Add Cucko notes

This commit is contained in:
Matt Nadareski
2021-02-19 10:14:02 -08:00
parent d574fb5e44
commit fff5f2610a

View File

@@ -3,6 +3,11 @@
public class ElectronicArts
{
// TODO: Verify this doesn't over-match
// TODO: Do more research into the Cucko protection:
// - Current usage looks for "EASTL" which just stands for "EA Standard Library"
// - There's little information outside of PiD detection that actually knows about Cucko
// - Are all programs made with the EASTL considered protected by Cucko?
// - Leads: EASTL structures (like `fixed_list`), `allocator.h`, `EASTLLocalAllocatorModule`, EA registry entries
public static string CheckContents(string file, byte[] fileContent, bool includePosition = false)
{
// EASTL