using System.Collections.Generic; using System.Linq; using System.Text; using BurnOutSharp.ExecutableType.Microsoft; using BurnOutSharp.Matching; namespace BurnOutSharp.ProtectionType { public class ThreePLock : IContentCheck { /// public List GetContentMatchSets() => null; // { // return new List // { // //This produced false positives in some DirectX 9.0c installer files // //"Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW" // new ContentMatchSet(new byte?[] // { // 0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30, // 0x53, 0x56, 0x57 // }, "3PLock"), // }; // } /// public string CheckContents(string file, byte[] fileContent, bool includeDebug = false) { // Get the sections from the executable, if possible PortableExecutable pex = PortableExecutable.Deserialize(fileContent, 0); var sections = pex?.SectionTable; if (sections == null) return null; // Get the .ldr and .ldt sections, if they exist -- TODO: Confirm if both are needed or either/or is fine var cmsdSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".ldr")); var cmstSection = sections.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).StartsWith(".ldt")); if (cmsdSection != null || cmstSection != null) return $"3PLock"; return null; } } }