From 0eab7fd55508627b28dde88a06ac0c7e0479ad20 Mon Sep 17 00:00:00 2001 From: TheRogueArchivist <24215969+TheRogueArchivist@users.noreply.github.com> Date: Mon, 25 Mar 2024 17:57:29 -0600 Subject: [PATCH] Significantly update Rainbow Sentinel detections and notes (#290) --- .../Protection/RainbowSentinel.cs | 329 ++++++++++++++++-- 1 file changed, 299 insertions(+), 30 deletions(-) diff --git a/BinaryObjectScanner/Protection/RainbowSentinel.cs b/BinaryObjectScanner/Protection/RainbowSentinel.cs index daa7a558..a08b0b97 100644 --- a/BinaryObjectScanner/Protection/RainbowSentinel.cs +++ b/BinaryObjectScanner/Protection/RainbowSentinel.cs @@ -4,6 +4,7 @@ using System.Collections.Concurrent; #endif using System.Collections.Generic; using System.Linq; +using System.Text; using BinaryObjectScanner.Interfaces; using SabreTools.Matching; using SabreTools.Serialization.Wrappers; @@ -16,16 +17,121 @@ namespace BinaryObjectScanner.Protection /// TODO: Investigate other versions/products. /// TODO: See if this is at all related to https://cpl.thalesgroup.com/software-monetization/all-products/sentinel-hl. /// TODO: Investigate the possible integration between FlexLM and Rainbow Sentinel in IA item "prog-17_202403". + /// TODO: Investigate the "NetSentinel Protection System" found in "NSRVOM.EXE" and "NSRVGX.EXE" in IA item "czchip199707cd". + /// TODO: Investigate "sntnlusb.sys" (https://www.rainbow.com.my/document/endusertroubleshooting.pdf). /// /// Versions: + /// Rainbow Sentinel PD-5.1: IA items "pcwkcd-1296" and "CHIPTRMart97". + /// Rainbow Sentinel PD-5.1e (Beta): IA item "CHIPTRMart97". + /// Rainbow Sentinel PD-5.39: IA item "chip-cds-2001-08". /// Rainbow Sentinel PD-15: IA items "ASMEsMechanicalEngineeringToolkit1997December" and "aplicaciones-windows". + /// Rainbow Sentinel PD-17: IA item "czchip199707cd". /// Rainbow Sentinel PD-30: BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]" and IA item "auto-cad-r14-cdrom". /// Rainbow Sentinel PD-31: BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]" and IA item "auto-cad-r14-cdrom". /// + /// Rainbow Sentinel SuperPro 5.0: IA items "chip-cds-2001-08". /// Rainbow Sentinel SuperPro 5.1: IA items "ASMEsMechanicalEngineeringToolkit1997December" and "aplicaciones-windows". + /// + /// Rainbow SentinelPro 5.1: IA item "pcwkcd-1296". + /// + /// Rainbow NetSentinel: IA item "czchip199707cd". /// - public class RainbowSentinel : IPathCheck, IPortableExecutableCheck + public class RainbowSentinel : IPathCheck, INewExecutableCheck, IPortableExecutableCheck { + /// + public string? CheckNewExecutable(string file, NewExecutable nex, bool includeDebug) + { + // TODO: Don't read entire file + var data = nex.ReadArbitraryRange(); + if (data == null) + return null; + + // TODO: Figure out what NE section this lives in + var neMatchSets = new List + { + // SentinelPro Windows Driver DLL + // Found in "SSWIN.dll" in IA item "pcwkcd-1296". + new(new byte?[] + { + 0x53, 0x65, 0x6E, 0x74, 0x69, 0x6E, 0x65, 0x6C, + 0x50, 0x72, 0x6F, 0x20, 0x57, 0x69, 0x6E, 0x64, + 0x6F, 0x77, 0x73, 0x20, 0x44, 0x72, 0x69, 0x76, + 0x65, 0x72, 0x20, 0x44, 0x4C, 0x4C + }, "Rainbow SentinelPro"), + + // Sentinel Device Driver Version �PD-5.17 + // Found in "SENTINEL.SYS" in IA item "czchip199707cd". + new(new byte?[] + { + 0x53, 0x65, 0x6E, 0x74, 0x69, 0x6E, 0x65, 0x6C, + 0x20, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x20, + 0x44, 0x72, 0x69, 0x76, 0x65, 0x72, 0x20, 0x56, + 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x20, 0x00, + 0x50, 0x44, 0x2D, 0x35, 0x2E, 0x31, 0x37 + }, "Rainbow Sentinel PD-5.17"), + + // NetSentinel OS/2 security server + // Found in "NSRVOM.EXE" in IA item "czchip199707cd". + new(new byte?[] + { + 0x4E, 0x65, 0x74, 0x53, 0x65, 0x6E, 0x74, 0x69, + 0x6E, 0x65, 0x6C, 0x20, 0x4F, 0x53, 0x2F, 0x32, + 0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72 + }, "Rainbow NetSentinel Server for OS/2"), + + // NetSentinel Monitor + // Found in "OS2MON.EXE" in IA item "czchip199707cd". + new(new byte?[] + { + 0x4E, 0x65, 0x74, 0x53, 0x65, 0x6E, 0x74, 0x69, + 0x6E, 0x65, 0x6C, 0x20, 0x20, 0x4D, 0x6F, 0x6E, + 0x69, 0x74, 0x6F, 0x72 + }, "Rainbow NetSentinel Monitor"), + + // Sentinel Device Driver + // Generic case to catch unknown versions. + // TODO: Add version parsing for this check. + new (new byte?[] + { + 0x53, 0x65, 0x6E, 0x74, 0x69, 0x6E, 0x65, 0x6C, + 0x20, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x20, + 0x44, 0x72, 0x69, 0x76, 0x65, 0x72, 0x20, 0x56, + 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x20, 0x00, + 0x50, 0x44, 0x2D, 0x35, 0x2E, 0x31, 0x37 + }, "Rainbow Sentinel (Unknown Version - Please report this to us on GitHub)"), + }; + + var match = MatchUtil.GetFirstMatch(file, data, neMatchSets, includeDebug); + if (!string.IsNullOrEmpty(match)) + return match; + + // Check the nonresident-name table + // Found in "SSWIN.dll" in IA item "pcwkcd-1296". + bool nonresidentNameTableEntries = nex.Model.NonResidentNameTable? + .Select(nrnte => nrnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(nrnte.NameString)) + .Any(s => s.Contains("SentinelPro Windows Driver DLL")) ?? false; + if (nonresidentNameTableEntries) + return "Rainbow SentinelPro"; + + // Found in "INSTALL.EXE" in IA item "czchip199707cd". + nonresidentNameTableEntries = nex.Model.NonResidentNameTable? + .Select(nrnte => nrnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(nrnte.NameString)) + .Any(s => s.Contains("Rainbow Technologies Installation Program")) ?? false; + if (nonresidentNameTableEntries) + return "Rainbow Sentinel"; + + // Found in "WNCEDITD.EXE" and "WNCEDITO.EXE" in IA item "czchip199707cd". + nonresidentNameTableEntries = nex.Model.NonResidentNameTable? + .Select(nrnte => nrnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(nrnte.NameString)) + .Any(s => s.Contains("NetSentinel-C Editor for Windows")) ?? false; + if (nonresidentNameTableEntries) + return "NetSentinel-C Editor for Windows"; + + // TODO: Investigate "SentinelScribe Windows Driver DLL" found in "NKWIN.DLL" in IA item "czchip199707cd". + + return null; + } + /// public string? CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -34,30 +140,6 @@ namespace BinaryObjectScanner.Protection if (sections == null) return null; - // Get the .data/DATA section strings, if they exist - var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA"); - if (strs != null) - { - // Found in "ADESKSYS.DLL"/"WINADMIN.EXE"/"WINQUERY.EXE" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\netsetup\SUPPORT\IPX". - if (strs.Any(s => s.Contains("Rainbow SentinelSuperPro"))) - return "Rainbow Sentinel SuperPro"; - } - - // Get the .text section strings, if they exist - strs = pex.GetFirstSectionStrings(".text"); - if (strs != null) - { - // Found in "ACLT.HWL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\aclt\DRV\W95LOCK". - // Found in "ACAD.HWL" in BA entry "Autodesk AutoCAD r14 (1997)" and IA item "auto-cad-r14-cdrom". - if (strs.Any(s => s.Contains("SENTINEL.VXD"))) - return "Rainbow Sentinel SuperPro"; - - // Found in "ADESKSYS.DLL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\netsetup\SUPPORT\IPX". - // TODO: Investigate "Elan License Manager" mentioned here. - if (strs.Any(s => s.Contains("Rainbow SentinelSuperPro"))) - return "Rainbow Sentinel SuperPro"; - } - // TODO: Figure out why resources for "RNBOVTMP.DLL", "SENTTEMP.DLL", "SNTI386.DLL", and "SX32W.DL_"/"SX32W.DLL" aren't getting read properly, causing checks for these files to not work. var name = pex.FileDescription; @@ -82,6 +164,14 @@ namespace BinaryObjectScanner.Protection if (name?.Equals("Rainbow Technologies SentinelSuperPro WIN32 DLL", StringComparison.OrdinalIgnoreCase) == true) return $"Rainbow Sentinel SuperPro {pex.ProductVersion}"; + // Found in "SP32W.DLL" in IA item "pcwkcd-1296". + if (name?.Equals("Rainbow Technologies SentinelPro WIN32 DLL", StringComparison.OrdinalIgnoreCase) == true) + return $"Rainbow SentinelPro {pex.ProductVersion}"; + + // Found in "NSRVGX.EXE" in IA item "czchip199707cd". + if (name?.Equals("NetSentinel Server for WIN 32", StringComparison.OrdinalIgnoreCase) == true) + return "Rainbow NetSentinel Server for Win32"; + name = pex.ProductName; // Found in multiple files in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", including "RNBOVTMP.DLL", "SENTTEMP.DLL", and "SNTI386.DLL". @@ -96,6 +186,93 @@ namespace BinaryObjectScanner.Protection if (name?.Equals("Rainbow Technologies SentinelSuperPro WIN32 DLL", StringComparison.OrdinalIgnoreCase) == true) return $"Rainbow Sentinel SuperPro {pex.ProductVersion}"; + // Found in "SP32W.DLL" in IA item "pcwkcd-1296". + if (name?.Equals("Rainbow Technologies SentinelPro WIN32 DLL", StringComparison.OrdinalIgnoreCase) == true) + return $"Rainbow SentinelPro {pex.ProductVersion}"; + + // Found in "F481_SetupSysDriver.exe.B391C18A_6953_11D4_82CB_00D0B72E1DB9"/"SetupSysDriver.exe" in IA item "chip-cds-2001-08". + if (name?.Equals("Sentinel System Driver", StringComparison.OrdinalIgnoreCase) == true) + return $"Rainbow Sentinel {pex.ProductVersion}"; + + // Get the .data/DATA section strings, if they exist + var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA"); + if (strs != null) + { + // Found in "ADESKSYS.DLL"/"WINADMIN.EXE"/"WINQUERY.EXE" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\netsetup\SUPPORT\IPX". + if (strs.Any(s => s.Contains("Rainbow SentinelSuperPro"))) + return "Rainbow Sentinel SuperPro"; + + // Found in "SETUPAXP.EXE", "SETUPMPS.EXE", and "SETUPPPC.EXE" in IA item "czchip199707cd". + if (strs.Any(s => s.Contains("Sentinel Driver Setup Program"))) + return "Rainbow Sentinel"; + } + + // Get the .rdata section strings, if they exist + strs = pex.GetFirstSectionStrings(".rdata"); + if (strs != null) + { + // Found in "SP32W.DLL" in IA item "pcwkcd-1296". + if (strs.Any(s => s.Contains("SentinelPro WIN32 DLL"))) + return "Rainbow SentinelPro"; + + // Found in "NKWIN32.DLL" in IA item "czchip199707cd". + if (strs.Any(s => s.Contains("NetSentinel-C Windows NT Driver DLL"))) + return "Rainbow NetSentinel-C Windows NT Driver"; + + // Found in "NSLMS32.DLL" in IA item "czchip199707cd". + if (strs.Any(s => s.Contains("NetSentinel 32-Bit Windows DLL"))) + return "Rainbow NetSentinel Win32 Driver"; + + // Found in "W32EDITD.EXE" and "W32EDITO.EXE" in IA item "czchip199707cd". + if (strs.Any(s => s.Contains("NetSentinel-C Editor for Windows"))) + return "NetSentinel-C Editor for Win32"; + + // Generic case to catch undetected versions. + if (strs.Any(s => s.Contains("SentinelPro"))) + return "Rainbow SentinelPro (Unknown Version - Please report to us on GitHub)"; + } + + // Get the .rsrc section strings, if they exist + strs = pex.GetFirstSectionStrings(".rsrc"); + if (strs != null) + { + // Found in "WINMON.exe" in IA item "czchip199707cd". + if (strs.Any(s => s.Contains("NetSentinel Monitor"))) + return "Rainbow NetSentinel Monitor"; + } + + // Get the .text section strings, if they exist + strs = pex.GetFirstSectionStrings(".text"); + if (strs != null) + { + // Found in "ACLT.HWL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\aclt\DRV\W95LOCK". + // Found in "ACAD.HWL" in BA entry "Autodesk AutoCAD r14 (1997)" and IA item "auto-cad-r14-cdrom". + if (strs.Any(s => s.Contains("\\\\.\\SENTINEL.VXD"))) + return "Rainbow Sentinel"; + + // Found in "ADESKSYS.DLL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\netsetup\SUPPORT\IPX". + // TODO: Investigate "Elan License Manager" mentioned here. + if (strs.Any(s => s.Contains("Rainbow SentinelSuperPro"))) + return "Rainbow Sentinel SuperPro"; + + // Found in "F1321_dorapro.exe" in IA item "chip-cds-2001-08". + if (strs.Any(s => s.Contains("modSentinelSuperPro"))) + return "Rainbow Sentinel SuperPro"; + + // Found in "F1321_dorapro.exe" in IA item "chip-cds-2001-08". + if (strs.Any(s => s.Contains("clsSentinelSuperPro"))) + return "Rainbow Sentinel SuperPro"; + + // Found in "SENTSTRT.EXE" in IA item "czchip199707cd". + if (strs.Any(s => s.Contains("Sentinel Driver Startup Program"))) + return "Rainbow Sentinel"; + + // Found in "SETUPX86.EXE" in IA item "czchip199707cd". + if (strs.Any(s => s.Contains("Sentinel Windows NT Driver Setup"))) + return "Rainbow Sentinel"; + } + + return null; } @@ -108,8 +285,11 @@ namespace BinaryObjectScanner.Protection { var matchers = new List { + // The Parallel Port driver for Rainbow Sentinel on Win9x (https://www.rainbow.com.my/document/endusertroubleshooting.pdf). + // Unfortunately, the file name overlaps with a file used by Clam Sentinel (https://clamsentinel.sourceforge.net/). + // new(new FilePathMatch("SENTINEL.VXD"), "Rainbow Sentinel"), + // Found in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]" and IA item "auto-cad-r14-cdrom". - new(new FilePathMatch("SENTINEL.VXD"), "Rainbow Sentinel"), new(new FilePathMatch("SENTSTRT.EXE"), "Rainbow Sentinel"), new(new FilePathMatch("SENTW95.DLL"), "Rainbow Sentinel"), new(new FilePathMatch("SENTW95.EXE"), "Rainbow Sentinel"), @@ -128,9 +308,69 @@ namespace BinaryObjectScanner.Protection new(new FilePathMatch("RAINBNT.Z"), "Rainbow Sentinel"), // Found in "wd126.zip/WDSHARE.EXE" in IA item "ASMEsMechanicalEngineeringToolkit1997December" and "WDSHARE.ZIP/WDSHARE.EXE/SX32W.DL_" in IA item "aplicaciones-windows". - new(new FilePathMatch("RainbowSentinel.386"), "Rainbow Sentinel"), - new(new FilePathMatch("SX32W.DL_"), "Rainbow Sentinel"), - new(new FilePathMatch("SX32W.DLL"), "Rainbow Sentinel"), + new(new FilePathMatch("RainbowSentinel.386"), "Rainbow Sentinel"), + new(new FilePathMatch("SX32W.DL_"), "Rainbow Sentinel"), + new(new FilePathMatch("SX32W.DLL"), "Rainbow Sentinel"), + + // Found in IA item "pcwkcd-1296". + new(new FilePathMatch("SP32W.DLL"), "Rainbow Sentinel"), + new(new FilePathMatch("SSWIN.DLL"), "Rainbow Sentinel"), + + // Found in IA item "czchip199707cd". + new(new FilePathMatch("SENTINEL.DPP"), "Rainbow Sentinel OS/2 Installation Script"), + new(new FilePathMatch("SENTDOS.SYS"), "Rainbow Sentinel DOS Driver"), + new(new FilePathMatch("SENTINEL.386"), "Rainbow Sentinel Windows 3.1 Driver"), + new(new FilePathMatch("SNTALPHA.DLL"), "Rainbow Sentinel Windows NT Alpha Platform Driver"), + new(new FilePathMatch("SNTI386.DLL"), "Rainbow Sentinel Windows NT Intel Platform Driver"), + new(new FilePathMatch("SNTMIPS.DLL"), "Rainbow Sentinel Windows NT MIPS Platform Driver"), + new(new FilePathMatch("SNTPPC.DLL"), "Rainbow Sentinel Windows NT PowerPC Platform Driver"), + new(new FilePathMatch("NSRVDI.EXE"), "Rainbow NetSentinel Server for DOS"), + new(new FilePathMatch("NSRVDN.EXE"), "Rainbow NetSentinel Server for DOS"), + new(new FilePathMatch("NSRVNI.NLM"), "Rainbow NetSentinel Server for Novell NetWare"), + new(new FilePathMatch("NSRVOM.EXE"), "Rainbow NetSentinel Server for OS/2"), + new(new FilePathMatch("NSRVGX.EXE"), "Rainbow NetSentinel Server for Win32"), + + // Found in IA item "czchip199707cd". + new(new List + { + new FilePathMatch("DOSMON.EXE"), + new FilePathMatch("FIND.EXE"), + new FilePathMatch("NCEDIT.EXE"), + new FilePathMatch("NETEVAL.EXE"), + }, "Rainbow NetSentinel Monitor for DOS"), + + // Found in IA item "czchip199707cd". + new(new List + { + new FilePathMatch("OS2MON.EXE"), + new FilePathMatch("RHPANELP.DLL"), + }, "Rainbow NetSentinel Monitor for OS/2"), + + // Found in IA item "czchip199707cd". + new(new List + { + new FilePathMatch("MAPFILE.TXT"), + new FilePathMatch("NKWIN32.DLL"), + new FilePathMatch("NSLMS32.DLL"), + new FilePathMatch("W32EDITD.EXE"), + new FilePathMatch("W32EDITO.EXE"), + new FilePathMatch("WINMON.DOC"), + new FilePathMatch("WINMON.EXE"), + new FilePathMatch("WINMON.HLP"), + new FilePathMatch("WMON_DOC.EXE"), + }, "Rainbow NetSentinel Monitor for Win32"), + + // Found in IA item "chip-cds-2001-08". + // File names for Rainbow Sentinel files sometimes found in ".cab" files. + new(new FilePathMatch("F194_rnbovdd.dll.B391C188_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F195_sentinel.sys.B391C188_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F225_sentinel.hlp.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F227_snti386.dll.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F288_sentinel.vxd.B391C188_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F317_sentstrt.exe.B391C188_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F344_sentw9x.hlp.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F481_SetupSysDriver.exe.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F766_SentinelDriverInstall_Start.htm.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), }; return MatchUtil.GetAllMatches(files, matchers, any: true); @@ -141,8 +381,12 @@ namespace BinaryObjectScanner.Protection { var matchers = new List { + // The Parallel Port driver for Rainbow Sentinel (https://www.rainbow.com.my/document/endusertroubleshooting.pdf). + // Unforutnately, the file name overlaps with a file used by Clam Sentinel (https://clamsentinel.sourceforge.net/). + // TODO: Add LE check for "SENTINEL.VXD" once LE checks are implemented. + // new(new FilePathMatch("SENTINEL.VXD"), "Rainbow Sentinel"), + // Found in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]" and IA item "auto-cad-r14-cdrom". - new(new FilePathMatch("SENTINEL.VXD"), "Rainbow Sentinel"), new(new FilePathMatch("SENTSTRT.EXE"), "Rainbow Sentinel"), new(new FilePathMatch("SENTW95.DLL"), "Rainbow Sentinel"), new(new FilePathMatch("SENTW95.EXE"), "Rainbow Sentinel"), @@ -164,6 +408,31 @@ namespace BinaryObjectScanner.Protection new(new FilePathMatch("RainbowSentinel.386"), "Rainbow Sentinel"), new(new FilePathMatch("SX32W.DL_"), "Rainbow Sentinel"), new(new FilePathMatch("SX32W.DLL"), "Rainbow Sentinel"), + + // Found in IA item "pcwkcd-1296". + new(new FilePathMatch("SP32W.DLL"), "Rainbow Sentinel"), + new(new FilePathMatch("SSWIN.DLL"), "Rainbow Sentinel"), + + // Found in IA item "czchip199707cd". + new(new FilePathMatch("SENTINEL.DPP"), "Rainbow Sentinel OS/2 Installation Script"), + new(new FilePathMatch("SENTDOS.SYS"), "Rainbow Sentinel DOS Driver"), + new(new FilePathMatch("SENTINEL.386"), "Rainbow Sentinel Windows 3.1 Driver"), + new(new FilePathMatch("SNTALPHA.DLL"), "Rainbow Sentinel Windows NT Alpha Platform Driver"), + new(new FilePathMatch("SNTI386.DLL"), "Rainbow Sentinel Windows NT Intel Platform Driver"), + new(new FilePathMatch("SNTMIPS.DLL"), "Rainbow Sentinel Windows NT MIPS Platform Driver"), + new(new FilePathMatch("SNTPPC.DLL"), "Rainbow Sentinel Windows NT PowerPC Platform Driver"), + + // Found in IA item "chip-cds-2001-08". + // File names for Rainbow Sentinel files sometimes found in ".cab" files. + new(new FilePathMatch("F194_rnbovdd.dll.B391C188_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F195_sentinel.sys.B391C188_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F225_sentinel.hlp.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F227_snti386.dll.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F288_sentinel.vxd.B391C188_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F317_sentstrt.exe.B391C188_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F344_sentw9x.hlp.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F481_SetupSysDriver.exe.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), + new(new FilePathMatch("F766_SentinelDriverInstall_Start.htm.B391C18A_6953_11D4_82CB_00D0B72E1DB9"), "Rainbow Sentinel"), }; return MatchUtil.GetFirstMatch(path, matchers, any: true);