SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-22 06:03:34 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Remove temporary code

Browse Source
This commit is contained in:
Matt Nadareski
2025-09-06 08:58:35 -04:00
parent 2597575500
commit 5ef9c4cd8a
42 changed files with 64 additions and 367 deletions
Download Patch File Download Diff File Expand all files Collapse all files

303
BinaryObjectScanner/FileType/Executable.cs
View File

@@ -1,7 +1,6 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Text;
using BinaryObjectScanner.Data;
using BinaryObjectScanner.Interfaces;
using SabreTools.IO.Extensions;
@@ -235,308 +234,6 @@ namespace BinaryObjectScanner.FileType
return protections;
}
#endregion
#region Helpers -- Remove when dependent libraries updated
/// <summary>
/// Map to contain overlay strings to avoid rereading
/// </summary>
private static readonly Dictionary<WrapperBase, List<string>> _overlayStrings = [];
/// <summary>
/// Lock object for <see cref="_overlayStrings"/>
/// </summary>
private static readonly object _overlayStringsLock = new();
/// <summary>
/// Cached found string data in sections
/// </summary>
private static readonly Dictionary<WrapperBase, List<string>[]?> _sectionStringData = [];
/// <summary>
/// Lock object for <see cref="_sectionStringData"/>
/// </summary>
private static readonly object _sectionStringDataLock = new();
/// <summary>
/// Overlay strings, if they exist
/// </summary>
public static List<string>? GetOverlayStrings(NewExecutable nex)
{
lock (_overlayStringsLock)
{
// Use the cached data if possible
if (_overlayStrings.TryGetValue(nex, out var strings))
return strings;
// Get the available source length, if possible
long dataLength = nex.Length;
if (dataLength == -1)
return null;
// If a required property is missing
if (nex.Header == null || nex.SegmentTable == null || nex.ResourceTable?.ResourceTypes == null)
return null;
try
{
// Get the overlay data, if possible
byte[]? overlayData = nex.OverlayData;
if (overlayData == null || overlayData.Length == 0)
{
_overlayStrings[nex] = [];
return [];
}
// Otherwise, cache and return the strings
_overlayStrings[nex] = ReadStringsFrom(overlayData, charLimit: 3) ?? [];
return _overlayStrings[nex];
}
catch
{
// Ignore the error for now
return [];
}
}
}
/// <summary>
/// Overlay strings, if they exist
/// </summary>
public static List<string>? GetOverlayStrings(PortableExecutable pex)
{
lock (_overlayStringsLock)
{
// Use the cached data if possible
if (_overlayStrings.TryGetValue(pex, out var strings))
return strings;
// Get the available source length, if possible
long dataLength = pex.Length;
if (dataLength == -1)
return null;
// If the section table is missing
if (pex.SectionTable == null)
return null;
// Get the overlay data, if possible
byte[]? overlayData = pex.OverlayData;
if (overlayData == null || overlayData.Length == 0)
{
_overlayStrings[pex] = [];
return [];
}
// Otherwise, cache and return the strings
_overlayStrings[pex] = ReadStringsFrom(overlayData, charLimit: 4) ?? [];
return _overlayStrings[pex];
}
}
/// <summary>
/// Get the section strings based on index, if possible
/// </summary>
/// <param name="index">Index of the section to check for</param>
/// <returns>Section strings on success, null on error</returns>
public static List<string>? GetSectionStrings(PortableExecutable pex, int index)
{
lock (_sectionStringDataLock)
{
// If we already have cached data, just use that immediately
if (_sectionStringData.TryGetValue(pex, out var strings)
&& strings != null
&& strings[index] != null
&& strings[index].Count > 0)
{
return strings[index];
}
// If we have no sections
if (pex.SectionNames == null || pex.SectionNames.Length == 0 || pex.SectionTable == null || pex.SectionTable.Length == 0)
return null;
// Create the section string array if we have to
if (!_sectionStringData.ContainsKey(pex))
_sectionStringData[pex] = new List<string>[pex.SectionNames.Length];
// If the section doesn't exist
if (index < 0 || index >= pex.SectionTable.Length)
return null;
// Get the section data from the table
var section = pex.SectionTable[index];
if (section == null)
return null;
// Get the section data, if possible
byte[]? sectionData = pex.GetSectionData(index);
if (sectionData == null || sectionData.Length == 0)
{
_sectionStringData[pex]![index] = [];
return [];
}
// Otherwise, cache and return the strings
_sectionStringData[pex]![index] = ReadStringsFrom(sectionData, charLimit: 4) ?? [];
return _sectionStringData[pex]![index];
}
}
/// <summary>
/// Get the first section strings based on name, if possible
/// </summary>
/// <param name="name">Name of the section to check for</param>
/// <param name="exact">True to enable exact matching of names, false for starts-with</param>
/// <returns>Section strings on success, null on error</returns>
public static List<string>? GetFirstSectionStrings(PortableExecutable pex, string? name, bool exact = false)
{
// If we have no sections
if (pex.SectionNames == null || pex.SectionNames.Length == 0 || pex.SectionTable == null || pex.SectionTable.Length == 0)
return null;
// If the section doesn't exist
if (!pex.ContainsSection(name, exact))
return null;
// Get the first index of the section
int index = Array.IndexOf(pex.SectionNames, name);
return GetSectionStrings(pex, index);
}
/// <summary>
/// Get the last section strings based on name, if possible
/// </summary>
/// <param name="name">Name of the section to check for</param>
/// <param name="exact">True to enable exact matching of names, false for starts-with</param>
/// <returns>Section strings on success, null on error</returns>
public static List<string>? GetLastSectionStrings(PortableExecutable pex, string? name, bool exact = false)
{
// If we have no sections
if (pex.SectionNames == null || pex.SectionNames.Length == 0 || pex.SectionTable == null || pex.SectionTable.Length == 0)
return null;
// If the section doesn't exist
if (!pex.ContainsSection(name, exact))
return null;
// Get the last index of the section
int index = Array.LastIndexOf(pex.SectionNames, name);
return GetSectionStrings(pex, index);
}
/// <summary>
/// Read string data from the source
/// </summary>
/// <param name="charLimit">Number of characters needed to be a valid string, default 5</param>
/// <returns>String list containing the requested data, null on error</returns>
private static List<string>? ReadStringsFrom(byte[]? input, int charLimit = 5)
{
// Validate the data
if (input == null || input.Length == 0)
return null;
// Limit to 16KiB of data
if (input.Length > 16384)
{
int offset = 0;
input = input.ReadBytes(ref offset, 16384);
}
// Check for ASCII strings
var asciiStrings = ReadStringsWithEncoding(input, charLimit, Encoding.ASCII);
// Check for UTF-8 strings
// We are limiting the check for Unicode characters with a second byte of 0x00 for now
var utf8Strings = ReadStringsWithEncoding(input, charLimit, Encoding.UTF8);
// Ignore duplicate strings across encodings
List<string> sourceStrings = [.. asciiStrings, .. utf8Strings];
// Sort the strings and return
sourceStrings.Sort();
return sourceStrings;
}
/// <summary>
/// Read string data from the source with an encoding
/// </summary>
/// <param name="bytes">Byte array representing the source data</param>
/// <param name="charLimit">Number of characters needed to be a valid string</param>
/// <param name="encoding">Character encoding to use for checking</param>
/// <returns>String list containing the requested data, empty on error</returns>
/// <remarks>
/// This method has a couple of notable implementation details:
/// - Strings can only have a maximum of 64 characters
/// - Characters that fall outside of the extended ASCII set will be unused
/// </remarks>
#if NET20
private static List<string> ReadStringsWithEncoding(byte[]? bytes, int charLimit, Encoding encoding)
#else
private static HashSet<string> ReadStringsWithEncoding(byte[]? bytes, int charLimit, Encoding encoding)
#endif
{
if (bytes == null || bytes.Length == 0)
return [];
if (charLimit <= 0 || charLimit > bytes.Length)
return [];
// Create the string set to return
#if NET20
var strings = new List<string>();
#else
var strings = new HashSet<string>();
#endif
// Open the text reader with the correct encoding
using var ms = new MemoryStream(bytes);
using var reader = new StreamReader(ms, encoding);
// Create a string builder for the loop
var sb = new StringBuilder();
// Check for strings
long lastOffset = 0;
while (!reader.EndOfStream)
{
// Read the next character from the stream
char c = (char)reader.Read();
// If the character is invalid
if (char.IsControl(c) || (c & 0xFF00) != 0)
{
// Seek to the end of the last found string
string str = sb.ToString();
lastOffset += encoding.GetByteCount(str) + 1;
ms.Seek(lastOffset, SeekOrigin.Begin);
reader.DiscardBufferedData();
// Add the string if long enough
if (str.Length >= charLimit)
strings.Add(str);
// Clear the builder and continue
#if NET20 || NET35
sb = new();
#else
sb.Clear();
#endif
continue;
}
// Otherwise, add the character to the builder and continue
sb.Append(c);
}
// Handle any remaining data
if (sb.Length >= charLimit)
strings.Add(sb.ToString());
return strings;
}
#endregion
}
}

2
BinaryObjectScanner/Packer/AdvancedInstaller.cs
View File

@@ -11,7 +11,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .rdata section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
var strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("Software\\Caphyon\\Advanced Installer")))

2
BinaryObjectScanner/Packer/Crunch.cs
View File

@@ -13,7 +13,7 @@ namespace BinaryObjectScanner.Packer
{
// Get the last section strings, if they exist
var sections = pex.Model.SectionTable ?? [];
var strs = FileType.Executable.GetSectionStrings(pex, sections.Length - 1);
var strs = pex.GetSectionStrings(sections.Length - 1);
if (strs != null)
{
if (strs.Exists(s => s.Contains("BITARTS")))

2
BinaryObjectScanner/Packer/DotFuscator.cs
View File

@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .text section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
var strs = pex.GetFirstSectionStrings(".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("DotfuscatorAttribute")))

2
BinaryObjectScanner/Packer/GenteeInstaller.cs
View File

@@ -11,7 +11,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("Gentee installer")))

2
BinaryObjectScanner/Packer/InnoSetup.cs
View File

@@ -34,7 +34,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
var str = strs.Find(s => s.StartsWith("Inno Setup Setup Data"));

2
BinaryObjectScanner/Packer/InstallerVISE.cs
View File

@@ -12,7 +12,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("ViseMain")))

4
BinaryObjectScanner/Packer/MicrosoftCABSFX.cs
View File

@@ -20,7 +20,7 @@ namespace BinaryObjectScanner.Packer
return $"Microsoft CAB SFX {GetVersion(pex)}";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("wextract_cleanup")))
@@ -28,7 +28,7 @@ namespace BinaryObjectScanner.Packer
}
// Get the .text section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
strs = pex.GetFirstSectionStrings(".text");
if (strs != null)
{
// This detects a different but similar type of SFX that uses Microsoft CAB files.

2
BinaryObjectScanner/Packer/NSIS.cs
View File

@@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Packer
return $"NSIS {name!.Substring("Nullsoft Install System".Length).Trim()}";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("NullsoftInst")))

8
BinaryObjectScanner/Protection/ActiveMARK.cs
View File

@@ -40,7 +40,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .data section strings, if they exist
var strs = FileType.Executable.GetLastSectionStrings(pex, ".data");
var strs = pex.GetLastSectionStrings(".data");
if (strs != null)
{
if (strs.Exists(s => s.Contains("MPRMMGVA"))
@@ -62,14 +62,14 @@ namespace BinaryObjectScanner.Protection
}
// Get the overlay data, if it exists
if (FileType.Executable.GetOverlayStrings(pex) != null)
if (pex.OverlayStrings != null)
{
if (FileType.Executable.GetOverlayStrings(pex)!.Exists(s => s.Contains("TMSAMVOH")))
if (pex.OverlayStrings.Exists(s => s.Contains("TMSAMVOH")))
return "ActiveMARK";
}
// Get the last .bss section strings, if they exist
strs = FileType.Executable.GetLastSectionStrings(pex, ".bss");
strs = pex.GetLastSectionStrings(".bss");
if (strs != null)
{
if (strs.Exists(s => s.Contains("TMSAMVOF")))

8
BinaryObjectScanner/Protection/AlphaROM.cs
View File

@@ -48,7 +48,7 @@ namespace BinaryObjectScanner.Protection
// TODO: Add version detection for Alpha-ROM.
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("\\SETTEC")))
@@ -59,7 +59,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("This Game is Japan Only")))
@@ -75,10 +75,10 @@ namespace BinaryObjectScanner.Protection
}
// Get the overlay data, if it exists
if (FileType.Executable.GetOverlayStrings(pex) != null)
if (pex.OverlayStrings != null)
{
// Found in Redump entry 84122.
if (FileType.Executable.GetOverlayStrings(pex)!.Exists(s => s.Contains("SETTEC0000")))
if (pex.OverlayStrings.Exists(s => s.Contains("SETTEC0000")))
return "Alpha-ROM";
}

2
BinaryObjectScanner/Protection/Armadillo.cs
View File

@@ -33,7 +33,7 @@ namespace BinaryObjectScanner.Protection
foreach (var sectionName in Array.FindAll(pex.SectionNames ?? [], s => s != null && s.EndsWith("1")))
{
// Get the section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, sectionName);
var strs = pex.GetFirstSectionStrings(sectionName);
if (strs != null)
{
if (strs.Exists(s => s.Contains("ARMDEBUG")))

6
BinaryObjectScanner/Protection/ByteShield.cs
View File

@@ -82,7 +82,7 @@ namespace BinaryObjectScanner.Protection
return "ByteShield";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "LineRider2.exe" in Redump entry 6236
@@ -91,7 +91,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Found in "ByteShield.dll" in Redump entry 6236
@@ -108,7 +108,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .ret section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".ret");
strs = pex.GetFirstSectionStrings(".ret");
if (strs != null)
{
// TODO: Figure out if this specifically indicates if the file is encrypted

2
BinaryObjectScanner/Protection/CDDVDCops.cs
View File

@@ -190,7 +190,7 @@ namespace BinaryObjectScanner.Protection
// Found in "bib.dll" in IA item "https://archive.org/details/cover_202501"
// This contains the version section that the Content Check looked for. There are likely other sections
// that may contain it. Update when more are found.
var strs = FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
var match = strs.Find(s => s.Contains(" ver. ") && (s.Contains("CD-Cops, ") || s.Contains("DVD-Cops, ")));

2
BinaryObjectScanner/Protection/CDSHiELDSE.cs
View File

@@ -18,7 +18,7 @@ namespace BinaryObjectScanner.Protection
//}
// Get the code/CODE section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)
{
if (strs.Exists(s => s.Contains("~0017.tmp")))

2
BinaryObjectScanner/Protection/ChosenBytesCodeLock.cs
View File

@@ -31,7 +31,7 @@ namespace BinaryObjectScanner.Protection
return $"ChosenBytes Code-Lock {pex.ProductVersion}";
// Get the .text section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
var strs = pex.GetFirstSectionStrings(".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("CODE-LOCK.OCX")))

6
BinaryObjectScanner/Protection/CopyX.cs
View File

@@ -66,7 +66,7 @@ namespace BinaryObjectScanner.Protection
if (sections == null)
return null;
if (FileType.Executable.GetOverlayStrings(pex) != null)
if (pex.OverlayStrings != null)
{
// Checks if main executable contains reference to optgraph.dll.
// This might be better removed later, as Redump ID 82475 is a false positive, and also doesn't actually
@@ -76,11 +76,11 @@ namespace BinaryObjectScanner.Protection
// TODO: This might need to check every single section. Unsure until more samples are acquired.
// TODO: TKKG also has an NE 3.1x executable with a reference. This can be added later.
// Samples: Redump ID 108150
if (FileType.Executable.GetOverlayStrings(pex)!.Exists(s => s.Contains("optgraph.dll")))
if (pex.OverlayStrings.Exists(s => s.Contains("optgraph.dll")))
return "copy-X [Check disc for physical ring]";
}
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
var strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Samples: Redump ID 82475, German Emergency 2 Deluxe, Redump ID 48393

2
BinaryObjectScanner/Protection/CrypKey.cs
View File

@@ -16,7 +16,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the code/CODE section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)
{
// Found in "NECRO95.EXE" in IA item "NBECRORV11".

6
BinaryObjectScanner/Protection/ElectronicArts.cs
View File

@@ -27,7 +27,7 @@ namespace BinaryObjectScanner.Protection
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("EReg Config Form")))
@@ -35,7 +35,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("GenericEA")) && strs.Exists(s => s.Contains("Activation")))
@@ -43,7 +43,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
strs = pex.GetFirstSectionStrings(".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("GenericEA")) && strs.Exists(s => s.Contains("Activation")))

6
BinaryObjectScanner/Protection/HexalockAutoLock.cs
View File

@@ -50,7 +50,7 @@ namespace BinaryObjectScanner.Protection
return $"Hexalock AutoLock 4.5";
// Get the .text section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
var strs = pex.GetFirstSectionStrings(".text");
if (strs != null)
{
// Found in "The Sudoku Challenge Collection.exe" in "The Sudoku Challenge! Collection" by Play at Joe's.
@@ -59,7 +59,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the code/CODE section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)
{
// Found in "launcher.exe" in "Sea Adventure / Adventure de la Mer" by Compedia.
@@ -68,7 +68,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the UPX1 section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, "UPX1");
strs = pex.GetFirstSectionStrings("UPX1");
if (strs != null)
{
// Found in "postmanpat.exe" in "Postman Pat" by Compedia.

2
BinaryObjectScanner/Protection/ImpulseReactor.cs
View File

@@ -34,7 +34,7 @@ namespace BinaryObjectScanner.Protection
// Get the .rdata section strings, if they exist
bool containsCheck2 = false;
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
var strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
containsCheck2 = strs.Exists(s => s.EndsWith("ATTLIST"))

2
BinaryObjectScanner/Protection/InterLok.cs
View File

@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .rsrc section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rsrc");
var strs = pex.GetFirstSectionStrings(".rsrc");
if (strs != null)
{
// Found in "nfsc_link.exe" in IA item "nfscorigin".

2
BinaryObjectScanner/Protection/KalypsoLauncher.cs
View File

@@ -39,7 +39,7 @@ namespace BinaryObjectScanner.Protection
return $"Kalypso Launcher {pex.GetInternalVersion()}";
// Get the .text section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
var strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Found in "TFT.exe" in Redump entry 95617.

2
BinaryObjectScanner/Protection/LabelGate.cs
View File

@@ -31,7 +31,7 @@ namespace BinaryObjectScanner.Protection
return $"LabelGate CD2 Media Player";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "START.EXE" (Redump entry 95010 and product ID SVWC-7185).

2
BinaryObjectScanner/Protection/Macrovision.CDilla.cs
View File

@@ -113,7 +113,7 @@ namespace BinaryObjectScanner.Protection
return $"C-Dilla License Management System";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "DJMixStation\DJMixStation.exe" in IA item "ejay_nestle_trial".

2
BinaryObjectScanner/Protection/Macrovision.CactusDataShield.cs
View File

@@ -33,7 +33,7 @@ namespace BinaryObjectScanner.Protection
internal static string? CactusDataShieldCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("\\*.CDS")))

2
BinaryObjectScanner/Protection/Macrovision.FLEXnet.cs
View File

@@ -51,7 +51,7 @@ namespace BinaryObjectScanner.Protection
return $"FlexLM {pex.ProductVersion}";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "FLEXLM.CPL", "INSTALLS.EXE", "LMGR326B.DLL", "LMGRD.EXE", and "TAKEFIVE.EXE" in IA item "prog-17_202403".

2
BinaryObjectScanner/Protection/Macrovision.SafeCast.cs
View File

@@ -98,7 +98,7 @@ namespace BinaryObjectScanner.Protection
return "SafeCast";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "DJMixStation\DJMixStation.exe" in IA item "ejay_nestle_trial".

2
BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs
View File

@@ -65,7 +65,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in Redump entries 14928, 25579, 32751.

4
BinaryObjectScanner/Protection/Macrovision.cs
View File

@@ -74,7 +74,7 @@ namespace BinaryObjectScanner.Protection
resultsList.Add(sectionMatch);
// Get the .data section, if it exists, for protected sections.
sectionMatch = CheckSectionForProtection(file, includeDebug, FileType.Executable.GetFirstSectionStrings(pex, ".data"), pex.GetFirstSectionData(".data"), true);
sectionMatch = CheckSectionForProtection(file, includeDebug, pex.GetFirstSectionStrings(".data"), pex.GetFirstSectionData(".data"), true);
if (sectionMatch != null)
resultsList.Add(sectionMatch!);
@@ -107,7 +107,7 @@ namespace BinaryObjectScanner.Protection
resultsList.Add(sectionMatch);
// Check the .data section, if it exists, for protected sections.
sectionMatch = CheckSectionForProtection(file, includeDebug, FileType.Executable.GetFirstSectionStrings(pex, ".data"), pex.GetFirstSectionData(".data"), false);
sectionMatch = CheckSectionForProtection(file, includeDebug, pex.GetFirstSectionStrings(".data"), pex.GetFirstSectionData(".data"), false);
if (sectionMatch != null)
resultsList.Add(sectionMatch);
}

2
BinaryObjectScanner/Protection/MediaMax.cs
View File

@@ -37,7 +37,7 @@ namespace BinaryObjectScanner.Protection
// "This limited production advanced CD is not playable on your computer. It is solely intended for playback on standard CD players."
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("CD3 Launch Error")))

2
BinaryObjectScanner/Protection/ProtectDISC.cs
View File

@@ -54,7 +54,7 @@ namespace BinaryObjectScanner.Protection
if (sections.Length > 1)
{
// Get the n - 1 section strings, if they exist
var strs = FileType.Executable.GetSectionStrings(pex, sections.Length - 2);
var strs = pex.GetSectionStrings(sections.Length - 2);
if (strs != null)
{
var str = strs.Find(s => s.Contains("VOB ProtectCD"));

8
BinaryObjectScanner/Protection/RainbowSentinel.cs
View File

@@ -203,7 +203,7 @@ namespace BinaryObjectScanner.Protection
return "Rainbow Sentinel Driver";
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
// Found in "ADESKSYS.DLL"/"WINADMIN.EXE"/"WINQUERY.EXE" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\netsetup\SUPPORT\IPX".
@@ -216,7 +216,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Found in "SP32W.DLL" in IA item "pcwkcd-1296".
@@ -241,7 +241,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rsrc section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rsrc");
strs = pex.GetFirstSectionStrings(".rsrc");
if (strs != null)
{
// Found in "WINMON.exe" in IA item "czchip199707cd".
@@ -250,7 +250,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .text section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
strs = pex.GetFirstSectionStrings(".text");
if (strs != null)
{
// Found in "ACLT.HWL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\aclt\DRV\W95LOCK".

2
BinaryObjectScanner/Protection/RealArcade.cs
View File

@@ -19,7 +19,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data");
var strs = pex.GetFirstSectionStrings(".data");
if (strs != null)
{
// Found in "rebound.exe" in the installation directory for "Rebound" in IA item "Nova_RealArcadeCD_USA".

4
BinaryObjectScanner/Protection/Roxxe.cs
View File

@@ -17,7 +17,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the code/CODE section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)
{
// Found in "Owar.exe" in IA item "game4u-22-cd".
@@ -27,7 +27,7 @@ namespace BinaryObjectScanner.Protection
// Get the .rsrc section strings, if they exist
// TODO: Check for these strings specifically within the application-defined resource that they're found in, not just the generic resource section.
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rsrc");
strs = pex.GetFirstSectionStrings(".rsrc");
if (strs != null)
{
// Found in "Owar.exe" in IA items "game4u-22-cd" and "original-war".

6
BinaryObjectScanner/Protection/SecuROM.cs
View File

@@ -64,9 +64,9 @@ namespace BinaryObjectScanner.Protection
return $"SecuROM SLL Protected (for SecuROM v8.x)";
// Search after the last section
if (FileType.Executable.GetOverlayStrings(pex) != null)
if (pex.OverlayStrings != null)
{
if (FileType.Executable.GetOverlayStrings(pex)!.Exists(s => s == "AddD"))
if (pex.OverlayStrings.Exists(s => s == "AddD"))
return $"SecuROM {GetV4Version(pex)}";
}
@@ -98,7 +98,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
var strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
// Both have the identifier found within `.rdata` but the version is within `.data`

2
BinaryObjectScanner/Protection/SoftLock.cs
View File

@@ -56,7 +56,7 @@ namespace BinaryObjectScanner.Protection
// and dialog boxes. See if any of those are unique to SoftLock.
// Found in "TafseerVer4.exe" in IA item "TAFSEERVER4SETUP"
var strings = FileType.Executable.GetFirstSectionStrings(pex, ".section") ?? [];
var strings = pex.GetFirstSectionStrings(".section") ?? [];
if (strings.Exists(s => s.Contains("SOFTLOCKPROTECTION")))
return "SoftLock";

2
BinaryObjectScanner/Protection/SolidShield.cs
View File

@@ -79,7 +79,7 @@ namespace BinaryObjectScanner.Protection
for (int i = Math.Max(sections.Length - 2, 0); i < sections.Length; i++)
{
// Get the nth section strings, if they exist
var strs = FileType.Executable.GetSectionStrings(pex, i);
var strs = pex.GetSectionStrings(i);
if (strs != null)
{
var str = strs.Find(s => s.Contains("Solidshield "));

2
BinaryObjectScanner/Protection/Sysiphus.cs
View File

@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
{
var str = strs.Find(s => s.Contains("V SUHPISYS"));

2
BinaryObjectScanner/Protection/Themida.cs
View File

@@ -27,7 +27,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the "Arcsoft " section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, "Arcsoft ");
var strs = pex.GetFirstSectionStrings("Arcsoft ");
if (strs != null)
{
// Found in "uDigital Theatre.exe" in http://downloads.fyxm.net/ArcSoft-TotalMedia-23085.html (https://web.archive.org/web/20221114042838/http://files.fyxm.net/23/23085/totalmediatheatre3platinum_retail_tbyb_all.exe).

4
BinaryObjectScanner/Protection/WTMCDProtect.cs
View File

@@ -25,7 +25,7 @@ namespace BinaryObjectScanner.Protection
return "WTM Protection Viewer";
// Get the code/CODE section strings, if they exist
var strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)
{
if (strs.Exists(s => s.Contains("wtmdum.imp")))
@@ -33,7 +33,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .text section strings, if they exist
strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
strs = pex.GetFirstSectionStrings(".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("WTM DIGITAL Photo Protect")))

2
BinaryObjectScanner/Protection/XCP.cs
View File

@@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .rdata section strings, if they exist
List<string>? strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
List<string>? strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("XCP.DAT")))