From 495864e8e07ecca47ebb9addffd798ff6e2ff9c1 Mon Sep 17 00:00:00 2001 From: TheRogueArchivist Date: Sun, 23 Oct 2022 21:46:58 -0600 Subject: [PATCH 1/2] Add summary for Denuvo (#159) Add summary and various notes for Denuvo. --- BurnOutSharp/ProtectionType/Denuvo.cs | 36 ++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-) diff --git a/BurnOutSharp/ProtectionType/Denuvo.cs b/BurnOutSharp/ProtectionType/Denuvo.cs index 037e2b1b..c7af3bc2 100644 --- a/BurnOutSharp/ProtectionType/Denuvo.cs +++ b/BurnOutSharp/ProtectionType/Denuvo.cs @@ -7,11 +7,37 @@ using BurnOutSharp.Tools; namespace BurnOutSharp.ProtectionType { - // Data sourced from: - // https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Denuvo%20protector.2.sg - // https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/_denuvoComplete.2.sg + /// + /// Denuvo (https://irdeto.com/denuvo/) is a family of DRM originally created in 2014 by Denuvo Software Solutions, which was acquired by Irdeto in 2018 (https://www.gamesindustry.biz/irdeto-acquires-denuvo-in-bid-to-beef-up-security-in-the-games-industry). + /// Denuvo Anti-Tamper (https://irdeto.com/denuvo/anti-tamper/) is the most common, preventing game files from being modified and requiring online activation of games. + /// Denuvo Anti-Tamper datasheet: https://resources.irdeto.com/video-games/datasheet-anti-tamper + /// Lists of games with Denuvo Anti-Tamper: + /// https://store.steampowered.com/curator/26095454-Denuvo-Games/ + /// https://www.pcgamingwiki.com/wiki/Denuvo + /// Denuvo Anti-Cheat (https://irdeto.com/denuvo/anti-cheat/) is a form of anti-cheat, though information on what games use it is rather sparse. + /// It was used briefly in Doom Eternal Update 1 (https://store.steampowered.com/news/app/782330/view/2187005925152148469), before being completely removed in Update 1.1 (https://store.steampowered.com/news/app/782330/view/2187006557874536446). + /// It's somewhat difficult to find other games that may use this, as quite a few sources seem to erroneously refer to Anti-Tamper as Anti-Cheat. + /// Announcements for Denuvo Anti-Cheat: + /// https://irdeto.com/news/leveling-the-playing-field-with-denuvo-anti-cheat/ + /// https://irdeto.com/news/denuvo-anti-cheat-now-available-on-steamworks/ + /// https://irdeto.com/news/denuvo-joins-exclusive-playstation5-tools-and-middleware-program-to-offer-anti-cheat-technology-to-game-developers/ + /// Denuvo Anti-Cheat datasheet: https://web.archive.org/web/20190512082146/https://resources.irdeto.com/video-games/datasheet-anti-cheat + /// Denuvo also has a number of products available, such as ones targeting mobile games: + /// https://irdeto.com/denuvo/mobile-games-protection/ + /// https://resources.irdeto.com/video-games/datasheet-anti-tamper-and-anti-cheat-technology-for-mobile + /// Additional information and resources: + /// https://en.wikipedia.org/wiki/Denuvo + /// https://www.wired.com/story/empress-drm-cracking-denuvo-video-game-piracy/ + /// + public class Denuvo : IPortableExecutableCheck { + // TODO: Add checks for Denuvo Anti-Cheat. + // Possible filename check: https://support.codefusion.technology/anti-cheat + + // TODO: Investigate possible filename checks for Denuvo Anti-Tamper. + // https://www.pcgamingwiki.com/wiki/Denuvo#Redeem.exe + /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { @@ -20,6 +46,10 @@ namespace BurnOutSharp.ProtectionType if (sections == null) return null; + // Data sourced from: + // https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Denuvo%20protector.2.sg + // https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/_denuvoComplete.2.sg + // Denuvo Protector if (pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus && pex.EntryPointRaw != null) { From f4f9ba9efad8227417670766308a954866d3619b Mon Sep 17 00:00:00 2001 From: TheRogueArchivist Date: Tue, 25 Oct 2022 11:31:17 -0600 Subject: [PATCH 2/2] Add "SafeDisc.exe" checks (#160) * Add checks for "SafeDisc.exe". * Add note about previously unknown SafeDisc version. * Add note about Drvmgt file with known sample but no known version. * Add various SafeDisc/SafeCast resources. * Add resource for CDS. --- .../ProtectionType/CactusDataShield.cs | 1 + BurnOutSharp/ProtectionType/SafeDisc.cs | 21 +++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/BurnOutSharp/ProtectionType/CactusDataShield.cs b/BurnOutSharp/ProtectionType/CactusDataShield.cs index 65b8d416..5ded7990 100644 --- a/BurnOutSharp/ProtectionType/CactusDataShield.cs +++ b/BurnOutSharp/ProtectionType/CactusDataShield.cs @@ -12,6 +12,7 @@ namespace BurnOutSharp.ProtectionType { /// /// CactusDataShield was a copy protection originally developed by Midbar Technologies, which was then purchased by Macrovision in 2002 (https://variety.com/2002/digital/news/macrovision-acquires-midbar-cuts-ttr-link-1117875824/). + /// Macrovision's product page for CDS: https://web.archive.org/web/20050215235405/http://www.macrovision.com/products/cds/index.shtml /// CDS-100 appears to function by attempting to prevent dumping/ripping the discs protected with it. /// CDS-200+ uses a dedicated audio player to play the music "legitimately". /// Patent relating to CDS-100: https://patents.google.com/patent/US6425098B1/ diff --git a/BurnOutSharp/ProtectionType/SafeDisc.cs b/BurnOutSharp/ProtectionType/SafeDisc.cs index b6f50ce7..0fd8079d 100644 --- a/BurnOutSharp/ProtectionType/SafeDisc.cs +++ b/BurnOutSharp/ProtectionType/SafeDisc.cs @@ -14,11 +14,16 @@ namespace BurnOutSharp.ProtectionType /// It uses several different copy protection mechanisms, such as reading a disc signature dependent on the presence of bad sectors and the attempted prevention of burning copies to CD-R. /// SafeDisc has been most commonly found on PC games and applications, though there a number of Mac discs that contain the protection as well. /// At least one system other than PC/Mac is known to use SafeDisc as well, this being the "ZAPiT Games Game Wave Family Entertainment System" which seems to use a form of SafeDisc 4 (Redump entry 46269). + /// SafeDisc resources: + /// https://web.archive.org/web/20031009091909/http://www.macrovision.com/products/safedisc/index.shtml + /// https://web.archive.org/web/20041023011150/http://www.macrovision.com/products/safedisc/index.shtml (Marketed as "SafeDisc Advanced") + /// https://web.archive.org/web/20041008173722/http://www.macrovision.com/pdfs/safedisc_datasheet.pdf /// SafeCast is in the same family of protections, and appears to mainly be for license management, and doesn't appear to affect the mastering of the disc in any way. /// Although SafeCast is most commonly used in non-game software, there is one game that comes with both SafeDisc and SafeCast protections (Redump entry 83145). /// Macrovision bought the company C-Dilla and created SafeCast based on C-Dilla's existing products (https://web.archive.org/web/20030212040047/http://www.auditmypc.com/freescan/readingroom/cdilla.asp). /// That being said, there are references to C-Dilla within SafeDisc protected executables as early as 1.00.025, making the exact relationship between SafeDisc/Macrovision/C-Dilla unclear. /// SafeCast resources: + /// https://web.archive.org/web/20031204024544mp_/http://www.macrovision.com/products/safecast/index.shtml /// https://web.archive.org/web/20010417222834/http://www.macrovision.com/press_rel3_17_99.html /// https://www.extremetech.com/computing/53394-turbotax-so-what-do-i-do-now/4 /// https://web.archive.org/web/20031013085038/http://www.pestpatrol.com/PestInfo/c/c-dilla.asp @@ -142,6 +147,12 @@ namespace BurnOutSharp.ProtectionType new PathMatchSet(new PathMatch("drvmgt.dll", useEndsWith: true), GetDrvmgtVersion, "SafeDisc"), new PathMatchSet(new PathMatch("secdrv.sys", useEndsWith: true), GetSecdrvVersion, "SafeDisc Security Driver"), + // Used to distribute SafeDisc driver updates over the internet. Two distinct versions known to exist, with Microsoft also having distributed the later update as well. + // Version 1: https://web.archive.org/web/20040614184055/http://www.macrovision.com:80/products/safedisc/safedisc.exe + // Version 2: https://web.archive.org/web/20051104123646/http://www.macrovision.com/products/safedisc/safedisc.exe + // Microsoft download page: https://web.archive.org/web/20080204081329/http://www.microsoft.com/downloads/details.aspx?FamilyID=eae20f0f-c41c-44fe-84ce-1df707d7a2e9&DisplayLang=en + new PathMatchSet(new PathMatch("safedisc.exe", useEndsWith: true), "SafeDisc Driver Installer"), + // Found in Redump entries 28810 and 30555. // Name check overmatches with a seemingly completely unrelated application, ironically included on at least one SafeDisc game (Redump entry 34828). // new PathMatchSet(new PathMatch("mcp.dll", useEndsWith: true), "SafeDisc (Version 1.45.011-1.50.020)"), @@ -207,6 +218,12 @@ namespace BurnOutSharp.ProtectionType // Found in Redump entry 58990. new PathMatchSet(new PathMatch("SafediskSplash.bmp", useEndsWith: true), "SafeDisc"), + + // Used to distribute SafeDisc driver updates over the internet. Two distinct versions known to exist, with Microsoft also having distributed the later update as well. + // Version 1: https://web.archive.org/web/20040614184055/http://www.macrovision.com:80/products/safedisc/safedisc.exe + // Version 2: https://web.archive.org/web/20051104123646/http://www.macrovision.com/products/safedisc/safedisc.exe + // Microsoft download page: https://web.archive.org/web/20080204081329/http://www.microsoft.com/downloads/details.aspx?FamilyID=eae20f0f-c41c-44fe-84ce-1df707d7a2e9&DisplayLang=en + new PathMatchSet(new PathMatch("safedisc.exe", useEndsWith: true), "SafeDisc Driver Installer"), // Found in seemingly every SafeDisc Lite disc. (CD: Redump entries 25579 and 57986. DVD: Redump entry 63941). new PathMatchSet(new PathMatch("00000001.LT1", useEndsWith: true), "SafeDisc Lite"), @@ -244,6 +261,7 @@ namespace BurnOutSharp.ProtectionType // 1.01.038 (Redump entry 51459). // 1.01.043 (Redump entries 34562 and 63304). // 1.01.044 (Redump entries 61731 and 81619). + // 1.01.045 (Currently only found in a pirate compilation disc: IA item "cdrom-classic-fond-58"). // 1.06.000 (Redump entries 29073 and 31149). // 1.07.000 (Redump entries 9718 and 46756). // 1.09.000 (Redump entries 12885 and 66210). @@ -738,6 +756,9 @@ namespace BurnOutSharp.ProtectionType // Found in Redump entry 56320. case "84480ABCE4676EEB9C43DFF7C5C49F0D574FAC25": return "4.70.000"; + // Found distributed in https://web.archive.org/web/20040614184055/http://www.macrovision.com:80/products/safedisc/safedisc.exe, but unknown what version it is associated with. + case "8426690FA43076EE466FD1B2D1F2F1267F9CC3EC": + return "Unknown Version (Report this to us on GitHub)"; default: return "Unknown Version (Report this to us on GitHub)";