using System.Collections.Concurrent; using System.Collections.Generic; using System.Linq; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; namespace BinaryObjectScanner.Protection { public class SmartE : IPathCheck, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { // Get the sections from the executable, if possible var sections = pex?.SectionTable; if (sections == null) return null; // Get the last section strings, if they exist List strs = pex.GetSectionStrings(sections.Length - 1); if (strs != null) { if (strs.Any(s => s.Contains("BITARTS"))) return "SmartE"; } return null; } /// public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files) { var matchers = new List { new PathMatchSet(new List { new FilePathMatch("00001.TMP"), new FilePathMatch("00002.TMP") }, "SmartE"), }; return MatchUtil.GetAllMatches(files, matchers, any: true); } /// public string CheckFilePath(string path) { var matchers = new List { new PathMatchSet(new FilePathMatch("00001.TMP"), "SmartE"), new PathMatchSet(new FilePathMatch("00002.TMP"), "SmartE"), }; return MatchUtil.GetFirstMatch(path, matchers, any: true); } } }