From aff43b76254dcbdcf116a057116539c35a648843 Mon Sep 17 00:00:00 2001 From: TheRogueArchivist Date: Thu, 5 Jan 2023 15:55:21 -0700 Subject: [PATCH] Add encrypted Link Data Security file detection (#223) * Add encrypted Link Data Security file (LDSCRYPT) detection. * Update CD-Cops notes. --- BurnOutSharp/Enums.cs | 5 +++ BurnOutSharp/FileType/LDSCRYPT.cs | 49 ++++++++++++++++++++++++ BurnOutSharp/ProtectionType/CDDVDCops.cs | 8 ++++ BurnOutSharp/Scanner.cs | 7 ++++ BurnOutSharp/Tools/Utilities.cs | 8 ++++ README.md | 1 + 6 files changed, 78 insertions(+) create mode 100644 BurnOutSharp/FileType/LDSCRYPT.cs diff --git a/BurnOutSharp/Enums.cs b/BurnOutSharp/Enums.cs index bde37a8a..39c9d1f8 100644 --- a/BurnOutSharp/Enums.cs +++ b/BurnOutSharp/Enums.cs @@ -55,6 +55,11 @@ /// InstallShieldCAB, + /// + /// Link Data Security encrypted file + /// + LDSCRYPT, + /// /// Microsoft cabinet file /// diff --git a/BurnOutSharp/FileType/LDSCRYPT.cs b/BurnOutSharp/FileType/LDSCRYPT.cs new file mode 100644 index 00000000..0a942eca --- /dev/null +++ b/BurnOutSharp/FileType/LDSCRYPT.cs @@ -0,0 +1,49 @@ +using System; +using System.Collections.Concurrent; +using System.IO; +using BurnOutSharp.Interfaces; +using static BurnOutSharp.Utilities.Dictionary; + +namespace BurnOutSharp.FileType +{ + /// + /// Link Data Security encrypted file + /// + public class LDSCRYPT : IScannable + { + /// + public ConcurrentDictionary> Scan(Scanner scanner, string file) + { + if (!File.Exists(file)) + return null; + + using (var fs = File.Open(file, FileMode.Open, FileAccess.Read, FileShare.Read)) + { + return Scan(scanner, fs, file); + } + } + + /// + public ConcurrentDictionary> Scan(Scanner scanner, Stream stream, string file) + { + var protections = new ConcurrentDictionary>(); + try + { + byte[] magic = new byte[16]; + stream.Read(magic, 0, 16); + + if (Tools.Utilities.GetFileType(magic) == SupportedFileType.LDSCRYPT) + { + AppendToDictionary(protections, file, "Link Data Security encrypted file"); + return protections; + } + } + catch (Exception ex) + { + if (scanner.IncludeDebug) Console.WriteLine(ex); + } + + return null; + } + } +} diff --git a/BurnOutSharp/ProtectionType/CDDVDCops.cs b/BurnOutSharp/ProtectionType/CDDVDCops.cs index 0d12a739..f3001372 100644 --- a/BurnOutSharp/ProtectionType/CDDVDCops.cs +++ b/BurnOutSharp/ProtectionType/CDDVDCops.cs @@ -16,6 +16,8 @@ namespace BurnOutSharp.ProtectionType // Embedded PKZIP archive that may contain the CD-Cops files // `CDCOPS.DLL` (1.46) / `CDCOPS.DLL` (1.48) // `WINCOPS.INI` + // Samples of CD-Cops can be found in IA items "der-brockhaus-multimedial-2002-premium" and "der-brockhaus-multimedial-2003-premium". + // A sample of CD-Cops that makes use of encrypted PDFs (LDSCRYPT) can be found in IA item "Faculty_Edition_People_Problems_and_Power_by_Joseph_Unekis_Textbytes". public class CDDVDCops : IContentCheck, INewExecutableCheck, IPathCheck, IPortableExecutableCheck { /// @@ -121,6 +123,9 @@ namespace BurnOutSharp.ProtectionType // TODO: Original had "CDCOPS.DLL" required and all the rest in a combined OR var matchers = new List { + // A 400+ MB file called "WASTE.DAT" that is fully 00 padded can be found in IA item "Faculty_Edition_People_Problems_and_Power_by_Joseph_Unekis_Textbytes". + // Presumably used to increase the amount of data written to the disc to allow DPM checking to be used for the protection. It's unknown if this file is used on any other protected discs. + // Found in Redump entry 84517 new PathMatchSet(new PathMatch("CDCOPS.DLL", useEndsWith: true), "CD-Cops"), new PathMatchSet(new PathMatch(".W_X", matchExact: true, useEndsWith: true), "CD-Cops"), @@ -138,6 +143,9 @@ namespace BurnOutSharp.ProtectionType { var matchers = new List { + // A 400+ MB file called "WASTE.DAT" that is fully 00 padded can be found in IA item "Faculty_Edition_People_Problems_and_Power_by_Joseph_Unekis_Textbytes". + // Presumably used to increase the amount of data written to the disc to allow DPM checking to be used for the protection. It's unknown if this file is used on any other protected discs. + // Found in Redump entry 84517 new PathMatchSet(new PathMatch("CDCOPS.DLL", useEndsWith: true), "CD-Cops"), new PathMatchSet(new PathMatch(".W_X", matchExact: true, useEndsWith: true), "CD-Cops"), diff --git a/BurnOutSharp/Scanner.cs b/BurnOutSharp/Scanner.cs index c861e22b..d399224a 100644 --- a/BurnOutSharp/Scanner.cs +++ b/BurnOutSharp/Scanner.cs @@ -359,6 +359,13 @@ namespace BurnOutSharp AppendToDictionary(protections, subProtections); } + // LDSCRYPT + if (scannable is LDSCRYPT) + { + var subProtections = scannable.Scan(this, stream, fileName); + AppendToDictionary(protections, subProtections); + } + // PLJ if (scannable is PLJ) { diff --git a/BurnOutSharp/Tools/Utilities.cs b/BurnOutSharp/Tools/Utilities.cs index e3e8cf12..b487d339 100644 --- a/BurnOutSharp/Tools/Utilities.cs +++ b/BurnOutSharp/Tools/Utilities.cs @@ -113,6 +113,13 @@ namespace BurnOutSharp.Tools #endregion + #region LDSCRYPT + + if (magic.StartsWith(new byte?[] { 0x4C, 0x44, 0x53, 0x43, 0x52, 0x59, 0x50, 0x54 })) + return SupportedFileType.LDSCRYPT; + + #endregion + #region MicrosoftCAB if (magic.StartsWith(new byte?[] { 0x4d, 0x53, 0x43, 0x46 })) @@ -659,6 +666,7 @@ namespace BurnOutSharp.Tools //case FileTypes.IniFile: return new FileType.IniFile(); case SupportedFileType.InstallShieldArchiveV3: return new FileType.InstallShieldArchiveV3(); case SupportedFileType.InstallShieldCAB: return new FileType.InstallShieldCAB(); + case SupportedFileType.LDSCRYPT: return new FileType.LDSCRYPT(); case SupportedFileType.MicrosoftCAB: return new FileType.MicrosoftCAB(); case SupportedFileType.MicrosoftLZ: return new FileType.MicrosoftLZ(); case SupportedFileType.MPQ: return new FileType.MPQ(); diff --git a/README.md b/README.md index 6479ab44..9291b36c 100644 --- a/README.md +++ b/README.md @@ -161,6 +161,7 @@ Below is a list of container formats that are supported in some way: | InstallShield Archive V3 (Z) | No | Yes | Yes | Via `UnshieldSharp` | | InstallShield CAB | No | Yes | Yes | Via `UnshieldSharp` | | Linear Executable | No | No | No | Skeleton only | +| Link Data Security encrypted file | No | Yes | No | | | Microsoft cabinet file | Yes | Yes | Yes | | | Microsoft LZ-compressed files | No | Yes | Yes | | | MoPaQ game data archive (MPQ) | No | Yes | Yes | Via `StormLibSharp` |