diff --git a/BurnOutSharp/ProtectionType/HexaLock.cs b/BurnOutSharp/ProtectionType/HexaLock.cs
index 2e78bd32..8e866846 100644
--- a/BurnOutSharp/ProtectionType/HexaLock.cs
+++ b/BurnOutSharp/ProtectionType/HexaLock.cs
@@ -1,5 +1,7 @@
-using System.Collections.Concurrent;
+using System;
+using System.Collections.Concurrent;
using System.Collections.Generic;
+using BurnOutSharp.ExecutableType.Microsoft.PE;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
@@ -8,24 +10,57 @@ namespace BurnOutSharp.ProtectionType
///
/// HexaLock AutoLock was a copy protection scheme that requied users to buy so-called "CD-RX" media that contained a special session pre-burned to it in order to burn their protect media.
/// Sales page for CD-RX media: http://www.image-src.com/services/hexalock.asp
+ /// Hexalock AutoLock was also able to be used with pressed CD-ROMs (Source: https://web.archive.org/web/20110828214830/http://hexalock.co.il/copyprotection/cdrom).
/// It also allowed you to protect multimedia documents, such as documents or pictures.
/// The official website is now dead, but there are a few archives made (https://web.archive.org/web/20110904233743/http://hexalock.co.il/).
/// There don't appear to be any archives of the "CD-RX" media available, though it appears that some are still for sale on Amazon:
/// https://www.amazon.cn/dp/B000F3RPCI + https://www.amazon.cn/dp/B000F3PJA8
- /// It appears that some versions of "Operation Flashpoint" contain HexaLock AutoLock (Source: https://www.cdmediaworld.com/hardware/cdrom/cd_protections_hexalock.shtml).
+ /// CD-RX media makes use of twin sectors as one of the aspects of the formats copy protection (Source: https://twitter.com/RibShark/status/1551660315489730561)
+ /// These twin sectors are presumably what the Hexalock AutoLock marketing refers to as VDH (Virtual Digital Hologram) (https://web.archive.org/web/20120616004438/http://hexalock.co.il/copyprotection/vdh).
+ /// It appears that some versions of "Operation Flashpoint" contain Hexaock AutoLock (Source: https://www.cdmediaworld.com/hardware/cdrom/cd_protections_hexalock.shtml).
/// HexaLock AutoLock 4.5 official download archive: https://web.archive.org/web/20070228235538/http://hexalock.com:80/45/alw_45_march_3_2006.exe
/// HexaLock AutoLock 4.7 official download archive: https://web.archive.org/web/20140801060304/http://hexalock.co.il/downloads/files/Psetup.exe
/// There appears to be another form of copy protection created by HexaLock called HexDVDR, but I have not been able to find a copy of it preserved (Source: https://web.archive.org/web/20140801060150/http://hexalock.co.il/news/2008-03-20/).
/// There is an example EXE protected using HexDVDR provided that is still online (https://web.archive.org/web/20140802144000/http://hexalock.co.il/downloads/files/Protected%20Img.zip).
+ /// Patents relating to this protection:
+ /// https://patentimages.storage.googleapis.com/64/d6/b1/91127b030d3503/US20060259975A1.pdf
+ /// https://patentimages.storage.googleapis.com/52/5b/3a/aee21ff4d987e9/US20060123483A1.pdf
+ /// Special thanks to Ribshark for looking into this protection and sharing his research on the topic!
///
- public class HexalockAutoLock : IPathCheck
+ public class HexalockAutoLock : IPathCheck, IPortableExecutableCheck
{
///
- public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files)
+ public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug)
+ {
+ // Get the sections from the executable, if possible
+ var sections = pex?.SectionTable;
+ if (sections == null)
+ return null;
+
+ // TODO: Fix the following checks, as this information is visible via Windows Explorer but isn't currently being seen by BOS.
+ // Found in "HCPSMng.exe".
+ string name = pex.FileDescription;
+ if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("HCPS Manager", StringComparison.OrdinalIgnoreCase))
+ return $"Hexalock AutoLock 4.5";
+
+ // Found in the file typically named "Start_Here.exe".
+ if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("HCPS Loader", StringComparison.OrdinalIgnoreCase))
+ return $"Hexalock AutoLock 4.5";
+
+ // Found in both "HCPSMng.exe" and in the file typically named "Start_Here.exe".
+ name = pex.ProductName;
+ if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("HCPS", StringComparison.OrdinalIgnoreCase))
+ return $"Hexalock AutoLock 4.5";
+
+ return null;
+ }
+
+ ///
+ public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files)
{
var matchers = new List
{
- // "Start_Here.exe" is the default named used in HexaLock AutoLock 4.5.
+ // "Start_Here.exe" is the default name used in HexaLock AutoLock 4.5.
new PathMatchSet(new List
{
new PathMatch("Start_Here.exe", useEndsWith: true),
@@ -48,9 +83,8 @@ namespace BurnOutSharp.ProtectionType
new PathMatch("MFIMP.DLL", useEndsWith: true),
}, "HexaLock AutoLock"),
- // Currently unverified.
- new PathMatchSet(new PathMatch("HCPSMng.exe", useEndsWith: true), "HexaLock AutoLock"),
-
+ // Found inside the file typically named "Start_Here.exe" in version 4.5.
+ new PathMatchSet(new PathMatch("HCPSMng.exe", useEndsWith: true), "HexaLock AutoLock 4.5"),
};
return MatchUtil.GetAllMatches(files, matchers, any: false);
@@ -61,7 +95,7 @@ namespace BurnOutSharp.ProtectionType
{
var matchers = new List
{
- // Found to be the default named used in HexaLock AutoLock 4.5.
+ // Found to be the default name used in HexaLock AutoLock 4.5.
new PathMatchSet(new PathMatch("Start_Here.exe", useEndsWith: true), "HexaLock AutoLock 4.5"),
// Found to be contained in HexaLock AutoLock 4.5 and 4.7.
@@ -72,8 +106,8 @@ namespace BurnOutSharp.ProtectionType
new PathMatchSet(new PathMatch("kleft.ipf", useEndsWith: true), "HexaLock AutoLock 4.7 PDF DRM"),
new PathMatchSet(new PathMatch("ReadPFile.exe", useEndsWith: true), "HexaLock AutoLock 4.7 PDF DRM"),
- // Currently unverified.
- new PathMatchSet(new PathMatch("HCPSMng.exe", useEndsWith: true), "HexaLock AutoLock"),
+ // Found inside the file typically named "Start_Here.exe" in version 4.5.
+ new PathMatchSet(new PathMatch("HCPSMng.exe", useEndsWith: true), "HexaLock AutoLock 4.5"),
};
return MatchUtil.GetFirstMatch(path, matchers, any: true);
diff --git a/README.md b/README.md
index 5e947082..a4b1400c 100644
--- a/README.md
+++ b/README.md
@@ -53,7 +53,7 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain
| Executable-Based Online Registration | True | False | Possibly too broad |
| Freelock | False | True | Unconfirmed¹ |
| Games for Windows - Live | True | True | |
-| Hexalock Autolock | False | True | Partially unconfirmed² |
+| Hexalock AutoLock | True | True | |
| Impulse Reactor / Stardock Product Activation | True | True | |
| IndyVCD | False | True | Unconfirmed¹ |
| ITENIUM Trial & Buy Protection | True | False | |