From 6cb86512c34bea718ac6a978ab66db1bc66d10fb Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Mon, 8 Sep 2025 17:58:48 -0400 Subject: [PATCH] Organize StarForce, get rid of all Model calls --- BinaryObjectScanner/Packer/Crunch.cs | 2 +- .../Packer/HyperTechCrackProof.cs | 2 +- BinaryObjectScanner/Packer/InnoSetup.cs | 2 +- BinaryObjectScanner/Packer/PECompact.cs | 2 +- BinaryObjectScanner/Packer/WinZipSFX.cs | 912 +++++++++--------- BinaryObjectScanner/Protection/ByteShield.cs | 2 +- BinaryObjectScanner/Protection/CDDVDCops.cs | 6 +- BinaryObjectScanner/Protection/CDGuard.cs | 8 +- BinaryObjectScanner/Protection/CDSHiELDSE.cs | 4 +- .../Protection/CenegaProtectDVD.cs | 4 +- BinaryObjectScanner/Protection/CopyX.cs | 2 +- BinaryObjectScanner/Protection/Denuvo.cs | 4 +- BinaryObjectScanner/Protection/Engine32.cs | 12 +- BinaryObjectScanner/Protection/GFWL.cs | 4 +- .../Protection/ImpulseReactor.cs | 4 +- BinaryObjectScanner/Protection/JoWood.cs | 4 +- BinaryObjectScanner/Protection/LaserLok.cs | 10 +- .../Protection/Macrovision.SafeCast.cs | 8 +- .../Protection/Macrovision.SafeDisc.cs | 8 +- BinaryObjectScanner/Protection/MediaMax.cs | 4 +- BinaryObjectScanner/Protection/ProtectDISC.cs | 2 +- .../Protection/RainbowSentinel.cs | 2 +- .../Protection/SVKProtector.cs | 2 +- BinaryObjectScanner/Protection/SecuROM.cs | 2 +- BinaryObjectScanner/Protection/SmartE.cs | 2 +- BinaryObjectScanner/Protection/SolidShield.cs | 10 +- BinaryObjectScanner/Protection/StarForce.cs | 28 +- 27 files changed, 533 insertions(+), 519 deletions(-) diff --git a/BinaryObjectScanner/Packer/Crunch.cs b/BinaryObjectScanner/Packer/Crunch.cs index 252e5f2c..31b15b9a 100644 --- a/BinaryObjectScanner/Packer/Crunch.cs +++ b/BinaryObjectScanner/Packer/Crunch.cs @@ -12,7 +12,7 @@ namespace BinaryObjectScanner.Packer public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) { // Get the last section strings, if they exist - var sections = exe.Model.SectionTable ?? []; + var sections = exe.SectionTable ?? []; var strs = exe.GetSectionStrings(sections.Length - 1); if (strs != null) { diff --git a/BinaryObjectScanner/Packer/HyperTechCrackProof.cs b/BinaryObjectScanner/Packer/HyperTechCrackProof.cs index b9052ef2..c5468ea5 100644 --- a/BinaryObjectScanner/Packer/HyperTechCrackProof.cs +++ b/BinaryObjectScanner/Packer/HyperTechCrackProof.cs @@ -16,7 +16,7 @@ namespace BinaryObjectScanner.Packer { // This check may be overly limiting, as it excludes the sample provided to DiE (https://github.com/horsicq/Detect-It-Easy/issues/102). // TODO: Find further samples and invesitgate if the "peC" section is only present on specific versions. - bool importTableMatch = Array.Exists(exe.Model.ImportTable?.ImportDirectoryTable ?? [], + bool importTableMatch = Array.Exists(exe.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "KeRnEl32.dLl"); if (exe.ContainsSection("peC", exact: true) && importTableMatch) diff --git a/BinaryObjectScanner/Packer/InnoSetup.cs b/BinaryObjectScanner/Packer/InnoSetup.cs index 57df28f4..ea02b531 100644 --- a/BinaryObjectScanner/Packer/InnoSetup.cs +++ b/BinaryObjectScanner/Packer/InnoSetup.cs @@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Packer public string? CheckExecutable(string file, NewExecutable exe, bool includeDebug) { // Check for "Inno" in the reserved words - var reserved2 = exe.Model.Stub?.Header?.Reserved2; + var reserved2 = exe.Stub?.Header?.Reserved2; if (reserved2 != null && reserved2.Length > 5) { if (reserved2[4] == 0x6E49 && reserved2[5] == 0x6F6E) diff --git a/BinaryObjectScanner/Packer/PECompact.cs b/BinaryObjectScanner/Packer/PECompact.cs index 9afcd5b9..6bd4aefe 100644 --- a/BinaryObjectScanner/Packer/PECompact.cs +++ b/BinaryObjectScanner/Packer/PECompact.cs @@ -11,7 +11,7 @@ namespace BinaryObjectScanner.Packer public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) { // 0x4F434550 is "PECO" - if (exe.Model.COFFFileHeader?.PointerToSymbolTable == 0x4F434550) + if (exe.COFFFileHeader?.PointerToSymbolTable == 0x4F434550) return "PE Compact v1.x"; // TODO: Get more granular version detection. PiD is somehow able to detect version ranges based diff --git a/BinaryObjectScanner/Packer/WinZipSFX.cs b/BinaryObjectScanner/Packer/WinZipSFX.cs index fccf97dd..0e8a4cce 100644 --- a/BinaryObjectScanner/Packer/WinZipSFX.cs +++ b/BinaryObjectScanner/Packer/WinZipSFX.cs @@ -11,13 +11,13 @@ namespace BinaryObjectScanner.Packer public string? CheckExecutable(string file, NewExecutable exe, bool includeDebug) { // If the resident-name table doesnt exist - if (exe.Model.ResidentNameTable == null) + if (exe.ResidentNameTable == null) return null; // Get the resident and non-resident name table strings - var rntStrs = Array.ConvertAll(exe.Model.ResidentNameTable, + var rntStrs = Array.ConvertAll(exe.ResidentNameTable, rnte => rnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(rnte.NameString)); - var nrntStrs = Array.ConvertAll(exe.Model.NonResidentNameTable ?? [], + var nrntStrs = Array.ConvertAll(exe.NonResidentNameTable ?? [], nrnte => nrnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(nrnte.NameString)); // Check for the WinZip name strings @@ -40,7 +40,7 @@ namespace BinaryObjectScanner.Packer public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) { // Check the export directory table, if it exists - if (exe.Model.ExportTable?.ExportDirectoryTable != null) + if (exe.ExportTable?.ExportDirectoryTable != null) { var version = GetPEExportDirectoryVersion(exe); if (!string.IsNullOrEmpty(version)) @@ -66,146 +66,146 @@ namespace BinaryObjectScanner.Packer #region 2.0 Variants // 2.0 (MS-DOS/16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x0086 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x0086 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.ProtectedModeOnly | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x00012BE6 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0058 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x0064 - && exe.Model.Header?.ImportedNamesTableOffset == 0x006C - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000044B8 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x00012BE6 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0058 + && exe.Header?.ModuleReferenceTableOffset == 0x0064 + && exe.Header?.ImportedNamesTableOffset == 0x006C + && exe.Header?.NonResidentNamesTableOffset == 0x000044B8 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "2.0 (MS-DOS/16-bit)"; // 2.0 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x0086 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x0086 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.ProtectedModeOnly | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x00013174 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0058 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x0064 - && exe.Model.Header?.ImportedNamesTableOffset == 0x006C - && exe.Model.Header?.NonResidentNamesTableOffset == 0x00000198 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x00013174 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0058 + && exe.Header?.ModuleReferenceTableOffset == 0x0064 + && exe.Header?.ImportedNamesTableOffset == 0x006C + && exe.Header?.NonResidentNamesTableOffset == 0x00000198 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "2.0 (16-bit)"; // Compact 2.0 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x0080 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x0080 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.ProtectedModeOnly | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x000124A0 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0003 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0058 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x0064 - && exe.Model.Header?.ImportedNamesTableOffset == 0x006A - && exe.Model.Header?.NonResidentNamesTableOffset == 0x00000192 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x000124A0 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0003 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0058 + && exe.Header?.ModuleReferenceTableOffset == 0x0064 + && exe.Header?.ImportedNamesTableOffset == 0x006A + && exe.Header?.NonResidentNamesTableOffset == 0x00000192 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Compact 2.0 (16-bit)"; // Software Installation 2.0 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x00CD - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x00CD + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x000136FA - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0005 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0097 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x00A3 - && exe.Model.Header?.ImportedNamesTableOffset == 0x00AD - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000001DF - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x000136FA + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0005 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0097 + && exe.Header?.ModuleReferenceTableOffset == 0x00A3 + && exe.Header?.ImportedNamesTableOffset == 0x00AD + && exe.Header?.NonResidentNamesTableOffset == 0x000001DF + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Software Installation 2.0 (16-bit)"; #endregion @@ -213,145 +213,145 @@ namespace BinaryObjectScanner.Packer #region 2.1 RC2 Variants // 2.1 RC2 (MS-DOS/16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x0086 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x0086 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.ProtectedModeOnly | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x00013386 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0058 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x0064 - && exe.Model.Header?.ImportedNamesTableOffset == 0x006C - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000043C8 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x00013386 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0058 + && exe.Header?.ModuleReferenceTableOffset == 0x0064 + && exe.Header?.ImportedNamesTableOffset == 0x006C + && exe.Header?.NonResidentNamesTableOffset == 0x000043C8 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "2.1 RC2 (MS-DOS/16-bit)"; // 2.1 RC2 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x00BE - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x00BE + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x00013E56 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0090 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x009C - && exe.Model.Header?.ImportedNamesTableOffset == 0x00A4 - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000001D0 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x00013E56 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0090 + && exe.Header?.ModuleReferenceTableOffset == 0x009C + && exe.Header?.ImportedNamesTableOffset == 0x00A4 + && exe.Header?.NonResidentNamesTableOffset == 0x000001D0 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "2.1 RC2 (16-bit)"; // Compact 2.1 RC2 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x0080 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x0080 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.ProtectedModeOnly | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x00012B84 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0003 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0058 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x0064 - && exe.Model.Header?.ImportedNamesTableOffset == 0x006A - && exe.Model.Header?.NonResidentNamesTableOffset == 0x00000192 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x00012B84 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0003 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0058 + && exe.Header?.ModuleReferenceTableOffset == 0x0064 + && exe.Header?.ImportedNamesTableOffset == 0x006A + && exe.Header?.NonResidentNamesTableOffset == 0x00000192 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Compact 2.1 RC2 (16-bit)"; // Software Installation 2.1 RC2 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x00BE - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x00BE + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x000143AC - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0090 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x009C - && exe.Model.Header?.ImportedNamesTableOffset == 0x00A4 - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000001D0 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x000143AC + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0090 + && exe.Header?.ModuleReferenceTableOffset == 0x009C + && exe.Header?.ImportedNamesTableOffset == 0x00A4 + && exe.Header?.NonResidentNamesTableOffset == 0x000001D0 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Software Installation 2.1 RC2 (16-bit)"; #endregion @@ -359,145 +359,145 @@ namespace BinaryObjectScanner.Packer #region 2.1 Variants // 2.1 (MS-DOS/16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x0086 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x0086 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.ProtectedModeOnly | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x3A00 - && exe.Model.Header?.InitialCSIPSetting == 0x00013396 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0058 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x0064 - && exe.Model.Header?.ImportedNamesTableOffset == 0x006C - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000043C8 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x3A00 + && exe.Header?.InitialCSIPSetting == 0x00013396 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0058 + && exe.Header?.ModuleReferenceTableOffset == 0x0064 + && exe.Header?.ImportedNamesTableOffset == 0x006C + && exe.Header?.NonResidentNamesTableOffset == 0x000043C8 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "2.1 (MS-DOS/16-bit)"; // 2.1 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x00BE - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x00BE + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x3A00 - && exe.Model.Header?.InitialCSIPSetting == 0x00013E7E - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0090 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x009C - && exe.Model.Header?.ImportedNamesTableOffset == 0x00A4 - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000001D0 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x3A00 + && exe.Header?.InitialCSIPSetting == 0x00013E7E + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0090 + && exe.Header?.ModuleReferenceTableOffset == 0x009C + && exe.Header?.ImportedNamesTableOffset == 0x00A4 + && exe.Header?.NonResidentNamesTableOffset == 0x000001D0 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "2.1 (16-bit)"; // Compact 2.1 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x0080 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x0080 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.ProtectedModeOnly | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x3A00 - && exe.Model.Header?.InitialCSIPSetting == 0x00012B90 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0003 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0058 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x0064 - && exe.Model.Header?.ImportedNamesTableOffset == 0x006A - && exe.Model.Header?.NonResidentNamesTableOffset == 0x00000192 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x3A00 + && exe.Header?.InitialCSIPSetting == 0x00012B90 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0003 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0058 + && exe.Header?.ModuleReferenceTableOffset == 0x0064 + && exe.Header?.ImportedNamesTableOffset == 0x006A + && exe.Header?.NonResidentNamesTableOffset == 0x00000192 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Compact 2.1 (16-bit)"; // Software Installation 2.1 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x00BE - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x00BE + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x3A00 - && exe.Model.Header?.InitialCSIPSetting == 0x00014408 - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0090 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x009C - && exe.Model.Header?.ImportedNamesTableOffset == 0x00A4 - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000001D0 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x3A00 + && exe.Header?.InitialCSIPSetting == 0x00014408 + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0090 + && exe.Header?.ModuleReferenceTableOffset == 0x009C + && exe.Header?.ImportedNamesTableOffset == 0x00A4 + && exe.Header?.NonResidentNamesTableOffset == 0x000001D0 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Software Installation 2.1 (16-bit)"; #endregion @@ -505,109 +505,109 @@ namespace BinaryObjectScanner.Packer #region Misc. Variants // Personal Edition (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x0086 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x0086 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.ProtectedModeOnly | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x4000 - && exe.Model.Header?.InitialCSIPSetting == 0x0001317C - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0058 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x0064 - && exe.Model.Header?.ImportedNamesTableOffset == 0x006C - && exe.Model.Header?.NonResidentNamesTableOffset == 0x00000198 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x4000 + && exe.Header?.InitialCSIPSetting == 0x0001317C + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0058 + && exe.Header?.ModuleReferenceTableOffset == 0x0064 + && exe.Header?.ImportedNamesTableOffset == 0x006C + && exe.Header?.NonResidentNamesTableOffset == 0x00000198 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Personal Edition (16-bit)"; // Personal Edition 32-bit (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x00BE - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x00BE + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x2000 - && exe.Model.Header?.InitialStackAlloc == 0x3C00 - && exe.Model.Header?.InitialCSIPSetting == 0x00013E7C - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0004 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0090 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x009C - && exe.Model.Header?.ImportedNamesTableOffset == 0x00A4 - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000001D0 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x2000 + && exe.Header?.InitialStackAlloc == 0x3C00 + && exe.Header?.InitialCSIPSetting == 0x00013E7C + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0004 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0090 + && exe.Header?.ModuleReferenceTableOffset == 0x009C + && exe.Header?.ImportedNamesTableOffset == 0x00A4 + && exe.Header?.NonResidentNamesTableOffset == 0x000001D0 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Personal Edition 32-bit (16-bit)"; // Personal Edition 32-bit Build 1260/1285 (16-bit) - if (exe.Model.Header?.LinkerVersion == 0x11 - && exe.Model.Header?.LinkerRevision == 0x20 - && exe.Model.Header?.EntryTableOffset == 0x00C6 - && exe.Model.Header?.EntryTableSize == 0x0002 - && exe.Model.Header?.CrcChecksum == 0x00000000 - && exe.Model.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA + if (exe.Header?.LinkerVersion == 0x11 + && exe.Header?.LinkerRevision == 0x20 + && exe.Header?.EntryTableOffset == 0x00C6 + && exe.Header?.EntryTableSize == 0x0002 + && exe.Header?.CrcChecksum == 0x00000000 + && exe.Header?.FlagWord == (SabreTools.Models.NewExecutable.HeaderFlag.MULTIPLEDATA | SabreTools.Models.NewExecutable.HeaderFlag.FullScreen | SabreTools.Models.NewExecutable.HeaderFlag.WindowsPMCompatible) - && exe.Model.Header?.AutomaticDataSegmentNumber == 0x0003 - && exe.Model.Header?.InitialHeapAlloc == 0x43DC - && exe.Model.Header?.InitialStackAlloc == 0x2708 - && exe.Model.Header?.InitialCSIPSetting == 0x00014ADC - && exe.Model.Header?.InitialSSSPSetting == 0x00030000 - && exe.Model.Header?.FileSegmentCount == 0x0003 - && exe.Model.Header?.ModuleReferenceTableSize == 0x0005 - && exe.Model.Header?.NonResidentNameTableSize == 0x004B - && exe.Model.Header?.SegmentTableOffset == 0x0040 - && exe.Model.Header?.ResourceTableOffset == 0x0058 - && exe.Model.Header?.ResidentNameTableOffset == 0x0090 - && exe.Model.Header?.ModuleReferenceTableOffset == 0x009C - && exe.Model.Header?.ImportedNamesTableOffset == 0x00A6 - && exe.Model.Header?.NonResidentNamesTableOffset == 0x000001D8 - && exe.Model.Header?.MovableEntriesCount == 0x0000 - && exe.Model.Header?.SegmentAlignmentShiftCount == 0x0001 - && exe.Model.Header?.ResourceEntriesCount == 0x0000 - && exe.Model.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS - && exe.Model.Header?.AdditionalFlags == 0x00 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.ReturnThunkOffset == 0x0000 - && exe.Model.Header?.MinCodeSwapAreaSize == 0x0000 - && exe.Model.Header?.WindowsSDKRevision == 0x00 - && exe.Model.Header?.WindowsSDKVersion == 0x03) + && exe.Header?.AutomaticDataSegmentNumber == 0x0003 + && exe.Header?.InitialHeapAlloc == 0x43DC + && exe.Header?.InitialStackAlloc == 0x2708 + && exe.Header?.InitialCSIPSetting == 0x00014ADC + && exe.Header?.InitialSSSPSetting == 0x00030000 + && exe.Header?.FileSegmentCount == 0x0003 + && exe.Header?.ModuleReferenceTableSize == 0x0005 + && exe.Header?.NonResidentNameTableSize == 0x004B + && exe.Header?.SegmentTableOffset == 0x0040 + && exe.Header?.ResourceTableOffset == 0x0058 + && exe.Header?.ResidentNameTableOffset == 0x0090 + && exe.Header?.ModuleReferenceTableOffset == 0x009C + && exe.Header?.ImportedNamesTableOffset == 0x00A6 + && exe.Header?.NonResidentNamesTableOffset == 0x000001D8 + && exe.Header?.MovableEntriesCount == 0x0000 + && exe.Header?.SegmentAlignmentShiftCount == 0x0001 + && exe.Header?.ResourceEntriesCount == 0x0000 + && exe.Header?.TargetOperatingSystem == SabreTools.Models.NewExecutable.OperatingSystem.WINDOWS + && exe.Header?.AdditionalFlags == 0x00 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.ReturnThunkOffset == 0x0000 + && exe.Header?.MinCodeSwapAreaSize == 0x0000 + && exe.Header?.WindowsSDKRevision == 0x00 + && exe.Header?.WindowsSDKVersion == 0x03) return "Personal Edition 32-bit Build 1260/1285 (16-bit)"; #endregion @@ -621,8 +621,8 @@ namespace BinaryObjectScanner.Packer /// TODO: Research to see if the versions are embedded elsewhere in these files private static string? GetPEExportDirectoryVersion(PortableExecutable exe) { - string sfxFileName = exe.Model.ExportTable?.ExportDirectoryTable?.Name ?? string.Empty; - uint sfxTimeDateStamp = exe.Model.ExportTable?.ExportDirectoryTable?.TimeDateStamp ?? uint.MaxValue; + string sfxFileName = exe.ExportTable?.ExportDirectoryTable?.Name ?? string.Empty; + uint sfxTimeDateStamp = exe.ExportTable?.ExportDirectoryTable?.TimeDateStamp ?? uint.MaxValue; string assemblyVersion = exe.AssemblyVersion ?? "Unknown Version"; // Standard diff --git a/BinaryObjectScanner/Protection/ByteShield.cs b/BinaryObjectScanner/Protection/ByteShield.cs index 6b772ec6..271c4906 100644 --- a/BinaryObjectScanner/Protection/ByteShield.cs +++ b/BinaryObjectScanner/Protection/ByteShield.cs @@ -63,7 +63,7 @@ namespace BinaryObjectScanner.Protection return $"ByteShield Activation Client {exe.GetInternalVersion()}"; // Found in "ByteShield.dll" in Redump entry 6236 - name = exe.Model.ExportTable?.ExportDirectoryTable?.Name; + name = exe.ExportTable?.ExportDirectoryTable?.Name; if (name.OptionalEquals("ByteShield Client")) return "ByteShield Component Module"; diff --git a/BinaryObjectScanner/Protection/CDDVDCops.cs b/BinaryObjectScanner/Protection/CDDVDCops.cs index 1a8b680b..8f1c71fa 100644 --- a/BinaryObjectScanner/Protection/CDDVDCops.cs +++ b/BinaryObjectScanner/Protection/CDDVDCops.cs @@ -120,14 +120,14 @@ namespace BinaryObjectScanner.Protection return match; // Get the resident and non-resident name table strings - var nrntStrs = Array.ConvertAll(exe.Model.NonResidentNameTable ?? [], + var nrntStrs = Array.ConvertAll(exe.NonResidentNameTable ?? [], nrnte => nrnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(nrnte.NameString)); // Check the imported-name table // Found in "h3blade.exe" in Redump entry 85077. - if (exe.Model.ImportedNameTable != null) + if (exe.ImportedNameTable != null) { - foreach (var inte in exe.Model.ImportedNameTable.Values) + foreach (var inte in exe.ImportedNameTable.Values) { if (inte.NameString.IsNullOrEmpty()) continue; diff --git a/BinaryObjectScanner/Protection/CDGuard.cs b/BinaryObjectScanner/Protection/CDGuard.cs index 72f8e730..6904a094 100644 --- a/BinaryObjectScanner/Protection/CDGuard.cs +++ b/BinaryObjectScanner/Protection/CDGuard.cs @@ -28,19 +28,19 @@ namespace BinaryObjectScanner.Protection // TODO: Investigate the numerous ".guard" sections present in "Randevu.exe" in Redump entry 97142. // Get the export directory table - if (exe.Model.ExportTable?.ExportDirectoryTable != null) + if (exe.ExportTable?.ExportDirectoryTable != null) { // Found in "cdguard.dll" in Redump entry 97142 and IA item "pahgeby-he3hakomkou". - bool match = exe.Model.ExportTable.ExportDirectoryTable.Name.OptionalEquals("cdguard.dll", StringComparison.OrdinalIgnoreCase); + bool match = exe.ExportTable.ExportDirectoryTable.Name.OptionalEquals("cdguard.dll", StringComparison.OrdinalIgnoreCase); if (match) return "CD-Guard Copy Protection System"; } // Get the import directory table - if (exe.Model.ImportTable?.ImportDirectoryTable != null) + if (exe.ImportTable?.ImportDirectoryTable != null) { // Found in "Randevu.exe" in Redump entry 97142. - bool match = Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name != null && idte.Name.Equals("cdguard.dll", StringComparison.OrdinalIgnoreCase)); + bool match = Array.Exists(exe.ImportTable.ImportDirectoryTable, idte => idte?.Name != null && idte.Name.Equals("cdguard.dll", StringComparison.OrdinalIgnoreCase)); if (match) return "CD-Guard Copy Protection System"; } diff --git a/BinaryObjectScanner/Protection/CDSHiELDSE.cs b/BinaryObjectScanner/Protection/CDSHiELDSE.cs index dfaa93ff..eaf9c4eb 100644 --- a/BinaryObjectScanner/Protection/CDSHiELDSE.cs +++ b/BinaryObjectScanner/Protection/CDSHiELDSE.cs @@ -10,9 +10,9 @@ namespace BinaryObjectScanner.Protection { // TODO: Indicates Hypertech Crack Proof as well? //// Get the import directory table - //if (exe.Model.ImportTable?.ImportDirectoryTable != null) + //if (exe.ImportTable?.ImportDirectoryTable != null) //{ - // bool match = exe.Model.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "KeRnEl32.dLl"); + // bool match = exe.ImportTable.ImportDirectoryTable.Any(idte => idte.Name == "KeRnEl32.dLl"); // if (match) // return "CDSHiELD SE"; //} diff --git a/BinaryObjectScanner/Protection/CenegaProtectDVD.cs b/BinaryObjectScanner/Protection/CenegaProtectDVD.cs index cc5a1b2a..ad41545c 100644 --- a/BinaryObjectScanner/Protection/CenegaProtectDVD.cs +++ b/BinaryObjectScanner/Protection/CenegaProtectDVD.cs @@ -18,10 +18,10 @@ namespace BinaryObjectScanner.Protection public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) { // Get the export directory table - if (exe.Model.ExportTable?.ExportDirectoryTable != null) + if (exe.ExportTable?.ExportDirectoryTable != null) { // Found in "cenega.dll" in IA item "speed-pack". - bool match = exe.Model.ExportTable.ExportDirectoryTable.Name.OptionalEquals("ProtectDVD.dll", StringComparison.OrdinalIgnoreCase); + bool match = exe.ExportTable.ExportDirectoryTable.Name.OptionalEquals("ProtectDVD.dll", StringComparison.OrdinalIgnoreCase); if (match) return "Cenega ProtectDVD"; } diff --git a/BinaryObjectScanner/Protection/CopyX.cs b/BinaryObjectScanner/Protection/CopyX.cs index 6fadfa53..5f454b64 100644 --- a/BinaryObjectScanner/Protection/CopyX.cs +++ b/BinaryObjectScanner/Protection/CopyX.cs @@ -62,7 +62,7 @@ namespace BinaryObjectScanner.Protection // Checks for Professional // PEX checks intentionally only detect Professional - var sections = exe.Model.SectionTable; + var sections = exe.SectionTable; if (sections == null) return null; diff --git a/BinaryObjectScanner/Protection/Denuvo.cs b/BinaryObjectScanner/Protection/Denuvo.cs index 8ef27d09..3d7b8af4 100644 --- a/BinaryObjectScanner/Protection/Denuvo.cs +++ b/BinaryObjectScanner/Protection/Denuvo.cs @@ -62,7 +62,7 @@ namespace BinaryObjectScanner.Protection // https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/_denuvoComplete.2.sg // Denuvo Protector - if (exe.Model.OptionalHeader?.Magic == OHMN.PE32Plus + if (exe.OptionalHeader?.Magic == OHMN.PE32Plus && exe.EntryPointData != null) { byte?[] denuvoProtector = @@ -95,7 +95,7 @@ namespace BinaryObjectScanner.Protection // || exe.ContainsSection(".srdata") || !string.IsNullOrEmpty(timingMatch)) { - if (exe.Model.OptionalHeader?.Magic == OHMN.PE32Plus) + if (exe.OptionalHeader?.Magic == OHMN.PE32Plus) { var matchers = new List { diff --git a/BinaryObjectScanner/Protection/Engine32.cs b/BinaryObjectScanner/Protection/Engine32.cs index 7434e1c9..416beb8c 100644 --- a/BinaryObjectScanner/Protection/Engine32.cs +++ b/BinaryObjectScanner/Protection/Engine32.cs @@ -20,11 +20,11 @@ namespace BinaryObjectScanner.Protection // Most every tested sample of "engine32.dll" has a product name of "engine32", and the file description typically follows the naming pattern of "[Game Name] DLL-helper". // Detects Engine32 within the game executables that contain it. - if (exe.Model.ImportTable?.ImportDirectoryTable != null && exe.Model.ImportTable?.HintNameTable != null) + if (exe.ImportTable?.ImportDirectoryTable != null && exe.ImportTable?.HintNameTable != null) { - bool importDirectoryTableMatch = Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, + bool importDirectoryTableMatch = Array.Exists(exe.ImportTable.ImportDirectoryTable, idte => idte?.Name != null && idte.Name.Equals("ENGINE32.DLL", StringComparison.OrdinalIgnoreCase)); - bool hintNameTableMatch = Array.Exists(exe.Model.ImportTable.HintNameTable, + bool hintNameTableMatch = Array.Exists(exe.ImportTable.HintNameTable, ihne => ihne?.Name == "InitEngine"); // The Hint/Name Table Entry "DeinitEngine" is present in every tested sample, aside from TOCA Race Driver 2 (Redump entries 104593-104596). @@ -33,10 +33,10 @@ namespace BinaryObjectScanner.Protection } // Detects Engine32 within the file "engine32.dll". - if (exe.Model.ExportTable?.ExportNameTable?.Strings != null) + if (exe.ExportTable?.ExportNameTable?.Strings != null) { - bool exportNameTableMatch1 = Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s == "engine32.dll"); - bool exportNameTableMatch2 = Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s == "DeinitEngine"); + bool exportNameTableMatch1 = Array.Exists(exe.ExportTable.ExportNameTable.Strings, s => s == "engine32.dll"); + bool exportNameTableMatch2 = Array.Exists(exe.ExportTable.ExportNameTable.Strings, s => s == "DeinitEngine"); if (exportNameTableMatch1 && exportNameTableMatch2) return "Engine32"; diff --git a/BinaryObjectScanner/Protection/GFWL.cs b/BinaryObjectScanner/Protection/GFWL.cs index 267b6d89..27ba7aa2 100644 --- a/BinaryObjectScanner/Protection/GFWL.cs +++ b/BinaryObjectScanner/Protection/GFWL.cs @@ -20,9 +20,9 @@ namespace BinaryObjectScanner.Protection return $"Games for Windows LIVE {exe.GetInternalVersion()}"; // Get the import directory table - if (exe.Model.ImportTable?.ImportDirectoryTable != null) + if (exe.ImportTable?.ImportDirectoryTable != null) { - if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "xlive.dll")) + if (Array.Exists(exe.ImportTable.ImportDirectoryTable, idte => idte?.Name == "xlive.dll")) return "Games for Windows LIVE"; } diff --git a/BinaryObjectScanner/Protection/ImpulseReactor.cs b/BinaryObjectScanner/Protection/ImpulseReactor.cs index 3532ea0e..54f504af 100644 --- a/BinaryObjectScanner/Protection/ImpulseReactor.cs +++ b/BinaryObjectScanner/Protection/ImpulseReactor.cs @@ -29,8 +29,8 @@ namespace BinaryObjectScanner.Protection // TODO: Check for CVP* instead? bool containsCheck = false; - if (exe.Model.ExportTable?.ExportNameTable?.Strings != null) - containsCheck = Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s.OptionalStartsWith("CVPInitializeClient")); + if (exe.ExportTable?.ExportNameTable?.Strings != null) + containsCheck = Array.Exists(exe.ExportTable.ExportNameTable.Strings, s => s.OptionalStartsWith("CVPInitializeClient")); // Get the .rdata section strings, if they exist bool containsCheck2 = false; diff --git a/BinaryObjectScanner/Protection/JoWood.cs b/BinaryObjectScanner/Protection/JoWood.cs index 31574f63..d557a9e4 100644 --- a/BinaryObjectScanner/Protection/JoWood.cs +++ b/BinaryObjectScanner/Protection/JoWood.cs @@ -19,8 +19,8 @@ namespace BinaryObjectScanner.Protection // Get the .ext section, if it exists if (exe.ContainsSection(".ext ", exact: true)) { - bool importTableMatches = Array.Exists(exe.Model.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "kernel32.dll") - && Array.Exists(exe.Model.ImportTable?.HintNameTable ?? [], s => s?.Name == "VirtualProtect"); + bool importTableMatches = Array.Exists(exe.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "kernel32.dll") + && Array.Exists(exe.ImportTable?.HintNameTable ?? [], s => s?.Name == "VirtualProtect"); // Get the .dcrtext section, if it exists if (exe.ContainsSection(".dcrtext") && importTableMatches) diff --git a/BinaryObjectScanner/Protection/LaserLok.cs b/BinaryObjectScanner/Protection/LaserLok.cs index 181ba5bd..62e9f357 100644 --- a/BinaryObjectScanner/Protection/LaserLok.cs +++ b/BinaryObjectScanner/Protection/LaserLok.cs @@ -59,16 +59,16 @@ namespace BinaryObjectScanner.Protection 0x6C, 0x61, 0x6D, 0x65, 0x6E, 0x74, 0x61, 0x73, 0x2E, 0x50, 0x45 ]; - int endDosStub = (int)(exe.Model.Stub?.Header?.NewExeHeaderAddr ?? 0); + int endDosStub = (int)(exe.Stub?.Header?.NewExeHeaderAddr ?? 0); int position = -1; // Check the executable tables position = exe.StubExecutableData?.FirstPosition(check) ?? -1; bool containsCheck = position > -1; - bool containsCheck2 = Array.Exists(exe.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "GetModuleHandleA") - && Array.Exists(exe.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "GetProcAddress") - && Array.Exists(exe.Model.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "LoadLibraryA") - && Array.Exists(exe.Model.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "KERNEL32.dll"); + bool containsCheck2 = Array.Exists(exe.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "GetModuleHandleA") + && Array.Exists(exe.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "GetProcAddress") + && Array.Exists(exe.ImportTable?.HintNameTable ?? [], hnte => hnte?.Name == "LoadLibraryA") + && Array.Exists(exe.ImportTable?.ImportDirectoryTable ?? [], idte => idte?.Name == "KERNEL32.dll"); int position2 = -1; diff --git a/BinaryObjectScanner/Protection/Macrovision.SafeCast.cs b/BinaryObjectScanner/Protection/Macrovision.SafeCast.cs index 90f1bc4d..b226c82f 100644 --- a/BinaryObjectScanner/Protection/Macrovision.SafeCast.cs +++ b/BinaryObjectScanner/Protection/Macrovision.SafeCast.cs @@ -43,9 +43,9 @@ namespace BinaryObjectScanner.Protection internal static string? SafeCastCheckExecutable(string file, NewExecutable exe, bool includeDebug) { // Check for the CDAC01AA name string. - if (exe.Model.ResidentNameTable != null) + if (exe.ResidentNameTable != null) { - var residentNames = Array.ConvertAll(exe.Model.ResidentNameTable, + var residentNames = Array.ConvertAll(exe.ResidentNameTable, rnte => rnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(rnte.NameString)); if (Array.Exists(residentNames, s => s.Contains("CDAC01AA"))) return "SafeCast"; @@ -74,9 +74,9 @@ namespace BinaryObjectScanner.Protection // TODO: Invesitgate if the "AdobeLM.dll" file (along with mentions of "AdobeLM" in executables) uniquely identifies SafeCast, or if it can be used with different DRM. (Found in IA item ccd0605) // Get the import directory table, if it exists - if (exe.Model.ImportTable?.ImportDirectoryTable != null) + if (exe.ImportTable?.ImportDirectoryTable != null) { - if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, + if (Array.Exists(exe.ImportTable.ImportDirectoryTable, idte => idte?.Name != null && idte.Name.Equals("CdaC14BA.dll", StringComparison.OrdinalIgnoreCase))) { return "SafeCast"; diff --git a/BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs b/BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs index 4cc17580..60f2eb72 100644 --- a/BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs +++ b/BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs @@ -51,16 +51,16 @@ namespace BinaryObjectScanner.Protection internal static string? SafeDiscCheckExecutable(string file, PortableExecutable exe, bool includeDebug) { // Found in Redump entry 57986. - if (exe.Model.ImportTable?.HintNameTable != null) + if (exe.ImportTable?.HintNameTable != null) { - if (Array.Exists(exe.Model.ImportTable.HintNameTable, ihne => ihne?.Name == "LTDLL_Authenticate")) + if (Array.Exists(exe.ImportTable.HintNameTable, ihne => ihne?.Name == "LTDLL_Authenticate")) return "SafeDisc Lite"; } // Found in Redump entry 57986. - if (exe.Model.ImportTable?.ImportDirectoryTable != null) + if (exe.ImportTable?.ImportDirectoryTable != null) { - if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "ltdll.dll")) + if (Array.Exists(exe.ImportTable.ImportDirectoryTable, idte => idte?.Name == "ltdll.dll")) return "SafeDisc Lite"; } diff --git a/BinaryObjectScanner/Protection/MediaMax.cs b/BinaryObjectScanner/Protection/MediaMax.cs index edd83ef0..d39f9f5b 100644 --- a/BinaryObjectScanner/Protection/MediaMax.cs +++ b/BinaryObjectScanner/Protection/MediaMax.cs @@ -45,9 +45,9 @@ namespace BinaryObjectScanner.Protection } // Get the export name table - if (exe.Model.ExportTable?.ExportNameTable?.Strings != null) + if (exe.ExportTable?.ExportNameTable?.Strings != null) { - if (Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s == "DllInstallSbcp")) + if (Array.Exists(exe.ExportTable.ExportNameTable.Strings, s => s == "DllInstallSbcp")) return "MediaMax CD-3"; } diff --git a/BinaryObjectScanner/Protection/ProtectDISC.cs b/BinaryObjectScanner/Protection/ProtectDISC.cs index 66c87f6f..9cfa3e99 100644 --- a/BinaryObjectScanner/Protection/ProtectDISC.cs +++ b/BinaryObjectScanner/Protection/ProtectDISC.cs @@ -17,7 +17,7 @@ namespace BinaryObjectScanner.Protection public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) { // Get the 4th and 5th sections, if they exist (example names: ACE4/ACE5) (Found in Redump entries 94792, 94793) - var sections = exe.Model.SectionTable ?? []; + var sections = exe.SectionTable ?? []; for (int i = 3; i < sections.Length; i++) { var nthSectionData = exe.GetSectionData(i); diff --git a/BinaryObjectScanner/Protection/RainbowSentinel.cs b/BinaryObjectScanner/Protection/RainbowSentinel.cs index 3e19cb0f..a87afea5 100644 --- a/BinaryObjectScanner/Protection/RainbowSentinel.cs +++ b/BinaryObjectScanner/Protection/RainbowSentinel.cs @@ -105,7 +105,7 @@ namespace BinaryObjectScanner.Protection return match; // Get the resident and non-resident name table strings - var nrntStrs = Array.ConvertAll(exe.Model.NonResidentNameTable ?? [], + var nrntStrs = Array.ConvertAll(exe.NonResidentNameTable ?? [], rnte => rnte?.NameString == null ? string.Empty : Encoding.ASCII.GetString(rnte.NameString)); // Check the nonresident-name table diff --git a/BinaryObjectScanner/Protection/SVKProtector.cs b/BinaryObjectScanner/Protection/SVKProtector.cs index 7de605c6..87ed8f7c 100644 --- a/BinaryObjectScanner/Protection/SVKProtector.cs +++ b/BinaryObjectScanner/Protection/SVKProtector.cs @@ -72,7 +72,7 @@ namespace BinaryObjectScanner.Protection } // 0x504B5653 is "SVKP" - if (exe.Model.COFFFileHeader?.PointerToSymbolTable == 0x504B5653) + if (exe.COFFFileHeader?.PointerToSymbolTable == 0x504B5653) return "SVKP"; // Get the .svkp section, if it exists. diff --git a/BinaryObjectScanner/Protection/SecuROM.cs b/BinaryObjectScanner/Protection/SecuROM.cs index 2dc6a6e1..ffdc09d8 100644 --- a/BinaryObjectScanner/Protection/SecuROM.cs +++ b/BinaryObjectScanner/Protection/SecuROM.cs @@ -49,7 +49,7 @@ namespace BinaryObjectScanner.Protection } // Get the sections 5+, if they exist (example names: .fmqyrx, .vcltz, .iywiak) - var sections = exe.Model.SectionTable ?? []; + var sections = exe.SectionTable ?? []; for (int i = 4; i < sections.Length; i++) { var nthSection = sections[i]; diff --git a/BinaryObjectScanner/Protection/SmartE.cs b/BinaryObjectScanner/Protection/SmartE.cs index 5d66b734..52052c8e 100644 --- a/BinaryObjectScanner/Protection/SmartE.cs +++ b/BinaryObjectScanner/Protection/SmartE.cs @@ -15,7 +15,7 @@ namespace BinaryObjectScanner.Protection if (exe.InternalName.OptionalEquals("SmarteSECURE")) return "SmartE"; - var sections = exe.Model.SectionTable ?? []; + var sections = exe.SectionTable ?? []; if (sections.Length > 0) { diff --git a/BinaryObjectScanner/Protection/SolidShield.cs b/BinaryObjectScanner/Protection/SolidShield.cs index 89004b75..83c5aa6d 100644 --- a/BinaryObjectScanner/Protection/SolidShield.cs +++ b/BinaryObjectScanner/Protection/SolidShield.cs @@ -75,7 +75,7 @@ namespace BinaryObjectScanner.Protection return "SolidShield EXE Wrapper v1"; // Search the last two available sections - var sections = exe.Model.SectionTable ?? []; + var sections = exe.SectionTable ?? []; for (int i = Math.Max(sections.Length - 2, 0); i < sections.Length; i++) { // Get the nth section strings, if they exist @@ -89,15 +89,15 @@ namespace BinaryObjectScanner.Protection } // Get the import directory table, if it exists - if (exe.Model.ImportTable?.ImportDirectoryTable != null) + if (exe.ImportTable?.ImportDirectoryTable != null) { - if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "dvm.dll")) + if (Array.Exists(exe.ImportTable.ImportDirectoryTable, idte => idte?.Name == "dvm.dll")) return "SolidShield EXE Wrapper v1"; - if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "activation.x86.dll")) + if (Array.Exists(exe.ImportTable.ImportDirectoryTable, idte => idte?.Name == "activation.x86.dll")) return "SolidShield EXE Wrapper v2"; - if (Array.Exists(exe.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name == "activation.x64.dll")) + if (Array.Exists(exe.ImportTable.ImportDirectoryTable, idte => idte?.Name == "activation.x64.dll")) return "SolidShield EXE Wrapper v2"; } diff --git a/BinaryObjectScanner/Protection/StarForce.cs b/BinaryObjectScanner/Protection/StarForce.cs index 5268403d..ceb6525e 100644 --- a/BinaryObjectScanner/Protection/StarForce.cs +++ b/BinaryObjectScanner/Protection/StarForce.cs @@ -19,7 +19,8 @@ namespace BinaryObjectScanner.Protection /// public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug) { - // TODO: Find what fvinfo field actually maps to this + #region File Description + var name = exe.FileDescription; // There are some File Description checks that are currently too generic to use. @@ -47,18 +48,26 @@ namespace BinaryObjectScanner.Protection if (name.OptionalContains("Protected Module")) return $"StarForce 5"; + #endregion + + #region Legal Copyright + name = exe.LegalCopyright; if (name.OptionalStartsWith("(c) Protection Technology")) // (c) Protection Technology (StarForce)? return $"StarForce {exe.GetInternalVersion()}"; else if (name.OptionalContains("Protection Technology")) // Protection Technology (StarForce)? return $"StarForce {exe.GetInternalVersion()}"; - + + #endregion + + #region Trade Name + // FrontLine ProActive (digital activation), samples: // https://dbox.tools/titles/pc/46450FA4/ // https://dbox.tools/titles/pc/4F430FA0/ // https://dbox.tools/titles/pc/53450FA1/ name = exe.TradeName; - if (name.OptionalContains("FL ProActive")) + if (name.OptionalContains("FL ProActive")) return "FrontLine ProActive"; // StarForce Crypto (SF Crypto) @@ -66,14 +75,17 @@ namespace BinaryObjectScanner.Protection if (name.OptionalContains("SF Crypto")) return "StarForce Crypto"; + #endregion + + #region Internal Name + // TODO: Decide if internal name checks are safe to use. - name = exe.InternalName; + name = exe.InternalName; // Found in "protect.x64" and "protect.x86" in Redump entry 94805. if (name.OptionalEquals("CORE.ADMIN", StringComparison.Ordinal)) return $"StarForce {exe.GetInternalVersion()}"; - // These checks currently disabled due being possibly too generic: // Found in "protect.dll" in Redump entry 94805. // if (name.OptionalEquals("CORE.DLL", StringComparison.Ordinal)) @@ -86,11 +98,13 @@ namespace BinaryObjectScanner.Protection // else if (name.OptionalEquals("protect.exe", StringComparison.Ordinal)) // return $"StarForce {Tools.Utilities.GetInternalVersion(exe)}"; + #endregion + // Check the export name table - if (exe.Model.ExportTable?.ExportNameTable?.Strings != null) + if (exe.ExportTable?.ExportNameTable?.Strings != null) { // TODO: Should we just check for "PSA_*" instead of a single entry? - if (Array.Exists(exe.Model.ExportTable.ExportNameTable.Strings, s => s == "PSA_GetDiscLabel")) + if (Array.Exists(exe.ExportTable.ExportNameTable.Strings, s => s == "PSA_GetDiscLabel")) return $"StarForce {exe.GetInternalVersion()}"; }