Skip to content

Commit e97558d

Browse files
Add new HexaLock check (#254)
1 parent 06ecc1a commit e97558d

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

BinaryObjectScanner.Protection/HexaLock.cs

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
using System;
22
using System.Collections.Concurrent;
33
using System.Collections.Generic;
4+
using System.Linq;
45
using BinaryObjectScanner.Interfaces;
56
using BinaryObjectScanner.Matching;
67
using BinaryObjectScanner.Wrappers;
@@ -54,6 +55,15 @@ public string CheckPortableExecutable(string file, PortableExecutable pex, bool
5455
if (name?.StartsWith("HCPS", StringComparison.OrdinalIgnoreCase) == true)
5556
return $"Hexalock AutoLock 4.5";
5657

58+
// Get the .text section strings, if they exist
59+
List<string> strs = pex.GetFirstSectionStrings(".text");
60+
if (strs != null)
61+
{
62+
// Found in "The Sudoku Challenge Collection.exe" in "The Sudoku Challenge! Collection" by Play at Joe's.
63+
if (strs.Any(s => s.Contains("mfint.dll")))
64+
return "Hexalock Autolock";
65+
}
66+
5767
return null;
5868
}
5969

0 commit comments

Comments
 (0)