BinaryObjectScanner/README.md

# BurnOutSharp

[![Build status](https://ci.appveyor.com/api/projects/status/gmdft5bk1h8a1c31?svg=true)](https://ci.appveyor.com/project/mnadareski/burnoutsharp)

C# port of the protection scanning ability of [BurnOut](http://burnout.sourceforge.net/) plus numerous updates and additions. This currently compiles as a library so it can be used in any C# application. For an example of usage, see [MPF](https://github.com/SabreTools/MPF).

In addition to the original BurnOut code, the following libraries (or ports thereof) are used for file handling:

- [LibMSPackSharp](https://github.com/mnadareski/LibMSPackSharp) - Microsoft CAB extraction [Only used in .NET 6.0 builds, unstable]
- [openmcdf](https://github.com/ironfede/openmcdf) - MSI extraction
- [psxt001z](https://github.com/Dremora/psxt001z) - PS1 LibCrypt detection [Ported to C#]
- [SharpCompress](https://github.com/adamhathcock/sharpcompress) - Common archive format extraction
- [StormLibSharp](https://github.com/robpaveza/stormlibsharp) - MoPaQ extraction [Unused in .NET 6.0 builds due to Windows-specific libraries]
- [UnshieldSharp](https://github.com/mnadareski/UnshieldSharp) - InstallShield CAB extraction
- [WiseUnpacker](https://github.com/mnadareski/WiseUnpacker) - Wise Installer extraction
- [WixToolset.Dtf](https://github.com/wixtoolset/Dtf) - Microsoft CAB extraction [Unused in .NET 6.0 builds due to Windows-specific libraries]

Valve packages handling is based [HLLibSharp](https://github.com/mnadareski/HLLibSharp) but lacks everything but parsing and extraction capability.

## Protections Detected

Below is a list of protections detected by BurnOutSharp. The two columns explain what sort of checks are performed to determine how the protection is detected. Generally speaking, it's better to have a content check than a path check.

| Protection Name | Content Check | Path Check | Notes |
| --------------- | ------------- | ---------- | ----- |
| 3PLock | True | False | |
| 321Studios Online Activation | True | False | |
| AACS | False | True | BluRay and HD-DVD variants detected |
| ActiveMARK | True | False | Version 5 unconfirmed²; version finding incomplete |
| AegiSoft License Manager | True | True | |
| Alpha-DVD | False | True | Unconfirmed¹ |
| Alpha-ROM | True | False | |
| BD+ | False | True | |
| Bitpool | False | True | |
| ByteShield | True | True | |
| C-Dilla License Management Solution / CD-Secure / CD-Compress | True | True | |
| Cactus Data Shield | True | True | |
| CD-Cops / DVD-Cops | True | True | Partially unconfirmed² |
| CD-Guard | True | True | |
| CD-Lock | True | True | |
| CD-Protector | False | True | |
| CD-X | False | True | Unconfirmed¹ |
| CDSHiELD SE | True | False | |
| Cenga ProtectDVD | True | True | |
| ChosenBytes CodeLock | True | True | Partially unconfirmed² |
| CopyKiller | True | True | Unconfirmed¹ |
| CopyLok/CodeLok | True | False | |
| Cucko (EA Custom) | True | False | Does not detect all known cases |
| Denuvo Anti-Cheat/Anti-Tamper| True | True | |
| Dinamic Multimedia Protection/LockBlocks | False | True | LockBlocks needs manual confirmation of the presence of 2 rings |
| DiscGuard | True | True | Partially unconfirmed² |
| DVD-Movie-PROTECT | False | True | Unconfirmed¹ |
| DVD Crypt | False | True | Unconfirmed¹ |
| EA Protections | True | False | Including EA CDKey and EA DRM. |
| Easy Anti-Cheat | True | True | |
| ~~Executable-Based CD Check~~ | True | False | Disabled due to overly-broad checks |
| Executable-Based Online Registration | True | False | Possibly too broad |
| Freelock | False | True | |
| Games for Windows - Live | True | True | |
| Gefest Protection System | True | False | |
| Hexalock AutoLock | True | True | |
| Impulse Reactor / Stardock Product Activation | True | True | |
| IndyVCD | False | True | Unconfirmed¹ |
| INTENIUM Trial & Buy Protection | True | False | |
| JoWood X-Prot (v1/v2) / Xtreme-Protector | True | False | |
| ~~Key2Audio~~ | True | True | Existing checks found to actually be indicators of OpenMG, not key2Audio specifically. |
| Key-Lock (Dongle) | True | False | Unconfirmed¹ |
| LabelGate CD | True | True | Currently only LabelGate CD2 is detected. |
| LibCrypt | True | False | Separate subfile scan only |
| LaserLok | True | True | |
| MediaCloQ | True | True | |
| MediaMax CD3 | True | True | |
| nProtect GameGuard | True | True | |
| nProtect KeyCrypt | True | True | |
| OpenMG | True | True | |
| Origin | True | True | |
| phenoProtect | False | False | Text file check only |
| PlayJ | True | True | |
| ProtectDISC / VOB ProtectCD/DVD | True | False | |
| Protect DVD-Video | False | True | Unconfirmed¹ |
| PlayStation Anti-modchip | True | False | En/Jp, not "Red Hand"; PSX executables only |
| Rainbow Sentinel | True | True | |
| Ring PROTECH / ProRing | True | True | Partially unconfirmed² |
| SafeDisc / SafeCast | True | True | Can't distinguish between some versions of SafeDisc and SafeCast |
| SafeLock | False | True | |
| SecuROM | True | True | v8.x and White Label detected partially² |
| SmartE | True | True | |
| SoftLock | True | True | |
| SolidShield | True | True | Some Wrapper v1 not detected² |
| StarForce | True | False | Partially unconfirmed², commented out issue with `protect.exe` false positives |
| Steam | True | True | |
| SVKP (Slovak Protector) | True | False | |
| Sysiphus / Sysiphus DVD | True | False | |
| TAGES | True | True | Partially unconfirmed² |
| Themida/WinLicense/Code Virtualizer | True | False | Only certain products/versions currently detected |
| Tivola Ring Protection | False | True | |
| TZCopyProtection | False | True | Partially unconfirmed² |
| Uplay | True | True | |
| Windows Media Data Session DRM | True | True | |
| Winlock | False | True | |
| WTM CD Protect | True | True | |
| XCP | True | True | |
| Zzxzz | False | True | |

**Notes**

¹ - This means that I have not obtained one or more samples to ensure that either the original check from BurnOut or information found online is correct.

² - This is the same as ¹, but only for a subset of the checks.

## Executable Packers Detected

Below is a list of executable packers detected by BurnOutSharp. The three columns explain what sort of checks are performed to determine how the protection is detected as well as if the contents can be extracted.

| Protection Name | Content Check | Path Check | Extractable |
| --------------- | ------------- | ---------- | ----------- |
| 7-zip SFX | Yes | No | No |
| Advanced Installer / Caphyon Advanced Installer | Yes | No | No |
| Armadillo | Yes | No | No |
| ASPack | Yes | No | No |
| AutoPlay Media Studio | Yes | No | No |
| CExe | Yes | No | Yes |
| dotFuscator | Yes | No | No |
| EXE Stealth | Yes | No | No |
| Gentee Installer | Yes | No | No |
| Inno Setup | Yes | No | No |
| InstallAnywhere | Yes | No | No |
| Installer VISE | Yes | No | No |
| Intel Installation Framework | Yes | No | No |
| Microsoft CAB SFX | Yes | No | No |
| NSIS | Yes | No | No |
| PECompact | Yes | No | No |
| PEtite | Yes | No | No |
| Setup Factory | Yes | No | No |
| Shrinker | Yes | No | No |
| UPX and UPX (NOS Variant) | Yes | No | No |
| WinRAR SFX | Yes | No | Yes |
| WinZip SFX | Yes | No | Yes |
| WISE Installer | Yes | No | Yes |

## Container Formats

Below is a list of container formats that are supported in some way:

| Format Name | Information Printing | Detection | Extraction | Notes |
| --- | --- | --- | --- | --- |
| 7-zip archive | No | Yes | Yes | Via `SharpCompress` |
| BFPK custom archive format | Yes | Yes | Yes | |
| bzip2 archive | No | Yes | Yes | Via `SharpCompress` |
| gzip archive | No | Yes | Yes | Via `SharpCompress` |
| Half-Life Game Cache File (GCF) | Yes | Yes | Yes | |
| Half-Life Level (BSP) | Yes | Yes | Yes | |
| Half-Life Package File (PAK) | Yes | Yes | Yes | |
| Half-Life Texture Package File (WAD) | Yes | Yes | Yes | |
| Half-Life 2 Level (VBSP) | Yes | Yes | Yes | |
| INI configuration file | No | No | No | Used in other detections currently |
| InstallShield Archive V3 (Z) | No | Yes | Yes | Via `UnshieldSharp` |
| InstallShield CAB | No | Yes | Yes | Via `UnshieldSharp` |
| Linear Executable | No | No | No | Skeleton only |
| Microsoft cabinet file | Yes | Yes | Yes | Via `WixToolset.Dtf` / ~~`LibMSPackSharp`~~ (Currently disabled) |
| Microsoft LZ-compressed files | No | Yes | Yes | |
| MoPaQ game data archive (MPQ) | No | Yes | Yes | Via `StormLibSharp` |
| Microsoft installation package (MSI) | No | Yes | Yes | Via `OpenMcdf` |
| MS-DOS Executable | Yes | Yes | No | Incomplete |
| New Exectuable | Yes | Yes | No | Incomplete |
| PKZIP and derived files (ZIP, etc.) | No | Yes | Yes | Via `SharpCompress` |
| PlayJ audio file (PLJ) | No | Yes | No | |
| Portable Executable | Yes | Yes | No* | Some packed executables are supported |
| RAR archive (RAR) | No | Yes | Yes | Via `SharpCompress` |
| SGA game archive | Yes | Yes | Yes | |
| StarForce Filesystem file (SFFS) | No | Yes | No | Skeleton only |
| Tape archive (TAR) | No | Yes | Yes | Via `SharpCompress` |
| Valve Package File (VPK) | Yes | Yes | Yes | |
| XBox Package File (XZP) | Yes | Yes | Yes | |
| xz archive (XZ) | No | Yes | Yes | Via `SharpCompress` |

## Contributions

Contributions to the project are welcome. Please follow the current coding styles and please do not add any keys or legally dubious things to the code. Thank you to all of the testers, particularly from the MPF project who helped get this rolling.

## Special Thanks

I want to give a special thanks to [TheRogueArchivist](https://github.com/TheRogueArchivist) who has gone above and beyond helping both fix existing checks as well as add new ones.