Skip to content

Commit d6a3a37

Browse files
committed
Add investigation notes about weird SF version
1 parent 281e7b4 commit d6a3a37

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

BinaryObjectScanner/Protection/StarForce.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,13 @@ public class StarForce : IExecutableCheck<PortableExecutable>, IPathCheck
105105
if (exe.ContainsSection(".sforce", exact: false))
106106
return "StarForce 3-5";
107107

108+
// TODO: Investigate the .common and .ps4 sections found in apache.exe
109+
// .common doesn't map to any table
110+
// The section is largely empty with a 3 or 4 byte value at
111+
// offset 0x40. Sample has "D4 DB DD 00"
112+
// .ps4 has a virtual size of 4096 and a physical size of 0
113+
// The physical offset is the end of the file
114+
108115
return null;
109116
}
110117

0 commit comments

Comments
 (0)