diff --git a/BinaryObjectScanner.Protection/Macrovision.RipGuard.cs b/BinaryObjectScanner.Protection/Macrovision.RipGuard.cs new file mode 100644 index 00000000..8773a57e --- /dev/null +++ b/BinaryObjectScanner.Protection/Macrovision.RipGuard.cs @@ -0,0 +1,73 @@ +using System; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using BinaryObjectScanner.Matching; +using BinaryObjectScanner.Wrappers; + +namespace BinaryObjectScanner.Protection +{ + /// + /// RipGuard was a copy protection made by Macrovision/Rovi to protect movie DVDs. It's known to use bad sectors to impede dumping, one of the relatively rare DVD DRMs to do this. + /// + /// Discs known to have it: + /// https://forum.redfox.bz/threads/resolved-installs-rootkit-black-lagoon-vol-2-3-region-1.29660/ + /// https://forum.redfox.bz/threads/resolved-one-on-one-with-tony-horton-vol2-disc3.33901/ + /// + public partial class Macrovision + { + /// + internal string RipGuardCheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) + { + // Get the sections from the executable, if possible + var sections = pex?.SectionTable; + if (sections == null) + return null; + + // Found in "RGASDEV.SYS" in the Black Lagoon Season 1 DVD Steelbook box set (Geneon ID 12970). + string name = pex.FileDescription; + if (name?.Equals("rgasdev", StringComparison.OrdinalIgnoreCase) == true) + return "RipGuard"; + + // Found in "RGASDEV.SYS" in the Black Lagoon Season 1 DVD Steelbook box set (Geneon ID 12970). + name = pex.ProductName; + if (name?.Equals("rgasdev", StringComparison.OrdinalIgnoreCase) == true) + return "RipGuard"; + + return null; + } + + /// + internal ConcurrentQueue RipGuardCheckDirectoryPath(string path, IEnumerable files) + { + var matchers = new List + { + // Found in the Black Lagoon Season 1 DVD steelbook box set (Geneon ID 12970). + new PathMatchSet(new PathMatch("G23YHWO1.EXE", useEndsWith: true), "RipGuard"), + new PathMatchSet(new PathMatch("RGASDEV.SYS", useEndsWith: true), "RipGuard"), + + // Mentioned online in https://forum.redfox.bz/threads/resolved-one-on-one-with-tony-horton-vol2-disc3.33901/. + new PathMatchSet(new PathMatch("9KMJ9G4I.EXE", useEndsWith: true), "RipGuard (Unconfirmed - Please report to us on GitHub)"), + }; + + return MatchUtil.GetAllMatches(files, matchers, any: false); + } + + /// + internal string RipGuardCheckFilePath(string path) + { + var matchers = new List + { + // Found in the Black Lagoon Season 1 DVD steelbook box set (Geneon ID 12970). + new PathMatchSet(new PathMatch("G23YHWO1.EXE", useEndsWith: true), "RipGuard"), + new PathMatchSet(new PathMatch("RGASDEV.SYS", useEndsWith: true), "RipGuard"), + + // Mentioned online in https://forum.redfox.bz/threads/resolved-one-on-one-with-tony-horton-vol2-disc3.33901/. + new PathMatchSet(new PathMatch("9KMJ9G4I.EXE", useEndsWith: true), "RipGuard (Unconfirmed - Please report to us on GitHub)"), + }; + + return MatchUtil.GetFirstMatch(path, matchers, any: true); + } + } +} diff --git a/BinaryObjectScanner.Protection/Macrovision.cs b/BinaryObjectScanner.Protection/Macrovision.cs index 0143664c..9f801ad1 100644 --- a/BinaryObjectScanner.Protection/Macrovision.cs +++ b/BinaryObjectScanner.Protection/Macrovision.cs @@ -136,6 +136,11 @@ namespace BinaryObjectScanner.Protection if (!string.IsNullOrWhiteSpace(match)) resultsList.Add(match); + // Run RipGuard PE checks + match = RipGuardCheckPortableExecutable(file, pex, includeDebug); + if (!string.IsNullOrWhiteSpace(match)) + resultsList.Add(match); + // Run SafeCast PE checks match = SafeCastCheckPortableExecutable(file, pex, includeDebug); if (!string.IsNullOrWhiteSpace(match)) @@ -179,6 +184,11 @@ namespace BinaryObjectScanner.Protection if (cDilla != null && !cDilla.IsEmpty) results.AddRange(cDilla); + // Run RipGuard directory checks + var ripGuard = RipGuardCheckDirectoryPath(path, files); + if (ripGuard != null && !ripGuard.IsEmpty) + results.AddRange(ripGuard); + // Run SafeCast directory checks var safeCast = SafeCastCheckDirectoryPath(path, files); if (safeCast != null && !safeCast.IsEmpty) @@ -215,6 +225,11 @@ namespace BinaryObjectScanner.Protection if (!string.IsNullOrWhiteSpace(cDilla)) resultsList.Add(cDilla); + // Run RipGuard file checks + string ripGuard = RipGuardCheckFilePath(path); + if (!string.IsNullOrWhiteSpace(ripGuard)) + resultsList.Add(ripGuard); + // Run SafeCast file checks string safeCast = SafeCastCheckFilePath(path); if (!string.IsNullOrWhiteSpace(safeCast)) diff --git a/README.md b/README.md index 00ffd429..482853f9 100644 --- a/README.md +++ b/README.md @@ -89,6 +89,7 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain | PlayStation Anti-modchip | True | False | En/Jp, not "Red Hand"; PSX executables only | | Rainbow Sentinel | True | True | | | Ring PROTECH / ProRing | True | True | Partially unconfirmed² | +| RipGuard | True | True | Partially unconfirmed² | | SafeDisc / SafeCast | True | True | Can't distinguish between some versions of SafeDisc and SafeCast | | SafeLock | False | True | | | SecuROM | True | True | v8.x and White Label detected partially² |