BOS.* -> BOS.*

2026-04-29 18:31:35 +00:00 · 2023-03-07 16:59:14 -05:00
parent e32b24c9f6
commit 473cbc5694
591 changed files with 1214 additions and 1214 deletions
--- a/BinaryObjectScanner.Models/PortableExecutable/SecuROMAddD.cs
+++ b/BinaryObjectScanner.Models/PortableExecutable/SecuROMAddD.cs
@@ -0,0 +1,60 @@
+using System.Runtime.InteropServices;
+
+namespace BinaryObjectScanner.Models.PortableExecutable
+{
+    /// <summary>
+    /// Overlay data associated with SecuROM executables
+    /// </summary>
+    /// <remarks>
+    /// All information in this file has been researched in a clean room
+    /// environment by using sample from legally obtained software that
+    /// is protected by SecuROM.
+    /// </remarks>
+    [StructLayout(LayoutKind.Sequential)]
+    public sealed class SecuROMAddD
+    {
+        /// <summary>
+        /// "AddD", Identifier?
+        /// </summary>
+        public uint Signature;
+
+        /// <summary>
+        /// Unknown (Entry count?)
+        /// </summary>
+        /// <remarks>
+        /// 3 in EXPUNGED, 3.17.00.0017, 3.17.00.0019
+        /// 3 in 4.47.00.0039, 4.84.00.0054, 4.84.69.0037, 4.84.76.7966, 4.84.76.7968, 4.85.07.0009
+        /// </remarks>
+        public uint EntryCount;
+
+        /// <summary>
+        /// Version, always 8 bytes?
+        /// </summary>
+        public string Version;
+
+        /// <summary>
+        /// Unknown (Build? Formatted as a string)
+        /// </summary>
+        public char[] Build;
+
+        /// <summary>
+        /// Unknown (0x14h), Variable number of bytes before entry table
+        /// </summary>
+        /// <remarks>
+        /// 44 bytes in EXPUNGED, 3.17.00.0017, 3.17.00.0019, 4.47.00.0039
+        /// 112 bytes in 4.84.00.0054, 4.84.69.0037, 4.84.76.7966, 4.84.76.7968, 4.85.07.0009
+        /// 112 byte range contains a fixed-length string at 0x2C, possibly a product ID?
+        /// "801400-001" in 4.84.00.0054
+        /// "594130-001" in 4.84.69.0037
+        /// "554900-001" in 4.84.76.7966
+        /// "554900-001" in 4.84.76.7968
+        /// "548520-001" in 4.85.07.0009
+        /// </remarks>
+        public byte[] Unknown14h;
+
+        /// <summary>
+        /// Entry table
+        /// </summary>
+        public SecuROMAddDEntry[] Entries;
+    }
+}