using System.Collections.Concurrent; using System.Collections.Generic; using BurnOutSharp.Interfaces; using BurnOutSharp.Matching; namespace BurnOutSharp.ProtectionType { public class CopyKiller : IContentCheck, IPathCheck { /// public string CheckContents(string file, byte[] fileContent, bool includeDebug) { // TODO: Obtain a sample to find where this string is in a typical executable if (includeDebug) { var contentMatchSets = new List { // Tom Commander new ContentMatchSet(new byte?[] { 0x54, 0x6F, 0x6D, 0x20, 0x43, 0x6F, 0x6D, 0x6D, 0x61, 0x6E, 0x64, 0x65, 0x72 }, "CopyKiller"), }; return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); } return null; } /// public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files) { // TODO: The following checks are overly broad and should be refined // TODO: Look into .PFF files as an indicator. At least one disc has those oversized files var matchers = new List { //new PathMatchSet(new PathMatch("Autorun.dat", useEndsWith: true), "CopyKiller"), }; return MatchUtil.GetAllMatches(files, matchers, any: true); } /// public string CheckFilePath(string path) { // TODO: The following checks are overly broad and should be refined // TODO: Look into .PFF files as an indicator. At least one disc has those oversized files var matchers = new List { //new PathMatchSet(new PathMatch("Autorun.dat", useEndsWith: true), "CopyKiller"), }; return MatchUtil.GetFirstMatch(path, matchers, any: true); } } }