Skip to content

Commit 6661c48

Browse files
Don't check files with ".srdata" section for Denuvo (#351)
Prone to too many false positives.
1 parent f2a07fc commit 6661c48

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

BinaryObjectScanner/Protection/Denuvo.cs

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,9 @@ public class Denuvo : IExecutableCheck<PortableExecutable>, IPathCheck
9090

9191
// TODO: Re-enable all Entry Point checks after implementing
9292
if (pex.ContainsSection(".arch")
93-
|| pex.ContainsSection(".srdata")
93+
// Disabled scanning in files with the ".srdata" section due to numerous false positives.
94+
// These include Redump entry 112733 and Bus Hound 5.04 (https://web.archive.org/web/20070129204350/http://www.perisoft.net/bin/bhe504.exe).
95+
// || pex.ContainsSection(".srdata")
9496
|| !string.IsNullOrEmpty(timingMatch))
9597
{
9698
if (pex.Model.OptionalHeader?.Magic == OHMN.PE32Plus)

0 commit comments

Comments
 (0)