Files
BinaryObjectScanner/BurnOutSharp/ProtectionType/KeyLock.cs
TheRogueArchivist e645b8e1c0 Add notes to unconfirmed detections (#157)
* Add notes to unconfirmed detections

* Add notes to unconfirmed detections to let users know what detections we need samples of.

* Add sources for some protections to confirm them.

* Confirm some RingPROTECH checks

* Confirm some RingPROTECH checks.

* Add notes for IndyVCD.
2022-10-13 20:58:49 -07:00

32 lines
1.0 KiB
C#

using System.Collections.Generic;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
namespace BurnOutSharp.ProtectionType
{
public class KeyLock : IContentCheck
{
/// <inheritdoc/>
public string CheckContents(string file, byte[] fileContent, bool includeDebug)
{
// TODO: Obtain a sample to find where this string is in a typical executable
if (includeDebug)
{
var contentMatchSets = new List<ContentMatchSet>
{
// KEY-LOCK COMMAND
new ContentMatchSet(new byte?[]
{
0x4B, 0x45, 0x59, 0x2D, 0x4C, 0x4F, 0x43, 0x4B,
0x20, 0x43, 0x4F, 0x4D, 0x4D, 0x41, 0x4E, 0x44
}, "Key-Lock (Dongle) (Unconfirmed - Please report to us on Github)"),
};
return MatchUtil.GetFirstMatch(file, fileContent, contentMatchSets, includeDebug);
}
return null;
}
}
}