Detecting CD-COPS String in CDCOPS.DLL

SabreTools / BinaryObjectScanner

C# protection, packer, and archive scanning library

MIT License

85 stars 13 forks source link

Detecting CD-COPS String in CDCOPS.DLL #88

Open Flashfire42 opened 2 years ago

Flashfire42 commented 2 years ago

In 2 of the 3 samples I have been able to examine so far of the CDCOPS.DLL this string is at the same offset every time in the third sample it is off by 1 but the string is still there. The files are all NEEXE according to virustotal which may make things more difficult to parse. If I get further info on the dll I will update this issue. They are also reportably all 16bit windows applications

mnadareski commented 2 years ago

If you can provide samples, this would be helpful. Otherwise, check latest to see if it's taken care of already.

TheRogueArchivist commented 1 year ago

I can confirm that this check is now present and functional.