using System.Collections.Concurrent; using System.Collections.Generic; using BurnOutSharp.ExecutableType.Microsoft; using BurnOutSharp.Matching; namespace BurnOutSharp.ProtectionType { public class SafeLock : IContentCheck, IPathCheck { /// public string CheckContents(string file, byte[] fileContent, bool includeDebug, PortableExecutable pex, NewExecutable nex) { // TODO: Obtain a sample to find where this string is in a typical executable var contentMatchSets = new List { // SafeLock new ContentMatchSet(new byte?[] { 0x53, 0x61, 0x66, 0x65, 0x4C, 0x6F, 0x63, 0x6B }, "SafeLock"), }; return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug); } /// public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files) { // TODO: Verify if these are OR or AND var matchers = new List { new PathMatchSet(new PathMatch("SafeLock.dat", useEndsWith: true), "SafeLock"), new PathMatchSet(new PathMatch("SafeLock.001", useEndsWith: true), "SafeLock"), new PathMatchSet(new PathMatch("SafeLock.128", useEndsWith: true), "SafeLock"), }; return MatchUtil.GetAllMatches(files, matchers, any: true); } /// public string CheckFilePath(string path) { var matchers = new List { new PathMatchSet(new PathMatch("SafeLock.dat", useEndsWith: true), "SafeLock"), new PathMatchSet(new PathMatch("SafeLock.001", useEndsWith: true), "SafeLock"), new PathMatchSet(new PathMatch("SafeLock.128", useEndsWith: true), "SafeLock"), }; return MatchUtil.GetFirstMatch(path, matchers, any: true); } } }