SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-09 02:16:46 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Slight tweaks and addtions to AegiSoft

Browse Source
This commit is contained in:
Matt Nadareski
2022-12-09 22:48:23 -08:00
parent ded5ecb3ed
commit bfe2381896
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
BurnOutSharp/ProtectionType/AegiSoft.cs
View File

@@ -1,5 +1,6 @@
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Linq;
using BurnOutSharp.Interfaces;
using BurnOutSharp.Matching;
using BurnOutSharp.Wrappers;
@@ -9,7 +10,7 @@ namespace BurnOutSharp.ProtectionType
/// <summary>
/// AegiSoft License Manager was made AegiSoft, which was later bought by Real Networks, the makes of RealArcade (https://www.crunchbase.com/organization/aegisoft).
/// It allowed publishers to give users a time-based free trial of software.
/// Based on "Asc006.exe", AegiSoft License Manager may also have been referred to as "Software-On-Demand License Manager", or it may just be a distinct component of the larger product.
/// Based on "Asc005.dll" and "Asc006.exe", AegiSoft License Manager may also have been referred to as "Software-On-Demand License Manager", or it may just be a distinct component of the larger product.
/// The single sample investigated was only able to run on Windows 9x (Redump entry 73521/IA item "Nova_HoyleCasino99USA").
/// Based on the packaging from IA item "Nova_HoyleCasino99USA", it seems that additional software from "www.1-800-software.com" is likely to be protected with AegiSoft License Manager or other DRM.
/// References and further information:
@@ -33,6 +34,15 @@ namespace BurnOutSharp.ProtectionType
// "Asc005.dll" has the Product Name "OrderWizard Dynamic Link Library".
// "Asc006.exe" has the Product Name "AGENT Application".
// These are possibly identifying export name table strings
// "Asc001.dll" has the strings "AscCheck" and "AscInstall"
// "Asc002.dll" has the string "AscActivate"
// Get string table resources
var resource = pex.FindStringTableByEntry("AegiSoft License Manager");
if (resource.Any())
return "AegiSoft License Manager";
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)
@@ -85,6 +95,11 @@ namespace BurnOutSharp.ProtectionType
// There are a few other files present, but the file names on their own may be too overmatching. Due to the small sample size, it's not sure if these files are always present together.
// These files are "Asc001.dll", "Asc002.dll", "Asc003.dll", "Asc005.dll", and "Asc006.exe" (Found in Redump entry 73521/IA item "Nova_HoyleCasino99USA").
// The "DATA.TAG" file in the "AgeiSoft" folder is an INI that includes:
// Company=AegiSoft Corporation
// Application=AegiSoft License Manager
// Version=2.1
};
return MatchUtil.GetFirstMatch(path, matchers, any: true);