mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-02-16 05:44:53 +00:00
17 lines
884 B
C#
17 lines
884 B
C#
namespace BurnOutSharp.PackerType
|
|
{
|
|
public class EXEStealth : IContentCheck
|
|
{
|
|
/// <inheritdoc/>
|
|
public string CheckContents(string file, byte[] fileContent, bool includePosition = false)
|
|
{
|
|
// "??[[__[[_" + (char)0x00 + "{{" + (char)0x0 + (char)0x00 + "{{" + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x0 + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + "?;??;??"
|
|
byte?[] check = new byte?[] { 0x3F, 0x3F, 0x5B, 0x5B, 0x5F, 0x5F, 0x5B, 0x5B, 0x5F, 0x00, 0x7B, 0x7B, 0x00, 0x00, 0x7B, 0x7B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x3F, 0x3B, 0x3F, 0x3F, 0x3B, 0x3F, 0x3F };
|
|
if (fileContent.FirstPosition(check, out int position))
|
|
return $"EXE Stealth" + (includePosition ? $" (Index {position})" : string.Empty);
|
|
|
|
return null;
|
|
}
|
|
}
|
|
}
|