SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-08 18:06:34 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Temporarily migrate more code

Browse Source
This commit is contained in:
Matt Nadareski
2025-09-03 09:33:44 -04:00
parent 6da9e9c931
commit 6904674785
42 changed files with 159 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

105
BinaryObjectScanner/FileType/Executable.cs
View File

@@ -249,6 +249,16 @@ namespace BinaryObjectScanner.FileType
/// </summary>
private static readonly object _overlayStringsLock = new();
/// <summary>
/// Cached found string data in sections
/// </summary>
private static readonly Dictionary<WrapperBase, List<string>[]?> _sectionStringData = [];
/// <summary>
/// Lock object for <see cref="_sectionStringData"/>
/// </summary>
private static readonly object _sectionStringDataLock = new();
/// <summary>
/// Overlay strings, if they exist
/// </summary>
@@ -317,6 +327,97 @@ namespace BinaryObjectScanner.FileType
}
}
/// <summary>
/// Get the section strings based on index, if possible
/// </summary>
/// <param name="index">Index of the section to check for</param>
/// <returns>Section strings on success, null on error</returns>
public static List<string>? GetSectionStrings(PortableExecutable pex, int index)
{
lock (_sectionStringDataLock)
{
// If we already have cached data, just use that immediately
if (_sectionStringData.TryGetValue(pex, out var strings)
&& strings != null
&& strings[index] != null
&& strings[index].Count > 0)
{
return strings[index];
}
// If we have no sections
if (pex.SectionNames == null || pex.SectionNames.Length == 0 || pex.SectionTable == null || pex.SectionTable.Length == 0)
return null;
// Create the section string array if we have to
if (!_sectionStringData.ContainsKey(pex))
_sectionStringData[pex] = new List<string>[pex.SectionNames.Length];
// If the section doesn't exist
if (index < 0 || index >= pex.SectionTable.Length)
return null;
// Get the section data from the table
var section = pex.SectionTable[index];
if (section == null)
return null;
// Get the section data, if possible
byte[]? sectionData = pex.GetSectionData(index);
if (sectionData == null || sectionData.Length == 0)
{
_sectionStringData[pex]![index] = [];
return [];
}
// Otherwise, cache and return the strings
_sectionStringData[pex]![index] = ReadStringsFrom(sectionData, charLimit: 4) ?? [];
return _sectionStringData[pex]![index];
}
}
/// <summary>
/// Get the first section strings based on name, if possible
/// </summary>
/// <param name="name">Name of the section to check for</param>
/// <param name="exact">True to enable exact matching of names, false for starts-with</param>
/// <returns>Section strings on success, null on error</returns>
public static List<string>? GetFirstSectionStrings(PortableExecutable pex, string? name, bool exact = false)
{
// If we have no sections
if (pex.SectionNames == null || pex.SectionNames.Length == 0 || pex.SectionTable == null || pex.SectionTable.Length == 0)
return null;
// If the section doesn't exist
if (!pex.ContainsSection(name, exact))
return null;
// Get the first index of the section
int index = Array.IndexOf(pex.SectionNames, name);
return GetSectionStrings(pex, index);
}
/// <summary>
/// Get the last section strings based on name, if possible
/// </summary>
/// <param name="name">Name of the section to check for</param>
/// <param name="exact">True to enable exact matching of names, false for starts-with</param>
/// <returns>Section strings on success, null on error</returns>
public static List<string>? GetLastSectionStrings(PortableExecutable pex, string? name, bool exact = false)
{
// If we have no sections
if (pex.SectionNames == null || pex.SectionNames.Length == 0 || pex.SectionTable == null || pex.SectionTable.Length == 0)
return null;
// If the section doesn't exist
if (!pex.ContainsSection(name, exact))
return null;
// Get the last index of the section
int index = Array.LastIndexOf(pex.SectionNames, name);
return GetSectionStrings(pex, index);
}
/// <summary>
/// Read string data from the source
/// </summary>
@@ -336,7 +437,7 @@ namespace BinaryObjectScanner.FileType
}
// Check for ASCII strings
var asciiStrings = ReadStringsWithEncoding(input, charLimit, Encoding.ASCII);
var asciiStrings = ReadStringsWithEncoding(input, charLimit, Encoding.ASCII);
// Check for UTF-8 strings
// We are limiting the check for Unicode characters with a second byte of 0x00 for now
@@ -426,7 +527,7 @@ namespace BinaryObjectScanner.FileType
return strings;
}
#endregion
}

2
BinaryObjectScanner/Packer/AdvancedInstaller.cs
View File

@@ -11,7 +11,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .rdata section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("Software\\Caphyon\\Advanced Installer")))

2
BinaryObjectScanner/Packer/Crunch.cs
View File

@@ -13,7 +13,7 @@ namespace BinaryObjectScanner.Packer
{
// Get the last section strings, if they exist
var sections = pex.Model.SectionTable ?? [];
var strs = pex.GetSectionStrings(sections.Length - 1);
var strs = FileType.Executable.GetSectionStrings(pex, sections.Length - 1);
if (strs != null)
{
if (strs.Exists(s => s.Contains("BITARTS")))

2
BinaryObjectScanner/Packer/DotFuscator.cs
View File

@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .text section strings, if they exist
var strs = pex.GetFirstSectionStrings(".text");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("DotfuscatorAttribute")))

2
BinaryObjectScanner/Packer/GenteeInstaller.cs
View File

@@ -11,7 +11,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("Gentee installer")))

2
BinaryObjectScanner/Packer/InnoSetup.cs
View File

@@ -34,7 +34,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
var str = strs.Find(s => s.StartsWith("Inno Setup Setup Data"));

2
BinaryObjectScanner/Packer/InstallerVISE.cs
View File

@@ -12,7 +12,7 @@ namespace BinaryObjectScanner.Packer
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("ViseMain")))

4
BinaryObjectScanner/Packer/MicrosoftCABSFX.cs
View File

@@ -20,7 +20,7 @@ namespace BinaryObjectScanner.Packer
return $"Microsoft CAB SFX {GetVersion(pex)}";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("wextract_cleanup")))
@@ -28,7 +28,7 @@ namespace BinaryObjectScanner.Packer
}
// Get the .text section strings, if they exist
strs = pex.GetFirstSectionStrings(".text");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
if (strs != null)
{
// This detects a different but similar type of SFX that uses Microsoft CAB files.

2
BinaryObjectScanner/Packer/NSIS.cs
View File

@@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Packer
return $"NSIS {name!.Substring("Nullsoft Install System".Length).Trim()}";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("NullsoftInst")))

4
BinaryObjectScanner/Protection/ActiveMARK.cs
View File

@@ -40,7 +40,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .data section strings, if they exist
var strs = pex.GetLastSectionStrings(".data");
var strs = FileType.Executable.GetLastSectionStrings(pex, ".data");
if (strs != null)
{
if (strs.Exists(s => s.Contains("MPRMMGVA"))
@@ -69,7 +69,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the last .bss section strings, if they exist
strs = pex.GetLastSectionStrings(".bss");
strs = FileType.Executable.GetLastSectionStrings(pex, ".bss");
if (strs != null)
{
if (strs.Exists(s => s.Contains("TMSAMVOF")))

4
BinaryObjectScanner/Protection/AlphaROM.cs
View File

@@ -48,7 +48,7 @@ namespace BinaryObjectScanner.Protection
// TODO: Add version detection for Alpha-ROM.
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("\\SETTEC")))
@@ -59,7 +59,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".rdata");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("This Game is Japan Only")))

2
BinaryObjectScanner/Protection/Armadillo.cs
View File

@@ -33,7 +33,7 @@ namespace BinaryObjectScanner.Protection
foreach (var sectionName in Array.FindAll(pex.SectionNames ?? [], s => s != null && s.EndsWith("1")))
{
// Get the section strings, if they exist
var strs = pex.GetFirstSectionStrings(sectionName);
var strs = FileType.Executable.GetFirstSectionStrings(pex, sectionName);
if (strs != null)
{
if (strs.Exists(s => s.Contains("ARMDEBUG")))

6
BinaryObjectScanner/Protection/ByteShield.cs
View File

@@ -82,7 +82,7 @@ namespace BinaryObjectScanner.Protection
return "ByteShield";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
// Found in "LineRider2.exe" in Redump entry 6236
@@ -91,7 +91,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".rdata");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
// Found in "ByteShield.dll" in Redump entry 6236
@@ -108,7 +108,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .ret section strings, if they exist
strs = pex.GetFirstSectionStrings(".ret");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".ret");
if (strs != null)
{
// TODO: Figure out if this specifically indicates if the file is encrypted

2
BinaryObjectScanner/Protection/CDDVDCops.cs
View File

@@ -181,7 +181,7 @@ namespace BinaryObjectScanner.Protection
// Found in "bib.dll" in IA item "https://archive.org/details/cover_202501"
// This contains the version section that the Content Check looked for. There are likely other sections
// that may contain it. Update when more are found.
var strs = pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
var match = strs.Find(s => s.Contains(" ver. ") && (s.Contains("CD-Cops, ") || s.Contains("DVD-Cops, ")));

2
BinaryObjectScanner/Protection/CDSHiELDSE.cs
View File

@@ -18,7 +18,7 @@ namespace BinaryObjectScanner.Protection
//}
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
var strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
if (strs != null)
{
if (strs.Exists(s => s.Contains("~0017.tmp")))

2
BinaryObjectScanner/Protection/ChosenBytesCodeLock.cs
View File

@@ -31,7 +31,7 @@ namespace BinaryObjectScanner.Protection
return $"ChosenBytes Code-Lock {pex.ProductVersion}";
// Get the .text section strings, if they exist
var strs = pex.GetFirstSectionStrings(".text");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("CODE-LOCK.OCX")))

2
BinaryObjectScanner/Protection/CopyX.cs
View File

@@ -80,7 +80,7 @@ namespace BinaryObjectScanner.Protection
return "copy-X [Check disc for physical ring]";
}
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
// Samples: Redump ID 82475, German Emergency 2 Deluxe, Redump ID 48393

2
BinaryObjectScanner/Protection/CrypKey.cs
View File

@@ -16,7 +16,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
var strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
if (strs != null)
{
// Found in "NECRO95.EXE" in IA item "NBECRORV11".

6
BinaryObjectScanner/Protection/ElectronicArts.cs
View File

@@ -27,7 +27,7 @@ namespace BinaryObjectScanner.Protection
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("EReg Config Form")))
@@ -35,7 +35,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".rdata");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("GenericEA")) && strs.Exists(s => s.Contains("Activation")))
@@ -43,7 +43,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".text");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("GenericEA")) && strs.Exists(s => s.Contains("Activation")))

6
BinaryObjectScanner/Protection/HexalockAutoLock.cs
View File

@@ -50,7 +50,7 @@ namespace BinaryObjectScanner.Protection
return $"Hexalock AutoLock 4.5";
// Get the .text section strings, if they exist
var strs = pex.GetFirstSectionStrings(".text");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
if (strs != null)
{
// Found in "The Sudoku Challenge Collection.exe" in "The Sudoku Challenge! Collection" by Play at Joe's.
@@ -59,7 +59,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the code/CODE section strings, if they exist
strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
if (strs != null)
{
// Found in "launcher.exe" in "Sea Adventure / Adventure de la Mer" by Compedia.
@@ -68,7 +68,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the UPX1 section strings, if they exist
strs = pex.GetFirstSectionStrings("UPX1");
strs = FileType.Executable.GetFirstSectionStrings(pex, "UPX1");
if (strs != null)
{
// Found in "postmanpat.exe" in "Postman Pat" by Compedia.

2
BinaryObjectScanner/Protection/ImpulseReactor.cs
View File

@@ -34,7 +34,7 @@ namespace BinaryObjectScanner.Protection
// Get the .rdata section strings, if they exist
bool containsCheck2 = false;
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
containsCheck2 = strs.Exists(s => s.EndsWith("ATTLIST"))

2
BinaryObjectScanner/Protection/InterLok.cs
View File

@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .rsrc section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rsrc");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rsrc");
if (strs != null)
{
// Found in "nfsc_link.exe" in IA item "nfscorigin".

2
BinaryObjectScanner/Protection/KalypsoLauncher.cs
View File

@@ -39,7 +39,7 @@ namespace BinaryObjectScanner.Protection
return $"Kalypso Launcher {pex.GetInternalVersion()}";
// Get the .text section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
// Found in "TFT.exe" in Redump entry 95617.

2
BinaryObjectScanner/Protection/LabelGate.cs
View File

@@ -31,7 +31,7 @@ namespace BinaryObjectScanner.Protection
return $"LabelGate CD2 Media Player";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
// Found in "START.EXE" (Redump entry 95010 and product ID SVWC-7185).

2
BinaryObjectScanner/Protection/Macrovision.CDilla.cs
View File

@@ -113,7 +113,7 @@ namespace BinaryObjectScanner.Protection
return $"C-Dilla License Management System";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
// Found in "DJMixStation\DJMixStation.exe" in IA item "ejay_nestle_trial".

2
BinaryObjectScanner/Protection/Macrovision.CactusDataShield.cs
View File

@@ -33,7 +33,7 @@ namespace BinaryObjectScanner.Protection
internal static string? CactusDataShieldCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("\\*.CDS")))

2
BinaryObjectScanner/Protection/Macrovision.FLEXnet.cs
View File

@@ -51,7 +51,7 @@ namespace BinaryObjectScanner.Protection
return $"FlexLM {pex.ProductVersion}";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
// Found in "FLEXLM.CPL", "INSTALLS.EXE", "LMGR326B.DLL", "LMGRD.EXE", and "TAKEFIVE.EXE" in IA item "prog-17_202403".

2
BinaryObjectScanner/Protection/Macrovision.SafeCast.cs
View File

@@ -89,7 +89,7 @@ namespace BinaryObjectScanner.Protection
return "SafeCast";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
// Found in "DJMixStation\DJMixStation.exe" in IA item "ejay_nestle_trial".

2
BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs
View File

@@ -65,7 +65,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
// Found in Redump entries 14928, 25579, 32751.

4
BinaryObjectScanner/Protection/Macrovision.cs
View File

@@ -74,7 +74,7 @@ namespace BinaryObjectScanner.Protection
resultsList.Add(sectionMatch);
// Get the .data section, if it exists, for protected sections.
sectionMatch = CheckSectionForProtection(file, includeDebug, pex.GetFirstSectionStrings(".data"), pex.GetFirstSectionData(".data"), true);
sectionMatch = CheckSectionForProtection(file, includeDebug, FileType.Executable.GetFirstSectionStrings(pex, ".data"), pex.GetFirstSectionData(".data"), true);
if (sectionMatch != null)
resultsList.Add(sectionMatch!);
@@ -107,7 +107,7 @@ namespace BinaryObjectScanner.Protection
resultsList.Add(sectionMatch);
// Check the .data section, if it exists, for protected sections.
sectionMatch = CheckSectionForProtection(file, includeDebug, pex.GetFirstSectionStrings(".data"), pex.GetFirstSectionData(".data"), false);
sectionMatch = CheckSectionForProtection(file, includeDebug, FileType.Executable.GetFirstSectionStrings(pex, ".data"), pex.GetFirstSectionData(".data"), false);
if (sectionMatch != null)
resultsList.Add(sectionMatch);
}

2
BinaryObjectScanner/Protection/MediaMax.cs
View File

@@ -37,7 +37,7 @@ namespace BinaryObjectScanner.Protection
// "This limited production advanced CD is not playable on your computer. It is solely intended for playback on standard CD players."
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
if (strs.Exists(s => s.Contains("CD3 Launch Error")))

2
BinaryObjectScanner/Protection/ProtectDISC.cs
View File

@@ -54,7 +54,7 @@ namespace BinaryObjectScanner.Protection
if (sections.Length > 1)
{
// Get the n - 1 section strings, if they exist
var strs = pex.GetSectionStrings(sections.Length - 2);
var strs = FileType.Executable.GetSectionStrings(pex, sections.Length - 2);
if (strs != null)
{
var str = strs.Find(s => s.Contains("VOB ProtectCD"));

8
BinaryObjectScanner/Protection/RainbowSentinel.cs
View File

@@ -194,7 +194,7 @@ namespace BinaryObjectScanner.Protection
return "Rainbow Sentinel Driver";
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
// Found in "ADESKSYS.DLL"/"WINADMIN.EXE"/"WINQUERY.EXE" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\netsetup\SUPPORT\IPX".
@@ -207,7 +207,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
strs = pex.GetFirstSectionStrings(".rdata");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
// Found in "SP32W.DLL" in IA item "pcwkcd-1296".
@@ -232,7 +232,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rsrc section strings, if they exist
strs = pex.GetFirstSectionStrings(".rsrc");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rsrc");
if (strs != null)
{
// Found in "WINMON.exe" in IA item "czchip199707cd".
@@ -241,7 +241,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .text section strings, if they exist
strs = pex.GetFirstSectionStrings(".text");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
if (strs != null)
{
// Found in "ACLT.HWL" in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]", folder "\aclt\DRV\W95LOCK".

2
BinaryObjectScanner/Protection/RealArcade.cs
View File

@@ -19,7 +19,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data");
if (strs != null)
{
// Found in "rebound.exe" in the installation directory for "Rebound" in IA item "Nova_RealArcadeCD_USA".

4
BinaryObjectScanner/Protection/Roxxe.cs
View File

@@ -17,7 +17,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
var strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
if (strs != null)
{
// Found in "Owar.exe" in IA item "game4u-22-cd".
@@ -27,7 +27,7 @@ namespace BinaryObjectScanner.Protection
// Get the .rsrc section strings, if they exist
// TODO: Check for these strings specifically within the application-defined resource that they're found in, not just the generic resource section.
strs = pex.GetFirstSectionStrings(".rsrc");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".rsrc");
if (strs != null)
{
// Found in "Owar.exe" in IA items "game4u-22-cd" and "original-war".

2
BinaryObjectScanner/Protection/SecuROM.cs
View File

@@ -98,7 +98,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .rdata section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rdata");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
// Both have the identifier found within `.rdata` but the version is within `.data`

2
BinaryObjectScanner/Protection/SoftLock.cs
View File

@@ -56,7 +56,7 @@ namespace BinaryObjectScanner.Protection
// and dialog boxes. See if any of those are unique to SoftLock.
// Found in "TafseerVer4.exe" in IA item "TAFSEERVER4SETUP"
var strings = pex.GetFirstSectionStrings(".section") ?? [];
var strings = FileType.Executable.GetFirstSectionStrings(pex, ".section") ?? [];
if (strings.Exists(s => s.Contains("SOFTLOCKPROTECTION")))
return "SoftLock";

2
BinaryObjectScanner/Protection/SolidShield.cs
View File

@@ -79,7 +79,7 @@ namespace BinaryObjectScanner.Protection
for (int i = Math.Max(sections.Length - 2, 0); i < sections.Length; i++)
{
// Get the nth section strings, if they exist
var strs = pex.GetSectionStrings(i);
var strs = FileType.Executable.GetSectionStrings(pex, i);
if (strs != null)
{
var str = strs.Find(s => s.Contains("Solidshield "));

2
BinaryObjectScanner/Protection/Sysiphus.cs
View File

@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
var strs = FileType.Executable.GetFirstSectionStrings(pex, ".data") ?? FileType.Executable.GetFirstSectionStrings(pex, "DATA");
if (strs != null)
{
var str = strs.Find(s => s.Contains("V SUHPISYS"));

2
BinaryObjectScanner/Protection/Themida.cs
View File

@@ -27,7 +27,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the "Arcsoft " section strings, if they exist
var strs = pex.GetFirstSectionStrings("Arcsoft ");
var strs = FileType.Executable.GetFirstSectionStrings(pex, "Arcsoft ");
if (strs != null)
{
// Found in "uDigital Theatre.exe" in http://downloads.fyxm.net/ArcSoft-TotalMedia-23085.html (https://web.archive.org/web/20221114042838/http://files.fyxm.net/23/23085/totalmediatheatre3platinum_retail_tbyb_all.exe).

4
BinaryObjectScanner/Protection/WTMCDProtect.cs
View File

@@ -25,7 +25,7 @@ namespace BinaryObjectScanner.Protection
return "WTM Protection Viewer";
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
var strs = FileType.Executable.GetFirstSectionStrings(pex, "code") ?? FileType.Executable.GetFirstSectionStrings(pex, "CODE");
if (strs != null)
{
if (strs.Exists(s => s.Contains("wtmdum.imp")))
@@ -33,7 +33,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the .text section strings, if they exist
strs = pex.GetFirstSectionStrings(".text");
strs = FileType.Executable.GetFirstSectionStrings(pex, ".text");
if (strs != null)
{
if (strs.Exists(s => s.Contains("WTM DIGITAL Photo Protect")))

2
BinaryObjectScanner/Protection/XCP.cs
View File

@@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .rdata section strings, if they exist
List<string>? strs = pex.GetFirstSectionStrings(".rdata");
List<string>? strs = FileType.Executable.GetFirstSectionStrings(pex, ".rdata");
if (strs != null)
{
if (strs.Exists(s => s.Contains("XCP.DAT")))