namespace BurnOutSharp.ProtectionType { public class ThreePLock { public static string CheckContents(byte[] fileContent, bool includePosition = false) { // .ldr byte[] check = new byte[] { 0x2E, 0x6C, 0x64, 0x72 }; if (fileContent.Contains(check, out int position)) { // .ldt byte[] check2 = new byte[] { 0x2E, 0x6C, 0x64, 0x74 }; if (fileContent.Contains(check2, out int position2)) return "3PLock" + (includePosition ? $" (Index {position}, {position2})" : string.Empty); } // This produced false positives in some DirectX 9.0c installer files // "Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW" //check = new byte[] { 0x59, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x30, 0x53, 0x56, 0x57 }; //if (fileContent.Contains(check, out position)) // return "3PLock" + (includePosition ? $" (Index {position})" : string.Empty); return null; } } }