47 Commits

Author	SHA1	Message	Date
Matt Nadareski	9d7cc4012c	Move interfaces to own namespace	2022-05-01 17:41:50 -07:00
Matt Nadareski	f9f2e0d932	Better naming	2022-05-01 17:17:15 -07:00
Matt Nadareski	b933249ff7	Add resource finding on creation	2022-04-02 16:12:23 -07:00
Matt Nadareski	61c09e3c97	Move resource helpers to PortableExecutable	2022-04-02 15:54:51 -07:00
Matt Nadareski	4b66cd8cd2	Update file version resource handling	2022-04-01 10:16:31 -07:00
Matt Nadareski	ceae505f4d	Switch order of interface parameters	2022-03-14 22:51:17 -07:00
Matt Nadareski	a7e9164f4f	Use SourceArray for PE checks	2022-03-14 22:49:35 -07:00
Matt Nadareski	513e799aa3	Migrate protections to new interfaces	2022-03-14 11:20:11 -07:00
Matt Nadareski	ffb529edb3	Granularly separate out executable types	2022-03-14 10:40:44 -07:00
Matt Nadareski	8c39adcc04	Simplify EA checks, add note to Registration	2021-09-11 23:03:56 -07:00
Matt Nadareski	214e8d41c7	Pre-read 3 most commonly-used section data ... This also adds comprehensive notes around the sections used in various protections, how they're used, and what we can do with them. It also adds a couple of various notes based on the findings from the protection audit	2021-09-11 16:47:25 -07:00
Matt Nadareski	f2b9e3a31b	Clean up a significant number of TODOs	2021-09-11 00:32:48 -07:00
Matt Nadareski	7c27fcd8a4	Identify and use .rsrc item for EA	2021-09-10 21:52:31 -07:00
Matt Nadareski	b779f2f546	Only deserialze a file once per round of checks	2021-09-10 16:10:15 -07:00
Matt Nadareski	5344de96b2	Cleanup and bugfixes; additional notes	2021-09-10 15:32:37 -07:00
Matt Nadareski	373268a6a8	Convert resource checks to header checks	2021-09-10 13:51:32 -07:00
Matt Nadareski	905d440367	Process file info resources; cleanup; refactors	2021-09-10 02:58:59 -07:00
Matt Nadareski	ed698e05d8	Partially convert EA to section based; add notes	2021-08-30 15:08:14 -07:00
Matt Nadareski	6cde7b8bef	Reduce redundant code in content matchers now	2021-08-25 20:26:43 -07:00
Matt Nadareski	3ab0bcc0ae	ContentMatchSets are now expected in IContentCheck	2021-08-25 19:37:32 -07:00
Matt Nadareski	7548646ba2	Create and use the Tools namespace	2021-08-25 15:09:42 -07:00
Matt Nadareski	43845cf722	Rename position flag -> debug flag	2021-08-24 15:19:23 -07:00
Matt Nadareski	3ac57b1c0c	Fix static matcher issues (fixes #51) ... Note: This may result in slower, but more accurate, scans	2021-07-17 23:40:16 -07:00
Matt Nadareski	e9c1a170ad	Move generic CD key to own file	2021-03-31 19:07:00 -07:00
SilasLaspada	9ce84c75dd	Comment out an overmatching definition (#34)	2021-03-31 18:58:34 -07:00
Matt Nadareski	9f40a8c4c0	Perform some post-removal cleanup	2021-03-23 16:43:23 -07:00
Matt Nadareski	921292e077	Static list of content matchers ... This also includes some more path matcher conversions that I couldn't reasonably split out	2021-03-23 09:52:09 -07:00
Matt Nadareski	5240f2eb70	Simplify util method naming	2021-03-22 21:32:58 -07:00
Matt Nadareski	6400c954ef	Split matchers more cleanly, comment better	2021-03-22 21:25:14 -07:00
Matt Nadareski	7aca58a6c9	Better split matching code, fix UPX name	2021-03-22 00:41:18 -07:00
Matt Nadareski	15ae2441c3	Use content matching helper, part 5	2021-03-21 22:37:16 -07:00
Matt Nadareski	cf9bd99f3d	Use content matching helper, part 4	2021-03-21 22:19:38 -07:00
Matt Nadareski	544aaed9da	Modify array finding, part 2	2021-03-20 20:47:56 -07:00
Matt Nadareski	cdc4d509ee	Modify array finding, part 1	2021-03-20 19:00:22 -07:00
Matt Nadareski	0e7d98158e	Split out generic online registration	2021-03-20 13:29:46 -07:00
Matt Nadareski	56d8518ee4	Comment out over-matching EA check	2021-03-19 17:31:53 -07:00
Matt Nadareski	2867ce2e9a	Add more EA CDKey checks (fixes #21)	2021-03-02 13:48:10 -08:00
Matt Nadareski	7cfa9649e4	Add IContentCheck interface	2021-02-26 01:26:49 -08:00
Matt Nadareski	9ebbeaed0f	Make EA CDKey checks more robust	2021-02-23 13:16:25 -08:00
Matt Nadareski	aebc139d52	I lied, keep it separate	2021-02-20 22:13:48 -08:00
Matt Nadareski	0e82eea891	Origin is an EA protection	2021-02-20 22:06:18 -08:00
Matt Nadareski	7ec76acf2f	Remove Cucko until more investigation	2021-02-20 13:16:52 -08:00
Matt Nadareski	21f17791ff	No... that's not right	2021-02-19 21:26:49 -08:00
Matt Nadareski	fff5f2610a	Add Cucko notes	2021-02-19 10:14:02 -08:00
Matt Nadareski	a7b5288277	One more EA CDKey detection	2020-10-28 21:03:45 -07:00
Matt Nadareski	c18e9b3538	Combine EA protection checks, add/fix reg checks	2020-10-28 11:13:26 -07:00
Matt Nadareski	513a64df4c	Rename Cucko and cleanup misc	2020-10-28 10:42:54 -07:00