diff --git a/BinaryObjectScanner/Protection/CrypKey.cs b/BinaryObjectScanner/Protection/CrypKey.cs index eb21dcad..7a0ab324 100644 --- a/BinaryObjectScanner/Protection/CrypKey.cs +++ b/BinaryObjectScanner/Protection/CrypKey.cs @@ -1,4 +1,10 @@ -using BinaryObjectScanner.Interfaces; +#if NET40_OR_GREATER || NETCOREAPP +using System.Collections.Concurrent; +#endif +using System.Collections.Generic; +using System.Linq; +using BinaryObjectScanner.Interfaces; +using SabreTools.Matching; using SabreTools.Serialization.Wrappers; namespace BinaryObjectScanner.Protection @@ -7,7 +13,7 @@ namespace BinaryObjectScanner.Protection // https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/CrypKey%20Installer.1.sg // https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/CrypKey.2.sg // https://github.com/wolfram77web/app-peid/blob/master/userdb.txt - public class CrypKey : IPortableExecutableCheck + public class CrypKey : IPathCheck, IPortableExecutableCheck { /// public string? CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) @@ -17,6 +23,26 @@ namespace BinaryObjectScanner.Protection if (sections == null) return null; + // Get the code/CODE section strings, if they exist + var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE"); + if (strs != null) + { + // Found in "NECRO95.EXE" in IA item "NBECRORV11". + // Full string: + // *CrypKey Instant 2.0 security i(32 - bit) * + // *Copyright(c) 1996 Kenonic Controls Ltd. * + if (strs.Any(s => s.Contains("CrypKey Instant 2.0 security"))) + return "CrypKey Instant 2.0"; + + // Generic check to catch unknown CrypKey Instant versions. + if (strs.Any(s => s.Contains("CrypKey Instant"))) + return "CrypKey Instant (Unknown version - Please report to us on GitHub)"; + + // Generic check to catch unknown CrypKey products. + if (strs.Any(s => s.Contains("CrypKey"))) + return "CrypKey (Unknown version - Please report to us on GitHub)"; + } + // Get the CrypKey version from the VersionInfo, if it exists string version = pex.GetVersionInfoString("CrypKey Version") ?? string.Empty; @@ -24,9 +50,14 @@ namespace BinaryObjectScanner.Protection var name = pex.CompanyName; if (name?.StartsWith("CrypKey") == true) return $"CrypKey {version}".TrimEnd(); + + name = pex.FileDescription; + + // Found in "CKSEC_32.DLL" in IA item "NBECRORV11". + if (name?.StartsWith("CrypKey Instant security library") == true) + return $"CrypKey Instant {pex.GetInternalVersion()}"; // Found in 'cki32k.dll' - name = pex.FileDescription; if (name?.StartsWith("CrypKey") == true) return $"CrypKey {version}".TrimEnd(); @@ -43,5 +74,41 @@ namespace BinaryObjectScanner.Protection return null; } + + /// +#if NET20 || NET35 + public Queue CheckDirectoryPath(string path, IEnumerable? files) +#else + public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable? files) +#endif + { + var matchers = new List + { + // Found in IA item "NBECRORV11". + new(new FilePathMatch("CKLICENS.HLP"), "CrypKey"), + new(new FilePathMatch("CKSEC_32.DLL"), "CrypKey"), + new(new FilePathMatch("CRYP95.DLL"), "CrypKey"), + new(new FilePathMatch("CRYP9516.DLL"), "CrypKey"), + new(new FilePathMatch("CRYPKEY.HLP"), "CrypKey"), + }; + + return MatchUtil.GetAllMatches(files, matchers, any: true); + } + + /// + public string? CheckFilePath(string path) + { + var matchers = new List + { + // Found in IA item "NBECRORV11". + new(new FilePathMatch("CKLICENS.HLP"), "CrypKey"), + new(new FilePathMatch("CKSEC_32.DLL"), "CrypKey"), + new(new FilePathMatch("CRYP95.DLL"), "CrypKey"), + new(new FilePathMatch("CRYP9516.DLL"), "CrypKey"), + new(new FilePathMatch("CRYPKEY.HLP"), "CrypKey"), + }; + + return MatchUtil.GetFirstMatch(path, matchers, any: true); + } } } diff --git a/README.md b/README.md index a06afbac..5c2683d2 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,7 @@ Below is a list of protections detected by BinaryObjectScanner. The two columns | ChosenBytes CodeLock | True | True | Partially unconfirmed² | | CopyKiller | True | True | Unconfirmed¹ | | CopyLok/CodeLok | True | False | | -| CrypKey | True | False | | +| CrypKey | True | True | | | Cucko (EA Custom) | True | False | Does not detect all known cases | | Denuvo Anti-Cheat/Anti-Tamper| True | True | | | DigiGuard | True | True | |