SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-20 15:55:15 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Fix inconsistency in interface implementations

Browse Source
This commit is contained in:
Matt Nadareski
2025-09-07 11:15:26 -04:00
parent bef5749b5e
commit 4b697c7d20
198 changed files with 1330 additions and 1330 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
BinaryObjectScanner/Protection/ActiveMARK.cs
View File

@@ -29,18 +29,18 @@ namespace BinaryObjectScanner.Protection
}
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the entry point data, if it exists
if (pex.EntryPointData != null)
if (exe.EntryPointData != null)
{
// Found in "Zuma.exe"
if (pex.EntryPointData.StartsWith(new byte?[] { 0x89, 0x25, 0x04, 0xF0, 0x86, 0x00, 0x68, 0x30 }))
if (exe.EntryPointData.StartsWith(new byte?[] { 0x89, 0x25, 0x04, 0xF0, 0x86, 0x00, 0x68, 0x30 }))
return "ActiveMark v5.3.1078 (Packer Version)";
}
// Get the .data section strings, if they exist
var strs = pex.GetLastSectionStrings(".data");
var strs = exe.GetLastSectionStrings(".data");
if (strs != null)
{
if (strs.Exists(s => s.Contains("MPRMMGVA"))
@@ -51,7 +51,7 @@ namespace BinaryObjectScanner.Protection
}
// Get "REGISTRY, AMINTERNETPROTOCOL" resource items
var resources = pex.FindResourceByNamedType("REGISTRY, AMINTERNETPROTOCOL");
var resources = exe.FindResourceByNamedType("REGISTRY, AMINTERNETPROTOCOL");
if (resources.Count > 0)
{
bool match = resources
@@ -62,14 +62,14 @@ namespace BinaryObjectScanner.Protection
}
// Get the overlay data, if it exists
if (pex.OverlayStrings != null)
if (exe.OverlayStrings != null)
{
if (pex.OverlayStrings.Exists(s => s.Contains("TMSAMVOH")))
if (exe.OverlayStrings.Exists(s => s.Contains("TMSAMVOH")))
return "ActiveMARK";
}
// Get the last .bss section strings, if they exist
strs = pex.GetLastSectionStrings(".bss");
strs = exe.GetLastSectionStrings(".bss");
if (strs != null)
{
if (strs.Exists(s => s.Contains("TMSAMVOF")))

6
BinaryObjectScanner/Protection/AegiSoft.cs
View File

@@ -20,7 +20,7 @@ namespace BinaryObjectScanner.Protection
public class AegiSoft : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// There are possibly identifying Product Names for some files used in AegiSoft License Manager, but they were deemed too overmatching to use for the time being (Found in Redump entry 73521/IA item "Nova_HoyleCasino99USA")..
// "Asc001.dll" has the Product Name "Install Dynamic Link Library".
@@ -34,12 +34,12 @@ namespace BinaryObjectScanner.Protection
// "Asc002.dll" has the string "AscActivate"
// Get string table resources
var resource = pex.FindStringTableByEntry("AegiSoft License Manager");
var resource = exe.FindStringTableByEntry("AegiSoft License Manager");
if (resource.Count > 0)
return "AegiSoft License Manager";
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
var dataSectionRaw = exe.GetFirstSectionData(".data") ?? exe.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>

10
BinaryObjectScanner/Protection/AlphaROM.cs
View File

@@ -42,13 +42,13 @@ namespace BinaryObjectScanner.Protection
public class AlphaROM : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Add support for detecting Alpha-ROM found in older games made with the RealLive engine.
// TODO: Add version detection for Alpha-ROM.
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("\\SETTEC")))
@@ -59,7 +59,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".rdata");
strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("This Game is Japan Only")))
@@ -75,10 +75,10 @@ namespace BinaryObjectScanner.Protection
}
// Get the overlay data, if it exists
if (pex.OverlayStrings != null)
if (exe.OverlayStrings != null)
{
// Found in Redump entry 84122.
if (pex.OverlayStrings.Exists(s => s.Contains("SETTEC0000")))
if (exe.OverlayStrings.Exists(s => s.Contains("SETTEC0000")))
return "Alpha-ROM";
}

10
BinaryObjectScanner/Protection/Armadillo.cs
View File

@@ -21,19 +21,19 @@ namespace BinaryObjectScanner.Protection
public class Armadillo : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .nicode section, if it exists
if (pex.ContainsSection(".nicode", exact: true))
if (exe.ContainsSection(".nicode", exact: true))
return "Armadillo";
// Loop through all "extension" sections -- usually .data1 or .text1
if (pex.SectionNames != null)
if (exe.SectionNames != null)
{
foreach (var sectionName in Array.FindAll(pex.SectionNames ?? [], s => s != null && s.EndsWith("1")))
foreach (var sectionName in Array.FindAll(exe.SectionNames ?? [], s => s != null && s.EndsWith("1")))
{
// Get the section strings, if they exist
var strs = pex.GetFirstSectionStrings(sectionName);
var strs = exe.GetFirstSectionStrings(sectionName);
if (strs != null)
{
if (strs.Exists(s => s.Contains("ARMDEBUG")))

34
BinaryObjectScanner/Protection/ByteShield.cs
View File

@@ -40,49 +40,49 @@ namespace BinaryObjectScanner.Protection
public class ByteShield : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in "LineRider2.exe" in Redump entry 6236
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalEquals("ByteShield Client"))
return $"ByteShield Activation Client {pex.GetInternalVersion()}";
return $"ByteShield Activation Client {exe.GetInternalVersion()}";
// Found in "LineRider2.exe" in Redump entry 6236
name = pex.InternalName;
name = exe.InternalName;
if (name.OptionalEquals("ByteShield"))
return $"ByteShield Activation Client {pex.GetInternalVersion()}";
return $"ByteShield Activation Client {exe.GetInternalVersion()}";
// Found in "LineRider2.exe" in Redump entry 6236
name = pex.OriginalFilename;
name = exe.OriginalFilename;
if (name.OptionalEquals("ByteShield.EXE"))
return $"ByteShield Activation Client {pex.GetInternalVersion()}";
return $"ByteShield Activation Client {exe.GetInternalVersion()}";
// Found in "LineRider2.exe" in Redump entry 6236
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalEquals("ByteShield Client"))
return $"ByteShield Activation Client {pex.GetInternalVersion()}";
return $"ByteShield Activation Client {exe.GetInternalVersion()}";
// Found in "ByteShield.dll" in Redump entry 6236
name = pex.Model.ExportTable?.ExportDirectoryTable?.Name;
name = exe.Model.ExportTable?.ExportDirectoryTable?.Name;
if (name.OptionalEquals("ByteShield Client"))
return "ByteShield Component Module";
// Found in "LineRider2.exe" in Redump entry 6236
if (pex.FindStringTableByEntry("ByteShield").Count > 0)
return $"ByteShield Activation Client {pex.GetInternalVersion()}";
if (exe.FindStringTableByEntry("ByteShield").Count > 0)
return $"ByteShield Activation Client {exe.GetInternalVersion()}";
// Found in "LineRider2.exe" in Redump entry 6236
if (pex.FindDialogByTitle("About ByteShield").Count > 0)
if (exe.FindDialogByTitle("About ByteShield").Count > 0)
return "ByteShield";
// TODO: See if the version number is anywhere else
// TODO: Parse the version number out of the dialog box item
// Found in "LineRider2.exe" in Redump entry 6236
if (pex.FindDialogBoxByItemTitle("ByteShield Version 1.0").Count > 0)
if (exe.FindDialogBoxByItemTitle("ByteShield Version 1.0").Count > 0)
return "ByteShield";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "LineRider2.exe" in Redump entry 6236
@@ -91,7 +91,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".rdata");
strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Found in "ByteShield.dll" in Redump entry 6236
@@ -108,7 +108,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .ret section strings, if they exist
strs = pex.GetFirstSectionStrings(".ret");
strs = exe.GetFirstSectionStrings(".ret");
if (strs != null)
{
// TODO: Figure out if this specifically indicates if the file is encrypted

8
BinaryObjectScanner/Protection/CDCheck.cs
View File

@@ -6,19 +6,19 @@ namespace BinaryObjectScanner.Protection
public class CDCheck : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.Comments;
var name = exe.Comments;
if (name.OptionalContains("CDCheck utlity for Microsoft Game Studios"))
return "Microsoft Game Studios CD Check";
// To broad to be of use
//name = pex.InternalName;
//name = exe.InternalName;
//if (name.OptionalContains("CDCheck"))
// return "Microsoft Game Studios CD Check";
// To broad to be of use
//name = pex.OriginalFilename;
//name = exe.OriginalFilename;
//if (name.OptionalContains("CDCheck.exe"))
// return "Microsoft Game Studios CD Check";

22
BinaryObjectScanner/Protection/CDDVDCops.cs
View File

@@ -70,10 +70,10 @@ namespace BinaryObjectScanner.Protection
public class CDDVDCops : IExecutableCheck<NewExecutable>, IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, NewExecutable nex, bool includeDebug)
public string? CheckExecutable(string file, NewExecutable exe, bool includeDebug)
{
// TODO: Don't read entire file
byte[]? data = nex.ReadArbitraryRange();
byte[]? data = exe.ReadArbitraryRange();
if (data == null)
return null;
@@ -120,14 +120,14 @@ namespace BinaryObjectScanner.Protection
return match;
// Get the resident and non-resident name table strings
var nrntStrs = Array.ConvertAll(nex.Model.NonResidentNameTable ?? [],
var nrntStrs = Array.ConvertAll(exe.Model.NonResidentNameTable ?? [],
nrnte => nrnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(nrnte.NameString));
// Check the imported-name table
// Found in "h3blade.exe" in Redump entry 85077.
if (nex.Model.ImportedNameTable != null)
if (exe.Model.ImportedNameTable != null)
{
foreach (var inte in nex.Model.ImportedNameTable.Values)
foreach (var inte in exe.Model.ImportedNameTable.Values)
{
if (inte.NameString.IsNullOrEmpty())
continue;
@@ -147,10 +147,10 @@ namespace BinaryObjectScanner.Protection
}
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the stub executable data, if it exists
if (pex.StubExecutableData != null)
if (exe.StubExecutableData != null)
{
var matchers = new List<ContentMatchSet>
{
@@ -162,26 +162,26 @@ namespace BinaryObjectScanner.Protection
}, "WEB-Cops")
};
var match = MatchUtil.GetFirstMatch(file, pex.StubExecutableData, matchers, includeDebug);
var match = MatchUtil.GetFirstMatch(file, exe.StubExecutableData, matchers, includeDebug);
if (!string.IsNullOrEmpty(match))
return match;
}
// Get the .grand section, if it exists
// Found in "AGENTHUG.QZ_" in Redump entry 84517 and "h3blade.QZ_" in Redump entry 85077.
if (pex.ContainsSection(".grand", exact: true))
if (exe.ContainsSection(".grand", exact: true))
return "CD/DVD/WEB-Cops";
// Get the UNICops section, if it exists
// Found in "FGP.exe" in IA item "flaklypa-grand-prix-dvd"/Redump entry 108169.
if (pex.ContainsSection("UNICops", exact: true))
if (exe.ContainsSection("UNICops", exact: true))
return "UNI-Cops";
// Get the DATA section, if it exists
// Found in "bib.dll" in IA item "https://archive.org/details/cover_202501"
// This contains the version section that the Content Check looked for. There are likely other sections
// that may contain it. Update when more are found.
var strs = pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
var match = strs.Find(s => s.Contains(" ver. ") && (s.Contains("CD-Cops, ") || s.Contains("DVD-Cops, ")));

10
BinaryObjectScanner/Protection/CDGuard.cs
View File

@@ -23,24 +23,24 @@ namespace BinaryObjectScanner.Protection
public class CDGuard : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Investigate the numerous ".guard" sections present in "Randevu.exe" in Redump entry 97142.
// Get the export directory table
if (pex.Model.ExportTable?.ExportDirectoryTable != null)
if (exe.Model.ExportTable?.ExportDirectoryTable != null)
{
// Found in "cdguard.dll" in Redump entry 97142 and IA item "pahgeby-he3hakomkou".
bool match = pex.Model.ExportTable.ExportDirectoryTable.Name.OptionalEquals("cdguard.dll", StringComparison.OrdinalIgnoreCase);
bool match = exe.Model.ExportTable.ExportDirectoryTable.Name.OptionalEquals("cdguard.dll", StringComparison.OrdinalIgnoreCase);
if (match)
return "CD-Guard Copy Protection System";
}
// Get the import directory table
if (pex.Model.ImportTable?.ImportDirectoryTable != null)
if (exe.Model.ImportTable?.ImportDirectoryTable != null)
{
// Found in "Randevu.exe" in Redump entry 97142.
bool match = Array.Exists(pex.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name != null && idte.Name.Equals("cdguard.dll", StringComparison.OrdinalIgnoreCase));
bool match = Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name != null && idte.Name.Equals("cdguard.dll", StringComparison.OrdinalIgnoreCase));
if (match)
return "CD-Guard Copy Protection System";
}

4
BinaryObjectScanner/Protection/CDKey.cs
View File

@@ -7,9 +7,9 @@ namespace BinaryObjectScanner.Protection
public class CDKey : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.InternalName;
var name = exe.InternalName;
if (name.OptionalEquals("CDKey", StringComparison.OrdinalIgnoreCase))
return "CD-Key / Serial";

4
BinaryObjectScanner/Protection/CDLock.cs
View File

@@ -28,10 +28,10 @@ namespace BinaryObjectScanner.Protection
public class CDLock : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
var dataSectionRaw = exe.GetFirstSectionData(".data") ?? exe.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>

8
BinaryObjectScanner/Protection/CDSHiELDSE.cs
View File

@@ -6,19 +6,19 @@ namespace BinaryObjectScanner.Protection
public class CDSHiELDSE : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Indicates Hypertech Crack Proof as well?
//// Get the import directory table
//if (pex.Model.ImportTable?.ImportDirectoryTable != null)
//if (exe.Model.ImportTable?.ImportDirectoryTable != null)
//{
// bool match = pex.Model.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "KeRnEl32.dLl");
// bool match = exe.Model.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "KeRnEl32.dLl");
// if (match)
// return "CDSHiELD SE";
//}
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
var strs = exe.GetFirstSectionStrings("code") ?? exe.GetFirstSectionStrings("CODE");
if (strs != null)
{
if (strs.Exists(s => s.Contains("~0017.tmp")))

14
BinaryObjectScanner/Protection/CenegaProtectDVD.cs
View File

@@ -15,27 +15,27 @@ namespace BinaryObjectScanner.Protection
public class CenegaProtectDVD : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the export directory table
if (pex.Model.ExportTable?.ExportDirectoryTable != null)
if (exe.Model.ExportTable?.ExportDirectoryTable != null)
{
// Found in "cenega.dll" in IA item "speed-pack".
bool match = pex.Model.ExportTable.ExportDirectoryTable.Name.OptionalEquals("ProtectDVD.dll", StringComparison.OrdinalIgnoreCase);
bool match = exe.Model.ExportTable.ExportDirectoryTable.Name.OptionalEquals("ProtectDVD.dll", StringComparison.OrdinalIgnoreCase);
if (match)
return "Cenega ProtectDVD";
}
// Get the .cenega section, if it exists. Seems to be found in the protected game executable ("game.exe" in Redump entry 31422 and "Classic Car Racing.exe" in IA item "speed-pack").
if (pex.ContainsSection(".cenega", exact: true))
if (exe.ContainsSection(".cenega", exact: true))
return "Cenega ProtectDVD";
// Get the .cenega0 through .cenega2 sections, if they exists. Found in "cenega.dll" in Redump entry 31422 and IA item "speed-pack".
if (pex.ContainsSection(".cenega0", exact: true))
if (exe.ContainsSection(".cenega0", exact: true))
return "Cenega ProtectDVD";
if (pex.ContainsSection(".cenega1", exact: true))
if (exe.ContainsSection(".cenega1", exact: true))
return "Cenega ProtectDVD";
if (pex.ContainsSection(".cenega2", exact: true))
if (exe.ContainsSection(".cenega2", exact: true))
return "Cenega ProtectDVD";
return null;

8
BinaryObjectScanner/Protection/Channelware.cs
View File

@@ -23,10 +23,10 @@ namespace BinaryObjectScanner.Protection
public class Channelware : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in "AbeWincw.dll" in Redump entry 116358 and in "TOYSGMcw.dll" in the "TOYSTORY" installation folder from Redump entry 12354.
var name = pex.ProductName;
var name = exe.ProductName;
if (name.OptionalEquals("ChannelWare Utilities"))
return "Channelware";
@@ -42,12 +42,12 @@ namespace BinaryObjectScanner.Protection
if (name.OptionalEquals("Channelware Authorization Server Browser Launcher"))
return "Channelware";
name = pex.FileDescription;
name = exe.FileDescription;
// Found in "cwuninst.exe" in the "Channelware" folder installed from Redump entry 12354.
if (name.OptionalEquals("Channelware Launcher Uninstall"))
return "Channelware";
name = pex.LegalTrademarks;
name = exe.LegalTrademarks;
// Found in "CWAuto.dll" and "Upgrader.exe" in the "TOYSTORY" installation folder from Redump entry 12354.
if (name.OptionalEquals("Channelware"))
return "Channelware";

8
BinaryObjectScanner/Protection/ChosenBytesCodeLock.cs
View File

@@ -22,16 +22,16 @@ namespace BinaryObjectScanner.Protection
public class ChosenBytesCodeLock : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in "Code-Lock.ocx" in Code-Lock version 2.35.
// Also worth noting is the File Description for this file, which is "A future for you, a challenge for the rest.".
var name = pex.ProductName;
var name = exe.ProductName;
if (name.OptionalStartsWith("Code-Lock", StringComparison.OrdinalIgnoreCase))
return $"ChosenBytes Code-Lock {pex.ProductVersion}";
return $"ChosenBytes Code-Lock {exe.ProductVersion}";
// Get the .text section strings, if they exist
var strs = pex.GetFirstSectionStrings(".text");
var strs = exe.GetFirstSectionStrings(".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("CODE-LOCK.OCX")))

4
BinaryObjectScanner/Protection/CopyKiller.cs
View File

@@ -18,11 +18,11 @@ namespace BinaryObjectScanner.Protection
public class CopyKiller : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Figure out why this check doesn't work.
// Found in "autorun.exe" in CopyKiller V3.64, V3.99, and V3.99a.
var name = pex.ProductName;
var name = exe.ProductName;
if (name.OptionalStartsWith("CopyKiller", StringComparison.OrdinalIgnoreCase))
return "CopyKiller V3.64+";

4
BinaryObjectScanner/Protection/CopyLok.cs
View File

@@ -23,12 +23,12 @@ namespace BinaryObjectScanner.Protection
public class CopyLok : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// If there are more than 2 icd-prefixed sections, then we have a match
// Though this is the same name that SafeDisc uses for protected executables, this seems to be a coincidence.
// Found in Redump entries 31557, 31674, 31675, 31708, 38239, 44210, and 53929.
int icdSectionCount = Array.FindAll(pex.SectionNames ?? [], s => s.StartsWith("icd")).Length;
int icdSectionCount = Array.FindAll(exe.SectionNames ?? [], s => s.StartsWith("icd")).Length;
if (icdSectionCount >= 2)
return "CopyLok / CodeLok";

10
BinaryObjectScanner/Protection/CopyX.cs
View File

@@ -57,16 +57,16 @@ namespace BinaryObjectScanner.Protection
// Find a viable way to check the last directory alphabetically and not just ZDAT*
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Checks for Professional
// PEX checks intentionally only detect Professional
var sections = pex.Model.SectionTable;
var sections = exe.Model.SectionTable;
if (sections == null)
return null;
if (pex.OverlayStrings != null)
if (exe.OverlayStrings != null)
{
// Checks if main executable contains reference to optgraph.dll.
// This might be better removed later, as Redump ID 82475 is a false positive, and also doesn't actually
@@ -76,11 +76,11 @@ namespace BinaryObjectScanner.Protection
// TODO: This might need to check every single section. Unsure until more samples are acquired.
// TODO: TKKG also has an NE 3.1x executable with a reference. This can be added later.
// Samples: Redump ID 108150
if (pex.OverlayStrings.Exists(s => s.Contains("optgraph.dll")))
if (exe.OverlayStrings.Exists(s => s.Contains("optgraph.dll")))
return "copy-X [Check disc for physical ring]";
}
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Samples: Redump ID 82475, German Emergency 2 Deluxe, Redump ID 48393

14
BinaryObjectScanner/Protection/CrypKey.cs
View File

@@ -13,10 +13,10 @@ namespace BinaryObjectScanner.Protection
public class CrypKey : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
var strs = exe.GetFirstSectionStrings("code") ?? exe.GetFirstSectionStrings("CODE");
if (strs != null)
{
// Found in "NECRO95.EXE" in IA item "NBECRORV11".
@@ -36,25 +36,25 @@ namespace BinaryObjectScanner.Protection
}
// Get the CrypKey version from the VersionInfo, if it exists
string version = pex.GetVersionInfoString("CrypKey Version") ?? string.Empty;
string version = exe.GetVersionInfoString("CrypKey Version") ?? string.Empty;
// Found in 'cki32k.dll'
var name = pex.CompanyName;
var name = exe.CompanyName;
if (name.OptionalStartsWith("CrypKey"))
return $"CrypKey {version}".TrimEnd();
name = pex.FileDescription;
name = exe.FileDescription;
// Found in "CKSEC_32.DLL" in IA item "NBECRORV11".
if (name.OptionalStartsWith("CrypKey Instant security library"))
return $"CrypKey Instant {pex.GetInternalVersion()}";
return $"CrypKey Instant {exe.GetInternalVersion()}";
// Found in 'cki32k.dll'
if (name.OptionalStartsWith("CrypKey"))
return $"CrypKey {version}".TrimEnd();
// Found in 'cki32k.dll'
name = pex.LegalCopyright;
name = exe.LegalCopyright;
if (name.OptionalContains("CrypKey"))
return $"CrypKey {version}".TrimEnd();

4
BinaryObjectScanner/Protection/Cucko.cs
View File

@@ -13,10 +13,10 @@ namespace BinaryObjectScanner.Protection
public class Cucko : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .text section, if it exists
var textData = pex.GetFirstSectionData(".text");
var textData = exe.GetFirstSectionData(".text");
if (textData != null)
{
var matchers = new List<ContentMatchSet>

22
BinaryObjectScanner/Protection/Denuvo.cs
View File

@@ -32,12 +32,12 @@ namespace BinaryObjectScanner.Protection
// https://www.pcgamingwiki.com/wiki/Denuvo#Redeem.exe
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// All current checks for Denuvo Anti-Cheat come from Doom Eternal Update 1 (Steam Depot 782332, Manifest 7064393210727378308).
// Found in "denuvo-anti-cheat.sys".
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalEquals("Denuvo Anti-Cheat Driver", StringComparison.OrdinalIgnoreCase))
return $"Denuvo Anti-Cheat";
@@ -62,8 +62,8 @@ namespace BinaryObjectScanner.Protection
// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/_denuvoComplete.2.sg
// Denuvo Protector
if (pex.Model.OptionalHeader?.Magic == OHMN.PE32Plus
&& pex.EntryPointData != null)
if (exe.Model.OptionalHeader?.Magic == OHMN.PE32Plus
&& exe.EntryPointData != null)
{
byte?[] denuvoProtector =
[
@@ -72,7 +72,7 @@ namespace BinaryObjectScanner.Protection
0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
];
if (pex.EntryPointData.StartsWith(denuvoProtector))
if (exe.EntryPointData.StartsWith(denuvoProtector))
return "Denuvo Protector";
}
@@ -86,16 +86,16 @@ namespace BinaryObjectScanner.Protection
0x69, 0x6D, 0x69, 0x6E, 0x67,
}, "Denuvo")
};
var timingMatch = MatchUtil.GetFirstMatch(file, pex.EntryPointData, timingMatchers, includeDebug);
var timingMatch = MatchUtil.GetFirstMatch(file, exe.EntryPointData, timingMatchers, includeDebug);
// TODO: Re-enable all Entry Point checks after implementing
if (pex.ContainsSection(".arch")
if (exe.ContainsSection(".arch")
// Disabled scanning in files with the ".srdata" section due to numerous false positives.
// These include Redump entry 112733 and Bus Hound 5.04 (https://web.archive.org/web/20070129204350/http://www.perisoft.net/bin/bhe504.exe).
// || pex.ContainsSection(".srdata")
// || exe.ContainsSection(".srdata")
|| !string.IsNullOrEmpty(timingMatch))
{
if (pex.Model.OptionalHeader?.Magic == OHMN.PE32Plus)
if (exe.Model.OptionalHeader?.Magic == OHMN.PE32Plus)
{
var matchers = new List<ContentMatchSet>
{
@@ -165,7 +165,7 @@ namespace BinaryObjectScanner.Protection
"Denuvo v3.0b (x64)"),
};
var match = MatchUtil.GetFirstMatch(file, pex.EntryPointData, matchers, includeDebug);
var match = MatchUtil.GetFirstMatch(file, exe.EntryPointData, matchers, includeDebug);
if (!string.IsNullOrEmpty(match))
return match;
@@ -231,7 +231,7 @@ namespace BinaryObjectScanner.Protection
"Denuvo v2.0 (x86)"),
};
var match = MatchUtil.GetFirstMatch(file, pex.EntryPointData, matchers, includeDebug);
var match = MatchUtil.GetFirstMatch(file, exe.EntryPointData, matchers, includeDebug);
if (!string.IsNullOrEmpty(match))
return match;

8
BinaryObjectScanner/Protection/DigiGuard.cs
View File

@@ -26,20 +26,20 @@ namespace BinaryObjectScanner.Protection
public class DigiGuard : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in "Start.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588.
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalEquals("DigiGuard3 Client"))
return $"DigiGuard3";
// Found in "Start.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588.
name = pex.LegalTrademarks;
name = exe.LegalTrademarks;
if (name.OptionalEquals("DigiGuard"))
return $"DigiGuard";
// Found in "PJS3.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588.
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalEquals("Greenleaf Wrapper3"))
return $"DigiGuard";

24
BinaryObjectScanner/Protection/DiscGuard.cs
View File

@@ -38,40 +38,40 @@ namespace BinaryObjectScanner.Protection
{
// TODO: Add checks for the game executables, which seem likely to contain some kind of indicators that can be checked for. The game executables all seem to import "Ord(1)" from one of the varying DLLs present.
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374).
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("IOSLinkNT", StringComparison.OrdinalIgnoreCase))
return "DiscGuard";
// Found in "T29.dll" (Redump entry 31914).
if (name.OptionalStartsWith("TTR Technologies DiscGuard (tm)", StringComparison.OrdinalIgnoreCase))
return $"DiscGuard {GetVersion(pex)}";
return $"DiscGuard {GetVersion(exe)}";
// Found in "T29.dll" (Redump entry 31914).
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("DiscGuard (tm)", StringComparison.OrdinalIgnoreCase))
return "DiscGuard";
// Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374).
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("TTR Technologies Ltd. DiscGuard (tm)", StringComparison.OrdinalIgnoreCase))
return "DiscGuard";
// Found in "Alternate.exe" (Redump entry 31914) and "Alt.exe" (Redump entries 46743, 46961, 79284, and 79374).
List<Dictionary<int, string?>?> resources =
[
.. pex.FindStringTableByEntry("DiscGuard"),
.. pex.FindStringTableByEntry("The file Dg.vbn was not found."),
.. pex.FindStringTableByEntry("The file IosLink.VxD was not found."),
.. pex.FindStringTableByEntry("The file IosLink.sys was not found."),
.. exe.FindStringTableByEntry("DiscGuard"),
.. exe.FindStringTableByEntry("The file Dg.vbn was not found."),
.. exe.FindStringTableByEntry("The file IosLink.VxD was not found."),
.. exe.FindStringTableByEntry("The file IosLink.sys was not found."),
];
if (resources.Count > 0)
return "DiscGuard";
// Get the .vbn section, if it exists
var vbnData = pex.GetFirstSectionData(".vbn");
var vbnData = exe.GetFirstSectionData(".vbn");
if (vbnData != null)
{
var matchers = new List<ContentMatchSet>
@@ -178,10 +178,10 @@ namespace BinaryObjectScanner.Protection
}
/// <inheritdoc/>
private static string GetVersion(PortableExecutable pex)
private static string GetVersion(PortableExecutable exe)
{
// Check the internal versions
var version = pex.GetInternalVersion();
var version = exe.GetInternalVersion();
if (!string.IsNullOrEmpty(version))
return version!;

8
BinaryObjectScanner/Protection/EAAntiCheat.cs
View File

@@ -19,19 +19,19 @@ namespace BinaryObjectScanner.Protection
{
// TODO: Add support for detecting older versions, especially versions made before Easy Anti-Cheat was purchased by Epic Games.
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
// Found in "EAAntiCheat.GameServiceLauncher.exe" and "EAAntiCheat.Installer.exe" in "Plants vs. Zombies: Battle for Neighborville" (Steam Depot 1262241, Manifest 8124759833120741594).
if (!string.IsNullOrEmpty(name) && name!.Contains("EA Anticheat"))
return "EA Anti Cheat";
name = pex.ProductName;
name = exe.ProductName;
// Found in "EAAntiCheat.GameServiceLauncher.exe" and "EAAntiCheat.Installer.exe" in "Plants vs. Zombies: Battle for Neighborville" (Steam Depot 1262241, Manifest 8124759833120741594).
if (!string.IsNullOrEmpty(name) && name!.Contains("EA Anticheat"))
return "EA Anti Cheat";
name = pex.InternalName;
name = exe.InternalName;
// Found in "EAAntiCheat.GameServiceLauncher.exe" and "EAAntiCheat.Installer.exe" in "Plants vs. Zombies: Battle for Neighborville" (Steam Depot 1262241, Manifest 8124759833120741594).
if (!string.IsNullOrEmpty(name) && name!.Equals("skyfall"))
return "EA Anti Cheat";

6
BinaryObjectScanner/Protection/EasyAntiCheat.cs
View File

@@ -22,9 +22,9 @@ namespace BinaryObjectScanner.Protection
{
// TODO: Add support for detecting older versions, especially versions made before Easy Anti-Cheat was purchased by Epic Games.
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
// Found in "VideoHorrorSociety.exe" ("Video Horror Society", Patch 1.0.70309, Steam).
if (!string.IsNullOrEmpty(name) && name!.Contains("Easy Anti-Cheat Bootstrapper (EOS)"))
return "Easy Anti-Cheat (EOS Version)";
@@ -50,7 +50,7 @@ namespace BinaryObjectScanner.Protection
// "EasyAntiCheat Server" -> "eac_server.dll" from "Intruder" (Update 2287, Steam).
// "EasyAntiCheat Service" -> "EasyAntiCheat.exe", which is found installed in "Program Files (x86)\EasyAntiCheat" and "EasyAntiCheat_Setup.exe" ("Intruder", Update 2287, Steam).
name = pex.ProductName;
name = exe.ProductName;
// Found in multiple files, including "VideoHorrorSociety.exe" ("Video Horror Society", Patch 1.0.70309, Steam) and "start_protected_game.exe" ("VRChat", Version 2022.2.2p2, Oculus).
if (!string.IsNullOrEmpty(name) && name!.Contains("Easy Anti-Cheat Bootstrapper (EOS)"))
return "Easy Anti-Cheat (EOS Version)";

28
BinaryObjectScanner/Protection/ElectronicArts.cs
View File

@@ -7,27 +7,27 @@ namespace BinaryObjectScanner.Protection
public class ElectronicArts : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalContains("EReg MFC Application"))
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";
return $"EA CdKey Registration Module {exe.GetInternalVersion()}";
else if (name.OptionalContains("Registration code installer program"))
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";
return $"EA CdKey Registration Module {exe.GetInternalVersion()}";
else if (name.OptionalEquals("EA DRM Helper", StringComparison.OrdinalIgnoreCase))
return $"EA DRM Protection {pex.GetInternalVersion()}";
return $"EA DRM Protection {exe.GetInternalVersion()}";
name = pex.InternalName;
name = exe.InternalName;
if (name.OptionalEquals("CDCode", StringComparison.Ordinal))
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";
return $"EA CdKey Registration Module {exe.GetInternalVersion()}";
if (pex.FindDialogByTitle("About CDKey").Count > 0)
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";
else if (pex.FindGenericResource("About CDKey").Count > 0)
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";
if (exe.FindDialogByTitle("About CDKey").Count > 0)
return $"EA CdKey Registration Module {exe.GetInternalVersion()}";
else if (exe.FindGenericResource("About CDKey").Count > 0)
return $"EA CdKey Registration Module {exe.GetInternalVersion()}";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("EReg Config Form")))
@@ -35,7 +35,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".rdata");
strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("GenericEA")) && strs.Exists(s => s.Contains("Activation")))
@@ -43,7 +43,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".text");
strs = exe.GetFirstSectionStrings(".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("GenericEA")) && strs.Exists(s => s.Contains("Activation")))

14
BinaryObjectScanner/Protection/Engine32.cs
View File

@@ -15,16 +15,16 @@ namespace BinaryObjectScanner.Protection
public class Engine32 : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Most every tested sample of "engine32.dll" has a product name of "engine32", and the file description typically follows the naming pattern of "[Game Name] DLL-helper".
// Detects Engine32 within the game executables that contain it.
if (pex.Model.ImportTable?.ImportDirectoryTable != null && pex.Model.ImportTable?.HintNameTable != null)
if (exe.Model.ImportTable?.ImportDirectoryTable != null && exe.Model.ImportTable?.HintNameTable != null)
{
bool importDirectoryTableMatch = Array.Exists(pex.Model.ImportTable.ImportDirectoryTable,
bool importDirectoryTableMatch = Array.Exists(exe.Model.ImportTable.ImportDirectoryTable,
idte => idte?.Name != null && idte.Name.Equals("ENGINE32.DLL", StringComparison.OrdinalIgnoreCase));
bool hintNameTableMatch = Array.Exists(pex.Model.ImportTable.HintNameTable,
bool hintNameTableMatch = Array.Exists(exe.Model.ImportTable.HintNameTable,
ihne => ihne?.Name == "InitEngine");
// The Hint/Name Table Entry "DeinitEngine" is present in every tested sample, aside from TOCA Race Driver 2 (Redump entries 104593-104596).
@@ -33,10 +33,10 @@ namespace BinaryObjectScanner.Protection
}
// Detects Engine32 within the file "engine32.dll".
if (pex.Model.ExportTable?.ExportNameTable?.Strings != null)
if (exe.Model.ExportTable?.ExportNameTable?.Strings != null)
{
bool exportNameTableMatch1 = Array.Exists(pex.Model.ExportTable.ExportNameTable.Strings, s => s == "engine32.dll");
bool exportNameTableMatch2 = Array.Exists(pex.Model.ExportTable.ExportNameTable.Strings, s => s == "DeinitEngine");
bool exportNameTableMatch1 = Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s == "engine32.dll");
bool exportNameTableMatch2 = Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s == "DeinitEngine");
if (exportNameTableMatch1 && exportNameTableMatch2)
return "Engine32";

12
BinaryObjectScanner/Protection/GFWL.cs
View File

@@ -11,18 +11,18 @@ namespace BinaryObjectScanner.Protection
public class GFWL : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("Games for Windows - LIVE Zero Day Piracy Protection", StringComparison.OrdinalIgnoreCase))
return $"Games for Windows LIVE - Zero Day Piracy Protection Module {pex.GetInternalVersion()}";
return $"Games for Windows LIVE - Zero Day Piracy Protection Module {exe.GetInternalVersion()}";
else if (name.OptionalStartsWith("Games for Windows", StringComparison.OrdinalIgnoreCase))
return $"Games for Windows LIVE {pex.GetInternalVersion()}";
return $"Games for Windows LIVE {exe.GetInternalVersion()}";
// Get the import directory table
if (pex.Model.ImportTable?.ImportDirectoryTable != null)
if (exe.Model.ImportTable?.ImportDirectoryTable != null)
{
if (Array.Exists(pex.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "xlive.dll"))
if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "xlive.dll"))
return "Games for Windows LIVE";
}

6
BinaryObjectScanner/Protection/Gefest.cs
View File

@@ -19,12 +19,12 @@ namespace BinaryObjectScanner.Protection
public class Gefest : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the header padding strings, if it exists
if (pex.HeaderPaddingStrings != null)
if (exe.HeaderPaddingStrings != null)
{
var match = pex.HeaderPaddingStrings.Find(s => s.Contains("Gefest Protection System"));
var match = exe.HeaderPaddingStrings.Find(s => s.Contains("Gefest Protection System"));
if (match != null)
return $"Gefest Protection System {GetVersion(match)}";
}

12
BinaryObjectScanner/Protection/HexalockAutoLock.cs
View File

@@ -32,11 +32,11 @@ namespace BinaryObjectScanner.Protection
public class HexalockAutoLock : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Fix the following checks, as this information is visible via Windows Explorer but isn't currently being seen by BOS.
// Found in "HCPSMng.exe".
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("HCPS Manager", StringComparison.OrdinalIgnoreCase))
return $"Hexalock AutoLock 4.5";
@@ -45,12 +45,12 @@ namespace BinaryObjectScanner.Protection
return $"Hexalock AutoLock 4.5";
// Found in both "HCPSMng.exe" and in the file typically named "Start_Here.exe".
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("HCPS", StringComparison.OrdinalIgnoreCase))
return $"Hexalock AutoLock 4.5";
// Get the .text section strings, if they exist
var strs = pex.GetFirstSectionStrings(".text");
var strs = exe.GetFirstSectionStrings(".text");
if (strs != null)
{
// Found in "The Sudoku Challenge Collection.exe" in "The Sudoku Challenge! Collection" by Play at Joe's.
@@ -59,7 +59,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the code/CODE section strings, if they exist
strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
strs = exe.GetFirstSectionStrings("code") ?? exe.GetFirstSectionStrings("CODE");
if (strs != null)
{
// Found in "launcher.exe" in "Sea Adventure / Adventure de la Mer" by Compedia.
@@ -68,7 +68,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the UPX1 section strings, if they exist
strs = pex.GetFirstSectionStrings("UPX1");
strs = exe.GetFirstSectionStrings("UPX1");
if (strs != null)
{
// Found in "postmanpat.exe" in "Postman Pat" by Compedia.

22
BinaryObjectScanner/Protection/ImpulseReactor.cs
View File

@@ -13,28 +13,28 @@ namespace BinaryObjectScanner.Protection
public class ImpulseReactor : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalContains("ImpulseReactor Dynamic Link Library"))
return $"Impulse Reactor Core Module {pex.GetInternalVersion()}";
return $"Impulse Reactor Core Module {exe.GetInternalVersion()}";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalContains("ImpulseReactor Dynamic Link Library"))
return $"Impulse Reactor Core Module {pex.GetInternalVersion()}";
return $"Impulse Reactor Core Module {exe.GetInternalVersion()}";
name = pex.OriginalFilename;
name = exe.OriginalFilename;
if (name.OptionalContains("ReactorActivate.exe"))
return $"Stardock Product Activation {pex.GetInternalVersion()}";
return $"Stardock Product Activation {exe.GetInternalVersion()}";
// TODO: Check for CVP* instead?
bool containsCheck = false;
if (pex.Model.ExportTable?.ExportNameTable?.Strings != null)
containsCheck = Array.Exists(pex.Model.ExportTable.ExportNameTable.Strings, s => s.OptionalStartsWith("CVPInitializeClient"));
if (exe.Model.ExportTable?.ExportNameTable?.Strings != null)
containsCheck = Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s.OptionalStartsWith("CVPInitializeClient"));
// Get the .rdata section strings, if they exist
bool containsCheck2 = false;
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
containsCheck2 = strs.Exists(s => s.EndsWith("ATTLIST"))
@@ -43,7 +43,7 @@ namespace BinaryObjectScanner.Protection
}
if (containsCheck && containsCheck2)
return $"Impulse Reactor Core Module {pex.GetInternalVersion()}";
return $"Impulse Reactor Core Module {exe.GetInternalVersion()}";
else if (containsCheck && !containsCheck2)
return $"Impulse Reactor";

4
BinaryObjectScanner/Protection/Intenium.cs
View File

@@ -22,9 +22,9 @@ namespace BinaryObjectScanner.Protection
*/
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
if (pex.FindGenericResource("NO NESTED PRMS SUPPORTED").Count > 0)
if (exe.FindGenericResource("NO NESTED PRMS SUPPORTED").Count > 0)
return "INTENIUM Trial & Buy Protection";
return null;

4
BinaryObjectScanner/Protection/InterLok.cs
View File

@@ -7,10 +7,10 @@ namespace BinaryObjectScanner.Protection
public class InterLok : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .rsrc section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rsrc");
var strs = exe.GetFirstSectionStrings(".rsrc");
if (strs != null)
{
// Found in "nfsc_link.exe" in IA item "nfscorigin".

16
BinaryObjectScanner/Protection/JoWood.cs
View File

@@ -14,18 +14,18 @@ namespace BinaryObjectScanner.Protection
public class JoWood : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .ext section, if it exists
if (pex.ContainsSection(".ext ", exact: true))
if (exe.ContainsSection(".ext ", exact: true))
{
bool importTableMatches = Array.Exists(pex.Model.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "kernel32.dll")
&& Array.Exists(pex.Model.ImportTable?.HintNameTable ?? [], s => s?.Name == "VirtualProtect");
bool importTableMatches = Array.Exists(exe.Model.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "kernel32.dll")
&& Array.Exists(exe.Model.ImportTable?.HintNameTable ?? [], s => s?.Name == "VirtualProtect");
// Get the .dcrtext section, if it exists
if (pex.ContainsSection(".dcrtext") && importTableMatches)
if (exe.ContainsSection(".dcrtext") && importTableMatches)
{
var dcrtextData = pex.GetFirstSectionData(".dcrtext");
var dcrtextData = exe.GetFirstSectionData(".dcrtext");
if (dcrtextData != null)
{
var matchers = new List<ContentMatchSet>
@@ -50,12 +50,12 @@ namespace BinaryObjectScanner.Protection
}
// Get the HC09 section, if it exists
bool hc09Section = pex.ContainsSection("HC09 ", exact: true);
bool hc09Section = exe.ContainsSection("HC09 ", exact: true);
if (hc09Section)
return "JoWood X-Prot v2"; // TODO: Can we get more granular with the version?
// Get the XPROT section, if it exists
var xprotSection = pex.ContainsSection("XPROT ", exact: true);
var xprotSection = exe.ContainsSection("XPROT ", exact: true);
if (xprotSection)
return "JoWood X-Prot v1.4+"; // TODO: Can we get more granular with the version?

12
BinaryObjectScanner/Protection/KalypsoLauncher.cs
View File

@@ -21,25 +21,25 @@ namespace BinaryObjectScanner.Protection
public class KalypsoLauncher : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Investigate if there are any viable checks for the game EXE itself.
// "Styx" is found as the File Description and Product Name in "KalypsoLauncher.dll", but checks aren't included due to the risk of false positives.
var name = pex.InternalName;
var name = exe.InternalName;
// Found in "KalypsoLauncher.dll" in Redump entry 95617.
if (name.OptionalContains("KalypsoLauncher.dll"))
return $"Kalypso Launcher {pex.GetInternalVersion()}";
return $"Kalypso Launcher {exe.GetInternalVersion()}";
name = pex.OriginalFilename;
name = exe.OriginalFilename;
// Found in "KalypsoLauncher.dll" in Redump entry 95617.
if (name.OptionalContains("KalypsoLauncher.dll"))
return $"Kalypso Launcher {pex.GetInternalVersion()}";
return $"Kalypso Launcher {exe.GetInternalVersion()}";
// Get the .text section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Found in "TFT.exe" in Redump entry 95617.

8
BinaryObjectScanner/Protection/LabelGate.cs
View File

@@ -19,19 +19,19 @@ namespace BinaryObjectScanner.Protection
public class LabelGate : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Should be present on all LabelGate CD2 discs (Redump entry 95010 and product ID SVWC-7185).
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("MAGIQLIP2 Installer", StringComparison.OrdinalIgnoreCase))
return $"LabelGate CD2 Media Player";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("MQSTART", StringComparison.OrdinalIgnoreCase))
return $"LabelGate CD2 Media Player";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "START.EXE" (Redump entry 95010 and product ID SVWC-7185).

24
BinaryObjectScanner/Protection/LaserLok.cs
View File

@@ -13,7 +13,7 @@ namespace BinaryObjectScanner.Protection
public class LaserLok : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Add entry point check
// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Laserlok.2.sg
@@ -59,21 +59,21 @@ namespace BinaryObjectScanner.Protection
0x6C, 0x61, 0x6D, 0x65, 0x6E, 0x74, 0x61, 0x73,
0x2E, 0x50, 0x45
];
int endDosStub = (int)(pex.Model.Stub?.Header?.NewExeHeaderAddr ?? 0);
int endDosStub = (int)(exe.Model.Stub?.Header?.NewExeHeaderAddr ?? 0);
int position = -1;
// Check the executable tables
position = pex.StubExecutableData?.FirstPosition(check) ?? -1;
position = exe.StubExecutableData?.FirstPosition(check) ?? -1;
bool containsCheck = position > -1;
bool containsCheck2 = Array.Exists(pex.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "GetModuleHandleA")
&& Array.Exists(pex.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "GetProcAddress")
&& Array.Exists(pex.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "LoadLibraryA")
&& Array.Exists(pex.Model.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "KERNEL32.dll");
bool containsCheck2 = Array.Exists(exe.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "GetModuleHandleA")
&& Array.Exists(exe.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "GetProcAddress")
&& Array.Exists(exe.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "LoadLibraryA")
&& Array.Exists(exe.Model.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "KERNEL32.dll");
int position2 = -1;
// Get the .text section, if it exists
if (containsCheck2 && pex.ContainsSection(".text"))
if (containsCheck2 && exe.ContainsSection(".text"))
{
// GetModuleHandleA + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + GetProcAddress + (char)0x00 + (char)0x00 + (char)0x00 + (char)0x00 + LoadLibraryA + (char)0x00 + (char)0x00 + KERNEL32.dll + (char)0x00 + ëy + (char)0x01 + SNIF/MPVI
byte?[] check2 =
@@ -89,7 +89,7 @@ namespace BinaryObjectScanner.Protection
0x00, 0xEB, 0x79, 0x01, null, null, null, null,
];
position2 = pex.GetFirstSectionData(".text")?.FirstPosition(check2) ?? -1;
position2 = exe.GetFirstSectionData(".text")?.FirstPosition(check2) ?? -1;
containsCheck2 = position2 > -1;
}
else
@@ -100,11 +100,11 @@ namespace BinaryObjectScanner.Protection
}
if (containsCheck && containsCheck2)
return $"LaserLok {GetVersion(pex.GetFirstSectionData(".text"), position2)} {GetBuild(pex.GetFirstSectionData(".text"), true)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position}, {position2})" : string.Empty);
return $"LaserLok {GetVersion(exe.GetFirstSectionData(".text"), position2)} {GetBuild(exe.GetFirstSectionData(".text"), true)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position}, {position2})" : string.Empty);
else if (containsCheck && !containsCheck2)
return $"LaserLok Marathon {GetBuild(pex.GetFirstSectionData(".text"), false)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position})" : string.Empty);
return $"LaserLok Marathon {GetBuild(exe.GetFirstSectionData(".text"), false)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position})" : string.Empty);
else if (!containsCheck && containsCheck2)
return $"LaserLok {GetVersion(pex.GetFirstSectionData(".text"), --position2)} {GetBuild(pex.GetFirstSectionData(".text"), false)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position2})" : string.Empty);
return $"LaserLok {GetVersion(exe.GetFirstSectionData(".text"), --position2)} {GetBuild(exe.GetFirstSectionData(".text"), false)} [Check disc for physical ring]" + (includeDebug ? $" (Index {position2})" : string.Empty);
return null;
}

10
BinaryObjectScanner/Protection/MGIRegistration.cs
View File

@@ -7,20 +7,20 @@ namespace BinaryObjectScanner.Protection
public class MGIRegistration : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.ProductName;
var name = exe.ProductName;
// Found in "Register.dll" in IA item "MGIPhotoSuite4.0AndPhotoVista2.02001".
if (name.OptionalEquals("MGI Registration Utility", StringComparison.Ordinal))
return $"MGI Registration {pex.GetInternalVersion()}";
return $"MGI Registration {exe.GetInternalVersion()}";
// Found in "Register.dll" from "VideoWaveIII" in IA item "mgi-videowave-iii-version-3.00-mgi-software-2000".
if (pex.FindStringTableByEntry("MGI Registration").Count > 0)
if (exe.FindStringTableByEntry("MGI Registration").Count > 0)
return "MGI Registration";
// Found in "Register.dll" in IA item "MGIPhotoSuite4.0AndPhotoVista2.02001".
if (pex.FindStringTableByEntry("Register@register.mgisoft.com").Count > 0)
if (exe.FindStringTableByEntry("Register@register.mgisoft.com").Count > 0)
return "MGI Registration";
return null;

38
BinaryObjectScanner/Protection/Macrovision.CDilla.cs
View File

@@ -34,7 +34,7 @@ namespace BinaryObjectScanner.Protection
public partial class Macrovision
{
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? CDillaCheckExecutable(string file, NewExecutable nex, bool includeDebug)
internal static string? CDillaCheckExecutable(string file, NewExecutable exe, bool includeDebug)
{
// TODO: Implement NE checks for "CDILLA05", "CDILLA10", "CDILLA16", and "CDILLA40".
@@ -60,9 +60,9 @@ namespace BinaryObjectScanner.Protection
}
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? CDillaCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
internal static string? CDillaCheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
// Found in in "cdilla52.dll" from C-Dilla LMS version 3.24.010.
if (name.OptionalEquals("32-bit C-Dilla DLL", StringComparison.OrdinalIgnoreCase))
@@ -70,50 +70,50 @@ namespace BinaryObjectScanner.Protection
// Found in "CdaIns32.dll" and "CdSet32.exe" from version 3.27.000 of C-Dilla LMS.
if (name.OptionalEquals("C-Dilla Windows 32-Bit RTS Installer", StringComparison.OrdinalIgnoreCase))
return $"C-Dilla License Management System Version {pex.ProductVersion}";
return $"C-Dilla License Management System Version {exe.ProductVersion}";
// Found in "CDILLA32.DLL"/"CDILLA64.EXE" from C-Dilla LMS version 3.27.000 for Windows 3.1.
if (name.OptionalEquals("C-Dilla Windows 3.1x RTS", StringComparison.OrdinalIgnoreCase))
return $"C-Dilla License Management System Version {pex.ProductVersion}";
return $"C-Dilla License Management System Version {exe.ProductVersion}";
// Found in "CDILLA13.DLL"/"CDILLA32.DLL"/"CDILLA64.EXE" from C-Dilla LMS version 3.27.000 for Windows 95.
if (name.OptionalEquals("C-Dilla Windows 95 RTS", StringComparison.OrdinalIgnoreCase))
return $"C-Dilla License Management System Version {pex.ProductVersion}";
return $"C-Dilla License Management System Version {exe.ProductVersion}";
// Found in "CDANT.SYS"/"CDILLA13.DLL"/"CDILLA32.DLL"/"CDILLA64.EXE" from C-Dilla LMSversion 3.27.000 for Windows NT.
if (name.OptionalEquals("C-Dilla Windows NT RTS", StringComparison.OrdinalIgnoreCase))
return $"C-Dilla License Management System Version {pex.ProductVersion}";
return $"C-Dilla License Management System Version {exe.ProductVersion}";
// Found in "CDANTSRV.EXE" from C-Dilla LMS version 3.27.000 for Windows NT, and an embedded executable contained in Redump entry 95524.
if (name.OptionalEquals("C-Dilla RTS Service", StringComparison.OrdinalIgnoreCase))
return $"C-Dilla RTS Service Version {pex.ProductVersion}";
return $"C-Dilla RTS Service Version {exe.ProductVersion}";
name = pex.ProductName;
name = exe.ProductName;
// Found in "CDANTSRV.EXE" from version 3.27.000 of C-Dilla LMS.
if (name.OptionalEquals("CD-Secure/CD-Compress Windows NT", StringComparison.OrdinalIgnoreCase))
return $"C-Dilla License Management System Version {pex.ProductVersion}";
return $"C-Dilla License Management System Version {exe.ProductVersion}";
// Get string table resources
if (pex.FindStringTableByEntry("C-Dilla Licence Management System").Count > 0)
if (exe.FindStringTableByEntry("C-Dilla Licence Management System").Count > 0)
return $"C-Dilla License Management System";
if (pex.FindStringTableByEntry("C-DiIla Licence Management System").Count > 0)
if (exe.FindStringTableByEntry("C-DiIla Licence Management System").Count > 0)
return $"C-Dilla License Management System";
if (pex.FindStringTableByEntry("C-DILLA_BITMAP_NAMES_TAG").Count > 0)
if (exe.FindStringTableByEntry("C-DILLA_BITMAP_NAMES_TAG").Count > 0)
return $"C-Dilla License Management System";
if (pex.FindStringTableByEntry("C-DILLA_EDITABLE_STRINGS_TAG").Count > 0)
if (exe.FindStringTableByEntry("C-DILLA_EDITABLE_STRINGS_TAG").Count > 0)
return $"C-Dilla License Management System";
if (pex.FindStringTableByEntry("CdaLMS.exe").Count > 0)
if (exe.FindStringTableByEntry("CdaLMS.exe").Count > 0)
return $"C-Dilla License Management System";
if (pex.FindStringTableByEntry("cdilla51.dll").Count > 0)
if (exe.FindStringTableByEntry("cdilla51.dll").Count > 0)
return $"C-Dilla License Management System";
if (pex.FindStringTableByEntry("cdilla52.dll").Count > 0)
if (exe.FindStringTableByEntry("cdilla52.dll").Count > 0)
return $"C-Dilla License Management System";
if (pex.FindStringTableByEntry("http://www.c-dilla.com/support/lms.html").Count > 0)
if (exe.FindStringTableByEntry("http://www.c-dilla.com/support/lms.html").Count > 0)
return $"C-Dilla License Management System";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "DJMixStation\DJMixStation.exe" in IA item "ejay_nestle_trial".

8
BinaryObjectScanner/Protection/Macrovision.CactusDataShield.cs
View File

@@ -30,10 +30,10 @@ namespace BinaryObjectScanner.Protection
public partial class Macrovision
{
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? CactusDataShieldCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
internal static string? CactusDataShieldCheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("\\*.CDS")))
@@ -44,11 +44,11 @@ namespace BinaryObjectScanner.Protection
// Found in "Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427]).
// Modified version of the PlayJ Music Player specificaly for CDS, as indicated by the About page present when running the executable.
if (pex.FindGenericResource("CactusPJ").Count > 0)
if (exe.FindGenericResource("CactusPJ").Count > 0)
return "PlayJ Music Player (Cactus Data Shield 200)";
// Found in various files in "Les Paul & Friends" (Barcode 4 98806 834170).
var name = pex.ProductName;
var name = exe.ProductName;
if (name.OptionalEquals("CDS300", StringComparison.OrdinalIgnoreCase))
return $"Cactus Data Shield 300";

22
BinaryObjectScanner/Protection/Macrovision.FLEXnet.cs
View File

@@ -12,9 +12,9 @@ namespace BinaryObjectScanner.Protection
public partial class Macrovision
{
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? FLEXnetCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
internal static string? FLEXnetCheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.ProductName;
var name = exe.ProductName;
// Found in "IsSvcInstDanceEJay7.dll" in IA item "computer200709dvd" (Dance eJay 7).
if (name.OptionalEquals("FLEXnet Activation Toolkit", StringComparison.OrdinalIgnoreCase))
@@ -22,36 +22,36 @@ namespace BinaryObjectScanner.Protection
// Found in "INSTALLS.EXE", "LMGR326B.DLL", "LMGRD.EXE", and "TAKEFIVE.EXE" in IA item "prog-17_202403".
if (name.OptionalEquals("Globetrotter Software Inc lmgr326b Flexlm", StringComparison.OrdinalIgnoreCase))
return $"FlexLM {pex.ProductVersion}";
return $"FlexLM {exe.ProductVersion}";
// Generic case to catch unknown versions.
if (name.OptionalContains("Flexlm"))
return "FlexLM (Unknown Version - Please report to us on GitHub)";
name = pex.FileDescription;
name = exe.FileDescription;
// Found in "INSTALLS.EXE", "LMGR326B.DLL", "LMGRD.EXE", and "TAKEFIVE.EXE" in IA item "prog-17_202403".
if (name.OptionalEquals("lmgr326b", StringComparison.OrdinalIgnoreCase))
return $"FlexLM {pex.ProductVersion}";
return $"FlexLM {exe.ProductVersion}";
name = pex.LegalTrademarks;
name = exe.LegalTrademarks;
// Found in "INSTALLS.EXE", "LMGR326B.DLL", "LMGRD.EXE", and "TAKEFIVE.EXE" in IA item "prog-17_202403".
if (name.OptionalEquals("Flexible License Manager,FLEXlm,Globetrotter,FLEXID", StringComparison.OrdinalIgnoreCase))
return $"FlexLM {pex.ProductVersion}";
return $"FlexLM {exe.ProductVersion}";
if (name.OptionalContains("FLEXlm"))
return $"FlexLM {pex.ProductVersion}";
return $"FlexLM {exe.ProductVersion}";
name = pex.OriginalFilename;
name = exe.OriginalFilename;
// Found in "INSTALLS.EXE", "LMGR326B.DLL", "LMGRD.EXE", and "TAKEFIVE.EXE" in IA item "prog-17_202403".
// It isn't known why these various executables have the same original filename.
if (name.OptionalEquals("lmgr326b.dll", StringComparison.OrdinalIgnoreCase))
return $"FlexLM {pex.ProductVersion}";
return $"FlexLM {exe.ProductVersion}";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "FLEXLM.CPL", "INSTALLS.EXE", "LMGR326B.DLL", "LMGRD.EXE", and "TAKEFIVE.EXE" in IA item "prog-17_202403".

6
BinaryObjectScanner/Protection/Macrovision.RipGuard.cs
View File

@@ -19,15 +19,15 @@ namespace BinaryObjectScanner.Protection
public partial class Macrovision
{
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? RipGuardCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
internal static string? RipGuardCheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in "RGASDEV.SYS" in the Black Lagoon Season 1 DVD Steelbook box set (Geneon ID 12970).
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalEquals("rgasdev", StringComparison.OrdinalIgnoreCase))
return "RipGuard";
// Found in "RGASDEV.SYS" in the Black Lagoon Season 1 DVD Steelbook box set (Geneon ID 12970).
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalEquals("rgasdev", StringComparison.OrdinalIgnoreCase))
return "RipGuard";

24
BinaryObjectScanner/Protection/Macrovision.SafeCast.cs
View File

@@ -40,19 +40,19 @@ namespace BinaryObjectScanner.Protection
public partial class Macrovision
{
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? SafeCastCheckExecutable(string file, NewExecutable nex, bool includeDebug)
internal static string? SafeCastCheckExecutable(string file, NewExecutable exe, bool includeDebug)
{
// Check for the CDAC01AA name string.
if (nex.Model.ResidentNameTable != null)
if (exe.Model.ResidentNameTable != null)
{
var residentNames = Array.ConvertAll(nex.Model.ResidentNameTable,
var residentNames = Array.ConvertAll(exe.Model.ResidentNameTable,
rnte => rnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(rnte.NameString));
if (Array.Exists(residentNames, s => s.Contains("CDAC01AA")))
return "SafeCast";
}
// TODO: Don't read entire file
byte[]? data = nex.ReadArbitraryRange();
byte[]? data = exe.ReadArbitraryRange();
if (data == null)
return null;
@@ -67,16 +67,16 @@ namespace BinaryObjectScanner.Protection
}
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? SafeCastCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
internal static string? SafeCastCheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Investigate import hint/name table entry "CdaSysInstall"
// TODO: Investigate string table entries: "CDWP02DG", "CDWP02DG", "CDWS02DG"
// TODO: Invesitgate if the "AdobeLM.dll" file (along with mentions of "AdobeLM" in executables) uniquely identifies SafeCast, or if it can be used with different DRM. (Found in IA item ccd0605)
// Get the import directory table, if it exists
if (pex.Model.ImportTable?.ImportDirectoryTable != null)
if (exe.Model.ImportTable?.ImportDirectoryTable != null)
{
if (Array.Exists(pex.Model.ImportTable.ImportDirectoryTable,
if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable,
idte => idte?.Name != null && idte.Name.Equals("CdaC14BA.dll", StringComparison.OrdinalIgnoreCase)))
{
return "SafeCast";
@@ -85,11 +85,11 @@ namespace BinaryObjectScanner.Protection
// Get the dialog box resources
// Found in "CDAC21BA.DLL" in Redump entry 95524.
if (pex.FindDialogByTitle("SafeCast API").Count > 0)
if (exe.FindDialogByTitle("SafeCast API").Count > 0)
return "SafeCast";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "DJMixStation\DJMixStation.exe" in IA item "ejay_nestle_trial".
@@ -98,7 +98,7 @@ namespace BinaryObjectScanner.Protection
}
// Found in "32bit\Tax02\cdac14ba.dll" in IA item "TurboTax Deluxe Tax Year 2002 for Wndows (2.00R)(Intuit)(2002)(352282)".
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalEquals("SafeCast2", StringComparison.OrdinalIgnoreCase))
return "SafeCast";
@@ -117,7 +117,7 @@ namespace BinaryObjectScanner.Protection
// Found in "SCRfrsh.exe" in Redump entry 102979.
if (name.OptionalEquals("32-bit SafeCast Toolkit", StringComparison.OrdinalIgnoreCase))
return $"SafeCast {pex.FileVersion}";
return $"SafeCast {exe.FileVersion}";
// Found in "CDAC14BA.DLL" in Redump entry 95524.
if (name.OptionalEquals("32-bit SafeCast Anchor Installer", StringComparison.OrdinalIgnoreCase))
@@ -128,7 +128,7 @@ namespace BinaryObjectScanner.Protection
return $"SafeCast";
// Found in hidden resource of "32bit\Tax02\cdac14ba.dll" in IA item "TurboTax Deluxe Tax Year 2002 for Wndows (2.00R)(Intuit)(2002)(352282)".
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalEquals("SafeCast Windows NT", StringComparison.OrdinalIgnoreCase))
return "SafeCast";

36
BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs
View File

@@ -48,24 +48,24 @@ namespace BinaryObjectScanner.Protection
public partial class Macrovision
{
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? SafeDiscCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
internal static string? SafeDiscCheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in Redump entry 57986.
if (pex.Model.ImportTable?.HintNameTable != null)
if (exe.Model.ImportTable?.HintNameTable != null)
{
if (Array.Exists(pex.Model.ImportTable.HintNameTable, ihne => ihne?.Name == "LTDLL_Authenticate"))
if (Array.Exists(exe.Model.ImportTable.HintNameTable, ihne => ihne?.Name == "LTDLL_Authenticate"))
return "SafeDisc Lite";
}
// Found in Redump entry 57986.
if (pex.Model.ImportTable?.ImportDirectoryTable != null)
if (exe.Model.ImportTable?.ImportDirectoryTable != null)
{
if (Array.Exists(pex.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "ltdll.dll"))
if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "ltdll.dll"))
return "SafeDisc Lite";
}
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in Redump entries 14928, 25579, 32751.
@@ -81,23 +81,23 @@ namespace BinaryObjectScanner.Protection
return "Macrovision SecDrv Update Installer";
}
var name = pex.FileDescription;
var name = exe.FileDescription;
// Present in "Diag.exe" files from SafeDisc 4.50.000+.
if (name.OptionalEquals("SafeDisc SRV Tool APP", StringComparison.OrdinalIgnoreCase))
return $"SafeDisc SRV Tool APP {GetSafeDiscDiagExecutableVersion(pex)}";
return $"SafeDisc SRV Tool APP {GetSafeDiscDiagExecutableVersion(exe)}";
// Present in "Setup.exe" from the later "safedisc.exe" driver update provided by Macrovision.
if (name.OptionalEquals("Macrovision SecDrv Update", StringComparison.OrdinalIgnoreCase))
return "Macrovision SecDrv Update Installer";
// Present on all "CLOKSPL.DLL" versions before SafeDisc 1.06.000. Found on Redump entries 61731 and 66004.
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalEquals("SafeDisc CDROM Protection System", StringComparison.OrdinalIgnoreCase))
return "SafeDisc 1.00.025-1.01.044";
// Present in "Diag.exe" files from SafeDisc 4.50.000+.
else if (name.OptionalEquals("SafeDisc SRV Tool APP", StringComparison.OrdinalIgnoreCase))
return $"SafeDisc SRV Tool APP {GetSafeDiscDiagExecutableVersion(pex)}";
return $"SafeDisc SRV Tool APP {GetSafeDiscDiagExecutableVersion(exe)}";
// Present in "Setup.exe" from the later "safedisc.exe" driver update provided by Macrovision.
if (name.OptionalEquals("Macrovision SecDrv Update", StringComparison.OrdinalIgnoreCase))
@@ -107,11 +107,11 @@ namespace BinaryObjectScanner.Protection
// This filename is confirmed by the file properties in SafeDisc 4+ (such as Redump entry 35382).
// It is only found extracted into the Windows Temp directory when a protected application is run, and is renamed to begin with a "~" and have the ".tmp" extension.
else if (name.OptionalEquals("SafeDisc AuthServ APP", StringComparison.OrdinalIgnoreCase))
return $"SafeDisc AuthServ APP {GetSafeDiscAuthServVersion(pex)}";
return $"SafeDisc AuthServ APP {GetSafeDiscAuthServVersion(exe)}";
// Present on all "CLOKSPL.EXE" versions before SafeDisc 1.06.000. Found on Redump entries 61731 and 66004.
// Only found so far on SafeDisc 1.00.025-1.01.044, but the report is currently left generic due to the generic nature of the check.
name = pex.FileDescription;
name = exe.FileDescription;
if (name.OptionalEquals("SafeDisc", StringComparison.OrdinalIgnoreCase))
return "SafeDisc";
@@ -119,9 +119,9 @@ namespace BinaryObjectScanner.Protection
{
// Found in Redump entries 20729 and 65569.
// Get the debug data
if (pex.FindCodeViewDebugTableByPath("SafeDisc").Count > 0)
if (exe.FindCodeViewDebugTableByPath("SafeDisc").Count > 0)
return "SafeDisc";
if (pex.FindCodeViewDebugTableByPath("Safedisk").Count > 0)
if (exe.FindCodeViewDebugTableByPath("Safedisk").Count > 0)
return "SafeDisc";
}
catch
@@ -386,10 +386,10 @@ namespace BinaryObjectScanner.Protection
return MatchUtil.GetFirstMatch(path, matchers, any: true);
}
private static string GetSafeDiscAuthServVersion(PortableExecutable pex)
private static string GetSafeDiscAuthServVersion(PortableExecutable exe)
{
// Different versions of this executable correspond to different SafeDisc versions.
var version = pex.FileVersion;
var version = exe.FileVersion;
if (!string.IsNullOrEmpty(version))
{
return version switch
@@ -1167,10 +1167,10 @@ namespace BinaryObjectScanner.Protection
// "SPLSH256.BMP": Found in SafeDisc versions 1.00.025-1.01.044 (Redump entries 66005 and 81619).
}
private static string GetSafeDiscDiagExecutableVersion(PortableExecutable pex)
private static string GetSafeDiscDiagExecutableVersion(PortableExecutable exe)
{
// Different versions of this executable correspond to different SafeDisc versions.
var version = pex.FileVersion;
var version = exe.FileVersion;
if (!string.IsNullOrEmpty(version))
{
return version switch

2
BinaryObjectScanner/Protection/Macrovision.SafeWrap.cs
View File

@@ -39,7 +39,7 @@ namespace BinaryObjectScanner.Protection
public partial class Macrovision
{
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal string? SafeWrapCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
internal string? SafeWrapCheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Figure out what SafeWrap is exactly, and add checks.

44
BinaryObjectScanner/Protection/Macrovision.cs
View File

@@ -20,17 +20,17 @@ namespace BinaryObjectScanner.Protection
public partial class Macrovision : IExecutableCheck<NewExecutable>, IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, NewExecutable nex, bool includeDebug)
public string? CheckExecutable(string file, NewExecutable exe, bool includeDebug)
{
var resultsList = new List<string>();
// Run C-Dilla NE checks
var cDilla = CDillaCheckExecutable(file, nex, includeDebug);
var cDilla = CDillaCheckExecutable(file, exe, includeDebug);
if (!string.IsNullOrEmpty(cDilla))
resultsList.Add(cDilla!);
// Run SafeCast NE checks
var safeCast = SafeCastCheckExecutable(file, nex, includeDebug);
var safeCast = SafeCastCheckExecutable(file, exe, includeDebug);
if (!string.IsNullOrEmpty(safeCast))
resultsList.Add(safeCast!);
@@ -41,23 +41,23 @@ namespace BinaryObjectScanner.Protection
}
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Check for specific indications for individual Macrovision protections.
var resultsList = new List<string>();
// Check for generic indications of Macrovision protections first.
var name = pex.FileDescription;
var name = exe.FileDescription;
// Present in "secdrv.sys" files found in SafeDisc 2.80.010+.
if (name.OptionalEquals("Macrovision SECURITY Driver", StringComparison.OrdinalIgnoreCase))
resultsList.Add($"Macrovision Security Driver {GetSecDrvExecutableVersion(pex)}");
resultsList.Add($"Macrovision Security Driver {GetSecDrvExecutableVersion(exe)}");
// Found in hidden resource of "32bit\Tax02\cdac14ba.dll" in IA item "TurboTax Deluxe Tax Year 2002 for Windows (2.00R)(Intuit)(2002)(352282)".
// Known versions:
// 4.16.050 Windows NT 2002/04/24
if (name.OptionalEquals("Macrovision RTS Service", StringComparison.OrdinalIgnoreCase))
resultsList.Add($"Macrovision RTS Service {pex.FileVersion}");
resultsList.Add($"Macrovision RTS Service {exe.FileVersion}");
// The stxt371 and stxt774 sections are found in various newer Macrovision products, including various versions of CDS-300, SafeCast, and SafeDisc.
// A stxt381 section has also been found in the "~df89e9.tmp" file, which is extracted into the Windows temp directory when running Redump entry 42034 on Windows 9x.
@@ -66,20 +66,20 @@ namespace BinaryObjectScanner.Protection
// Almost every single sample known has both sections, though one only contains the "stxt371" section. It is unknown if this is intentional, or if the game functions without it.
// It is present in the "Texas HoldEm!" game in "boontybox_PCGamer_DVD.exe" in IA items PC_Gamer_Disc_7.55_July_2005 and cdrom-pcgamercd7.58.
// Other games in this set also aren't functional despite having the normal layout of stxt sections, and the primary program doesn't install at all due to activation servers being down.
if (pex.ContainsSection("stxt371", exact: true) || pex.ContainsSection("stxt774", exact: true))
if (exe.ContainsSection("stxt371", exact: true) || exe.ContainsSection("stxt774", exact: true))
{
// Check the header padding for protected sections.
var sectionMatch = CheckSectionForProtection(file, includeDebug, pex.HeaderPaddingStrings, pex.HeaderPaddingData, true);
var sectionMatch = CheckSectionForProtection(file, includeDebug, exe.HeaderPaddingStrings, exe.HeaderPaddingData, true);
if (sectionMatch != null)
resultsList.Add(sectionMatch);
// Get the .data section, if it exists, for protected sections.
sectionMatch = CheckSectionForProtection(file, includeDebug, pex.GetFirstSectionStrings(".data"), pex.GetFirstSectionData(".data"), true);
sectionMatch = CheckSectionForProtection(file, includeDebug, exe.GetFirstSectionStrings(".data"), exe.GetFirstSectionData(".data"), true);
if (sectionMatch != null)
resultsList.Add(sectionMatch!);
int entryPointIndex = pex.FindEntryPointSectionIndex();
var entryPointSectionName = pex.SectionNames?[entryPointIndex];
int entryPointIndex = exe.FindEntryPointSectionIndex();
var entryPointSectionName = exe.SectionNames?[entryPointIndex];
switch (entryPointSectionName)
{
@@ -102,43 +102,43 @@ namespace BinaryObjectScanner.Protection
else
{
// Check the header padding for protected sections.
var sectionMatch = CheckSectionForProtection(file, includeDebug, pex.HeaderPaddingStrings, pex.HeaderPaddingData, false);
var sectionMatch = CheckSectionForProtection(file, includeDebug, exe.HeaderPaddingStrings, exe.HeaderPaddingData, false);
if (sectionMatch != null)
resultsList.Add(sectionMatch);
// Check the .data section, if it exists, for protected sections.
sectionMatch = CheckSectionForProtection(file, includeDebug, pex.GetFirstSectionStrings(".data"), pex.GetFirstSectionData(".data"), false);
sectionMatch = CheckSectionForProtection(file, includeDebug, exe.GetFirstSectionStrings(".data"), exe.GetFirstSectionData(".data"), false);
if (sectionMatch != null)
resultsList.Add(sectionMatch);
}
// Run Cactus Data Shield PE checks
var match = CactusDataShieldCheckExecutable(file, pex, includeDebug);
var match = CactusDataShieldCheckExecutable(file, exe, includeDebug);
if (!string.IsNullOrEmpty(match))
resultsList.Add(match!);
// Run C-Dilla PE checks
match = CDillaCheckExecutable(file, pex, includeDebug);
match = CDillaCheckExecutable(file, exe, includeDebug);
if (!string.IsNullOrEmpty(match))
resultsList.Add(match!);
// Run RipGuard PE checks
match = RipGuardCheckExecutable(file, pex, includeDebug);
match = RipGuardCheckExecutable(file, exe, includeDebug);
if (!string.IsNullOrEmpty(match))
resultsList.Add(match!);
// Run SafeCast PE checks
match = SafeCastCheckExecutable(file, pex, includeDebug);
match = SafeCastCheckExecutable(file, exe, includeDebug);
if (!string.IsNullOrEmpty(match))
resultsList.Add(match!);
// Run SafeDisc PE checks
match = SafeDiscCheckExecutable(file, pex, includeDebug);
match = SafeDiscCheckExecutable(file, exe, includeDebug);
if (!string.IsNullOrEmpty(match))
resultsList.Add(match!);
// Run FLEXnet PE checks
match = FLEXnetCheckExecutable(file, pex, includeDebug);
match = FLEXnetCheckExecutable(file, exe, includeDebug);
if (!string.IsNullOrEmpty(match))
resultsList.Add(match!);
@@ -389,11 +389,11 @@ namespace BinaryObjectScanner.Protection
}
// TODO: Combine with filesize version checks if possible.
private static string GetSecDrvExecutableVersion(PortableExecutable pex)
private static string GetSecDrvExecutableVersion(PortableExecutable exe)
{
// Different versions of this driver correspond to different SafeDisc versions.
// TODO: Check if earlier versions of this driver contain the version string in a less obvious place.
var version = pex.FileVersion;
var version = exe.FileVersion;
if (!string.IsNullOrEmpty(version))
{
return version switch

6
BinaryObjectScanner/Protection/MediaCloQ.cs
View File

@@ -16,15 +16,15 @@ namespace BinaryObjectScanner.Protection
// TODO: "Karaoke Spotlight Series - Pop Hits - Vol. 132" - Sound Choice (SC8732)" is currently undetected, due to there seeming to be no reference to MediaCloQ in the disc's contents.
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in scvfy.exe on "Charley Pride - A Tribute to Jim Reeves" (barcode "7 816190222-2 4").
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("scvfy MFC Application", StringComparison.OrdinalIgnoreCase))
return $"MediaCloQ";
// Found in scvfy.exe on "Charley Pride - A Tribute to Jim Reeves" (barcode "7 816190222-2 4").
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("scvfy Application", StringComparison.OrdinalIgnoreCase))
return $"MediaCloQ";

16
BinaryObjectScanner/Protection/MediaMax.cs
View File

@@ -16,28 +16,28 @@ namespace BinaryObjectScanner.Protection
public class MediaMax : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Used to detect "LicGen.exe", found on "All That I Am" by Santana (Barcode 8 2876-59773-2 6)
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase))
return $"MediaMax CD-3";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase))
return $"MediaMax CD-3";
if (pex.FindGenericResource("Cd3Ctl").Count > 0)
if (exe.FindGenericResource("Cd3Ctl").Count > 0)
return $"MediaMax CD-3";
if (pex.FindDialogBoxByItemTitle("This limited production advanced CD is not playable on your computer. It is solely intended for playback on standard CD players.").Count > 0)
if (exe.FindDialogBoxByItemTitle("This limited production advanced CD is not playable on your computer. It is solely intended for playback on standard CD players.").Count > 0)
return $"MediaMax CD-3";
// TODO: Investigate the following dialog item title resource
// "This limited production advanced CD is not playable on your computer. It is solely intended for playback on standard CD players."
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("CD3 Launch Error")))
@@ -45,9 +45,9 @@ namespace BinaryObjectScanner.Protection
}
// Get the export name table
if (pex.Model.ExportTable?.ExportNameTable?.Strings != null)
if (exe.Model.ExportTable?.ExportNameTable?.Strings != null)
{
if (Array.Exists(pex.Model.ExportTable.ExportNameTable.Strings, s => s == "DllInstallSbcp"))
if (Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s == "DllInstallSbcp"))
return "MediaMax CD-3";
}

6
BinaryObjectScanner/Protection/NEACProtect.cs
View File

@@ -22,16 +22,16 @@ namespace BinaryObjectScanner.Protection
public class NEACProtect : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Most of the relevant executables are highly obfuscated, making executable detection mostly impractical.
// Get the .neac0 and .neac1 sections, if they exist.
// Found in "NeacSafe64.sys" and "NeacSafe.sys".
if (pex.ContainsSection(".neac0", exact: true) || pex.ContainsSection(".neac1", exact: true))
if (exe.ContainsSection(".neac0", exact: true) || exe.ContainsSection(".neac1", exact: true))
return "NEAC Protect";
var name = pex.ProductName;
var name = exe.ProductName;
// Found in "NeacSafe64.sys" and "NeacSafe.sys".
// TODO: Fix Product Name not being properly grabbed from the file.

22
BinaryObjectScanner/Protection/NProtect.cs
View File

@@ -31,45 +31,45 @@ namespace BinaryObjectScanner.Protection
// TODO: Add text check for the string mentioned in https://github.com/mnadareski/BinaryObjectScanner/issues/154.
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Investigate if there are any viable checks for the game EXE itself.
var name = pex.FileDescription;
var name = exe.FileDescription;
// Found in "GameGuard.des" in Redump entry 90526 and 99598, and "Soulworker" (Steam Depot 1377581, Manifest 5092481117079359342).
if (name.OptionalContains("nProtect GameGuard Launcher"))
return $"nProtect GameGuard ({pex.GetInternalVersion()})";
return $"nProtect GameGuard ({exe.GetInternalVersion()})";
// Found in "npkcrypt.dll" in Redump entry 90526.
if (name.OptionalContains("nProtect KeyCrypt Driver Support Dll"))
return $"nProtect KeyCrypt ({pex.GetInternalVersion()})";
return $"nProtect KeyCrypt ({exe.GetInternalVersion()})";
// Found in "npkcrypt.sys" and "npkcusb.sys" in Redump entry 90526.
if (name.OptionalContains("nProtect KeyCrypt Driver"))
return $"nProtect KeyCrypt ({pex.GetInternalVersion()})";
return $"nProtect KeyCrypt ({exe.GetInternalVersion()})";
// Found in "npkpdb.dll" in Redump entry 90526.
if (name.OptionalContains("nProtect KeyCrypt Program Database DLL"))
return $"nProtect KeyCrypt ({pex.GetInternalVersion()})";
return $"nProtect KeyCrypt ({exe.GetInternalVersion()})";
name = pex.ProductName;
name = exe.ProductName;
// Found in "GameGuard.des" in Redump entry 90526 and 99598.
if (name.OptionalContains("nProtect GameGuard Launcher"))
return $"nProtect GameGuard ({pex.GetInternalVersion()})";
return $"nProtect GameGuard ({exe.GetInternalVersion()})";
// Found in "npkcrypt.dll" in Redump entry 90526.
if (name.OptionalContains("nProtect KeyCrypt Driver Support Dll"))
return $"nProtect KeyCrypt ({pex.GetInternalVersion()})";
return $"nProtect KeyCrypt ({exe.GetInternalVersion()})";
// Found in "npkcrypt.sys" and "npkcusb.sys" in Redump entry 90526.
if (name.OptionalContains("nProtect KeyCrypt Driver"))
return $"nProtect KeyCrypt ({pex.GetInternalVersion()})";
return $"nProtect KeyCrypt ({exe.GetInternalVersion()})";
// Found in "npkpdb.dll" in Redump entry 90526.
if (name.OptionalContains("nProtect KeyCrypt Program Database DLL"))
return $"nProtect KeyCrypt ({pex.GetInternalVersion()})";
return $"nProtect KeyCrypt ({exe.GetInternalVersion()})";
return null;
}

6
BinaryObjectScanner/Protection/OnlineRegistration.cs
View File

@@ -7,12 +7,12 @@ namespace BinaryObjectScanner.Protection
public class OnlineRegistration : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Is this too broad in general?
var name = pex.InternalName;
var name = exe.InternalName;
if (name.OptionalStartsWith("EReg", StringComparison.OrdinalIgnoreCase))
return $"Executable-Based Online Registration {pex.GetInternalVersion()}";
return $"Executable-Based Online Registration {exe.GetInternalVersion()}";
return null;
}

6
BinaryObjectScanner/Protection/OpenMG.cs
View File

@@ -17,15 +17,15 @@ namespace BinaryObjectScanner.Protection
public class OpenMG : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in many different OpenMG related files ("Touch" by Amerie).
var name = pex.LegalTrademarks;
var name = exe.LegalTrademarks;
if (name.OptionalStartsWith("OpenMG", StringComparison.OrdinalIgnoreCase))
return $"OpenMG";
// Found in "OMGDBP.OCX" ("Touch" by Amerie).
name = pex.FileDescription;
name = exe.FileDescription;
if (name.OptionalStartsWith("LGDiscComp Module", StringComparison.OrdinalIgnoreCase))
return $"OpenMG";

6
BinaryObjectScanner/Protection/Origin.cs
View File

@@ -10,13 +10,13 @@ namespace BinaryObjectScanner.Protection
public class Origin : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalEquals("Origin", StringComparison.OrdinalIgnoreCase))
return "Origin";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalEquals("Origin", StringComparison.OrdinalIgnoreCase))
return "Origin";

8
BinaryObjectScanner/Protection/PlayJ.cs
View File

@@ -14,20 +14,20 @@ namespace BinaryObjectScanner.Protection
public class PlayJ : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in "PlayJ.exe" (https://web.archive.org/web/20010417025347/http://dlp.playj.com:80/playj/PlayJIns266.exe) and "CACTUSPJ.exe" ("Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427])).
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("PlayJ Music Player", StringComparison.OrdinalIgnoreCase))
return $"PlayJ Music Player";
// Found in "PJSTREAM.DLL" ("Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427])).
name = pex.FileDescription;
name = exe.FileDescription;
if (name.OptionalStartsWith("EVAUX32 Module", StringComparison.OrdinalIgnoreCase))
return $"PlayJ Music Player Component";
// Found in "PlayJ.exe" (https://web.archive.org/web/20010417025347/http://dlp.playj.com:80/playj/PlayJIns266.exe) and "CACTUSPJ.exe" ("Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427])).
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("PlayJ", StringComparison.OrdinalIgnoreCase))
return $"PlayJ";

14
BinaryObjectScanner/Protection/ProtectDISC.cs
View File

@@ -14,13 +14,13 @@ namespace BinaryObjectScanner.Protection
public class ProtectDISC : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the 4th and 5th sections, if they exist (example names: ACE4/ACE5) (Found in Redump entries 94792, 94793)
var sections = pex.Model.SectionTable ?? [];
var sections = exe.Model.SectionTable ?? [];
for (int i = 3; i < sections.Length; i++)
{
var nthSectionData = pex.GetSectionData(i);
var nthSectionData = exe.GetSectionData(i);
if (nthSectionData == null)
continue;
@@ -36,7 +36,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
var dataSectionRaw = exe.GetFirstSectionData(".data") ?? exe.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
@@ -54,7 +54,7 @@ namespace BinaryObjectScanner.Protection
if (sections.Length > 1)
{
// Get the n - 1 section strings, if they exist
var strs = pex.GetSectionStrings(sections.Length - 2);
var strs = exe.GetSectionStrings(sections.Length - 2);
if (strs != null)
{
var str = strs.Find(s => s.Contains("VOB ProtectCD"));
@@ -66,7 +66,7 @@ namespace BinaryObjectScanner.Protection
// Get the last section (example names: ACE5, akxpxgcv, and piofinqb)
if (sections.Length > 0)
{
var lastSectionData = pex.GetSectionData(sections.Length - 1);
var lastSectionData = exe.GetSectionData(sections.Length - 1);
if (lastSectionData != null)
{
var matchers = new List<ContentMatchSet>
@@ -85,7 +85,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .vob.pcd section, if it exists
if (pex.ContainsSection(".vob.pcd", exact: true))
if (exe.ContainsSection(".vob.pcd", exact: true))
return "VOB ProtectCD";
return null;

42
BinaryObjectScanner/Protection/RainbowSentinel.cs
View File

@@ -38,10 +38,10 @@ namespace BinaryObjectScanner.Protection
public class RainbowSentinel : IExecutableCheck<NewExecutable>, IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, NewExecutable nex, bool includeDebug)
public string? CheckExecutable(string file, NewExecutable exe, bool includeDebug)
{
// TODO: Don't read entire file
byte[]? data = nex.ReadArbitraryRange();
byte[]? data = exe.ReadArbitraryRange();
if (data == null)
return null;
@@ -105,7 +105,7 @@ namespace BinaryObjectScanner.Protection
return match;
// Get the resident and non-resident name table strings
var nrntStrs = Array.ConvertAll(nex.Model.NonResidentNameTable ?? [],
var nrntStrs = Array.ConvertAll(exe.Model.NonResidentNameTable ?? [],
rnte => rnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(rnte.NameString));
// Check the nonresident-name table
@@ -127,35 +127,35 @@ namespace BinaryObjectScanner.Protection
}
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Figure out why resources for "RNBOVTMP.DLL", "SENTTEMP.DLL", "SNTI386.DLL", and "SX32W.DL_"/"SX32W.DLL" aren't getting read properly, causing checks for these files to not work.
var name = pex.FileDescription;
var name = exe.FileDescription;
// Found in "RNBOVTMP.DLL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]".
if (name.OptionalEquals("Rainbow Technologies Virtual Device Driver", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel {pex.ProductVersion}";
return $"Rainbow Sentinel {exe.ProductVersion}";
// Found in "SENTTEMP.DLL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]".
if (name.OptionalEquals("Rainbow Technologies Sentinel Driver", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel {pex.ProductVersion}";
return $"Rainbow Sentinel {exe.ProductVersion}";
// Found in "SETUPX86.EXE"/"SENTW95.EXE" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]".
if (name.OptionalEquals("Sentinel Driver Setup DLL", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel {pex.ProductVersion}";
return $"Rainbow Sentinel {exe.ProductVersion}";
// Found in "SNTI386.DLL"/"SENTW95.DLL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]".
if (name.OptionalEquals("Install, Setup - Sentinel Driver", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel {pex.ProductVersion}";
return $"Rainbow Sentinel {exe.ProductVersion}";
// Found in "wd126.zip/WDSHARE.EXE/SX32W.DL_" in IA item "ASMEsMechanicalEngineeringToolkit1997December" and "WDSHARE.ZIP/WDSHARE.EXE/SX32W.DL_" in IA item "aplicaciones-windows".
if (name.OptionalEquals("Rainbow Technologies SentinelSuperPro WIN32 DLL", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel SuperPro {pex.ProductVersion}";
return $"Rainbow Sentinel SuperPro {exe.ProductVersion}";
// Found in "SP32W.DLL" in IA item "pcwkcd-1296".
if (name.OptionalEquals("Rainbow Technologies SentinelPro WIN32 DLL", StringComparison.OrdinalIgnoreCase))
return $"Rainbow SentinelPro {pex.ProductVersion}";
return $"Rainbow SentinelPro {exe.ProductVersion}";
// Found in "NSRVGX.EXE" in IA item "czchip199707cd".
if (name.OptionalEquals("NetSentinel Server for WIN 32", StringComparison.OrdinalIgnoreCase))
@@ -166,27 +166,27 @@ namespace BinaryObjectScanner.Protection
if (name.OptionalEquals("Rainbow Technologies Sentinel Device Driver", StringComparison.OrdinalIgnoreCase))
return "Rainbow Sentinel Driver";
name = pex.ProductName;
name = exe.ProductName;
// Found in multiple files in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", including "RNBOVTMP.DLL", "SENTTEMP.DLL", and "SNTI386.DLL".
if (name.OptionalEquals("Rainbow Technologies Sentinel", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel {pex.ProductVersion}";
return $"Rainbow Sentinel {exe.ProductVersion}";
// Found in "SETUPX86.EXE"/"SENTW95.EXE" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]".
if (name.OptionalEquals("Sentinel Driver Setup", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel {pex.ProductVersion}";
return $"Rainbow Sentinel {exe.ProductVersion}";
// Found in "wd126.zip/WDSHARE.EXE/SX32W.DL_" in IA item "ASMEsMechanicalEngineeringToolkit1997December" and "WDSHARE.ZIP/WDSHARE.EXE/SX32W.DL_" in IA item "aplicaciones-windows".
if (name.OptionalEquals("Rainbow Technologies SentinelSuperPro WIN32 DLL", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel SuperPro {pex.ProductVersion}";
return $"Rainbow Sentinel SuperPro {exe.ProductVersion}";
// Found in "SP32W.DLL" in IA item "pcwkcd-1296".
if (name.OptionalEquals("Rainbow Technologies SentinelPro WIN32 DLL", StringComparison.OrdinalIgnoreCase))
return $"Rainbow SentinelPro {pex.ProductVersion}";
return $"Rainbow SentinelPro {exe.ProductVersion}";
// Found in "F481_SetupSysDriver.exe.B391C18A_6953_11D4_82CB_00D0B72E1DB9"/"SetupSysDriver.exe" in IA item "chip-cds-2001-08".
if (name.OptionalEquals("Sentinel System Driver", StringComparison.OrdinalIgnoreCase))
return $"Rainbow Sentinel {pex.ProductVersion}";
return $"Rainbow Sentinel {exe.ProductVersion}";
// Found in "\disc4\cad\sdcc_200.zip\DISK1\_USER1.HDR\Language_Independent_Intel_32_Files\SNTNLUSB.SYS" in "CICA 32 For Windows CD-ROM (Walnut Creek) (October 1999) (Disc 4).iso" in IA item "CICA_32_For_Windows_CD-ROM_Walnut_Creek_October_1999".
// TODO: Check if the version included with this is useful.
@@ -194,7 +194,7 @@ namespace BinaryObjectScanner.Protection
return "Rainbow Sentinel Driver";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "ADESKSYS.DLL"/"WINADMIN.EXE"/"WINQUERY.EXE" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\netsetup\SUPPORT\IPX".
@@ -207,7 +207,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".rdata");
strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Found in "SP32W.DLL" in IA item "pcwkcd-1296".
@@ -232,7 +232,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rsrc section strings, if they exist
strs = pex.GetFirstSectionStrings(".rsrc");
strs = exe.GetFirstSectionStrings(".rsrc");
if (strs != null)
{
// Found in "WINMON.exe" in IA item "czchip199707cd".
@@ -241,7 +241,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .text section strings, if they exist
strs = pex.GetFirstSectionStrings(".text");
strs = exe.GetFirstSectionStrings(".text");
if (strs != null)
{
// Found in "ACLT.HWL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\aclt\DRV\W95LOCK".

6
BinaryObjectScanner/Protection/RealArcade.cs
View File

@@ -16,10 +16,10 @@ namespace BinaryObjectScanner.Protection
public class RealArcade : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .data section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data");
var strs = exe.GetFirstSectionStrings(".data");
if (strs != null)
{
// Found in "rebound.exe" in the installation directory for "Rebound" in IA item "Nova_RealArcadeCD_USA".
@@ -28,7 +28,7 @@ namespace BinaryObjectScanner.Protection
}
// Found in "RngInterstitial.dll" in the RealArcade installation directory in IA item "Nova_RealArcadeCD_USA".
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalContains("RngInterstitial"))
return "RealArcade";

10
BinaryObjectScanner/Protection/Roxxe.cs
View File

@@ -14,10 +14,10 @@ namespace BinaryObjectScanner.Protection
public class Roxxe : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
var strs = exe.GetFirstSectionStrings("code") ?? exe.GetFirstSectionStrings("CODE");
if (strs != null)
{
// Found in "Owar.exe" in IA item "game4u-22-cd".
@@ -27,7 +27,7 @@ namespace BinaryObjectScanner.Protection
// Get the .rsrc section strings, if they exist
// TODO: Check for these strings specifically within the application-defined resource that they're found in, not just the generic resource section.
strs = pex.GetFirstSectionStrings(".rsrc");
strs = exe.GetFirstSectionStrings(".rsrc");
if (strs != null)
{
// Found in "Owar.exe" in IA items "game4u-22-cd" and "original-war".
@@ -45,10 +45,10 @@ namespace BinaryObjectScanner.Protection
// If any dialog boxes match
// Found in "Data6.OWP" in IA item "game4u-22-cd".
if (pex.FindDialogBoxByItemTitle("SharpTiny Version 1.0").Count > 0)
if (exe.FindDialogBoxByItemTitle("SharpTiny Version 1.0").Count > 0)
return "Roxxe";
// Found in "Data8.OWP" in IA item "game4u-22-cd".
else if (pex.FindDialogBoxByItemTitle("T32xWin Version 1.0").Count > 0)
else if (exe.FindDialogBoxByItemTitle("T32xWin Version 1.0").Count > 0)
return "Roxxe";
return null;

16
BinaryObjectScanner/Protection/SVKProtector.cs
View File

@@ -24,15 +24,15 @@ namespace BinaryObjectScanner.Protection
// TODO: Find 1.4+ samples.
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Investigate the "Debugger or tool for monitoring detected!!!.Application cannot be run with debugger or monitoring tool(s) loaded!. Please unload it and restart the application" strings present in seemingly every version.
// Get the entry point data, if it exists.
if (pex.EntryPointData != null)
if (exe.EntryPointData != null)
{
// Found in the SVKP 1.05 demo.
if (pex.EntryPointData.StartsWith(new byte?[]
if (exe.EntryPointData.StartsWith(new byte?[]
{
0xEB, 0x03, 0xC7, 0x84, 0xE8, 0x60, 0xEB, 0x03,
0xC7, 0x84, 0xE8, 0xEB, 0x03, 0xC7, 0x84, 0x9A,
@@ -43,7 +43,7 @@ namespace BinaryObjectScanner.Protection
return "SVKP v1.05";
// Found in the SVKP 1.051 demo.
if (pex.EntryPointData.StartsWith(new byte?[]
if (exe.EntryPointData.StartsWith(new byte?[]
{
0x60, 0xEB, 0x03, 0xC7, 0x84, 0xE8, 0xEB, 0x03,
0xC7, 0x84, 0x9A, 0xE8, 0x00, 0x00, 0x00, 0x00,
@@ -54,7 +54,7 @@ namespace BinaryObjectScanner.Protection
return "SVKP v1.051";
// Found in the SVKP 1.11 demo.
if (pex.EntryPointData.StartsWith(new byte?[]
if (exe.EntryPointData.StartsWith(new byte?[]
{
0x60, 0xE8, null, null, null, null, 0x5D, 0x81,
0xED, 0x06, null, null, null, 0x64, 0xA0, 0x23
@@ -62,7 +62,7 @@ namespace BinaryObjectScanner.Protection
return "SVKP v1.11";
// Found in the SVKP 1.32 demo and Redump entry 84122.
if (pex.EntryPointData.StartsWith(new byte?[]
if (exe.EntryPointData.StartsWith(new byte?[]
{
0x60, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5D, 0x81,
0xED, 0x06, 0x00, 0x00, 0x00, 0xEB, 0x05, 0xB8,
@@ -72,12 +72,12 @@ namespace BinaryObjectScanner.Protection
}
// 0x504B5653 is "SVKP"
if (pex.Model.COFFFileHeader?.PointerToSymbolTable == 0x504B5653)
if (exe.Model.COFFFileHeader?.PointerToSymbolTable == 0x504B5653)
return "SVKP";
// Get the .svkp section, if it exists.
// This section is present in at least versions 1.05-1.32, but isn't present in every known sample of these versions. Removing this section name may be a perk of the licensed version.
if (pex.ContainsSection(".svkp", exact: true))
if (exe.ContainsSection(".svkp", exact: true))
return "SVKP";
return null;

88
BinaryObjectScanner/Protection/SecuROM.cs
View File

@@ -13,65 +13,65 @@ namespace BinaryObjectScanner.Protection
public class SecuROM : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalContains("SecuROM PA"))
return $"SecuROM Product Activation v{pex.GetInternalVersion()}";
return $"SecuROM Product Activation v{exe.GetInternalVersion()}";
name = pex.InternalName;
name = exe.InternalName;
if (name.OptionalEquals("paul.dll", StringComparison.OrdinalIgnoreCase))
{
if (pex.ProductName.OptionalEquals("drEAm"))
return $"SecuROM Product Activation v{pex.GetInternalVersion()} - EA Game Authorization Management";
if (exe.ProductName.OptionalEquals("drEAm"))
return $"SecuROM Product Activation v{exe.GetInternalVersion()} - EA Game Authorization Management";
else
return $"SecuROM Product Activation v{pex.GetInternalVersion()}";
return $"SecuROM Product Activation v{exe.GetInternalVersion()}";
}
else if (name.OptionalEquals("paul_dll_activate_and_play.dll"))
{
return $"SecuROM Product Activation v{pex.GetInternalVersion()}";
return $"SecuROM Product Activation v{exe.GetInternalVersion()}";
}
else if (name.OptionalEquals("paul_dll_preview_and_review.dll"))
{
return $"SecuROM Product Activation v{pex.GetInternalVersion()}";
return $"SecuROM Product Activation v{exe.GetInternalVersion()}";
}
name = pex.OriginalFilename;
name = exe.OriginalFilename;
if (name.OptionalEquals("paul_dll_activate_and_play.dll"))
return $"SecuROM Product Activation v{pex.GetInternalVersion()}";
return $"SecuROM Product Activation v{exe.GetInternalVersion()}";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalContains("SecuROM Activate & Play"))
return $"SecuROM Product Activation v{pex.GetInternalVersion()}";
return $"SecuROM Product Activation v{exe.GetInternalVersion()}";
// Get the matrosch section, if it exists
if (pex.ContainsSection("matrosch", exact: true))
if (exe.ContainsSection("matrosch", exact: true))
return $"SecuROM Matroschka Package";
// Get the rcpacker section, if it exists
if (pex.ContainsSection("rcpacker", exact: true))
if (exe.ContainsSection("rcpacker", exact: true))
return $"SecuROM Release Control";
if (pex.ContainsSection(".dsstext", exact: true))
if (exe.ContainsSection(".dsstext", exact: true))
return $"SecuROM 8.03.03+";
// Get the .securom section, if it exists
if (pex.ContainsSection(".securom", exact: true))
return $"SecuROM {GetV7Version(pex)}";
if (exe.ContainsSection(".securom", exact: true))
return $"SecuROM {GetV7Version(exe)}";
// Get the .sll section, if it exists
if (pex.ContainsSection(".sll", exact: true))
if (exe.ContainsSection(".sll", exact: true))
return $"SecuROM SLL Protected (for SecuROM v8.x)";
// Search after the last section
if (pex.OverlayStrings != null)
if (exe.OverlayStrings != null)
{
if (pex.OverlayStrings.Exists(s => s == "AddD"))
return $"SecuROM {GetV4Version(pex)}";
if (exe.OverlayStrings.Exists(s => s == "AddD"))
return $"SecuROM {GetV4Version(exe)}";
}
// Get the sections 5+, if they exist (example names: .fmqyrx, .vcltz, .iywiak)
var sections = pex.Model.SectionTable ?? [];
var sections = exe.Model.SectionTable ?? [];
for (int i = 4; i < sections.Length; i++)
{
var nthSection = sections[i];
@@ -81,7 +81,7 @@ namespace BinaryObjectScanner.Protection
string nthSectionName = Encoding.ASCII.GetString(nthSection.Name ?? []).TrimEnd('\0');
if (nthSectionName != ".idata" && nthSectionName != ".rsrc")
{
var nthSectionData = pex.GetFirstSectionData(nthSectionName);
var nthSectionData = exe.GetFirstSectionData(nthSectionName);
if (nthSectionData == null)
continue;
@@ -98,18 +98,18 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Both have the identifier found within `.rdata` but the version is within `.data`
if (strs.Exists(s => s.Contains("/secuexp")))
return $"SecuROM {GetV8WhiteLabelVersion(pex)} (White Label)";
return $"SecuROM {GetV8WhiteLabelVersion(exe)} (White Label)";
else if (strs.Exists(s => s.Contains("SecuExp.exe")))
return $"SecuROM {GetV8WhiteLabelVersion(pex)} (White Label)";
return $"SecuROM {GetV8WhiteLabelVersion(exe)} (White Label)";
}
// Get the .cms_d and .cms_t sections, if they exist -- TODO: Confirm if both are needed or either/or is fine
if (pex.ContainsSection(".cmd_d", true) || pex.ContainsSection(".cms_t", true))
if (exe.ContainsSection(".cmd_d", true) || exe.ContainsSection(".cms_t", true))
return $"SecuROM 1-3";
return null;
@@ -167,19 +167,19 @@ namespace BinaryObjectScanner.Protection
return MatchUtil.GetFirstMatch(path, matchers, any: true);
}
private static string GetV4Version(PortableExecutable pex)
private static string GetV4Version(PortableExecutable exe)
{
int index = 8; // Begin reading after "AddD"
char major = (char)pex.OverlayData![index];
char major = (char)exe.OverlayData![index];
index += 2;
string minor = Encoding.ASCII.GetString(pex.OverlayData, index, 2);
string minor = Encoding.ASCII.GetString(exe.OverlayData, index, 2);
index += 3;
string patch = Encoding.ASCII.GetString(pex.OverlayData, index, 2);
string patch = Encoding.ASCII.GetString(exe.OverlayData, index, 2);
index += 3;
string revision = Encoding.ASCII.GetString(pex.OverlayData, index, 4);
string revision = Encoding.ASCII.GetString(exe.OverlayData, index, 4);
if (!char.IsNumber(major))
return "(very old, v3 or less)";
@@ -225,30 +225,30 @@ namespace BinaryObjectScanner.Protection
}
// These live in the MS-DOS stub, for some reason
private static string GetV7Version(PortableExecutable pex)
private static string GetV7Version(PortableExecutable exe)
{
// If SecuROM is stripped, the MS-DOS stub might be shorter.
// We then know that SecuROM -was- there, but we don't know what exact version.
if (pex.StubExecutableData == null)
if (exe.StubExecutableData == null)
return "7 remnants";
//SecuROM 7 new and 8 -- 64 bytes for DOS stub, 236 bytes in total
int index = 172;
if (pex.StubExecutableData.Length >= 176 && pex.StubExecutableData[index + 3] == 0x5C)
if (exe.StubExecutableData.Length >= 176 && exe.StubExecutableData[index + 3] == 0x5C)
{
int major = pex.StubExecutableData[index + 0] ^ 0xEA;
int minor = pex.StubExecutableData[index + 1] ^ 0x2C;
int patch = pex.StubExecutableData[index + 2] ^ 0x08;
int major = exe.StubExecutableData[index + 0] ^ 0xEA;
int minor = exe.StubExecutableData[index + 1] ^ 0x2C;
int patch = exe.StubExecutableData[index + 2] ^ 0x08;
return $"{major}.{minor:00}.{patch:0000}";
}
// SecuROM 7 old -- 64 bytes for DOS stub, 122 bytes in total
index = 58;
if (pex.StubExecutableData.Length >= 62)
if (exe.StubExecutableData.Length >= 62)
{
int minor = pex.StubExecutableData[index + 0] ^ 0x10;
int patch = pex.StubExecutableData[index + 1] ^ 0x10;
int minor = exe.StubExecutableData[index + 0] ^ 0x10;
int patch = exe.StubExecutableData[index + 1] ^ 0x10;
//return "7.01-7.10"
return $"7.{minor:00}.{patch:0000}";
@@ -259,10 +259,10 @@ namespace BinaryObjectScanner.Protection
return "7 remnants";
}
private static string GetV8WhiteLabelVersion(PortableExecutable pex)
private static string GetV8WhiteLabelVersion(PortableExecutable exe)
{
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
var dataSectionRaw = exe.GetFirstSectionData(".data") ?? exe.GetFirstSectionData("DATA");
if (dataSectionRaw == null)
return "8";

8
BinaryObjectScanner/Protection/SmartE.cs
View File

@@ -9,18 +9,18 @@ namespace BinaryObjectScanner.Protection
{
public class SmartE : IPathCheck, IExecutableCheck<PortableExecutable>
{
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Only works on stub generated from running the program yourself
if (pex.InternalName.OptionalEquals("SmarteSECURE"))
if (exe.InternalName.OptionalEquals("SmarteSECURE"))
return "SmartE";
var sections = pex.Model.SectionTable ?? [];
var sections = exe.Model.SectionTable ?? [];
if (sections.Length > 0)
{
// Get the last section data, if it exists
var lastSectionData = pex.GetSectionData(sections.Length - 1);
var lastSectionData = exe.GetSectionData(sections.Length - 1);
if (lastSectionData != null)
{
// All sections seen so far are the last sections, so this is "technically"

20
BinaryObjectScanner/Protection/SoftLock.cs
View File

@@ -14,49 +14,49 @@ namespace BinaryObjectScanner.Protection
public class SoftLock : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
var name = pex.InternalName;
var name = exe.InternalName;
if (name.OptionalEquals("Softlock Protected Application"))
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
name = pex.Comments;
name = exe.Comments;
if (name.OptionalEquals("Softlock Protected Application"))
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
if (pex.FindStringTableByEntry("Softlock CD").Count > 0)
if (exe.FindStringTableByEntry("Softlock CD").Count > 0)
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
if (pex.FindStringTableByEntry("Softlock USB Key").Count > 0)
if (exe.FindStringTableByEntry("Softlock USB Key").Count > 0)
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
if (pex.FindDialogByTitle("Softlock Protection Kit").Count > 0)
if (exe.FindDialogByTitle("Softlock Protection Kit").Count > 0)
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
if (pex.FindDialogByTitle("About Softlock Protected Application").Count > 0)
if (exe.FindDialogByTitle("About Softlock Protected Application").Count > 0)
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
if (pex.FindDialogBoxByItemTitle("www.softlock.net").Count > 0)
if (exe.FindDialogBoxByItemTitle("www.softlock.net").Count > 0)
return "SoftLock";
// TODO: See if the version number is anywhere else
// TODO: Parse the version number out of the dialog box item
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
if (pex.FindDialogBoxByItemTitle("Softlock Protected Application Version 1.0").Count > 0)
if (exe.FindDialogBoxByItemTitle("Softlock Protected Application Version 1.0").Count > 0)
return "SoftLock";
// There are many mentions of USB dongle and CD protection in the various string tables
// and dialog boxes. See if any of those are unique to SoftLock.
// Found in "TafseerVer4.exe" in IA item "TAFSEERVER4SETUP"
var strings = pex.GetFirstSectionStrings(".section") ?? [];
var strings = exe.GetFirstSectionStrings(".section") ?? [];
if (strings.Exists(s => s.Contains("SOFTLOCKPROTECTION")))
return "SoftLock";

48
BinaryObjectScanner/Protection/SolidShield.cs
View File

@@ -13,46 +13,46 @@ namespace BinaryObjectScanner.Protection
public class SolidShield : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Investigate ".pseudo" section found in "tvdm.dll" in Redump entry 68166.
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("DVM Library", StringComparison.OrdinalIgnoreCase))
return $"SolidShield {pex.GetInternalVersion()}";
return $"SolidShield {exe.GetInternalVersion()}";
else if (name.OptionalStartsWith("Solidshield Activation Library", StringComparison.OrdinalIgnoreCase))
return $"SolidShield Core.dll {pex.GetInternalVersion()}";
return $"SolidShield Core.dll {exe.GetInternalVersion()}";
else if (name.OptionalStartsWith("Activation Manager", StringComparison.OrdinalIgnoreCase))
return $"SolidShield Activation Manager Module {GetInternalVersion(pex)}";
return $"SolidShield Activation Manager Module {GetInternalVersion(exe)}";
// Found in Redump entry 63719.
else if (name.OptionalStartsWith("Solidshield - Activation Wizard", StringComparison.OrdinalIgnoreCase))
return $"SolidShield Activation Manager Module {GetInternalVersion(pex)}";
return $"SolidShield Activation Manager Module {GetInternalVersion(exe)}";
// Found in "tvdm.dll" in Redump entry 68166.
else if (name.OptionalStartsWith("Solidshield Library", StringComparison.OrdinalIgnoreCase))
return $"SolidShield {GetInternalVersion(pex)}";
return $"SolidShield {GetInternalVersion(exe)}";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("Solidshield Activation Library", StringComparison.OrdinalIgnoreCase))
return $"SolidShield Core.dll {pex.GetInternalVersion()}";
return $"SolidShield Core.dll {exe.GetInternalVersion()}";
else if (name.OptionalStartsWith("Solidshield Library", StringComparison.OrdinalIgnoreCase))
return $"SolidShield Core.dll {pex.GetInternalVersion()}";
return $"SolidShield Core.dll {exe.GetInternalVersion()}";
else if (name.OptionalStartsWith("Activation Manager", StringComparison.OrdinalIgnoreCase))
return $"SolidShield Activation Manager Module {GetInternalVersion(pex)}";
return $"SolidShield Activation Manager Module {GetInternalVersion(exe)}";
// Found in "tvdm.dll" in Redump entry 68166.
else if (name.OptionalStartsWith("Solidshield Library", StringComparison.OrdinalIgnoreCase))
return $"SolidShield {GetInternalVersion(pex)}";
return $"SolidShield {GetInternalVersion(exe)}";
// Get the .init section, if it exists
if (pex.ContainsSection(".init"))
if (exe.ContainsSection(".init"))
{
var initData = pex.GetFirstSectionData(".init");
var initData = exe.GetFirstSectionData(".init");
if (initData != null)
{
var matchers = new List<ContentMatchSet>
@@ -71,15 +71,15 @@ namespace BinaryObjectScanner.Protection
}
// Get the wrapper resource, if it exists
if (pex.FindResourceByNamedType("BIN, IDR_SGT").Count > 0)
if (exe.FindResourceByNamedType("BIN, IDR_SGT").Count > 0)
return "SolidShield EXE Wrapper v1";
// Search the last two available sections
var sections = pex.Model.SectionTable ?? [];
var sections = exe.Model.SectionTable ?? [];
for (int i = Math.Max(sections.Length - 2, 0); i < sections.Length; i++)
{
// Get the nth section strings, if they exist
var strs = pex.GetSectionStrings(i);
var strs = exe.GetSectionStrings(i);
if (strs != null)
{
var str = strs.Find(s => s.Contains("Solidshield "));
@@ -89,15 +89,15 @@ namespace BinaryObjectScanner.Protection
}
// Get the import directory table, if it exists
if (pex.Model.ImportTable?.ImportDirectoryTable != null)
if (exe.Model.ImportTable?.ImportDirectoryTable != null)
{
if (Array.Exists(pex.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "dvm.dll"))
if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "dvm.dll"))
return "SolidShield EXE Wrapper v1";
if (Array.Exists(pex.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "activation.x86.dll"))
if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "activation.x86.dll"))
return "SolidShield EXE Wrapper v2";
if (Array.Exists(pex.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "activation.x64.dll"))
if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "activation.x64.dll"))
return "SolidShield EXE Wrapper v2";
}
@@ -216,11 +216,11 @@ namespace BinaryObjectScanner.Protection
return string.Empty;
}
private static string GetInternalVersion(PortableExecutable pex)
private static string GetInternalVersion(PortableExecutable exe)
{
var companyName = pex.CompanyName?.ToLowerInvariant();
var companyName = exe.CompanyName?.ToLowerInvariant();
if (!string.IsNullOrEmpty(companyName) && (companyName!.Contains("solidshield") || companyName.Contains("tages")))
return pex.GetInternalVersion() ?? string.Empty;
return exe.GetInternalVersion() ?? string.Empty;
return string.Empty;
}

38
BinaryObjectScanner/Protection/StarForce.cs
View File

@@ -17,10 +17,10 @@ namespace BinaryObjectScanner.Protection
// "Replay.exe" not detected, doesn't detect "[FL Disc]" (Redump entry 81756).
// Doesn't detect "[Pro]" (Redump entry 91336).
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// TODO: Find what fvinfo field actually maps to this
var name = pex.FileDescription;
var name = exe.FileDescription;
// There are some File Description checks that are currently too generic to use.
// "Host Library" - Found in "protect.dll" in Redump entry 81756.
@@ -33,71 +33,71 @@ namespace BinaryObjectScanner.Protection
// Found in "protect.exe" in Redump entry 94805.
if (name.OptionalContains("FrontLine Protection GUI Application"))
return $"StarForce {pex.GetInternalVersion()}";
return $"StarForce {exe.GetInternalVersion()}";
// Found in "protect.dll" in Redump entry 94805.
if (name.OptionalContains("FrontLine Protection Library"))
return $"StarForce {pex.GetInternalVersion()}";
return $"StarForce {exe.GetInternalVersion()}";
// Found in "protect.x64" and "protect.x86" in Redump entry 94805.
if (name.OptionalContains("FrontLine Helper"))
return $"StarForce {pex.GetInternalVersion()}";
return $"StarForce {exe.GetInternalVersion()}";
// TODO: Find a sample of this check.
if (name.OptionalContains("Protected Module"))
return $"StarForce 5";
name = pex.LegalCopyright;
name = exe.LegalCopyright;
if (name.OptionalStartsWith("(c) Protection Technology")) // (c) Protection Technology (StarForce)?
return $"StarForce {pex.GetInternalVersion()}";
return $"StarForce {exe.GetInternalVersion()}";
else if (name.OptionalContains("Protection Technology")) // Protection Technology (StarForce)?
return $"StarForce {pex.GetInternalVersion()}";
return $"StarForce {exe.GetInternalVersion()}";
// FrontLine ProActive (digital activation), samples:
// https://dbox.tools/titles/pc/46450FA4/
// https://dbox.tools/titles/pc/4F430FA0/
// https://dbox.tools/titles/pc/53450FA1/
name = pex.TradeName;
name = exe.TradeName;
if (name.OptionalContains("FL ProActive"))
return $"FrontLine ProActive";
// TODO: Decide if internal name checks are safe to use.
name = pex.InternalName;
name = exe.InternalName;
// Found in "protect.x64" and "protect.x86" in Redump entry 94805.
if (name.OptionalEquals("CORE.ADMIN", StringComparison.Ordinal))
return $"StarForce {pex.GetInternalVersion()}";
return $"StarForce {exe.GetInternalVersion()}";
// These checks currently disabled due being possibly too generic:
// Found in "protect.dll" in Redump entry 94805.
// if (name.OptionalEquals("CORE.DLL", StringComparison.Ordinal))
// return $"StarForce {Tools.Utilities.GetInternalVersion(pex)}";
// return $"StarForce {Tools.Utilities.GetInternalVersion(exe)}";
//
// Found in "protect.exe" in Redump entry 94805.
// if (name.OptionalEquals("CORE.EXE", StringComparison.Ordinal))
// return $"StarForce {Tools.Utilities.GetInternalVersion(pex)}";
// return $"StarForce {Tools.Utilities.GetInternalVersion(exe)}";
//
// else if (name.OptionalEquals("protect.exe", StringComparison.Ordinal))
// return $"StarForce {Tools.Utilities.GetInternalVersion(pex)}";
// return $"StarForce {Tools.Utilities.GetInternalVersion(exe)}";
// Check the export name table
if (pex.Model.ExportTable?.ExportNameTable?.Strings != null)
if (exe.Model.ExportTable?.ExportNameTable?.Strings != null)
{
// TODO: Should we just check for "PSA_*" instead of a single entry?
if (Array.Exists(pex.Model.ExportTable.ExportNameTable.Strings, s => s == "PSA_GetDiscLabel"))
return $"StarForce {pex.GetInternalVersion()}";
if (Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s == "PSA_GetDiscLabel"))
return $"StarForce {exe.GetInternalVersion()}";
}
// TODO: Check to see if there are any missing checks
// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/StarForce.2.sg
// Get the .brick section, if it exists
if (pex.ContainsSection(".brick", exact: true))
if (exe.ContainsSection(".brick", exact: true))
return "StarForce 3-5";
// Get the .sforce* section, if it exists
if (pex.ContainsSection(".sforce", exact: false))
if (exe.ContainsSection(".sforce", exact: false))
return "StarForce 3-5";
return null;

8
BinaryObjectScanner/Protection/Steam.cs
View File

@@ -9,19 +9,19 @@ namespace BinaryObjectScanner.Protection
public class Steam : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalContains("Steam Autorun Setup"))
return "Steam";
else if (name.OptionalContains("Steam Client API"))
return "Steam";
else if (name.OptionalContains("Steam Client Engine"))
return $"Steam Client Engine {pex.GetInternalVersion()}";
return $"Steam Client Engine {exe.GetInternalVersion()}";
else if (name.OptionalContains("Steam Client Service"))
return "Steam";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalContains("Steam Autorun Setup"))
return "Steam";
else if (name.OptionalContains("Steam Client API"))

4
BinaryObjectScanner/Protection/Sysiphus.cs
View File

@@ -7,10 +7,10 @@ namespace BinaryObjectScanner.Protection
public class Sysiphus : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
if (strs != null)
{
var str = strs.Find(s => s.Contains("V SUHPISYS"));

20
BinaryObjectScanner/Protection/Tages.cs
View File

@@ -12,7 +12,7 @@ namespace BinaryObjectScanner.Protection
public class TAGES : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Known TAGES Driver Setup filenames:
// - DrvSetup.exe
@@ -24,23 +24,23 @@ namespace BinaryObjectScanner.Protection
// - TagesClient.exe
// - TagesClient.dat (Does not always exist)
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("TagesSetup", StringComparison.OrdinalIgnoreCase))
return $"TAGES Driver Setup {GetVersion(pex)}";
return $"TAGES Driver Setup {GetVersion(exe)}";
else if (name.OptionalStartsWith("Tagès activation client", StringComparison.OrdinalIgnoreCase))
return $"TAGES Activation Client {GetVersion(pex)}";
return $"TAGES Activation Client {GetVersion(exe)}";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalStartsWith("Application TagesSetup", StringComparison.OrdinalIgnoreCase))
return $"TAGES Driver Setup {GetVersion(pex)}";
return $"TAGES Driver Setup {GetVersion(exe)}";
else if (name.OptionalStartsWith("T@GES", StringComparison.OrdinalIgnoreCase))
return $"TAGES Activation Client {GetVersion(pex)}";
return $"TAGES Activation Client {GetVersion(exe)}";
// TODO: Add entry point check
// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Tages.2.sg
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
var dataSectionRaw = exe.GetFirstSectionData(".data") ?? exe.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
{
var matchers = new List<ContentMatchSet>
@@ -210,10 +210,10 @@ namespace BinaryObjectScanner.Protection
return MatchUtil.GetFirstMatch(path, matchers, any: true);
}
private static string GetVersion(PortableExecutable pex)
private static string GetVersion(PortableExecutable exe)
{
// Check the internal versions
var version = pex.GetInternalVersion();
var version = exe.GetInternalVersion();
if (!string.IsNullOrEmpty(version))
return version!;

4
BinaryObjectScanner/Protection/Themida.cs
View File

@@ -24,10 +24,10 @@ namespace BinaryObjectScanner.Protection
public class Themida : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the "Arcsoft " section strings, if they exist
var strs = pex.GetFirstSectionStrings("Arcsoft ");
var strs = exe.GetFirstSectionStrings("Arcsoft ");
if (strs != null)
{
// Found in "uDigital Theatre.exe" in http://downloads.fyxm.net/ArcSoft-TotalMedia-23085.html (https://web.archive.org/web/20221114042838/http://files.fyxm.net/23/23085/totalmediatheatre3platinum_retail_tbyb_all.exe).

4
BinaryObjectScanner/Protection/ThreePLock.cs
View File

@@ -11,13 +11,13 @@ namespace BinaryObjectScanner.Protection
public class ThreePLock : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// This produced false positives in some DirectX 9.0c installer files
//"Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// Get the .ldr and .ldt sections, if they exist
if (pex.ContainsSection(".ldr", exact: true) && pex.ContainsSection(".ldt", exact: true))
if (exe.ContainsSection(".ldr", exact: true) && exe.ContainsSection(".ldt", exact: true))
return $"3P-Lock Copy Protection";
return null;

6
BinaryObjectScanner/Protection/ThreeTwoOneStudios.cs
View File

@@ -6,12 +6,12 @@ namespace BinaryObjectScanner.Protection
public class ThreeTwoOneStudios : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Check the dialog box resources
if (pex.FindDialogByTitle("321Studios Activation").Count > 0)
if (exe.FindDialogByTitle("321Studios Activation").Count > 0)
return $"321Studios Online Activation";
else if (pex.FindDialogByTitle("321Studios Phone Activation").Count > 0)
else if (exe.FindDialogByTitle("321Studios Phone Activation").Count > 0)
return $"321Studios Online Activation";
return null;

6
BinaryObjectScanner/Protection/Uplay.cs
View File

@@ -10,9 +10,9 @@ namespace BinaryObjectScanner.Protection
public class Uplay : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalContains("Ubisoft Connect Installer"))
return "Uplay / Ubisoft Connect";
else if (name.OptionalContains("Ubisoft Connect Service"))
@@ -29,7 +29,7 @@ namespace BinaryObjectScanner.Protection
return "Uplay / Ubisoft Connect";
// There's also a variant that looks like "Uplay <version> installer"
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalContains("Ubisoft Connect"))
return "Uplay / Ubisoft Connect";
else if (name.OptionalContains("Uplay"))

8
BinaryObjectScanner/Protection/WMDS.cs
View File

@@ -16,19 +16,19 @@ namespace BinaryObjectScanner.Protection
public class WMDS : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Found on "All That I Am" by Santana (Barcode 8 2876-59773-2 6)
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalStartsWith("Windows Media Data Session Licensing Engine", StringComparison.OrdinalIgnoreCase))
return "Windows Media Data Session DRM";
// Found in "autorun.exe" ("Touch" by Amerie).
if (pex.FindDialogBoxByItemTitle("If you attempt to play this content on a computer without a license, you will first have to acquire a license before it will play.").Count > 0)
if (exe.FindDialogBoxByItemTitle("If you attempt to play this content on a computer without a license, you will first have to acquire a license before it will play.").Count > 0)
return "Windows Media Data Session DRM";
// Found in "autorun.exe" ("Touch" by Amerie).
if (pex.FindDialogBoxByItemTitle("You cannot generate a licence to play the protected Windows Media files without an original disc.").Count > 0)
if (exe.FindDialogBoxByItemTitle("You cannot generate a licence to play the protected Windows Media files without an original disc.").Count > 0)
return "Windows Media Data Session DRM";
return null;

12
BinaryObjectScanner/Protection/WTMCDProtect.cs
View File

@@ -10,22 +10,22 @@ namespace BinaryObjectScanner.Protection
public class WTMCDProtect : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
var name = pex.FileDescription;
var name = exe.FileDescription;
if (name.OptionalContains("Copy Protection Viewer"))
return "WTM Protection Viewer";
name = pex.LegalTrademarks;
name = exe.LegalTrademarks;
if (name.OptionalContains("WTM Copy Protection"))
return "WTM Protection Viewer";
name = pex.ProductName;
name = exe.ProductName;
if (name.OptionalContains("WTM Copy Protection Viewer"))
return "WTM Protection Viewer";
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
var strs = exe.GetFirstSectionStrings("code") ?? exe.GetFirstSectionStrings("CODE");
if (strs != null)
{
if (strs.Exists(s => s.Contains("wtmdum.imp")))
@@ -33,7 +33,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .text section strings, if they exist
strs = pex.GetFirstSectionStrings(".text");
strs = exe.GetFirstSectionStrings(".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("WTM DIGITAL Photo Protect")))

4
BinaryObjectScanner/Protection/XCP.cs
View File

@@ -11,10 +11,10 @@ namespace BinaryObjectScanner.Protection
public class XCP : IExecutableCheck<PortableExecutable>, IPathCheck
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
{
// Get the .rdata section strings, if they exist
List<string>? strs = pex.GetFirstSectionStrings(".rdata");
List<string>? strs = exe.GetFirstSectionStrings(".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("XCP.DAT")))