Add PE checks to SoftLock

This commit is contained in:
Matt Nadareski
2022-12-19 21:39:24 -08:00
parent 28391de50c
commit 64cc4785ca
3 changed files with 76 additions and 2 deletions

View File

@@ -1278,6 +1278,7 @@ namespace BurnOutSharp.Wrappers
Console.WriteLine(" -------------------------");
if (PointerToSymbolTable == 0
|| NumberOfSymbols == 0
|| COFFSymbolTable == null
|| COFFSymbolTable.Length == 0)
{
Console.WriteLine(" No COFF symbol table items");

View File

@@ -1,12 +1,85 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
namespace BurnOutSharp.ProtectionType
{
public class SoftLock : IPathCheck
/// <see href="https://zhidao.baidu.com/question/211454017.html"/>
/// <see href="https://bbs.pediy.com/thread-62414-3.htm"/>
/// <see href="https://bbs.pediy.com/thread-141554.htm"/>
/// <see href="https://forum.arabhardware.net/showthread.php?t=45360"/>
/// <see href="https://forum.arabhardware.net/showthread.php?t=45360&p=304085"/>
public class SoftLock : IPortableExecutableCheck, IPathCheck
{
/// <inheritdoc/>
public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex?.SectionTable;
if (sections == null)
return null;
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
string name = pex.InternalName;
if (name?.Equals("Softlock Protected Application") == true)
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
name = pex.Comments;
if (name?.Equals("Softlock Protected Application") == true)
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
var stMatch = pex.FindStringTableByEntry("Softlock CD");
if (stMatch.Any())
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
stMatch = pex.FindStringTableByEntry("Softlock USB Key");
if (stMatch.Any())
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
var dbMatch = pex.FindDialogByTitle("Softlock Protection Kit");
if (dbMatch.Any())
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
dbMatch = pex.FindDialogByTitle("About Softlock Protected Application");
if (dbMatch.Any())
return "SoftLock";
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
dbMatch = pex.FindDialogBoxByItemTitle("www.softlock.net");
if (dbMatch.Any())
return "SoftLock";
// TODO: See if the version number is anywhere else
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
dbMatch = pex.FindDialogBoxByItemTitle("Softlock Protected Application Version 1.0");
if (dbMatch.Any())
return "SoftLock";
// There are many mentions of USB dongle and CD protection in the various string tables
// and dialog boxes. See if any of those are unique to SoftLock.
// Get strings from .section, if possible
var strings = pex.GetFirstSectionStrings(".section");
if (strings != null && strings.Any())
{
// Found in "TafseerVer4.exe" in IA item "TAFSEERVER4SETUP"
if (strings.Any(s => s?.Contains("SOFTLOCKPROTECTION") == true))
return "SoftLock";
};
// Investigate if the ".section" section is an indicator of SoftLock
return null;
}
/// <inheritdoc/>
public ConcurrentQueue<string> CheckDirectoryPath(string path, IEnumerable<string> files)
{

View File

@@ -86,7 +86,7 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain
| SafeLock | False | True | |
| SecuROM | True | True | v8.x and White Label detected partially² |
| SmartE | True | True | |
| SoftLock | False | True | |
| SoftLock | True | True | |
| SolidShield | True | True | Some Wrapper v1 not detected² |
| StarForce | True | False | Partially unconfirmed², commented out issue with `protect.exe` false positives |
| Steam | True | True | |