mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-07-08 18:06:34 +00:00
Add PACE Anti-Piracy InterLok detection (#362)
* Add detection class and test class for PACE Anti-Piracy Interlok * Remove unnecessary empty lines after end of class. * Added missing null check for pex section strings. * Add newline above getversion * GetFirstSectionStrings assigned to variable. * Change getversion in InterLok to use regex. * Final? getversion regex cleanup
This commit is contained in:
committed by
GitHub
parent
cfe9825af7
commit
75517a5f83
22
BinaryObjectScanner.Test/Protection/InterLokTests.cs
Normal file
22
BinaryObjectScanner.Test/Protection/InterLokTests.cs
Normal file
@@ -0,0 +1,22 @@
|
||||
using System.IO;
|
||||
using BinaryObjectScanner.Protection;
|
||||
using Xunit;
|
||||
|
||||
namespace BinaryObjectScanner.Test.Protection
|
||||
{
|
||||
public class InterLokTests
|
||||
{
|
||||
[Fact]
|
||||
public void CheckPortableExecutableTest()
|
||||
{
|
||||
string file = "filename";
|
||||
SabreTools.Models.PortableExecutable.Executable model = new();
|
||||
Stream source = new MemoryStream();
|
||||
SabreTools.Serialization.Wrappers.PortableExecutable pex = new(model, source);
|
||||
|
||||
var checker = new InterLok();
|
||||
string? actual = checker.CheckExecutable(file, pex, includeDebug: false);
|
||||
Assert.Null(actual);
|
||||
}
|
||||
}
|
||||
}
|
||||
36
BinaryObjectScanner/Protection/InterLok.cs
Normal file
36
BinaryObjectScanner/Protection/InterLok.cs
Normal file
@@ -0,0 +1,36 @@
|
||||
using System.Text.RegularExpressions;
|
||||
using BinaryObjectScanner.Interfaces;
|
||||
using SabreTools.Serialization.Wrappers;
|
||||
|
||||
namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
public class InterLok : IExecutableCheck<PortableExecutable>
|
||||
{
|
||||
/// <inheritdoc/>
|
||||
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
|
||||
{
|
||||
// Get the .rsrc section strings, if they exist
|
||||
var strs = pex.GetFirstSectionStrings(".rsrc");
|
||||
if (strs != null)
|
||||
{
|
||||
// Found in "nfsc_link.exe" in IA item "nfscorigin".
|
||||
// Full string:
|
||||
// (: ) InterLok PC v2.0, PACE Anti-Piracy, Copyright (C) 1998, ALL RIGHTS RESERVED
|
||||
var match = strs.Find(s => s.Contains("InterLok") && s.Contains("PACE Anti-Piracy"));
|
||||
if (match != null)
|
||||
return $"PACE Anti-Piracy InterLok {GetVersion(match)}";
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static string GetVersion(string match)
|
||||
{
|
||||
var versionMatch = Regex.Match(match, @"(?<=InterLok )(.*?)(?=,)");
|
||||
if (versionMatch.Success)
|
||||
return versionMatch.Value;
|
||||
|
||||
return "(Unknown Version - Please report to us on GitHub)";
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user