content checks
if (nex?.Initialized == true)
if (nex != null)
{
Parallel.ForEach(ScanningClasses.NewExecutableCheckClasses, contentCheckClass =>
{
@@ -137,7 +136,7 @@ namespace BurnOutSharp.FileType
}
// If we have a PE executable, iterate through all PE content checks
if (pex?.Initialized == true)
if (pex != null)
{
// Print the section table for debug
if (scanner.IncludeDebug && pex.SectionTable != null)

2
BurnOutSharp/Interfaces/ILinearExecutableCheck.cs
View File

@@ -1,4 +1,4 @@
using BurnOutSharp.ExecutableType.Microsoft.LE;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.Interfaces
{

2
BurnOutSharp/Interfaces/INewExecutableCheck.cs
View File

@@ -1,4 +1,4 @@
using BurnOutSharp.ExecutableType.Microsoft.NE;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.Interfaces
{

2
BurnOutSharp/Interfaces/IPortableExecutableCheck.cs
View File

@@ -1,4 +1,4 @@
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.Interfaces
{

20
BurnOutSharp/PackerType/ASPack.cs
View File

@@ -1,9 +1,10 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Text;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -26,20 +27,21 @@ namespace BurnOutSharp.PackerType
if (aspackSection)
return "ASPack 2.29";
// TODO: Re-enable all Entry Point checks after implementing
// Use the entry point data, if it exists
if (pex.EntryPointRaw != null)
{
var matchers = GenerateMatchers();
string match = MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// if (pex.EntryPointRaw != null)
// {
// var matchers = GenerateMatchers();
// string match = MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, matchers, includeDebug);
// if (!string.IsNullOrWhiteSpace(match))
// return match;
// }
// Get the .adata* section, if it exists
var adataSection = pex.GetFirstSection(".adata", exact: false);
if (adataSection != null)
{
var adataSectionRaw = pex.ReadRawSection(adataSection.NameString);
var adataSectionRaw = pex.GetFirstSectionData(Encoding.UTF8.GetString(adataSection.Name));
if (adataSectionRaw != null)
{
var matchers = GenerateMatchers();

6
BurnOutSharp/PackerType/AdvancedInstaller.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -23,7 +23,7 @@ namespace BurnOutSharp.PackerType
return null;
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -38,7 +38,7 @@ namespace BurnOutSharp.PackerType
}, "Caphyon Advanced Installer"),
};
return MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
return MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
}
return null;

6
BurnOutSharp/PackerType/Armadillo.cs
View File

@@ -2,9 +2,9 @@
using System.Collections.Generic;
using System.IO;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -30,9 +30,9 @@ namespace BurnOutSharp.PackerType
return "Armadillo";
// Loop through all "extension" sections -- usually .data1 or .text1
foreach (var section in sections.Where(s => s != null && s.NameString.EndsWith("1")))
foreach (var sectionName in pex.SectionNames.Where(s => s != null && s.EndsWith("1")))
{
var sectionRaw = pex.ReadRawSection(section.NameString);
var sectionRaw = pex.GetFirstSectionData(sectionName);
if (sectionRaw != null)
{
var matchers = new List<ContentMatchSet>

2
BurnOutSharp/PackerType/AutoPlayMediaStudio.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{

8
BurnOutSharp/PackerType/CExe.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -20,8 +20,8 @@ namespace BurnOutSharp.PackerType
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var stub = pex?.DOSStubHeader;
if (stub == null)
var stubMagic = pex?.Stub_Magic;
if (stubMagic == null)
return null;
var matchers = new List<ContentMatchSet>
@@ -37,7 +37,7 @@ namespace BurnOutSharp.PackerType
}, "CExe")
};
string match = MatchUtil.GetFirstMatch(file, pex.DOSStubHeader.ExecutableData, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.StubExecutableData, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;

2
BurnOutSharp/PackerType/EXEStealth.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{

9
BurnOutSharp/PackerType/GenteeInstaller.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -22,8 +22,9 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -42,7 +43,7 @@ namespace BurnOutSharp.PackerType
}, "Gentee Installer"),
};
return MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
return MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
}
return null;

19
BurnOutSharp/PackerType/InnoSetup.cs
View File

@@ -4,10 +4,9 @@ using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft.NE;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -21,13 +20,12 @@ namespace BurnOutSharp.PackerType
/// <inheritdoc/>
public string CheckNewExecutable(string file, NewExecutable nex, bool includeDebug)
{
// Get the DOS stub from the executable, if possible
var stub = nex?.DOSStubHeader;
if (stub == null)
// Check we have a valid executable
if (nex == null)
return null;
// Check for "Inno" in the reserved words
if (stub.Reserved2[4] == 0x6E49 && stub.Reserved2[5] == 0x6F6E)
if (nex.Stub_Reserved2[4] == 0x6E49 && nex.Stub_Reserved2[5] == 0x6F6E)
{
string version = GetOldVersion(file, nex);
if (!string.IsNullOrWhiteSpace(version))
@@ -47,8 +45,9 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
// Get the DATA/.data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -61,7 +60,7 @@ namespace BurnOutSharp.PackerType
}, GetVersion, "Inno Setup"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
@@ -102,7 +101,7 @@ namespace BurnOutSharp.PackerType
string version = Encoding.ASCII.GetString(onlyVersion);
if (unicodeBytes.SequenceEqual(new byte[] { 0x28, 0x75, 0x29 }))
return (version + " (Unicode)");
return version + " (Unicode)";
return version;
}

2
BurnOutSharp/PackerType/InstallAnywhere.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{

9
BurnOutSharp/PackerType/InstallerVISE.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -23,8 +23,9 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
// Get the DATA/.data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -32,7 +33,7 @@ namespace BurnOutSharp.PackerType
new ContentMatchSet(new byte?[] { 0x56, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Installer VISE"),
};
return MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
return MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
}
return null;

2
BurnOutSharp/PackerType/IntelInstallationFramework.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{

15
BurnOutSharp/PackerType/MicrosoftCABSFX.cs
View File

@@ -2,10 +2,10 @@ using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -28,12 +28,13 @@ namespace BurnOutSharp.PackerType
if (name?.Equals("Wextract", StringComparison.OrdinalIgnoreCase) == true)
return $"Microsoft CAB SFX {GetVersion(pex)}";
name = pex.OriginalFileName;
name = pex.OriginalFilename;
if (name?.Equals("WEXTRACT.EXE", StringComparison.OrdinalIgnoreCase) == true)
return $"Microsoft CAB SFX {GetVersion(pex)}";
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -45,13 +46,13 @@ namespace BurnOutSharp.PackerType
}, "Microsoft CAB SFX"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return $"Microsoft CAB SFX {GetVersion(pex)}";
}
// Get the .text section, if it exists
if (pex.TextSectionRaw != null)
if (pex.ContainsSection(".text"))
{
var matchers = new List<ContentMatchSet>
{
@@ -61,7 +62,7 @@ namespace BurnOutSharp.PackerType
new ContentMatchSet(new byte?[] { 0x4D, 0x53, 0x43, 0x46, 0x75 }, "Microsoft CAB SFX"),
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".text"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return $"Microsoft CAB SFX {GetVersion(pex)}";
}

11
BurnOutSharp/PackerType/NSIS.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -21,12 +21,13 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
string description = pex.ManifestDescription;
string description = pex.AssemblyDescription;
if (!string.IsNullOrWhiteSpace(description) && description.StartsWith("Nullsoft Install System"))
return $"NSIS {description.Substring("Nullsoft Install System".Length).Trim()}";
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -38,7 +39,7 @@ namespace BurnOutSharp.PackerType
}, "NSIS"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

4
BurnOutSharp/PackerType/PECompact.cs
View File

@@ -1,7 +1,7 @@
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -21,7 +21,7 @@ namespace BurnOutSharp.PackerType
return null;
// 0x4F434550 is "PECO"
if (pex.ImageFileHeader.PointerToSymbolTable == 0x4F434550)
if (pex.PointerToSymbolTable == 0x4F434550)
return "PE Compact v1.x";
// TODO: Get more granular version detection. PiD is somehow able to detect version ranges based

2
BurnOutSharp/PackerType/Petite.cs
View File

@@ -1,7 +1,7 @@
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{

2
BurnOutSharp/PackerType/SetupFactory.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{

2
BurnOutSharp/PackerType/Shrinker.cs
View File

@@ -1,7 +1,7 @@
using System.Collections.Concurrent;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{

4
BurnOutSharp/PackerType/UPX.cs
View File

@@ -2,9 +2,9 @@ using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -116,7 +116,7 @@ namespace BurnOutSharp.PackerType
return null;
// This subtract is needed because the version is before the section
return pex.ReadRawSection($"{sectionPrefix}0", first: true, offset: -128);
return pex.GetFirstSectionDataWithOffset($"{sectionPrefix}0", offset: -128);
}
}
}

9
BurnOutSharp/PackerType/WinRARSFX.cs
View File

@@ -2,10 +2,10 @@ using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
using SharpCompress.Archives;
using SharpCompress.Archives.Rar;
@@ -24,8 +24,9 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -38,7 +39,7 @@ namespace BurnOutSharp.PackerType
}, "WinRAR SFX"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

1205
BurnOutSharp/PackerType/WinZipSFX.cs
View File

File diff suppressed because it is too large Load Diff

19
BurnOutSharp/PackerType/WiseInstaller.cs
View File

@@ -2,11 +2,10 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.NE;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
using Wise = WiseUnpacker.WiseUnpacker;
namespace BurnOutSharp.PackerType
@@ -20,9 +19,8 @@ namespace BurnOutSharp.PackerType
/// <inheritdoc/>
public string CheckNewExecutable(string file, NewExecutable nex, bool includeDebug)
{
// Get the DOS stub from the executable, if possible
var stub = nex?.DOSStubHeader;
if (stub == null)
/// Check we have a valid executable
if (nex == null)
return null;
// TODO: Don't read entire file
@@ -49,8 +47,9 @@ namespace BurnOutSharp.PackerType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -58,13 +57,13 @@ namespace BurnOutSharp.PackerType
new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -72,7 +71,7 @@ namespace BurnOutSharp.PackerType
new ContentMatchSet(new byte?[] { 0x57, 0x69, 0x73, 0x65, 0x4D, 0x61, 0x69, 0x6E }, "Wise Installation Wizard Module"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

6
BurnOutSharp/PackerType/dotFuscator.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.PackerType
{
@@ -22,7 +22,7 @@ namespace BurnOutSharp.PackerType
return null;
// Get the .text section, if it exists
if (pex.TextSectionRaw != null)
if (pex.ContainsSection(".text"))
{
var matchers = new List<ContentMatchSet>
{
@@ -35,7 +35,7 @@ namespace BurnOutSharp.PackerType
}, "dotFuscator"),
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".text"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

243
BurnOutSharp/ProtectionType/ActiveMARK.cs
View File

@@ -1,7 +1,7 @@
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -39,134 +39,135 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// TODO: Re-enable all Entry Point checks after implementing
// Get the entry point data, if it exists
if (pex.EntryPointRaw != null)
{
var matchers = new List<ContentMatchSet>
{
// Checks sourced from https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt
new ContentMatchSet(new byte?[]
{
0x79, 0x11, 0x7F, 0xAB, 0x9A, 0x4A, 0x83, 0xB5,
0xC9, 0x6B, 0x1A, 0x48, 0xF9, 0x27, 0xB4, 0x25,
}, "ActiveMARK"),
// if (pex.EntryPointRaw != null)
// {
// var matchers = new List<ContentMatchSet>
// {
// // Checks sourced from https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt
// new ContentMatchSet(new byte?[]
// {
// 0x79, 0x11, 0x7F, 0xAB, 0x9A, 0x4A, 0x83, 0xB5,
// 0xC9, 0x6B, 0x1A, 0x48, 0xF9, 0x27, 0xB4, 0x25,
// }, "ActiveMARK"),
new ContentMatchSet(new byte?[]
{
0x20, 0x2D, 0x2D, 0x4D, 0x50, 0x52, 0x4D, 0x4D,
0x47, 0x56, 0x41, 0x2D, 0x2D, 0x00, 0x75, 0x73,
0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C,
0x00, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
0x42, 0x6F, 0x78, 0x41, 0x00, 0x54, 0x68, 0x69,
0x73, 0x20, 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63,
0x61, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x63, 0x61,
0x6E, 0x6E, 0x6F, 0x74, 0x20, 0x72, 0x75, 0x6E,
0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6E,
0x20, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x20,
0x64, 0x65, 0x62, 0x75, 0x67,
}, "ActiveMARK 5.x -> Trymedia Systems Inc. (h)"),
// new ContentMatchSet(new byte?[]
// {
// 0x20, 0x2D, 0x2D, 0x4D, 0x50, 0x52, 0x4D, 0x4D,
// 0x47, 0x56, 0x41, 0x2D, 0x2D, 0x00, 0x75, 0x73,
// 0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C,
// 0x00, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
// 0x42, 0x6F, 0x78, 0x41, 0x00, 0x54, 0x68, 0x69,
// 0x73, 0x20, 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63,
// 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x63, 0x61,
// 0x6E, 0x6E, 0x6F, 0x74, 0x20, 0x72, 0x75, 0x6E,
// 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6E,
// 0x20, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x20,
// 0x64, 0x65, 0x62, 0x75, 0x67,
// }, "ActiveMARK 5.x -> Trymedia Systems Inc. (h)"),
new ContentMatchSet(new byte?[]
{
0x20, 0x2D, 0x2D, 0x4D, 0x50, 0x52, 0x4D, 0x4D,
0x47, 0x56, 0x41, 0x2D, 0x2D, 0x00, 0x75, 0x73,
0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C,
0x00, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
0x42, 0x6F, 0x78, 0x41, 0x00, 0x54, 0x68, 0x69,
0x73, 0x20, 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63,
0x61, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x63, 0x61,
0x6E, 0x6E, 0x6F, 0x74, 0x20, 0x72, 0x75, 0x6E,
0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6E,
0x20, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x20,
0x64, 0x65, 0x62, 0x75, 0x67, 0x67, 0x65, 0x72,
0x20, 0x69, 0x6E, 0x20, 0x6D, 0x65, 0x6D, 0x6F,
0x72, 0x79, 0x2E, 0x0D, 0x0A, 0x50, 0x6C, 0x65,
0x61, 0x73, 0x65, 0x20, 0x75, 0x6E, 0x6C, 0x6F,
0x61, 0x64, 0x20, 0x74, 0x68, 0x65, 0x20, 0x64,
0x65, 0x62, 0x75, 0x67, 0x67, 0x65, 0x72, 0x20,
0x61, 0x6E, 0x64, 0x20, 0x72, 0x65, 0x73, 0x74,
0x61, 0x72, 0x74, 0x20, 0x74, 0x68, 0x65, 0x20,
0x61, 0x70, 0x70, 0x6C, 0x69, 0x63, 0x61, 0x74,
0x69, 0x6F, 0x6E, 0x2E, 0x00, 0x57, 0x61, 0x72,
0x6E, 0x69, 0x6E, 0x67,
}, "ActiveMARK 5.x -> Trymedia Systems,Inc."),
// new ContentMatchSet(new byte?[]
// {
// 0x20, 0x2D, 0x2D, 0x4D, 0x50, 0x52, 0x4D, 0x4D,
// 0x47, 0x56, 0x41, 0x2D, 0x2D, 0x00, 0x75, 0x73,
// 0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C,
// 0x00, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
// 0x42, 0x6F, 0x78, 0x41, 0x00, 0x54, 0x68, 0x69,
// 0x73, 0x20, 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63,
// 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x63, 0x61,
// 0x6E, 0x6E, 0x6F, 0x74, 0x20, 0x72, 0x75, 0x6E,
// 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6E,
// 0x20, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x20,
// 0x64, 0x65, 0x62, 0x75, 0x67, 0x67, 0x65, 0x72,
// 0x20, 0x69, 0x6E, 0x20, 0x6D, 0x65, 0x6D, 0x6F,
// 0x72, 0x79, 0x2E, 0x0D, 0x0A, 0x50, 0x6C, 0x65,
// 0x61, 0x73, 0x65, 0x20, 0x75, 0x6E, 0x6C, 0x6F,
// 0x61, 0x64, 0x20, 0x74, 0x68, 0x65, 0x20, 0x64,
// 0x65, 0x62, 0x75, 0x67, 0x67, 0x65, 0x72, 0x20,
// 0x61, 0x6E, 0x64, 0x20, 0x72, 0x65, 0x73, 0x74,
// 0x61, 0x72, 0x74, 0x20, 0x74, 0x68, 0x65, 0x20,
// 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63, 0x61, 0x74,
// 0x69, 0x6F, 0x6E, 0x2E, 0x00, 0x57, 0x61, 0x72,
// 0x6E, 0x69, 0x6E, 0x67,
// }, "ActiveMARK 5.x -> Trymedia Systems,Inc."),
new ContentMatchSet(new byte?[]
{
0xBE, 0x48, 0x01, 0x40, 0x00, 0xAD, 0x8B, 0xF8,
0x95, 0xA5, 0x33, 0xC0, 0x33, 0xC9, 0xAB, 0x48,
0xAB, 0xF7, 0xD8, 0xB1, 0x04, 0xF3, 0xAB, 0xC1,
0xE0, 0x0A, 0xB5, 0x1C, 0xF3, 0xAB, 0xAD, 0x50,
0x97, 0x51, 0xAD, 0x87, 0xF5, 0x58, 0x8D, 0x54,
0x86, 0x5C, 0xFF, 0xD5, 0x72, 0x5A, 0x2C, 0x03,
0x73, 0x02, 0xB0, 0x00, 0x3C, 0x07, 0x72, 0x02,
0x2C, 0x03, 0x50, 0x0F, 0xB6, 0x5F, 0xFF, 0xC1,
0xE3, 0x03, 0xB3, 0x00, 0x8D, 0x1C, 0x5B, 0x8D,
0x9C, 0x9E, 0x0C, 0x10, 0x00, 0x00, 0xB0, 0x01,
0x67, 0xE3, 0x29, 0x8B, 0xD7, 0x2B, 0x56, 0x0C,
0x8A, 0x2A, 0x33, 0xD2, 0x84, 0xE9, 0x0F, 0x95,
0xC6, 0x52, 0xFE, 0xC6, 0x8A, 0xD0, 0x8D, 0x14,
0x93, 0xFF, 0xD5, 0x5A, 0x9F, 0x12, 0xC0, 0xD0,
0xE9, 0x74, 0x0E, 0x9E, 0x1A, 0xF2, 0x74, 0xE4,
0xB4, 0x00, 0x33, 0xC9, 0xB5, 0x01, 0xFF, 0x55,
0xCC, 0x33, 0xC9, 0xE9, 0xDF, 0x00, 0x00, 0x00,
0x8B, 0x5E, 0x0C, 0x83, 0xC2, 0x30, 0xFF, 0xD5,
0x73, 0x50, 0x83, 0xC2, 0x30, 0xFF, 0xD5, 0x72,
0x1B, 0x83, 0xC2, 0x30, 0xFF, 0xD5, 0x72, 0x2B,
0x3C, 0x07, 0xB0, 0x09, 0x72, 0x02, 0xB0, 0x0B,
0x50, 0x8B, 0xC7, 0x2B, 0x46, 0x0C, 0xB1, 0x80,
0x8A, 0x00, 0xEB, 0xCF, 0x83, 0xC2, 0x60, 0xFF,
0xD5, 0x87, 0x5E, 0x10, 0x73, 0x0D, 0x83, 0xC2,
0x30, 0xFF, 0xD5, 0x87, 0x5E, 0x14, 0x73, 0x03,
0x87, 0x5E, 0x18, 0x3C, 0x07, 0xB0, 0x08, 0x72,
0x02, 0xB0, 0x0B, 0x50, 0x53, 0x8D, 0x96, 0x7C,
0x07, 0x00, 0x00, 0xFF, 0x55, 0xD0, 0x5B, 0x91,
0xEB, 0x77, 0x3C, 0x07, 0xB0, 0x07, 0x72, 0x02,
0xB0, 0x0A, 0x50, 0x87, 0x5E, 0x10, 0x87, 0x5E,
0x14, 0x89, 0x5E, 0x18, 0x8D, 0x96, 0xC4, 0x0B,
0x00, 0x00, 0xFF, 0x55, 0xD0, 0x50, 0x48,
}, "ActiveMARK 5.x -> Trymedia Systems,Inc. (h)"),
// new ContentMatchSet(new byte?[]
// {
// 0xBE, 0x48, 0x01, 0x40, 0x00, 0xAD, 0x8B, 0xF8,
// 0x95, 0xA5, 0x33, 0xC0, 0x33, 0xC9, 0xAB, 0x48,
// 0xAB, 0xF7, 0xD8, 0xB1, 0x04, 0xF3, 0xAB, 0xC1,
// 0xE0, 0x0A, 0xB5, 0x1C, 0xF3, 0xAB, 0xAD, 0x50,
// 0x97, 0x51, 0xAD, 0x87, 0xF5, 0x58, 0x8D, 0x54,
// 0x86, 0x5C, 0xFF, 0xD5, 0x72, 0x5A, 0x2C, 0x03,
// 0x73, 0x02, 0xB0, 0x00, 0x3C, 0x07, 0x72, 0x02,
// 0x2C, 0x03, 0x50, 0x0F, 0xB6, 0x5F, 0xFF, 0xC1,
// 0xE3, 0x03, 0xB3, 0x00, 0x8D, 0x1C, 0x5B, 0x8D,
// 0x9C, 0x9E, 0x0C, 0x10, 0x00, 0x00, 0xB0, 0x01,
// 0x67, 0xE3, 0x29, 0x8B, 0xD7, 0x2B, 0x56, 0x0C,
// 0x8A, 0x2A, 0x33, 0xD2, 0x84, 0xE9, 0x0F, 0x95,
// 0xC6, 0x52, 0xFE, 0xC6, 0x8A, 0xD0, 0x8D, 0x14,
// 0x93, 0xFF, 0xD5, 0x5A, 0x9F, 0x12, 0xC0, 0xD0,
// 0xE9, 0x74, 0x0E, 0x9E, 0x1A, 0xF2, 0x74, 0xE4,
// 0xB4, 0x00, 0x33, 0xC9, 0xB5, 0x01, 0xFF, 0x55,
// 0xCC, 0x33, 0xC9, 0xE9, 0xDF, 0x00, 0x00, 0x00,
// 0x8B, 0x5E, 0x0C, 0x83, 0xC2, 0x30, 0xFF, 0xD5,
// 0x73, 0x50, 0x83, 0xC2, 0x30, 0xFF, 0xD5, 0x72,
// 0x1B, 0x83, 0xC2, 0x30, 0xFF, 0xD5, 0x72, 0x2B,
// 0x3C, 0x07, 0xB0, 0x09, 0x72, 0x02, 0xB0, 0x0B,
// 0x50, 0x8B, 0xC7, 0x2B, 0x46, 0x0C, 0xB1, 0x80,
// 0x8A, 0x00, 0xEB, 0xCF, 0x83, 0xC2, 0x60, 0xFF,
// 0xD5, 0x87, 0x5E, 0x10, 0x73, 0x0D, 0x83, 0xC2,
// 0x30, 0xFF, 0xD5, 0x87, 0x5E, 0x14, 0x73, 0x03,
// 0x87, 0x5E, 0x18, 0x3C, 0x07, 0xB0, 0x08, 0x72,
// 0x02, 0xB0, 0x0B, 0x50, 0x53, 0x8D, 0x96, 0x7C,
// 0x07, 0x00, 0x00, 0xFF, 0x55, 0xD0, 0x5B, 0x91,
// 0xEB, 0x77, 0x3C, 0x07, 0xB0, 0x07, 0x72, 0x02,
// 0xB0, 0x0A, 0x50, 0x87, 0x5E, 0x10, 0x87, 0x5E,
// 0x14, 0x89, 0x5E, 0x18, 0x8D, 0x96, 0xC4, 0x0B,
// 0x00, 0x00, 0xFF, 0x55, 0xD0, 0x50, 0x48,
// }, "ActiveMARK 5.x -> Trymedia Systems,Inc. (h)"),
new ContentMatchSet(new byte?[]
{
0x79, 0x07, 0x0F, 0xB7, 0x07, 0x47, 0x50, 0x47,
0xB9, 0x57, 0x48, 0xF2, 0xAE, 0x55, 0xFF, 0x96,
0x84, null, 0x00, 0x00, 0x09, 0xC0, 0x74, 0x07,
0x89, 0x03, 0x83, 0xC3, 0x04, 0xEB, 0xD8, 0xFF,
0x96, 0x88, null, 0x00, 0x00, 0x61, 0xE9, null,
null, null, 0xFF,
}, "ActiveMARK R5.31.1140 -> Trymedia"),
// new ContentMatchSet(new byte?[]
// {
// 0x79, 0x07, 0x0F, 0xB7, 0x07, 0x47, 0x50, 0x47,
// 0xB9, 0x57, 0x48, 0xF2, 0xAE, 0x55, 0xFF, 0x96,
// 0x84, null, 0x00, 0x00, 0x09, 0xC0, 0x74, 0x07,
// 0x89, 0x03, 0x83, 0xC3, 0x04, 0xEB, 0xD8, 0xFF,
// 0x96, 0x88, null, 0x00, 0x00, 0x61, 0xE9, null,
// null, null, 0xFF,
// }, "ActiveMARK R5.31.1140 -> Trymedia"),
new ContentMatchSet(new byte?[]
{
0x89, 0x25, null, null, null, null, null, null,
null, null, 0xEB,
}, "ActiveMark -> Trymedia Systems Inc."),
// new ContentMatchSet(new byte?[]
// {
// 0x89, 0x25, null, null, null, null, null, null,
// null, null, 0xEB,
// }, "ActiveMark -> Trymedia Systems Inc."),
new ContentMatchSet(new byte?[]
{
0x89, 0x25, null, null, null, null, 0x33, 0xED,
0x55, 0x8B, 0xEC, 0xE8, null, null, null, null,
0x8B, 0xD0, 0x81, 0xE2, 0xFF, 0x00, 0x00, 0x00,
0x89, 0x15, null, null, null, null, 0x8B, 0xD0,
0xC1, 0xEA, 0x08, 0x81, 0xE2, 0xFF, 0x00, 0x00,
0x00, 0xA3, null, null, null, null, 0xD1, 0xE0,
0x0F, 0x93, 0xC3, 0x33, 0xC0, 0x8A, 0xC3, 0xA3,
null, null, null, null, 0x68, 0xFF, 0x00, 0x00,
0x00, 0xE8, null, null, null, null, 0x6A, 0x00,
0xE8, null, null, null, null, 0xA3, null, null,
null, null, 0xBB, null, null, null, null, 0xC7,
0x03, 0x44, 0x00, 0x00, 0x00,
}, "ActiveMark -> Trymedia Systems Inc."),
};
// new ContentMatchSet(new byte?[]
// {
// 0x89, 0x25, null, null, null, null, 0x33, 0xED,
// 0x55, 0x8B, 0xEC, 0xE8, null, null, null, null,
// 0x8B, 0xD0, 0x81, 0xE2, 0xFF, 0x00, 0x00, 0x00,
// 0x89, 0x15, null, null, null, null, 0x8B, 0xD0,
// 0xC1, 0xEA, 0x08, 0x81, 0xE2, 0xFF, 0x00, 0x00,
// 0x00, 0xA3, null, null, null, null, 0xD1, 0xE0,
// 0x0F, 0x93, 0xC3, 0x33, 0xC0, 0x8A, 0xC3, 0xA3,
// null, null, null, null, 0x68, 0xFF, 0x00, 0x00,
// 0x00, 0xE8, null, null, null, null, 0x6A, 0x00,
// 0xE8, null, null, null, null, 0xA3, null, null,
// null, null, 0xBB, null, null, null, null, 0xC7,
// 0x03, 0x44, 0x00, 0x00, 0x00,
// }, "ActiveMark -> Trymedia Systems Inc."),
// };
string match = MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// string match = MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, matchers, includeDebug);
// if (!string.IsNullOrWhiteSpace(match))
// return match;
// }
// Get the overlay data, if it exists
if (pex.OverlayRaw != null)
if (pex.Overlay != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -174,13 +175,13 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x00, 0x54, 0x4D, 0x53, 0x41, 0x4D, 0x56, 0x4F, 0x48, }, "ActiveMARK"),
};
string match = MatchUtil.GetFirstMatch(file, pex.OverlayRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.Overlay, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the last .bss section, if it exists
var bssSectionRaw = pex.ReadRawSection(".bss", first: false);
var bssSectionRaw = pex.GetLastSectionData(".bss");
if (bssSectionRaw != null)
{
var matchers = new List<ContentMatchSet>

9
BurnOutSharp/ProtectionType/AegiSoft.cs
View File

@@ -1,8 +1,8 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -33,8 +33,9 @@ namespace BurnOutSharp.ProtectionType
// "Asc005.dll" has the Product Name "OrderWizard Dynamic Link Library".
// "Asc006.exe" has the Product Name "AGENT Application".
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -47,7 +48,7 @@ namespace BurnOutSharp.ProtectionType
}, "AegiSoft License Manager"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

17
BurnOutSharp/ProtectionType/AlphaROM.cs
View File

@@ -1,7 +1,7 @@
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -54,8 +54,9 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -68,13 +69,13 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x53, 0x45, 0x54, 0x54, 0x45, 0x43, 0x30, 0x30, 0x30, 0x30 }, "Alpha-ROM"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -112,13 +113,13 @@ namespace BurnOutSharp.ProtectionType
}, "Alpha-ROM"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the overlay data, if it exists
if (pex.OverlayRaw != null)
if (pex.Overlay != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -127,7 +128,7 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x53, 0x45, 0x54, 0x54, 0x45, 0x43, 0x30, 0x30, 0x30, 0x30 }, "Alpha-ROM"),
};
string match = MatchUtil.GetFirstMatch(file, pex.OverlayRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.Overlay, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

6
BurnOutSharp/ProtectionType/CDCheck.cs
View File

@@ -1,7 +1,7 @@
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -16,7 +16,7 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -28,7 +28,7 @@ namespace BurnOutSharp.ProtectionType
}, "Microsoft Game Studios CD Check"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

8
BurnOutSharp/ProtectionType/CDDVDCops.cs
View File

@@ -2,10 +2,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.NE;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -45,9 +44,8 @@ namespace BurnOutSharp.ProtectionType
/// <inheritdoc/>
public string CheckNewExecutable(string file, NewExecutable nex, bool includeDebug)
{
// Get the DOS stub from the executable, if possible
var stub = nex?.DOSStubHeader;
if (stub == null)
// Check we have a valid executable
if (nex == null)
return null;
// TODO: Don't read entire file

2
BurnOutSharp/ProtectionType/CDKey.cs
View File

@@ -1,6 +1,6 @@
using System;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

9
BurnOutSharp/ProtectionType/CDLock.cs
View File

@@ -1,8 +1,8 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -34,8 +34,9 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -51,7 +52,7 @@ namespace BurnOutSharp.ProtectionType
}, "CD-Lock"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

4
BurnOutSharp/ProtectionType/CDSHiELDSE.cs
View File

@@ -1,7 +1,7 @@
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -16,7 +16,7 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the code/CODE section, if it exists
var codeSectionRaw = pex.ReadRawSection("code", first: true) ?? pex.ReadRawSection("CODE", first: true);
var codeSectionRaw = pex.GetFirstSectionData("code") ?? pex.GetFirstSectionData("CODE");
if (codeSectionRaw != null)
{
var matchers = new List<ContentMatchSet>

11
BurnOutSharp/ProtectionType/CactusDataShield.cs
View File

@@ -4,9 +4,9 @@ using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -62,8 +62,9 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -74,13 +75,13 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x44, 0x41, 0x54, 0x41, 0x2E, 0x43, 0x44, 0x53 }, "Cactus Data Shield 200"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .rsrc section, if it exists
var rsrcSectionRaw = pex.ReadRawSection(".rsrc", first: false);
var rsrcSectionRaw = pex.GetLastSectionData(".rsrc");
if (rsrcSectionRaw != null)
{
var matchers = new List<ContentMatchSet>

2
BurnOutSharp/ProtectionType/CenegaProtectDVD.cs
View File

@@ -1,8 +1,8 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

6
BurnOutSharp/ProtectionType/ChosenBytesCode-Lock.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -59,7 +59,7 @@ namespace BurnOutSharp.ProtectionType
return $"ChosenBytes Code-Lock {pex.ProductVersion}";
// Get the .text section, if it exists
if (pex.TextSectionRaw != null)
if (pex.ContainsSection(".text"))
{
var matchers = new List<ContentMatchSet>
{
@@ -72,7 +72,7 @@ namespace BurnOutSharp.ProtectionType
}, "ChosenBytes Code-Lock"),
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".text"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

4
BurnOutSharp/ProtectionType/CopyLok.cs
View File

@@ -1,6 +1,6 @@
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -33,7 +33,7 @@ namespace BurnOutSharp.ProtectionType
// If there are more than 2 icd-prefixed sections, then we have a match
// Though this is the same name that SafeDisc uses for protected executables, this seems to be a coincidence.
// Found in Redump entries 31557, 31674, 31675, 31708, 38239, 44210, and 53929.
int icdSectionCount = pex.GetSectionNames().Count(s => s.StartsWith("icd"));
int icdSectionCount = pex.SectionNames.Count(s => s.StartsWith("icd"));
if (icdSectionCount >= 2)
return "CopyLok / CodeLok";

6
BurnOutSharp/ProtectionType/Cucko.cs
View File

@@ -1,7 +1,7 @@
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -20,7 +20,7 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the .text section, if it exists
if (pex.TextSectionRaw == null)
if (!pex.ContainsSection(".text"))
return null;
var matchers = new List<ContentMatchSet>
@@ -35,7 +35,7 @@ namespace BurnOutSharp.ProtectionType
}, "Cucko (EA Custom)")
};
return MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
return MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".text"), matchers, includeDebug);
}
}
}

337
BurnOutSharp/ProtectionType/Denuvo.cs
View File

@@ -1,11 +1,10 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -66,19 +65,20 @@ namespace BurnOutSharp.ProtectionType
// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Denuvo%20protector.2.sg
// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/_denuvoComplete.2.sg
// TODO: Re-enable all Entry Point checks after implementing
// Denuvo Protector
if (pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus && pex.EntryPointRaw != null)
{
byte?[] denuvoProtector = new byte?[]
{
0x48, 0x8D, 0x0D, null, null, null, null, null,
null, null, null, 0xE9, null, null, null, null,
0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
};
// if (pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus && pex.EntryPointRaw != null)
// {
// byte?[] denuvoProtector = new byte?[]
// {
// 0x48, 0x8D, 0x0D, null, null, null, null, null,
// null, null, null, 0xE9, null, null, null, null,
// 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
// };
if (pex.EntryPointRaw.StartsWith(denuvoProtector))
return "Denuvo Protector";
}
// if (pex.EntryPointRaw.StartsWith(denuvoProtector))
// return "Denuvo Protector";
// }
// Denuvo
var timingMatchers = new List<ContentMatchSet>
@@ -92,171 +92,172 @@ namespace BurnOutSharp.ProtectionType
}, "Denuvo")
};
if (pex.ContainsSection(".arch") || pex.ContainsSection(".srdata") || !string.IsNullOrWhiteSpace(MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, timingMatchers, includeDebug)))
{
if (pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus)
{
var matchers = new List<ContentMatchSet>
{
// Mad Max, Metal Gear Solid: TPP, Rise of the Tomb Raider
new ContentMatchSet(
new ContentMatch(
new byte?[]
{
0x51, 0x52, 0x41, 0x50, 0x41, 0x51, 0x4C, 0x8D,
null, null, null, null, null, 0x4C, 0x8D, null,
null, null, null, null, 0x4D, 0x29, 0xC1,
},
end: 0
),
"Denuvo v1.0 (x64)"),
// TODO: Re-enable all Entry Point checks after implementing
// if (pex.ContainsSection(".arch") || pex.ContainsSection(".srdata") || !string.IsNullOrWhiteSpace(MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, timingMatchers, includeDebug)))
// {
// if (pex.OH_Magic == OptionalHeaderType.PE32Plus)
// {
// var matchers = new List<ContentMatchSet>
// {
// // Mad Max, Metal Gear Solid: TPP, Rise of the Tomb Raider
// new ContentMatchSet(
// new ContentMatch(
// new byte?[]
// {
// 0x51, 0x52, 0x41, 0x50, 0x41, 0x51, 0x4C, 0x8D,
// null, null, null, null, null, 0x4C, 0x8D, null,
// null, null, null, null, 0x4D, 0x29, 0xC1,
// },
// end: 0
// ),
// "Denuvo v1.0 (x64)"),
// Lords of the Fallen, Batman: AK, Just Cause 3, Sherlock Holmes: TdD, Tales of Berseria etc
new ContentMatchSet(
new ContentMatch(
new byte?[]
{
0x48, 0x8D, 0x0D, null, null, null, null, 0xE9,
null, null, null, null,
},
end: 0
),
"Denuvo v2.0a (x64)"),
// // Lords of the Fallen, Batman: AK, Just Cause 3, Sherlock Holmes: TdD, Tales of Berseria etc
// new ContentMatchSet(
// new ContentMatch(
// new byte?[]
// {
// 0x48, 0x8D, 0x0D, null, null, null, null, 0xE9,
// null, null, null, null,
// },
// end: 0
// ),
// "Denuvo v2.0a (x64)"),
// Yesterday Origins
new ContentMatchSet(
new ContentMatch(
new byte?[]
{
0x48, 0x89, null, null, null, null, null, 0x48,
0x89, null, null, null, null, null, 0x4C, 0x89,
null, null, null, null, null, 0x4C, 0x89, null,
null, null, null, null, 0x48, 0x83, 0xFA, 0x01,
},
end: 0
),
"Denuvo v2.0b (x64)"),
// // Yesterday Origins
// new ContentMatchSet(
// new ContentMatch(
// new byte?[]
// {
// 0x48, 0x89, null, null, null, null, null, 0x48,
// 0x89, null, null, null, null, null, 0x4C, 0x89,
// null, null, null, null, null, 0x4C, 0x89, null,
// null, null, null, null, 0x48, 0x83, 0xFA, 0x01,
// },
// end: 0
// ),
// "Denuvo v2.0b (x64)"),
// Sniper Ghost Warrior 3 (beta), Dead Rising 4 (SteamStub-free)
new ContentMatchSet(
new ContentMatch(
new byte?[]
{
null, null, null, null, null, null, null, null,
0x4C, 0x89, 0x1C, 0x24, 0x49, 0x89, 0xE3,
},
end: 0
),
"Denuvo v3.0a (x64)"),
// // Sniper Ghost Warrior 3 (beta), Dead Rising 4 (SteamStub-free)
// new ContentMatchSet(
// new ContentMatch(
// new byte?[]
// {
// null, null, null, null, null, null, null, null,
// 0x4C, 0x89, 0x1C, 0x24, 0x49, 0x89, 0xE3,
// },
// end: 0
// ),
// "Denuvo v3.0a (x64)"),
// Train Sim World CSX Heavy Haul
new ContentMatchSet(
new ContentMatch(
new byte?[]
{
0x4D, 0x8D, null, null, null, null, null, null,
null, null, null, 0x48, 0x89, null, null, null,
null, null, 0x48, 0x8D, null, null, 0x48, 0x89,
null, 0x48, 0x89, null, 0x48, 0x89,
},
end: 0
),
"Denuvo v3.0b (x64)"),
};
// // Train Sim World CSX Heavy Haul
// new ContentMatchSet(
// new ContentMatch(
// new byte?[]
// {
// 0x4D, 0x8D, null, null, null, null, null, null,
// null, null, null, 0x48, 0x89, null, null, null,
// null, null, 0x48, 0x8D, null, null, 0x48, 0x89,
// null, 0x48, 0x89, null, 0x48, 0x89,
// },
// end: 0
// ),
// "Denuvo v3.0b (x64)"),
// };
string match = MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// string match = MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, matchers, includeDebug);
// if (!string.IsNullOrWhiteSpace(match))
// return match;
return "Denuvo (Unknown x64 Version)";
// return "Denuvo (Unknown x64 Version)";
//// Check if steam_api64.dll present
//if (PE.isLibraryPresent("steam_api64.dll"))
//{
// // Override additional info
// sOptions = "x64 -> Steam";
// bDetected = 1;
//}
//// Check if uplay_r1_loader64.dll present
//if (PE.isLibraryPresent("uplay_r1_loader64.dll"))
//{
// // Override additional info
// sOptions = "x64 -> uPlay";
// bDetected = 1;
//}
//// Check if uplay_r2_loader64.dll present
//if (PE.isLibraryPresent("uplay_r2_loader64.dll"))
//{
// // Override additional info
// sOptions = "x64 -> uPlay";
// bDetected = 1;
//}
//// Check if Core/Activation64.dll present
//if (PE.isLibraryPresent("Core/Activation64.dll"))
//{
// // Override additional info
// sOptions = "x64 -> Origin";
// bDetected = 1;
//}
}
else
{
var matchers = new List<ContentMatchSet>
{
// Pro Evolution Soccer 2017, Champions of Anteria
new ContentMatchSet(
new ContentMatch(
new byte?[]
{
0x55, 0x89, 0xE5, 0x8D, null, null, null, null,
null, null, 0xE8, null, null, null, null, 0xE8,
null, null, null, null, 0xE8, null, null, null,
null, 0xE8, null, null, null, null,
},
end: 0
),
"Denuvo v1.0 (x86)"),
// //// Check if steam_api64.dll present
// //if (PE.isLibraryPresent("steam_api64.dll"))
// //{
// // // Override additional info
// // sOptions = "x64 -> Steam";
// // bDetected = 1;
// //}
// //// Check if uplay_r1_loader64.dll present
// //if (PE.isLibraryPresent("uplay_r1_loader64.dll"))
// //{
// // // Override additional info
// // sOptions = "x64 -> uPlay";
// // bDetected = 1;
// //}
// //// Check if uplay_r2_loader64.dll present
// //if (PE.isLibraryPresent("uplay_r2_loader64.dll"))
// //{
// // // Override additional info
// // sOptions = "x64 -> uPlay";
// // bDetected = 1;
// //}
// //// Check if Core/Activation64.dll present
// //if (PE.isLibraryPresent("Core/Activation64.dll"))
// //{
// // // Override additional info
// // sOptions = "x64 -> Origin";
// // bDetected = 1;
// //}
// }
// else
// {
// var matchers = new List<ContentMatchSet>
// {
// // Pro Evolution Soccer 2017, Champions of Anteria
// new ContentMatchSet(
// new ContentMatch(
// new byte?[]
// {
// 0x55, 0x89, 0xE5, 0x8D, null, null, null, null,
// null, null, 0xE8, null, null, null, null, 0xE8,
// null, null, null, null, 0xE8, null, null, null,
// null, 0xE8, null, null, null, null,
// },
// end: 0
// ),
// "Denuvo v1.0 (x86)"),
// Romance of 13 Kingdoms, 2Dark
new ContentMatchSet(
new ContentMatch(
new byte?[]
{
0x8D, null, null, null, null, null, null, 0x89,
0x7C, 0x24, 0x04, 0x89, 0xE7,
},
end: 0
),
"Denuvo v2.0 (x86)"),
};
// // Romance of 13 Kingdoms, 2Dark
// new ContentMatchSet(
// new ContentMatch(
// new byte?[]
// {
// 0x8D, null, null, null, null, null, null, 0x89,
// 0x7C, 0x24, 0x04, 0x89, 0xE7,
// },
// end: 0
// ),
// "Denuvo v2.0 (x86)"),
// };
string match = MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// string match = MatchUtil.GetFirstMatch(file, pex.EntryPointRaw, matchers, includeDebug);
// if (!string.IsNullOrWhiteSpace(match))
// return match;
//// Check if steam_api64.dll present
//if (PE.isLibraryPresent("steam_api.dll"))
//{
// // Override additional info
// sOptions = "x86 -> Steam";
// bDetected = 1;
//}
//// Check if uplay_r1_loader.dll present
//if (PE.isLibraryPresent("uplay_r1_loader.dll"))
//{
// // Override additional info
// sOptions = "x86 -> uPlay";
// bDetected = 1;
//}
//// Check if Core/Activation.dll present
//if (PE.isLibraryPresent("Core/Activation.dll"))
//{
// // Override additional info
// sOptions = "x86 -> Origin";
// bDetected = 1;
//}
}
}
// //// Check if steam_api64.dll present
// //if (PE.isLibraryPresent("steam_api.dll"))
// //{
// // // Override additional info
// // sOptions = "x86 -> Steam";
// // bDetected = 1;
// //}
// //// Check if uplay_r1_loader.dll present
// //if (PE.isLibraryPresent("uplay_r1_loader.dll"))
// //{
// // // Override additional info
// // sOptions = "x86 -> uPlay";
// // bDetected = 1;
// //}
// //// Check if Core/Activation.dll present
// //if (PE.isLibraryPresent("Core/Activation.dll"))
// //{
// // // Override additional info
// // sOptions = "x86 -> Origin";
// // bDetected = 1;
// //}
// }
// }
return null;
}

9
BurnOutSharp/ProtectionType/DiscGuard.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -54,8 +54,7 @@ namespace BurnOutSharp.ProtectionType
return $"DiscGuard";
// Get the .vbn section, if it exists
var DiscGuardSection = pex.ReadRawSection(".vbn");
if (DiscGuardSection != null)
if (pex.ContainsSection(".vbn"))
{
var matchers = new List<ContentMatchSet>
{
@@ -106,13 +105,13 @@ namespace BurnOutSharp.ProtectionType
}, "DiscGuard"),
};
string match = MatchUtil.GetFirstMatch(file, DiscGuardSection, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".vbn"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .rsrc section, if it exists
var rsrcSection = pex.ReadRawSection(".rsrc");
var rsrcSection = pex.GetFirstSectionData(".rsrc");
if (rsrcSection != null)
{
var matchers = new List<ContentMatchSet>

2
BurnOutSharp/ProtectionType/EasyAntiCheat.cs
View File

@@ -1,8 +1,8 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

21
BurnOutSharp/ProtectionType/ElectronicArts.cs
View File

@@ -1,9 +1,10 @@
using System;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -29,12 +30,12 @@ namespace BurnOutSharp.ProtectionType
if (name?.Equals("CDCode", StringComparison.Ordinal) == true)
return $"EA CdKey Registration Module {Utilities.GetInternalVersion(pex)}";
var resource = pex.FindResource(dataContains: "A\0b\0o\0u\0t\0 \0C\0D\0K\0e\0y");
if (resource != null)
if (pex.FindDialogByTitle("About CDKey").Any())
return $"EA CdKey Registration Module {Utilities.GetInternalVersion(pex)}";
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -46,13 +47,13 @@ namespace BurnOutSharp.ProtectionType
}, Utilities.GetInternalVersion, "EA CdKey Registration Module"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -65,13 +66,13 @@ namespace BurnOutSharp.ProtectionType
}, "EA DRM Protection"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .text section, if it exists
if (pex.TextSectionRaw != null)
if (pex.ContainsSection(".text"))
{
var matchers = new List<ContentMatchSet>
{
@@ -84,7 +85,7 @@ namespace BurnOutSharp.ProtectionType
}, "EA DRM Protection"),
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".text"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

6
BurnOutSharp/ProtectionType/GFWL.cs
View File

@@ -1,10 +1,10 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -25,7 +25,7 @@ namespace BurnOutSharp.ProtectionType
return $"Games for Windows LIVE {Utilities.GetInternalVersion(pex)}";
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -33,7 +33,7 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x78, 0x6C, 0x69, 0x76, 0x65, 0x2E, 0x64, 0x6C, 0x6C }, "Games for Windows LIVE"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

2
BurnOutSharp/ProtectionType/HexaLock.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

10
BurnOutSharp/ProtectionType/ImpulseReactor.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -27,12 +27,12 @@ namespace BurnOutSharp.ProtectionType
if (name?.Contains("ImpulseReactor Dynamic Link Library") == true)
return $"Impulse Reactor Core Module {Utilities.GetInternalVersion(pex)}";
name = pex.OriginalFileName;
name = pex.OriginalFilename;
if (name?.Contains("ReactorActivate.exe") == true)
return $"Stardock Product Activation {Utilities.GetInternalVersion(pex)}";
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
// CVPInitializeClient
byte?[] check = new byte?[]
@@ -41,7 +41,7 @@ namespace BurnOutSharp.ProtectionType
0x61, 0x6C, 0x69, 0x7A, 0x65, 0x43, 0x6C, 0x69,
0x65, 0x6E, 0x74
};
bool containsCheck = pex.ResourceDataSectionRaw.FirstPosition(check, out int position);
bool containsCheck = pex.GetFirstSectionData(".rdata").FirstPosition(check, out int position);
// TODO: Find what resource this is in
// A + (char)0x00 + T + (char)0x00 + T + (char)0x00 + L + (char)0x00 + I + (char)0x00 + S + (char)0x00 + T + (char)0x00 + (char)0x00 + (char)0x00 + E + (char)0x00 + L + (char)0x00 + E + (char)0x00 + M + (char)0x00 + E + (char)0x00 + N + (char)0x00 + T + (char)0x00 + (char)0x00 + (char)0x00 + N + (char)0x00 + O + (char)0x00 + T + (char)0x00 + A + (char)0x00 + T + (char)0x00 + I + (char)0x00 + O + (char)0x00 + N + (char)0x00
@@ -54,7 +54,7 @@ namespace BurnOutSharp.ProtectionType
0x4E, 0x00, 0x4F, 0x00, 0x54, 0x00, 0x41, 0x00,
0x54, 0x00, 0x49, 0x00, 0x4F, 0x00, 0x4E
};
bool containsCheck2 = pex.ResourceDataSectionRaw.FirstPosition(check2, out int position2);
bool containsCheck2 = pex.GetFirstSectionData(".rdata").FirstPosition(check2, out int position2);
if (containsCheck && containsCheck2)
return $"Impulse Reactor Core Module {Utilities.GetInternalVersion(pex)}" + (includeDebug ? $" (Index {position}, {position2})" : string.Empty);

7
BurnOutSharp/ProtectionType/Intenium.cs
View File

@@ -1,5 +1,6 @@
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -29,8 +30,8 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
var fileNameResource = pex.FindResource(dataContains: $"NO NESTED PRMS SUPPORTED");
if (fileNameResource != null)
var fileNameResource = pex.FindGenericResource("NO NESTED PRMS SUPPORTED");
if (fileNameResource.Any())
return "INTENIUM Trial & Buy Protection";
return null;

7
BurnOutSharp/ProtectionType/JoWood.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -25,8 +25,7 @@ namespace BurnOutSharp.ProtectionType
if (extSection)
{
// Get the .dcrtext section, if it exists
var dcrtextSectionRaw = pex.ReadRawSection(".dcrtext");
if (dcrtextSectionRaw != null)
if (pex.ContainsSection(".dcrtext"))
{
var matchers = new List<ContentMatchSet>
{
@@ -40,7 +39,7 @@ namespace BurnOutSharp.ProtectionType
}, GetVersion, "JoWood X-Prot"),
};
string match = MatchUtil.GetFirstMatch(file, dcrtextSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".dcrtext"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

9
BurnOutSharp/ProtectionType/LabelGate.cs
View File

@@ -2,9 +2,9 @@ using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -34,8 +34,9 @@ namespace BurnOutSharp.ProtectionType
if (name?.StartsWith("MQSTART", StringComparison.OrdinalIgnoreCase) == true)
return $"LabelGate CD2 Media Player";
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -44,7 +45,7 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x4C, 0x47, 0x43, 0x44, 0x32, 0x5F, 0x4C, 0x41, 0x55, 0x4E, 0x43, 0x48 }, "LabelGate CD2"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

16
BurnOutSharp/ProtectionType/LaserLok.cs
View File

@@ -3,10 +3,10 @@ using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -64,15 +64,15 @@ namespace BurnOutSharp.ProtectionType
0x6C, 0x61, 0x6D, 0x65, 0x6E, 0x74, 0x61, 0x73,
0x2E, 0x50, 0x45
};
int endDosStub = pex.DOSStubHeader.NewExeHeaderAddr;
bool containsCheck = pex.DOSStubHeader.ExecutableData.FirstPosition(check, out int position);
int endDosStub = (int)pex.Stub_NewExeHeaderAddr;
bool containsCheck = pex.StubExecutableData.FirstPosition(check, out int position);
// If the .text section doesn't exist, then the second check can't be found
bool containsCheck2 = false;
int position2 = -1;
// Get the .text section, if it exists
if (pex.TextSectionRaw != null)
if (pex.ContainsSection(".text"))
{
// GetModuleHandleA + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + GetProcAddress + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + LoadLibraryA + (char)0x00 + (char)0x00 + KERNEL32.dll + (char)0x00 + ëy + (char)0x01 + SNIF/MPVI
byte?[] check2 = new byte?[]
@@ -87,15 +87,15 @@ namespace BurnOutSharp.ProtectionType
0x45, 0x4C, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C,
0x00, 0xEB, 0x79, 0x01, null, null, null, null,
};
containsCheck2 = pex.TextSectionRaw.FirstPosition(check2, out position2);
containsCheck2 = pex.GetFirstSectionData(".text").FirstPosition(check2, out position2);
}
if (containsCheck && containsCheck2)
return $"LaserLok {GetVersion(pex.TextSectionRaw, position2)} {GetBuild(pex.TextSectionRaw, true)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position}, {position2})" : string.Empty);
return $"LaserLok {GetVersion(pex.GetFirstSectionData(".text"), position2)} {GetBuild(pex.GetFirstSectionData(".text"), true)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position}, {position2})" : string.Empty);
else if (containsCheck && !containsCheck2)
return $"LaserLok Marathon {GetBuild(pex.TextSectionRaw, false)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position})" : string.Empty);
return $"LaserLok Marathon {GetBuild(pex.GetFirstSectionData(".text"), false)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position})" : string.Empty);
else if (!containsCheck && containsCheck2)
return $"LaserLok {GetVersion(pex.TextSectionRaw, --position2)} {GetBuild(pex.TextSectionRaw, false)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position2})" : string.Empty);
return $"LaserLok {GetVersion(pex.GetFirstSectionData(".text"), --position2)} {GetBuild(pex.GetFirstSectionData(".text"), false)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position2})" : string.Empty);
return null;
}

18
BurnOutSharp/ProtectionType/Macrovision.CDilla.cs
View File

@@ -1,12 +1,8 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.NE;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -38,9 +34,8 @@ namespace BurnOutSharp.ProtectionType
/// <inheritdoc/>
public string CDillaCheckNewExecutable(string file, NewExecutable nex, bool includeDebug)
{
// Get the DOS stub from the executable, if possible
var stub = nex?.DOSStubHeader;
if (stub == null)
// Check we have a valid executable
if (nex == null)
return null;
// TODO: Implement NE checks for "CDILLA05", "CDILLA10", "CDILLA16", and "CDILLA40".
@@ -73,8 +68,9 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -86,7 +82,7 @@ namespace BurnOutSharp.ProtectionType
0x5C, 0x52, 0x54, 0x53 }, "C-Dilla License Management System"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

2
BurnOutSharp/ProtectionType/Macrovision.CactusDataShield.cs
View File

@@ -2,10 +2,10 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

8
BurnOutSharp/ProtectionType/Macrovision.FLEXnet.cs
View File

@@ -1,11 +1,5 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

18
BurnOutSharp/ProtectionType/Macrovision.SafeCast.cs
View File

@@ -1,12 +1,8 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.NE;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -37,9 +33,8 @@ namespace BurnOutSharp.ProtectionType
/// <inheritdoc/>
public string SafeCastCheckNewExecutable(string file, NewExecutable nex, bool includeDebug)
{
// Get the DOS stub from the executable, if possible
var stub = nex?.DOSStubHeader;
if (stub == null)
// Check we have a valid executable
if (nex == null)
return null;
// TODO: Implement the following NE checks:
@@ -59,8 +54,9 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -73,7 +69,7 @@ namespace BurnOutSharp.ProtectionType
0x74 }, "SafeCast"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

3
BurnOutSharp/ProtectionType/Macrovision.SafeDisc.cs
View File

@@ -2,10 +2,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

13
BurnOutSharp/ProtectionType/Macrovision.cs
View File

@@ -1,14 +1,10 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.NE;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using static System.Net.WebRequestMethods;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -20,9 +16,8 @@ namespace BurnOutSharp.ProtectionType
/// <inheritdoc/>
public string CheckNewExecutable(string file, NewExecutable nex, bool includeDebug)
{
// Get the DOS stub from the executable, if possible
var stub = nex?.DOSStubHeader;
if (stub == null)
// Check we have a valid executable
if (nex == null)
return null;
List<string> resultsList = new List<string>();
@@ -195,7 +190,7 @@ namespace BurnOutSharp.ProtectionType
return $"SafeDisc SRV Tool APP {GetSafeDiscDiagExecutableVersion(pex)}";
// This subtract is needed because BoG_ starts before the section
var sectionRaw = pex.ReadRawSection(sectionName, first: true, offset: -64);
var sectionRaw = pex.GetFirstSectionDataWithOffset(sectionName, offset: -64);
if (sectionRaw != null)
{
// TODO: Add more checks to help differentiate between SafeDisc and SafeCast.

2
BurnOutSharp/ProtectionType/MediaCloQ.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

22
BurnOutSharp/ProtectionType/MediaMaxCD3.cs
View File

@@ -1,9 +1,10 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -32,12 +33,17 @@ namespace BurnOutSharp.ProtectionType
if (name?.StartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase) == true)
return $"MediaMax CD-3";
var resource = pex.FindResource(dataContains: "Cd3Ctl");
if (resource != null)
var cd3CtrlResources = pex.FindGenericResource("Cd3Ctl");
if (cd3CtrlResources.Any())
return $"MediaMax CD-3";
var limitedProductionResources = pex.FindDialogBoxByItemTitle("This limited production advanced CD is not playable on your computer. It is solely intended for playback on standard CD players.");
if (limitedProductionResources.Any())
return $"MediaMax CD-3";
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -49,13 +55,13 @@ namespace BurnOutSharp.ProtectionType
}, "MediaMax CD-3"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -67,7 +73,7 @@ namespace BurnOutSharp.ProtectionType
}, "MediaMax CD-3"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

2
BurnOutSharp/ProtectionType/OnlineRegistration.cs
View File

@@ -1,7 +1,7 @@
using System;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

2
BurnOutSharp/ProtectionType/OpenMG.cs
View File

@@ -2,9 +2,9 @@ using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

2
BurnOutSharp/ProtectionType/Origin.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

2
BurnOutSharp/ProtectionType/PlayJ.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

46
BurnOutSharp/ProtectionType/ProtectDisc.cs
View File

@@ -1,9 +1,10 @@
using System;
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Text;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -18,12 +19,11 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the 4th section, if it exists (example names: ACE4) (Found in Redump entry 94793)
var fourthSection = sections.Length < 4 ? null : sections[3];
if (fourthSection != null)
// Get the 4th and 5th sections, if they exist (example names: ACE4/ACE5) (Found in Redump entries 94792, 94793)
for (int i = 3; i < sections.Length; i++)
{
var fourthSectionData = pex.ReadRawSection(fourthSection.NameString, first: true);
if (fourthSectionData != null)
var nthSectionData = pex.GetSectionData(i);
if (nthSectionData != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -31,33 +31,15 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x41, 0x43, 0x45, 0x2D, 0x50, 0x43, 0x44 }, GetVersion6till8, "ProtectDISC"),
};
string match = MatchUtil.GetFirstMatch(file, fourthSectionData, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, nthSectionData, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
}
// Get the 5th section, if it exists (example names: ACE5) (Found in Redump entry 94792)
var fifthSection = sections.Length < 5 ? null : sections[4];
if (fifthSection != null)
{
var fifthSectionData = pex.ReadRawSection(fifthSection.NameString, first: true);
if (fifthSectionData != null)
{
var matchers = new List<ContentMatchSet>
{
// ACE-PCD
new ContentMatchSet(new byte?[] { 0x41, 0x43, 0x45, 0x2D, 0x50, 0x43, 0x44 }, GetVersion6till8, "ProtectDISC"),
};
string match = MatchUtil.GetFirstMatch(file, fifthSectionData, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
}
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -65,7 +47,7 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x44, 0x43, 0x50, 0x2D, 0x42, 0x4F, 0x56, 0x00, 0x00 }, GetVersion3till6, "VOB ProtectCD/DVD"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
@@ -74,7 +56,7 @@ namespace BurnOutSharp.ProtectionType
var secondToLastSection = sections.Length > 1 ? sections[sections.Length - 2] : null;
if (secondToLastSection != null)
{
var secondToLastSectionData = pex.ReadRawSection(secondToLastSection.NameString, first: true);
var secondToLastSectionData = pex.GetSectionData(sections.Length - 2);
if (secondToLastSectionData != null)
{
var matchers = new List<ContentMatchSet>
@@ -96,11 +78,13 @@ namespace BurnOutSharp.ProtectionType
}
}
// TODO: Be better about finding the last section
// Get the last section (example names: ACE5, akxpxgcv, and piofinqb)
var lastSection = sections.LastOrDefault();
if (lastSection != null)
{
var lastSectionData = pex.ReadRawSection(lastSection.NameString, first: true);
string lastSectionName = Encoding.UTF8.GetString(lastSection.Name).TrimEnd('\0');
var lastSectionData = pex.GetFirstSectionData(lastSectionName);
if (lastSectionData != null)
{
var matchers = new List<ContentMatchSet>

13
BurnOutSharp/ProtectionType/RainbowSentinel.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -30,8 +30,9 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -45,13 +46,13 @@ namespace BurnOutSharp.ProtectionType
}, "Rainbow Sentinel SuperPro"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .text section, if it exists
if (pex.TextSectionRaw != null)
if (pex.ContainsSection(".text"))
{
var matchers = new List<ContentMatchSet>
{
@@ -74,7 +75,7 @@ namespace BurnOutSharp.ProtectionType
}, "Rainbow Sentinel SuperPro"),
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".text"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

8
BurnOutSharp/ProtectionType/SVKP.cs
View File

@@ -1,5 +1,5 @@
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -14,11 +14,11 @@ namespace BurnOutSharp.ProtectionType
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the image file header from the executable, if possible
if (pex?.ImageFileHeader == null)
if (pex == null)
return null;
// 0x504B5653 is "SVKP"
if (pex.ImageFileHeader.PointerToSymbolTable == 0x504B5653)
if (pex.PointerToSymbolTable == 0x504B5653)
return "SVKP (Slovak Protector)";
return null;

27
BurnOutSharp/ProtectionType/SecuROM.cs
View File

@@ -2,10 +2,10 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Text;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -44,7 +44,7 @@ namespace BurnOutSharp.ProtectionType
return $"SecuROM SLL Protected (for SecuROM v8.x)";
// Search after the last section
if (pex.OverlayRaw != null)
if (pex.Overlay != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -52,7 +52,7 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x41, 0x64, 0x64, 0x44, 0x03, 0x00, 0x00, 0x00 }, GetV4Version, "SecuROM"),
};
string match = MatchUtil.GetFirstMatch(file, pex.OverlayRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.Overlay, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
@@ -61,10 +61,10 @@ namespace BurnOutSharp.ProtectionType
for (int i = 4; i < sections.Length; i++)
{
var nthSection = sections[i];
string nthSectionName = nthSection.NameString;
string nthSectionName = Encoding.UTF8.GetString(nthSection.Name).TrimEnd('\0');
if (nthSection != null && nthSectionName != ".idata" && nthSectionName != ".rsrc")
{
var nthSectionData = pex.ReadRawSection(nthSectionName, first: true);
var nthSectionData = pex.GetFirstSectionData(nthSectionName);
if (nthSectionData != null)
{
var matchers = new List<ContentMatchSet>
@@ -81,7 +81,7 @@ namespace BurnOutSharp.ProtectionType
}
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -112,7 +112,7 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x53, 0x65, 0x63, 0x75, 0x45, 0x78, 0x70 }, "WHITELABEL"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
{
if (match.StartsWith("WHITELABEL"))
@@ -240,7 +240,7 @@ namespace BurnOutSharp.ProtectionType
private static string GetV7Version(PortableExecutable pex)
{
int index = 172; // 64 bytes for DOS stub, 236 bytes in total
byte[] bytes = new ReadOnlySpan<byte>(pex.DOSStubHeader.ExecutableData, index, 4).ToArray();
byte[] bytes = new ReadOnlySpan<byte>(pex.StubExecutableData, index, 4).ToArray();
//SecuROM 7 new and 8
if (bytes[3] == 0x5C) // if (bytes[0] == 0xED && bytes[3] == 0x5C {
@@ -252,15 +252,16 @@ namespace BurnOutSharp.ProtectionType
else
{
index = 58; // 64 bytes for DOS stub, 122 bytes in total
bytes = new ReadOnlySpan<byte>(pex.DOSStubHeader.ExecutableData, index, 2).ToArray();
bytes = new ReadOnlySpan<byte>(pex.StubExecutableData, index, 2).ToArray();
return $"7.{bytes[0] ^ 0x10:00}.{bytes[1] ^ 0x10:0000}"; //return "7.01-7.10"
}
}
private static string GetV8WhiteLabelVersion(PortableExecutable pex)
{
// If we don't have a data section, we default to generic
if (pex.DataSectionRaw == null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
return "8";
// Search .data for the version indicator
@@ -274,13 +275,13 @@ namespace BurnOutSharp.ProtectionType
0x82, 0xD8, 0x0C, 0xAC
});
(bool success, int position) = matcher.Match(pex.DataSectionRaw);
(bool success, int position) = matcher.Match(dataSectionRaw);
// If we can't find the string, we default to generic
if (!success)
return "8";
byte[] bytes = new ReadOnlySpan<byte>(pex.DataSectionRaw, position + 0xAC, 3).ToArray();
byte[] bytes = new ReadOnlySpan<byte>(dataSectionRaw, position + 0xAC, 3).ToArray();
return $"{bytes[0] ^ 0xCA}.{bytes[1] ^ 0x39:00}.{bytes[2] ^ 0x51:0000}";
}
}

13
BurnOutSharp/ProtectionType/SmartE.cs
View File

@@ -1,10 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.ExecutableType.Microsoft.PE.Headers;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -19,22 +18,22 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the .edata section, if it exists
string match = GetMatchForSection(file, pex.ExportDataSectionRaw, includeDebug);
string match = GetMatchForSection(file, pex.GetFirstSectionData(".edata"), includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Get the .idata section, if it exists
match = GetMatchForSection(file, pex.ImportDataSectionRaw, includeDebug);
match = GetMatchForSection(file, pex.GetFirstSectionData(".idata"), includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Get the .rdata section, if it exists
match = GetMatchForSection(file, pex.ResourceDataSectionRaw, includeDebug);
match = GetMatchForSection(file, pex.GetFirstSectionData(".rdata"), includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
// Get the .tls section, if it exists
var tlsSectionRaw = pex.ReadRawSection(".tls", first: false);
var tlsSectionRaw = pex.GetLastSectionData(".tls");
match = GetMatchForSection(file, tlsSectionRaw, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
@@ -72,7 +71,7 @@ namespace BurnOutSharp.ProtectionType
/// <summary>
/// Check a section for the SmartE string(s)
/// </summary>
private string GetMatchForSection(SectionHeader section, string file, byte[] sectionContent, bool includeDebug)
private string GetMatchForSection(Models.PortableExecutable.SectionHeader section, string file, byte[] sectionContent, bool includeDebug)
{
if (section == null)
return null;

15
BurnOutSharp/ProtectionType/SolidShield.cs
View File

@@ -3,10 +3,10 @@ using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -53,8 +53,7 @@ namespace BurnOutSharp.ProtectionType
return $"SolidShield {GetInternalVersion(pex)}";
// Get the .init section, if it exists
var initSectionRaw = pex.ReadRawSection(".init", first: true);
if (initSectionRaw != null)
if (pex.ContainsSection(".init"))
{
var matchers = new List<ContentMatchSet>
{
@@ -68,21 +67,21 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x64, 0x76, 0x6D, 0x2E, 0x64, 0x6C, 0x6C }, "SolidShield EXE Wrapper v1"),
};
string match = MatchUtil.GetFirstMatch(file, initSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".init"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the wrapper resource, if it exists
var resource = pex.FindResource(dataContains: "B\0I\0N\0" + (char)0x07 + "\0I\0D\0R\0_\0S\0G\0T\0");
if (resource != null)
var wrapperResources = pex.FindResourceByNamedType("BIN, IDR_SGT");
if (wrapperResources.Any())
return "SolidShield EXE Wrapper v1";
// Search the last two available sections
var sectionNames = pex.GetSectionNames();
var sectionNames = pex.SectionNames;
for (int i = (sectionNames.Length >= 2 ? sectionNames.Length - 2 : 0); i < sectionNames.Length; i++)
{
var nthSectionRaw = pex.ReadRawSection(sectionNames[i], first: false);
var nthSectionRaw = pex.GetLastSectionData(sectionNames[i]);
if (nthSectionRaw != null)
{
var matchers = new List<ContentMatchSet>

4
BurnOutSharp/ProtectionType/StarForce.cs
View File

@@ -1,10 +1,10 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -41,7 +41,7 @@ namespace BurnOutSharp.ProtectionType
var rsrcSection = pex.GetLastSection(".rsrc", exact: true);
if (rsrcSection != null)
{
var rsrcSectionData = pex.ReadRawSection(".rsrc", first: true);
var rsrcSectionData = pex.GetLastSectionData(".rsrc");
if (rsrcSectionData != null)
{
var matchers = new List<ContentMatchSet>

2
BurnOutSharp/ProtectionType/Steam.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

9
BurnOutSharp/ProtectionType/Sysiphus.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -17,8 +17,9 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -30,7 +31,7 @@ namespace BurnOutSharp.ProtectionType
}, GetVersion, "Sysiphus"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

9
BurnOutSharp/ProtectionType/Tages.cs
View File

@@ -2,10 +2,10 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Tools;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -44,8 +44,9 @@ namespace BurnOutSharp.ProtectionType
// TODO: Add entry point check
// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Tages.2.sg
// Get the .data section, if it exists
if (pex.DataSectionRaw != null)
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -53,7 +54,7 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0xE8, 0x75, 0x00, 0x00, 0x00, 0xE8, null, null, 0xFF, 0xFF, 0x68 }, GetVersion, "TAGES"),
};
string match = MatchUtil.GetFirstMatch(file, pex.DataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, dataSectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

9
BurnOutSharp/ProtectionType/Themida.cs
View File

@@ -1,7 +1,7 @@
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Collections.Generic;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using System.Collections.Generic;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -35,8 +35,7 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the "Arcsoft " section, if it exists
var initSectionRaw = pex.ReadRawSection("Arcsoft ", first: true);
if (initSectionRaw != null)
if (pex.ContainsSection("Arcsoft "))
{
var matchers = new List<ContentMatchSet>
{
@@ -46,7 +45,7 @@ namespace BurnOutSharp.ProtectionType
new ContentMatchSet(new byte?[] { 0x54, 0x68, 0x65, 0x6D, 0x69, 0x64, 0x61 }, "Themida"),
};
string match = MatchUtil.GetFirstMatch(file, initSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData("Arcsoft "), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

4
BurnOutSharp/ProtectionType/ThreePLock.cs
View File

@@ -1,5 +1,5 @@
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

9
BurnOutSharp/ProtectionType/ThreeTwoOneStudios.cs
View File

@@ -1,5 +1,6 @@
using BurnOutSharp.ExecutableType.Microsoft.PE;
using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -13,8 +14,10 @@ namespace BurnOutSharp.ProtectionType
if (sections == null)
return null;
var resource = pex.FindResource(dataContains: "3\02\01\0S\0t\0u\0d\0i\0o\0s\0 \0A\0c\0t\0i\0v\0a\0t\0i\0o\0n\0");
if (resource != null)
// Check the dialog box resources
if (pex.FindDialogByTitle("321Studios Activation").Any())
return $"321Studios Online Activation";
else if (pex.FindDialogByTitle("321Studios Phone Activation").Any())
return $"321Studios Online Activation";
return null;

2
BurnOutSharp/ProtectionType/Uplay.cs
View File

@@ -1,8 +1,8 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{

6
BurnOutSharp/ProtectionType/WMDS.cs
View File

@@ -1,9 +1,9 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -28,7 +28,7 @@ namespace BurnOutSharp.ProtectionType
return $"Windows Media Data Session DRM";
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -47,7 +47,7 @@ namespace BurnOutSharp.ProtectionType
}, "Windows Media Data Session DRM"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

11
BurnOutSharp/ProtectionType/WTMCDProtect.cs
View File

@@ -1,9 +1,9 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -26,8 +26,7 @@ namespace BurnOutSharp.ProtectionType
return "WTM Protection Viewer";
// Get the CODE section, if it exists
var codeSectionRaw = pex.ReadRawSection("CODE", first: true);
if (codeSectionRaw != null)
if (pex.ContainsSection("CODE"))
{
var matchers = new List<ContentMatchSet>
{
@@ -39,13 +38,13 @@ namespace BurnOutSharp.ProtectionType
}, "WTM CD Protect"),
};
string match = MatchUtil.GetFirstMatch(file, codeSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData("CODE"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
// Get the .text section, if it exists
if (pex.TextSectionRaw != null)
if (pex.ContainsSection(".text"))
{
var matchers = new List<ContentMatchSet>
{
@@ -68,7 +67,7 @@ namespace BurnOutSharp.ProtectionType
}, "WTM Protection Viewer"),
};
string match = MatchUtil.GetFirstMatch(file, pex.TextSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".text"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

6
BurnOutSharp/ProtectionType/XCP.cs
View File

@@ -3,10 +3,10 @@ using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.FileType;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
@@ -22,7 +22,7 @@ namespace BurnOutSharp.ProtectionType
return null;
// Get the .rdata section, if it exists
if (pex.ResourceDataSectionRaw != null)
if (pex.ContainsSection(".rdata"))
{
var matchers = new List<ContentMatchSet>
{
@@ -47,7 +47,7 @@ namespace BurnOutSharp.ProtectionType
}, "XCP"),
};
string match = MatchUtil.GetFirstMatch(file, pex.ResourceDataSectionRaw, matchers, includeDebug);
string match = MatchUtil.GetFirstMatch(file, pex.GetFirstSectionData(".rdata"), matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}

19
BurnOutSharp/Tools/Utilities.cs
View File

@@ -5,7 +5,7 @@ using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Security.Cryptography;
using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.Tools
{
@@ -179,19 +179,6 @@ namespace BurnOutSharp.Tools
#region Processed Executable Information
/// <summary>
/// Get the internal version as reported by the resources
/// </summary>
/// <param name="fileContent">Byte array representing the file contents</param>
/// <returns>Version string, null on error</returns>
public static string GetInternalVersion(byte[] fileContent)
{
if (fileContent == null || !fileContent.Any())
return null;
return GetInternalVersion(new PortableExecutable(fileContent, 0));
}
/// <summary>
/// Get the internal version as reported by the resources
/// </summary>
@@ -207,7 +194,7 @@ namespace BurnOutSharp.Tools
if (!string.IsNullOrWhiteSpace(version))
return version;
version = pex.ManifestVersion;
version = pex.AssemblyVersion;
if (!string.IsNullOrWhiteSpace(version))
return version;
@@ -306,7 +293,7 @@ namespace BurnOutSharp.Tools
/// <param name="fileContent">Byte array representing the file contents</param>
/// <param name="positions">Last matched positions in the contents</param>
/// <returns>Version string, null on error</returns>
public static string GetInternalVersion(string file, byte[] fileContent, List<int> positions) => GetInternalVersion(fileContent);
public static string GetInternalVersion(string file, byte[] fileContent, List<int> positions) => GetInternalVersion(file);
/// <summary>
/// Wrapper for GetInternalVersion for use in path matching