43 Commits

Author	SHA1	Message	Date
Matt Nadareski	9d7cc4012c	Move interfaces to own namespace	2022-05-01 17:41:50 -07:00
Matt Nadareski	a44bdf9013	Reorder inherited interfaces	2022-05-01 17:23:00 -07:00
Matt Nadareski	f9f2e0d932	Better naming	2022-05-01 17:17:15 -07:00
Matt Nadareski	ceae505f4d	Switch order of interface parameters	2022-03-14 22:51:17 -07:00
Matt Nadareski	a7e9164f4f	Use SourceArray for PE checks	2022-03-14 22:49:35 -07:00
Matt Nadareski	513e799aa3	Migrate protections to new interfaces	2022-03-14 11:20:11 -07:00
Matt Nadareski	ffb529edb3	Granularly separate out executable types	2022-03-14 10:40:44 -07:00
Matt Nadareski	c915f29c05	Minor formatting changes	2021-09-14 13:53:30 -07:00
Matt Nadareski	38d35d1991	Convert remaining XCP full content check	2021-09-14 11:51:01 -07:00
Matt Nadareski	dbc841cb7f	Clean up formatting of remaining full content checks	2021-09-14 11:33:53 -07:00
Matt Nadareski	214e8d41c7	Pre-read 3 most commonly-used section data ... This also adds comprehensive notes around the sections used in various protections, how they're used, and what we can do with them. It also adds a couple of various notes based on the findings from the protection audit	2021-09-11 16:47:25 -07:00
Matt Nadareski	b779f2f546	Only deserialze a file once per round of checks	2021-09-10 16:10:15 -07:00
Matt Nadareski	5344de96b2	Cleanup and bugfixes; additional notes	2021-09-10 15:32:37 -07:00
Matt Nadareski	198c320ad8	Convert XCP to section based; add note	2021-09-08 09:58:11 -07:00
Matt Nadareski	6cde7b8bef	Reduce redundant code in content matchers now	2021-08-25 20:26:43 -07:00
Matt Nadareski	3ab0bcc0ae	ContentMatchSets are now expected in IContentCheck	2021-08-25 19:37:32 -07:00
Matt Nadareski	43845cf722	Rename position flag -> debug flag	2021-08-24 15:19:23 -07:00
Matt Nadareski	3667a5b57a	Concurrent protection scans per file (#52) ... * Move to ConcurrentDictionary * Convert to ConcurrentQueue	2021-07-18 09:44:23 -07:00
Matt Nadareski	3ac57b1c0c	Fix static matcher issues (fixes #51) ... Note: This may result in slower, but more accurate, scans	2021-07-17 23:40:16 -07:00
SilasLaspada	9c3201aa4b	Improve XCP detection to prevent false positives (#42) ... * Improve XCP detection to prevent false positives * Address comments	2021-07-01 20:51:40 -07:00
Matt Nadareski	9f40a8c4c0	Perform some post-removal cleanup	2021-03-23 16:43:23 -07:00
Matt Nadareski	f9d6fce3bd	Reduce boilerplate for directory checks	2021-03-23 13:35:12 -07:00
Matt Nadareski	aa83896963	Final batch of first pass for path check conversions	2021-03-23 10:36:14 -07:00
Matt Nadareski	921292e077	Static list of content matchers ... This also includes some more path matcher conversions that I couldn't reasonably split out	2021-03-23 09:52:09 -07:00
Matt Nadareski	5240f2eb70	Simplify util method naming	2021-03-22 21:32:58 -07:00
Matt Nadareski	6400c954ef	Split matchers more cleanly, comment better	2021-03-22 21:25:14 -07:00
Matt Nadareski	7aca58a6c9	Better split matching code, fix UPX name	2021-03-22 00:41:18 -07:00
Matt Nadareski	15ae2441c3	Use content matching helper, part 5	2021-03-21 22:37:16 -07:00
Matt Nadareski	cf9bd99f3d	Use content matching helper, part 4	2021-03-21 22:19:38 -07:00
Matt Nadareski	d01826ffa4	Use content matching helper, part 3	2021-03-21 15:34:19 -07:00
Matt Nadareski	ab07eb96ce	Use content matching helper, part 1	2021-03-21 14:30:37 -07:00
Matt Nadareski	544aaed9da	Modify array finding, part 2	2021-03-20 20:47:56 -07:00
Matt Nadareski	cdc4d509ee	Modify array finding, part 1	2021-03-20 19:00:22 -07:00
Matt Nadareski	a2888e3371	Split IPathCheck method	2021-03-19 15:41:49 -07:00
Matt Nadareski	b3671a430e	Swap order of params for IPathCheck	2021-02-26 11:02:10 -08:00
Matt Nadareski	7cfa9649e4	Add IContentCheck interface	2021-02-26 01:26:49 -08:00
Matt Nadareski	c6eaafebbe	Add IPathCheck interface	2021-02-26 00:32:09 -08:00
Matt Nadareski	28dbe8542b	Add CDS content checks, fix XCP over-detection	2020-10-27 17:01:33 -07:00
Matt Nadareski	e1fb1c7bcf	Minor renaming	2020-10-26 22:22:46 -07:00
Matt Nadareski	095de1441d	Add XCP content checks (thanks to Silas)	2020-10-26 21:08:39 -07:00
Matt Nadareski	43cbafc0f5	Add better detection for XCP2	2020-10-26 20:34:47 -07:00
Matt Nadareski	c78229c3cd	Use Any() instead of Count() > 0	2020-02-20 14:23:39 -08:00
Matt Nadareski	550086791b	Separate protections into their own classes	2019-09-27 23:52:24 -07:00