diff --git a/BurnOutSharp/ProtectionType/Themida.cs b/BurnOutSharp/ProtectionType/Themida.cs
index dbf11f94..cf37aba2 100644
--- a/BurnOutSharp/ProtectionType/Themida.cs
+++ b/BurnOutSharp/ProtectionType/Themida.cs
@@ -1,13 +1,57 @@
-namespace BurnOutSharp.ProtectionType
+using BurnOutSharp.ExecutableType.Microsoft.PE;
+using BurnOutSharp.Interfaces;
+using BurnOutSharp.Matching;
+using System.Collections.Generic;
+
+namespace BurnOutSharp.ProtectionType
{
///
/// Protection created by Oreans and in use since at least before 2009. Known to be used in Book/Music Collector (http://www.alwinhoogerdijk.com/2009/12/24/protecting-software-with-themida/).
/// May possibly be used in the PC release of Dynasty Warriors 7 with Xtreme Legends (https://www.pcgamingwiki.com/wiki/Dynasty_Warriors_7_with_Xtreme_Legends).
- /// Themida/WinLicense/Code Virtualize seem to all be interconnected/related to each other, or are all at least part of the SecureEngine suite together (https://www.oreans.com/products.php).
+ /// Themida/WinLicense/"Code Virtualize" seem to all be interconnected/related to each other, or are all at least part of the SecureEngine suite together (https://www.oreans.com/products.php).
+ ///
+ /// Versions:
+ /// 1.8x - 1.9x (Detect-It-Easy): ArcSoft TotalMedia 3 (http://downloads.fyxm.net/ArcSoft-TotalMedia-23085.html / https://web.archive.org/web/20221114042838/http://files.fyxm.net/23/23085/totalmediatheatre3platinum_retail_tbyb_all.exe).
+ ///
+ /// Further links and resources:
+ /// https://github.com/VenTaz/Themidie
+ /// https://github.com/ergrelet/unlicense
+ /// https://github.com/horsicq/Detect-It-Easy/blob/c332fa452087bc0e6705c452e00331618a9da00e/db/PE/Themida.2.sg
+ ///
+ /// TODO:
+ /// Add/Confirm detection for WinLicense/"Code Virtualize".
+ /// Investigate further ArcSoft programs.
+ /// Investigate PUBG (possibly older versions) (https://www.pcgamingwiki.com/wiki/PUBG:_Battlegrounds).
///
- public class Themida
+ public class Themida : IPortableExecutableCheck
{
- // TODO: Implement - https://www.oreans.com/
- // https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt
+ ///
+ public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
+ {
+ // TODO: Add detections from DiE (https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Themida.2.sg).
+ // Get the sections from the executable, if possible
+ var sections = pex?.SectionTable;
+ if (sections == null)
+ return null;
+
+ // Get the "Arcsoft " section, if it exists
+ var initSectionRaw = pex.ReadRawSection("Arcsoft ", first: true);
+ if (initSectionRaw != null)
+ {
+ var matchers = new List
+ {
+ // Themida
+ // Found in "uDigital Theatre.exe" in http://downloads.fyxm.net/ArcSoft-TotalMedia-23085.html (https://web.archive.org/web/20221114042838/http://files.fyxm.net/23/23085/totalmediatheatre3platinum_retail_tbyb_all.exe).
+ // TODO: Investiage "uDRMCheck.dll" in the same product to see if it's related to Themida, or if it's a different form of DRM.
+ new ContentMatchSet(new byte?[] { 0x54, 0x68, 0x65, 0x6D, 0x69, 0x64, 0x61 }, "Themida"),
+ };
+
+ string match = MatchUtil.GetFirstMatch(file, initSectionRaw, matchers, includeDebug);
+ if (!string.IsNullOrWhiteSpace(match))
+ return match;
+ }
+
+ return null;
+ }
}
}
diff --git a/README.md b/README.md
index a96b82b4..c0d22c98 100644
--- a/README.md
+++ b/README.md
@@ -88,6 +88,7 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain
| SVKP (Slovak Protector) | True | False | |
| Sysiphus / Sysiphus DVD | True | False | |
| TAGES | True | True | Partially unconfirmed² |
+| Themida/WinLicense/Code Virtualizer | True | False | Only certain products/versions currently detected |
| Tivola Ring Protection | False | True | |
| TZCopyProtection | False | True | Partially unconfirmed² |
| Uplay | True | True | |
@@ -119,7 +120,6 @@ Below is a list of protections that have been identified but have not yet been i
- SAFEAUDIO
- The Bongle
- The Copy Protected CD
-- Themida/WinLicense/Code Virtualizer
## Executable Packers Detected