Add PACE Anti-Piracy InterLok detection (#362)

* Add detection class and test class for PACE Anti-Piracy Interlok

* Remove unnecessary empty lines after end of class.

* Added missing null check for pex section strings.

* Add newline above getversion

* GetFirstSectionStrings assigned to variable.

* Change getversion in InterLok to use regex.

* Final? getversion regex cleanup
This commit is contained in:
HeroponRikiBestest
2025-04-19 23:08:49 -04:00
committed by GitHub
parent cfe9825af7
commit 75517a5f83
2 changed files with 58 additions and 0 deletions

View File

@@ -0,0 +1,22 @@
using System.IO;
using BinaryObjectScanner.Protection;
using Xunit;
namespace BinaryObjectScanner.Test.Protection
{
public class InterLokTests
{
[Fact]
public void CheckPortableExecutableTest()
{
string file = "filename";
SabreTools.Models.PortableExecutable.Executable model = new();
Stream source = new MemoryStream();
SabreTools.Serialization.Wrappers.PortableExecutable pex = new(model, source);
var checker = new InterLok();
string? actual = checker.CheckExecutable(file, pex, includeDebug: false);
Assert.Null(actual);
}
}
}

View File

@@ -0,0 +1,36 @@
using System.Text.RegularExpressions;
using BinaryObjectScanner.Interfaces;
using SabreTools.Serialization.Wrappers;
namespace BinaryObjectScanner.Protection
{
public class InterLok : IExecutableCheck<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the .rsrc section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rsrc");
if (strs != null)
{
// Found in "nfsc_link.exe" in IA item "nfscorigin".
// Full string:
// (: ) InterLok PC v2.0, PACE Anti-Piracy, Copyright (C) 1998, ALL RIGHTS RESERVED
var match = strs.Find(s => s.Contains("InterLok") && s.Contains("PACE Anti-Piracy"));
if (match != null)
return $"PACE Anti-Piracy InterLok {GetVersion(match)}";
}
return null;
}
private static string GetVersion(string match)
{
var versionMatch = Regex.Match(match, @"(?<=InterLok )(.*?)(?=,)");
if (versionMatch.Success)
return versionMatch.Value;
return "(Unknown Version - Please report to us on GitHub)";
}
}
}