From cfc9092479a80734f7ae50d998550170307f0008 Mon Sep 17 00:00:00 2001 From: TheRogueArchivist Date: Sun, 1 Oct 2023 20:05:04 -0600 Subject: [PATCH] Add DigiGuard detection (#267) * Add DigiGuard detection * Use FilePathMatch instead of PathMatch --- BinaryObjectScanner/Protection/DigiGuard.cs | 95 +++++++++++++++++++++ README.md | 1 + 2 files changed, 96 insertions(+) create mode 100644 BinaryObjectScanner/Protection/DigiGuard.cs diff --git a/BinaryObjectScanner/Protection/DigiGuard.cs b/BinaryObjectScanner/Protection/DigiGuard.cs new file mode 100644 index 00000000..b7330ad0 --- /dev/null +++ b/BinaryObjectScanner/Protection/DigiGuard.cs @@ -0,0 +1,95 @@ +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.Linq; +using BinaryObjectScanner.Interfaces; +using SabreTools.Matching; +using SabreTools.Serialization.Wrappers; + +namespace BinaryObjectScanner.Protection +{ + /// + /// DigiGuard (AKA DigiGuard ESD) was an online activation based DRM by Greenleaf Technologies Corporation. It was seemingly used for several OEM game collections, such as for Dell and Sony. + /// Discs with DigiGuard appear to contain the full games in an encrypted format, with the option of purchasing the game online or via telephone so they can be installed from the disc. + /// + /// Links: + /// First archived GLFC website: https://web.archive.org/web/19991008072239/http://www.glfc.com:80/ + /// Later GLFC website: https://web.archive.org/web/20010331132439/http://www.glfc.com/index2.html + /// Press release regarding the use of DigiGuard with Sony OEM discs: https://web.archive.org/web/20001010225304/http://www.glfc.com:80/press_releases/8_23_00.asp + /// Press release regarding the use of DigiGuard with Dell OEM discs: https://web.archive.org/web/20010430042245fw_/http://www.glfc.com/pr_oct16_00.html + /// Press release regarding the use of DigiGuard with the "Accolade Family Spectacular" DVD: https://web.archive.org/web/20010430042245fw_/http://www.glfc.com/pr_oct16_00.html + /// Press release regarding GLFC and Ritek: https://www.bloomberg.com/press-releases/2000-10-24/ritek-and-greenleaf-technologies-align-to-drive-encrypted-dvd + /// Press release regarding GLFC and Dell: https://www.bloomberg.com/press-releases/2000-10-04/greenleaf-technologies-signs-agreement-with-dell-computers-to + /// First list of archived GLFC press releases: https://web.archive.org/web/*/http://glfc.com/press_releases/* + /// Second list of archived GLFC press releases (Search for "pr_"): https://web.archive.org/web/*/http://glfc.com/* + /// News article regarding GLFC and Accolade Games: https://www.gamespot.com/articles/accolade-games-on-dvd/1100-2460436/ + /// eBay listing for the "BIGWIG SOFTWARE LOCKER", which very likely contains DigiGuard: https://www.ebay.com/itm/325573968970 + /// + public class DigiGuard : IPathCheck, IPortableExecutableCheck + { + /// +#if NET48 + public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) +#else + public string? CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) +#endif + { + // Get the sections from the executable, if possible + var sections = pex.Model.SectionTable; + if (sections == null) + return null; + + // Found in "Start.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588. + var name = pex.FileDescription; + if (name?.Equals("DigiGuard3 Client") == true) + return $"DigiGuard3"; + + // Found in "Start.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588. + name = pex.LegalTrademarks; + if (name?.Equals("DigiGuard") == true) + return $"DigiGuard"; + + // Found in "PJS3.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588. + name = pex.ProductName; + if (name?.Equals("Greenleaf Wrapper3") == true) + return $"DigiGuard"; + + return null; + } + + /// +#if NET48 + public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files) +#else + public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable? files) +#endif + { + var matchers = new List + { + // Found in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588. + new PathMatchSet(new FilePathMatch("DecryptWrap.exe"), "DigiGuard"), + + // There are at least two additional specifically named DecryptWrap files, "DecryptWrapTW2000.exe" and "DecryptWrapTW2KCode.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588. + }; + + return MatchUtil.GetAllMatches(files ?? System.Array.Empty(), matchers, any: true); + } + + /// +#if NET48 + public string CheckFilePath(string path) +#else + public string? CheckFilePath(string path) +#endif + { + var matchers = new List + { + // Found in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588. + new PathMatchSet(new FilePathMatch("DecryptWrap.exe"), "DigiGuard"), + + // There are at least two additional specifically named DecryptWrap files, "DecryptWrapTW2000.exe" and "DecryptWrapTW2KCode.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588. + }; + + return MatchUtil.GetFirstMatch(path, matchers, any: true); + } + } +} diff --git a/README.md b/README.md index 174ace02..0a218745 100644 --- a/README.md +++ b/README.md @@ -52,6 +52,7 @@ Below is a list of protections detected by BurnOutSharp. The two columns explain | CrypKey | True | False | | | Cucko (EA Custom) | True | False | Does not detect all known cases | | Denuvo Anti-Cheat/Anti-Tamper| True | True | | +| DigiGuard | True | True | | | Dinamic Multimedia Protection/LockBlocks | False | True | LockBlocks needs manual confirmation of the presence of 2 rings | | DiscGuard | True | True | Partially unconfirmed² | | DVD-Movie-PROTECT | False | True | Unconfirmed¹ |