mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-07-09 18:36:43 +00:00
Automatic cleanup
This commit is contained in:
@@ -4,7 +4,7 @@ namespace BinaryObjectScanner.FileType
|
||||
{
|
||||
/// <summary>
|
||||
/// RealArcade Installer. Known to use the ".rgs" file extension.
|
||||
///
|
||||
///
|
||||
/// TODO: Add further parsing, game ID and name should be possible to parse.
|
||||
/// </summary>
|
||||
public class RealArcadeInstaller : DetectableBase<SabreTools.Serialization.Wrappers.RealArcadeInstaller>
|
||||
|
||||
@@ -4,7 +4,7 @@ namespace BinaryObjectScanner.FileType
|
||||
{
|
||||
/// <summary>
|
||||
/// RealArcade Mezzanine files, which contain metadata. Known to use the ".mez" file extension.
|
||||
///
|
||||
///
|
||||
/// TODO: Add further parsing, game ID should be possible to parse.
|
||||
/// </summary>
|
||||
public class RealArcadeMezzanine : DetectableBase<SabreTools.Serialization.Wrappers.RealArcadeMezzanine>
|
||||
|
||||
@@ -132,7 +132,7 @@ namespace BinaryObjectScanner.FileType
|
||||
if (fileContent.Contains("<NAME>SAFECAST</NAME>"))
|
||||
protections.Add("SafeCast");
|
||||
|
||||
// SafeDisc
|
||||
// SafeDisc
|
||||
// TODO: Add better version parsing.
|
||||
// Found in "Info.plist" in Redump entries 23983, 42762, 72713, 73070, and 89603.
|
||||
if (fileContent.Contains("<string>com.europevisionmacro.SafeDiscDVD</string>"))
|
||||
|
||||
@@ -7,7 +7,7 @@ namespace BinaryObjectScanner.GameEngine
|
||||
/// RenderWare (https://web.archive.org/web/20070214132346/http://www.renderware.com/) is an API and graphics engine created by Criterion in 1993.
|
||||
/// It appears that version 4.X was exclusively used by EA internally, with version 3.X being the final public version (https://sigmaco.org/3782-renderware/).
|
||||
/// It was available to use on many different platforms, with it being particularly useful for the PS2 (https://en.wikipedia.org/wiki/RenderWare).
|
||||
///
|
||||
///
|
||||
/// Additional resources and documentation:
|
||||
/// RenderWare interview: https://web.archive.org/web/20031208124348/http://www.homelanfed.com/index.php?id=9856
|
||||
/// RenderWare V2.1 API reference: http://www.tnlc.com/rw/api/rwdoc.htm
|
||||
|
||||
@@ -7,7 +7,7 @@ using SabreTools.Serialization.Wrappers;
|
||||
namespace BinaryObjectScanner.Packer
|
||||
{
|
||||
// TODO: Add extraction
|
||||
// TODO: Research and add support for ASProtect. It seems to be an additional layer of protection for ASPack, making detecting it separately more difficult.
|
||||
// TODO: Research and add support for ASProtect. It seems to be an additional layer of protection for ASPack, making detecting it separately more difficult.
|
||||
public class ASPack : IExecutableCheck<PortableExecutable>
|
||||
{
|
||||
/// <inheritdoc/>
|
||||
@@ -562,12 +562,12 @@ namespace BinaryObjectScanner.Packer
|
||||
/* new(new byte?[]
|
||||
{
|
||||
0x60, 0xE8, 0x03, 0x00, 0x00, 0x00, 0xE9, 0xEB,
|
||||
0x04, 0x5D, 0x45, 0x55, 0xC3, 0xE8, 0x01, 0x00,
|
||||
0x00, 0x00, 0xEB, 0x5D, 0xBB, 0xED, 0xFF, 0xFF,
|
||||
0x04, 0x5D, 0x45, 0x55, 0xC3, 0xE8, 0x01, 0x00,
|
||||
0x00, 0x00, 0xEB, 0x5D, 0xBB, 0xED, 0xFF, 0xFF,
|
||||
0xFF, 0x03, 0xDD, 0x81, 0xEB, 0x00, null, null,
|
||||
null, 0x80, 0x7D, 0x4D, 0x01, 0x75, 0x0C, 0x8B,
|
||||
null, 0x80, 0x7D, 0x4D, 0x01, 0x75, 0x0C, 0x8B,
|
||||
0x74, 0x24, 0x28, 0x83, 0xFE, 0x01, 0x89, 0x5D,
|
||||
0x4E, 0x75, 0x31, 0x8D, 0x45, 0x53, 0x50, 0x53,
|
||||
0x4E, 0x75, 0x31, 0x8D, 0x45, 0x53, 0x50, 0x53,
|
||||
0xFF, 0xB5, null, 0x09, 0x00, 0x00, 0x8D, 0x45,
|
||||
0x35, 0x50, 0xE9, 0x82, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
@@ -575,7 +575,7 @@ namespace BinaryObjectScanner.Packer
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, null,
|
||||
0x00, 0x00, 0x00, 0x00, 0xB8, 0xF8, 0xC0, 0xA5,
|
||||
0x23, 0x50, 0x50, 0x03, 0x45, 0x4E, 0x5B, 0x85,
|
||||
0xC0, 0x74, 0x1C, 0xEB, 0x01, 0xE8, 0x81, 0xFB,
|
||||
0xC0, 0x74, 0x1C, 0xEB, 0x01, 0xE8, 0x81, 0xFB,
|
||||
0xF8, 0xC0, 0xA5, 0x23, 0x74, 0x35, 0x33, 0xD2,
|
||||
0x56, 0x6A, 0x00, 0x56, 0xFF, 0x75, 0x4E, 0xFF,
|
||||
0xD0, 0x5E, 0x83, 0xFE, 0x00, 0x75, 0x24, 0x33,
|
||||
@@ -584,8 +584,8 @@ namespace BinaryObjectScanner.Packer
|
||||
0x45, 0x35, 0x85, 0xC0, 0x74, 0x0D, 0x68, 0x00,
|
||||
0x80, 0x00, 0x00, 0x6A, 0x00, 0xFF, 0x75, 0x35,
|
||||
0xFF, 0x55, 0x3D, 0x5B, 0x0B, 0xDB, 0x61, 0x75,
|
||||
0x06, 0x6A, 0x01, 0x58, 0xC2, 0x0C, 0x00, 0x33,
|
||||
0xC0, 0xF7, 0xD8, 0x1B, 0xC0, 0x40, 0xC2, 0x0C,
|
||||
0x06, 0x6A, 0x01, 0x58, 0xC2, 0x0C, 0x00, 0x33,
|
||||
0xC0, 0xF7, 0xD8, 0x1B, 0xC0, 0x40, 0xC2, 0x0C,
|
||||
0x00
|
||||
}, "ASProtect SKE 2.x -> Solodovnikov Alexey"), */
|
||||
|
||||
@@ -615,7 +615,7 @@ namespace BinaryObjectScanner.Packer
|
||||
|
||||
#region Short
|
||||
|
||||
// Disabled due to being too prone to false positives.
|
||||
// Disabled due to being too prone to false positives.
|
||||
// new(new byte?[] { 0x75, 0x00, 0xE9 }, "ASPack 1.05b"),
|
||||
|
||||
new(new byte?[] { 0x90, 0x90, 0x90, 0x75, 0x00, 0xE9 }, "ASPack 1.06.1b"),
|
||||
@@ -650,9 +650,9 @@ namespace BinaryObjectScanner.Packer
|
||||
|
||||
new(new byte?[] { 0x60, 0xE8, 0x41, 0x06, 0x00, 0x00, 0xEB, 0x41 }, "ASPack 1.08.04"),
|
||||
|
||||
// Disabled due to being too prone to false positives.
|
||||
// Disabled due to being too prone to false positives.
|
||||
//new(new byte?[] { 0x60, 0xE8, null, null, null, null, 0xEB }, "ASPack 1.08.04"),
|
||||
|
||||
|
||||
new(new byte?[] { 0x60, 0xE8, 0x70, 0x05, 0x00, 0x00, 0xEB, 0x4C }, "ASPack 2.00.00"),
|
||||
|
||||
new(new byte?[] { 0x60, 0xE8, 0x48, 0x11, 0x00, 0x00, 0xC3, 0x83 }, "ASPack 2.00.00"),
|
||||
|
||||
@@ -9,10 +9,10 @@ namespace BinaryObjectScanner.Packer
|
||||
/// <summary>
|
||||
/// .NET Reactor is a .NET obfuscator that was original released in 2004. https://web.archive.org/web/20040828162124/http://eziriz.com:80/
|
||||
/// It is currently still being updated and supported. https://www.eziriz.com/dotnet_reactor.htm
|
||||
/// While ProtectionID does detect .NET Reactor, it's currently unknown exactly how.
|
||||
/// While ProtectionID does detect .NET Reactor, it's currently unknown exactly how.
|
||||
/// It seems to simply check for the string "<PrivateImplementationDetails>" in specific, and currently unknown, conditions but appears to be prone to false positives.
|
||||
/// A "Demo/Nag Screen" version is available for free, and may be able to be used to make samples to improve detections. https://www.eziriz.com/reactor_download.htm
|
||||
///
|
||||
///
|
||||
/// Resource that could be useful for extraction: https://github.com/SychicBoy/NETReactorSlayer
|
||||
/// </summary>
|
||||
public class DotNetReactor : IExecutableCheck<PortableExecutable>
|
||||
@@ -44,7 +44,7 @@ namespace BinaryObjectScanner.Packer
|
||||
null, null, null, 0x7D
|
||||
}, ".NET Reactor"),
|
||||
|
||||
// Modified from the previous detection to detect a presumably newer version of .NET Reactor found in "KalypsoLauncher.dll" version 2.0.4.2.
|
||||
// Modified from the previous detection to detect a presumably newer version of .NET Reactor found in "KalypsoLauncher.dll" version 2.0.4.2.
|
||||
// TODO: Check if this can/should be made more specific.
|
||||
// <PrivateImplementationDetails>.RSA
|
||||
new(new byte?[]
|
||||
@@ -68,7 +68,7 @@ namespace BinaryObjectScanner.Packer
|
||||
null, null, null, null, null, null, null, null,
|
||||
0x00, 0x7D, 0x00
|
||||
}, ".NET Reactor (Unconfirmed - Please report to us on GitHub)"),
|
||||
|
||||
|
||||
// Adapted from https://github.com/cod3nym/detection-rules/blob/main/yara/dotnet/obf_net_reactor.yar and confirmed to work with "KalypsoLauncher.dll" from Redump entry 95617.
|
||||
// <Module>{[8]-[4]-[4]-[4]-[12]}
|
||||
new(new byte?[]
|
||||
|
||||
@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Packer
|
||||
/// <inheritdoc/>
|
||||
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
|
||||
{
|
||||
// TODO: Confirm if both need to be present
|
||||
// TODO: Confirm if both need to be present
|
||||
// TODO: Figure out how to get version
|
||||
|
||||
if (exe.ContainsSection(".MPRESS1"))
|
||||
|
||||
@@ -25,7 +25,7 @@ namespace BinaryObjectScanner.Packer
|
||||
return "NSIS";
|
||||
|
||||
// Get the .data/DATA section strings, if they exist
|
||||
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
|
||||
var strs = exe.GetFirstSectionStrings(".data") ?? exe.GetFirstSectionStrings("DATA");
|
||||
if (strs != null)
|
||||
{
|
||||
if (strs.Exists(s => s.Contains("NullsoftInst")))
|
||||
|
||||
@@ -7,7 +7,7 @@ namespace BinaryObjectScanner.Packer
|
||||
/// NeoLite (https://web.archive.org/web/20000815214147/http://www.neoworx.com/products/neolite/default.asp) was a packer created by NeoWorx.
|
||||
/// The most common version appears to be 2.0, with earlier versions existing but with no archived copies available.
|
||||
/// NeoWorx was acquired by McAfee in October 2001, who seemingly dropped support for NeoLite (https://web.archive.org/web/20020603224725/http://www.mcafee.com/myapps/neoworx/default.asp).
|
||||
///
|
||||
///
|
||||
/// Additional references and documentation:
|
||||
/// NeoLite 2.0 evaluation installer: https://web.archive.org/web/20001012061916/http://www.neoworx.com/download/neolte20.exe
|
||||
/// PEiD scanning definitions that include NeoLite: https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt
|
||||
|
||||
@@ -89,7 +89,7 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
// There are a few other files present, but the file names on their own may be too overmatching. Due to the small sample size, it's not sure if these files are always present together.
|
||||
// These files are "Asc001.dll", "Asc002.dll", "Asc003.dll", "Asc005.dll", and "Asc006.exe" (Found in Redump entry 73521/IA item "Nova_HoyleCasino99USA").
|
||||
|
||||
|
||||
// The "DATA.TAG" file in the "AgeiSoft" folder is an INI that includes:
|
||||
// Company=AegiSoft Corporation
|
||||
// Application=AegiSoft License Manager
|
||||
|
||||
@@ -13,11 +13,11 @@ namespace BinaryObjectScanner.Protection
|
||||
/// The ByteShield DRM itself is online activation based, using randomly generated activation codes it refers to as DACs (https://web.archive.org/web/20080921231346/http://www.byteshield.net/byteshield_whitepaper_0005.pdf).
|
||||
/// It appears that ByteShield advertised itself around online web forums (https://gamedev.net/forums/topic/508082-net-copy-protection-c/508082/ and https://cboard.cprogramming.com/tech-board/106642-how-add-copy-protection-software.html).
|
||||
/// Patent relating to ByteShield: https://patentimages.storage.googleapis.com/ed/76/c7/d98a56aeeca2e9/US7716474.pdf and https://patents.google.com/patent/US20100212028.
|
||||
///
|
||||
/// Games known to use it:
|
||||
///
|
||||
/// Games known to use it:
|
||||
/// Line Rider 2: Unbound (https://fileforums.com/showthread.php?t=86909).
|
||||
/// Football Manager 2011 (https://community.sigames.com/forums/topic/189163-for-those-of-you-struggling-with-byteshield-activation-issues/).
|
||||
///
|
||||
///
|
||||
/// Publishers known to use it:
|
||||
/// PAN Vision (http://web.archive.org/web/20120413160122/http://www.byteshield.net/ -> Company -> Milestones).
|
||||
/// JIAN (http://web.archive.org/web/20120413160122/http://www.byteshield.net/ -> Company -> Milestones).
|
||||
@@ -29,7 +29,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// N3V Games (http://web.archive.org/web/20120413160122/http://www.byteshield.net/ -> Customers).
|
||||
/// OnePlayS (http://web.archive.org/web/20120413160122/http://www.byteshield.net/ -> Customers).
|
||||
/// YAWMA (http://web.archive.org/web/20120413160122/http://www.byteshield.net/ -> Customers).
|
||||
///
|
||||
///
|
||||
/// Further links and resources:
|
||||
/// https://www.cdmediaworld.com/hardware/cdrom/cd_protections_byteshield.shtml
|
||||
/// https://www.bcs.org/articles-opinion-and-research/is-there-anything-like-acceptable-drm/
|
||||
|
||||
@@ -19,9 +19,9 @@ namespace BinaryObjectScanner.Protection
|
||||
/// Embedded PKZIP archive that may contain the CD-Cops files
|
||||
/// `CDCOPS.DLL` (1.46) / `CDCOPS.DLL` (1.48)
|
||||
/// `WINCOPS.INI`
|
||||
///
|
||||
///
|
||||
/// TODO: Investigate if "DVD-Cops" is a separate product, or simply what CD-Cops is referred to when used on a DVD.
|
||||
///
|
||||
///
|
||||
/// Known versions of CD-Cops:
|
||||
/// * 1.08 (Unconfirmed) (Redump entry 84517).
|
||||
/// * 1,13[sic] (Confirmed) ("FGP.exe" in IA item "flaklypa-grand-prix-gullutgave-2cd"/Redump entries 108167-108168 patched with https://web.archive.org/web/20040307124358/http://www.caprino.no:80/download/fgpgold_upd4.exe).
|
||||
@@ -36,10 +36,10 @@ namespace BinaryObjectScanner.Protection
|
||||
/// * 1.73 (Confirmed) ("WETFLIPPER.EXE" in IA item "LULA_Erotic_Pinball_-_Windows95_Eng).
|
||||
/// * 1,81[sic] (Confirmed) ("FGP.exe" in IA item "flaklypa-grand-prix-gullutgave-2cd"/Redump entries 108167-108168 patched with https://web.archive.org/web/20030308040529/http://www.caprino.no:80/download/fgpgold_upd1.exe).
|
||||
/// * 2.03 (Confirmed) ("HyperBowl.exe" in IA item "hyperbowl_20190626").
|
||||
///
|
||||
///
|
||||
/// Known versions of DVD-Cops:
|
||||
/// * 1.69 (Confirmed) ("FGP.exe" in IA item "flaklypa-grand-prix-dvd"/Redump entry 108169).
|
||||
///
|
||||
///
|
||||
/// Known samples of CD-Cops include:
|
||||
/// * IA item "der-brockhaus-multimedial-2002-premium".
|
||||
/// * IA item "der-brockhaus-multimedial-2003-premium".
|
||||
@@ -51,15 +51,15 @@ namespace BinaryObjectScanner.Protection
|
||||
/// * Patches for "flaklypa-grand-prix-gullutgave-2cd"/Redump entries 108167-108168, found at https://web.archive.org/web/*/http://www.caprino.no/download/* (FGPGOLD_UPD files).
|
||||
/// * IA item "hyperbowl_20190626"/"hyperbowl-arcade-edition".
|
||||
/// * Redump entries 51403(?), 84517, and 85077.
|
||||
///
|
||||
///
|
||||
/// Known samples of DVD-Cops include:
|
||||
/// * IA item "flaklypa-grand-prix-dvd"/Redump entry 108169.
|
||||
///
|
||||
/// Known samples of WEB-Cops include:
|
||||
///
|
||||
/// Known samples of WEB-Cops include:
|
||||
/// * https://web.archive.org/web/20120616074941/http://icm.games.tucows.com/files2/HyperDemo-109a.exe
|
||||
///
|
||||
///
|
||||
/// A sample of CD-Cops that makes use of encrypted PDFs (LDSCRYPT) can be found in IA item "Faculty_Edition_People_Problems_and_Power_by_Joseph_Unekis_Textbytes".
|
||||
///
|
||||
///
|
||||
/// List of applications that have CD/DVD/WEB-Cops relating to a Windows update: https://www.betaarchive.com/wiki/index.php/Microsoft_KB_Archive/924867
|
||||
/// </summary>
|
||||
// TODO: Investigate reference to "CD32COPS.DLL" in "WETFLIPP.QZ_" in IA item "Triada_Russian_DVD_Complete_Collection_of_Erotic_Games".
|
||||
@@ -85,18 +85,18 @@ namespace BinaryObjectScanner.Protection
|
||||
0x43, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73, 0x2C,
|
||||
0x20, 0x76, 0x65, 0x72, 0x2E, 0x20
|
||||
}, GetVersion, "CD-Cops"),
|
||||
// CD-Cops, ver.
|
||||
|
||||
// CD-Cops, ver.
|
||||
|
||||
// Found in "h3blade.exe" in Redump entry 85077.
|
||||
new(new byte?[]
|
||||
{
|
||||
0x43, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73, 0x2C,
|
||||
0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20
|
||||
}, GetVersion, "CD-Cops"),
|
||||
// CD-Cops, ver.
|
||||
// CD-Cops, ver.
|
||||
|
||||
// Found in IA entries "der-brockhaus-multimedial-2002-premium" and "der-brockhaus-multimedial-2003-premium"
|
||||
// TODO: 2002 returns DVD-Cops 2.01, 2003 returns DVD-Cops 1,60. CD-Cops version numbers seem to "reset"
|
||||
// TODO: 2002 returns DVD-Cops 2.01, 2003 returns DVD-Cops 1,60. CD-Cops version numbers seem to "reset"
|
||||
// after some point in time in existing redump entries- perhaps the command instead of the period may have
|
||||
// some significance?
|
||||
new(new byte?[]
|
||||
@@ -104,14 +104,14 @@ namespace BinaryObjectScanner.Protection
|
||||
0x44, 0x56, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73,
|
||||
0x2C, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20
|
||||
}, GetVersion, "DVD-Cops"),
|
||||
// DVD-Cops, ver.
|
||||
|
||||
// DVD-Cops, ver.
|
||||
|
||||
new(new byte?[]
|
||||
{
|
||||
0x44, 0x56, 0x44, 0x2D, 0x43, 0x6F, 0x70, 0x73,
|
||||
0x2C, 0x20, 0x20, 0x76, 0x65, 0x72, 0x2E, 0x20
|
||||
}, GetVersion, "DVD-Cops"),
|
||||
// DVD-Cops, ver.
|
||||
// DVD-Cops, ver.
|
||||
};
|
||||
|
||||
var match = MatchUtil.GetFirstMatch(file, data, neMatchSets, includeDebug);
|
||||
@@ -210,13 +210,13 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
new(new PathMatch(".GZ_", matchCase: true, useEndsWith: true), "CD-Cops (Unconfirmed - Please report to us on Github)"),
|
||||
new(new PathMatch(".Qz", matchCase: true, useEndsWith: true), "CD-Cops (Unconfirmed - Please report to us on Github)"),
|
||||
|
||||
|
||||
// Found in Redump entries 84517, 108167, 119435, 119436, and 119437. This is the official
|
||||
// name from their website https://www.linkdatasecurity.com/index.htm#/protection-products/cd-dvd-usb-copy-protection/cdcops
|
||||
// I can't find this specific filename documented anywhere, but, all of these
|
||||
// games do not require a key to be input
|
||||
new(new FilePathMatch("cdcode.key"), "CD-Cops Codefree"),
|
||||
|
||||
|
||||
// DVD-Cops Codefree does exist https://www.linkdatasecurity.com/index.htm#/protection-products/cd-dvd-usb-copy-protection/dvdvers
|
||||
// but we currently have no samples. Presumably this is what the file would be called?
|
||||
new(new FilePathMatch("dvdcode.key"), "DVD-Cops Codefree (Unconfirmed - Please report to us on Github)"),
|
||||
@@ -245,7 +245,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// I can't find this specific filename documented anywhere, but, all of these
|
||||
// games do not require a key to be input
|
||||
new(new FilePathMatch("cdcode.key"), "CD-Cops Codefree"),
|
||||
|
||||
|
||||
// DVD-Cops Codefree does exist https://www.linkdatasecurity.com/index.htm#/protection-products/cd-dvd-usb-copy-protection/dvdvers
|
||||
// but we currently have no samples. Presumably this is what the file would be called?
|
||||
new(new FilePathMatch("dvdcode.key"), "DVD-Cops Codefree (Unconfirmed - Please report to us on Github)"),
|
||||
@@ -269,7 +269,7 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
private static string GetVersionString(string match)
|
||||
{
|
||||
// Full string ends with # (i.e. "CD-Cops, ver. 1.72, #"), use that to compensate for comma in version
|
||||
// Full string ends with # (i.e. "CD-Cops, ver. 1.72, #"), use that to compensate for comma in version
|
||||
// number cases (don't change the comma, see earlier to-do) like "DVD-Cops, ver. 1,60, #"
|
||||
// TODO: improve regex via the starting "N" character? Possibly unnecessary?
|
||||
var versionMatch = Regex.Match(match, @"(?<=D-Cops,\s{1,}ver. )(.*?)(?=,\s{1,}#)");
|
||||
|
||||
@@ -62,7 +62,7 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
// TODO: Determine if there's any consistency in the naming of the additional AFP files.
|
||||
|
||||
// Found in every confirmed sample of CD-Lock, generally (but not always) appears to include markers relating to the additional AFP files present (Redump entries 24287 and 31615).
|
||||
// Found in every confirmed sample of CD-Lock, generally (but not always) appears to include markers relating to the additional AFP files present (Redump entries 24287 and 31615).
|
||||
new(new FilePathMatch("CONFIG.AFP"), "CD-Lock"),
|
||||
|
||||
// There is also a "$$$$$$$$.$$$" file present on some discs, but it isn't known if this is directly related to CD-Lock (Redump entries 37788 and 43221).
|
||||
|
||||
@@ -10,15 +10,15 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// Channelware was an online activation DRM.
|
||||
///
|
||||
///
|
||||
/// Official websites:
|
||||
///
|
||||
///
|
||||
/// https://web.archive.org/web/19980212121046/http://www.channelware.com/index.html
|
||||
/// https://web.archive.org/web/20021002225705/http://cwsw.com/Home/default.asp
|
||||
/// https://web.archive.org/web/20040101180929/http://www.netactive.com/Home/
|
||||
///
|
||||
///
|
||||
/// TODO:
|
||||
/// Add version detection. Redump entry 116358 is version 1.x and Redump entry 12354 is 2.x, but the file versions are inconsistent.
|
||||
/// Add version detection. Redump entry 116358 is version 1.x and Redump entry 12354 is 2.x, but the file versions are inconsistent.
|
||||
/// Investigate "NetActive Reach", which is is either a newer version of this DRM, or a new DRM created by the same company. (https://web.archive.org/web/20040101162921/http://www.netactive.com/Products/)
|
||||
/// </summary>
|
||||
public class Channelware : IExecutableCheck<PortableExecutable>, IPathCheck
|
||||
|
||||
@@ -12,11 +12,11 @@ namespace BinaryObjectScanner.Protection
|
||||
/// Code-Lock by ChosenBytes (https://web.archive.org/web/20040225072021/http://chosenbytes.com/) is a form of DRM that protects Visual Basic and .NET programs.
|
||||
/// It requires the use of a registration code that is unique to each individual user (https://web.archive.org/web/20031210093259/http://www.chosenbytes.com/codemain.php).
|
||||
/// As an advertising point, ChosenBytes apparently held a contest with a cash prize to see if a protected file could be cracked (https://web.archive.org/web/20031106163334/http://www.chosenbytes.com/challenge.php).
|
||||
///
|
||||
///
|
||||
/// Previous versions of BinaryObjectScanner incorrectly reported this DRM as "CodeLock / CodeLok / CopyLok". It was later discovered that due to the similar names, two entirely different DRM were erroneously lumped together.
|
||||
/// Not only is "CodeLok / CopyLok" an entirely separate form of DRM, but "CodeLock" (as opposed to "Code-Lock") appears to refer specifically to another unrelated DRM (https://web.archive.org/web/20031106033758/http://www.codelock.co.nz/).
|
||||
/// Also not to be confused with https://www.youtube.com/watch?v=AHqdgk0uJyc.
|
||||
///
|
||||
///
|
||||
/// Code-Lock FAQ: https://web.archive.org/web/20041205165232/http://www.chosenbytes.com/codefaq.php
|
||||
/// Download (Version 2.35 trial): https://web.archive.org/web/20060220121200/http://www.chosenbytes.com:80/Code-Lock_cnet.zip
|
||||
/// </summary>
|
||||
|
||||
@@ -14,8 +14,8 @@ namespace BinaryObjectScanner.Protection
|
||||
// TODO: Figure out if Light and Professional are what designate rings and rings+disccheck
|
||||
public class CopyX : IExecutableCheck<PortableExecutable>, IPathCheck
|
||||
{
|
||||
// Previous check 'Tivola Ring Protect' removed because it was found to actually be copy-x.
|
||||
// The checks were for ZDAT/webmast.dxx and ZDAT/webmast.dxx, for Redump IDs 81628 and 116418.
|
||||
// Previous check 'Tivola Ring Protect' removed because it was found to actually be copy-x.
|
||||
// The checks were for ZDAT/webmast.dxx and ZDAT/webmast.dxx, for Redump IDs 81628 and 116418.
|
||||
|
||||
// https://web.archive.org/web/20011016234742/http://www.optimal-online.de:80/product/copy_x.htm
|
||||
// There are four kinds of copy-X; Light, Profesisonal, audio, and Trial Maker.
|
||||
@@ -37,7 +37,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// games, Tivola. Still, most use ZDAT.
|
||||
|
||||
// Professional:
|
||||
// All instances of professional contain a disc check, performed via optgraph.dll.
|
||||
// All instances of professional contain a disc check, performed via optgraph.dll.
|
||||
// All instances of professional contain in a directory usually (but not always, German Emergency 2 Deluxe has a
|
||||
// Videos folder as well, which isn't involved in rings/protection) at the end of the image, 3 files:
|
||||
// gov_[something].x64, iofile.x64, and sound.x64. So far, they have always been in a directory called "System".
|
||||
@@ -63,7 +63,7 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
if (exe.OverlayStrings != null)
|
||||
{
|
||||
// Checks if main executable contains reference to optgraph.dll.
|
||||
// Checks if main executable contains reference to optgraph.dll.
|
||||
// This might be better removed later, as Redump ID 82475 is a false positive, and also doesn't actually
|
||||
// contain the actual optgraph.dll file.
|
||||
// TODO: Find a way to check for situations like Redump ID 48393, where the string is spaced out with
|
||||
@@ -97,7 +97,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// Directory checks intentionally only detect Light
|
||||
|
||||
// Excludes files with .x64 extension to avoid flagging Professional files.
|
||||
// Sorts list of files in ZDAT* so just the first file gets pulled, later ones have a chance of the ring
|
||||
// Sorts list of files in ZDAT* so just the first file gets pulled, later ones have a chance of the ring
|
||||
// intersecting the start of the file.
|
||||
|
||||
// Kenny's Adventure uses System instead of ZDAT.
|
||||
|
||||
@@ -269,14 +269,14 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
// Found in Doom Eternal Update 1 (Steam Depot 782332, Manifest 7064393210727378308).
|
||||
|
||||
// These files are automatically installed into an "Denuvo Anti-Cheat" folder when the game is installed.
|
||||
// These files are automatically installed into an "Denuvo Anti-Cheat" folder when the game is installed.
|
||||
new(new FilePathMatch("denuvo-anti-cheat.sys"), "Denuvo Anti-Cheat"),
|
||||
new(new FilePathMatch("denuvo-anti-cheat-update-service.exe"), "Denuvo Anti-Cheat"),
|
||||
new(new FilePathMatch("denuvo-anti-cheat-runtime.dll"), "Denuvo Anti-Cheat"),
|
||||
|
||||
// This file is a renamed copy of "denuvo-anti-cheat-update-service.exe" which is only seen in the folder of the main game executable after it has been run, but before Denuvo Anti-Cheat is finished installing.
|
||||
new(new FilePathMatch("Denuvo Anti-Cheat Installer.exe"), "Denuvo Anti-Cheat"),
|
||||
|
||||
|
||||
// Found in the Denuvo Anti-Cheat installer on their support website. (https://web.archive.org/web/20240130142033/https://support.codefusion.technology/anti-cheat/?l=ja&s=ac&e=2009)
|
||||
new(new FilePathMatch("denuvo-anti-cheat-installer.zip"), "Denuvo Anti-Cheat"),
|
||||
|
||||
@@ -297,14 +297,14 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
// Found in Doom Eternal Update 1 (Steam Depot 782332, Manifest 7064393210727378308).
|
||||
|
||||
// These files are automatically installed into an "Denuvo Anti-Cheat" folder when the game is installed.
|
||||
// These files are automatically installed into an "Denuvo Anti-Cheat" folder when the game is installed.
|
||||
new(new FilePathMatch("denuvo-anti-cheat.sys"), "Denuvo Anti-Cheat"),
|
||||
new(new FilePathMatch("denuvo-anti-cheat-update-service.exe"), "Denuvo Anti-Cheat"),
|
||||
new(new FilePathMatch("denuvo-anti-cheat-runtime.dll"), "Denuvo Anti-Cheat"),
|
||||
|
||||
// This file is a renamed copy of "denuvo-anti-cheat-update-service.exe" which is only seen in the folder of the main game executable after it has been run, but before Denuvo Anti-Cheat is finished installing.
|
||||
new(new FilePathMatch("Denuvo Anti-Cheat Installer.exe"), "Denuvo Anti-Cheat"),
|
||||
|
||||
|
||||
// Found in the Denuvo Anti-Cheat installer on their support website. (https://web.archive.org/web/20240130142033/https://support.codefusion.technology/anti-cheat/?l=ja&s=ac&e=2009)
|
||||
new(new FilePathMatch("denuvo-anti-cheat-installer.zip"), "Denuvo Anti-Cheat"),
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// <summary>
|
||||
/// DigiGuard (AKA DigiGuard ESD) was an online activation based DRM by Greenleaf Technologies Corporation. It was seemingly used for several OEM game collections, such as for Dell and Sony.
|
||||
/// Discs with DigiGuard appear to contain the full games in an encrypted format, with the option of purchasing the game online or via telephone so they can be installed from the disc.
|
||||
///
|
||||
///
|
||||
/// Links:
|
||||
/// First archived GLFC website: https://web.archive.org/web/19991008072239/http://www.glfc.com:80/
|
||||
/// Later GLFC website: https://web.archive.org/web/20010331132439/http://www.glfc.com/index2.html
|
||||
@@ -20,7 +20,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// Press release regarding GLFC and Ritek: https://www.bloomberg.com/press-releases/2000-10-24/ritek-and-greenleaf-technologies-align-to-drive-encrypted-dvd
|
||||
/// Press release regarding GLFC and Dell: https://www.bloomberg.com/press-releases/2000-10-04/greenleaf-technologies-signs-agreement-with-dell-computers-to
|
||||
/// First list of archived GLFC press releases: https://web.archive.org/web/*/http://glfc.com/press_releases/*
|
||||
/// Second list of archived GLFC press releases (Search for "pr_"): https://web.archive.org/web/*/http://glfc.com/*
|
||||
/// Second list of archived GLFC press releases (Search for "pr_"): https://web.archive.org/web/*/http://glfc.com/*
|
||||
/// News article regarding GLFC and Accolade Games: https://www.gamespot.com/articles/accolade-games-on-dvd/1100-2460436/
|
||||
/// eBay listing for the "BIGWIG SOFTWARE LOCKER", which very likely contains DigiGuard: https://www.ebay.com/itm/325573968970
|
||||
/// </summary>
|
||||
|
||||
@@ -9,10 +9,10 @@ namespace BinaryObjectScanner.Protection
|
||||
/// <summary>
|
||||
/// EA Anti Cheat is a kernel-level anti-cheat developed and used by EA. (https://www.ea.com/security/news/eaac-deep-dive).
|
||||
/// List of games that contain EA Anti Cheat on Steam: https://steamdb.info/tech/AntiCheat/EA_AntiCheat/
|
||||
///
|
||||
///
|
||||
/// An EasyAntiCheat installer is present in the file "EAAntiCheat.Installer.Tool.exe" found in "Plants vs. Zombies: Battle for Neighborville" (Steam Depot 1262241, Manifest 8124759833120741594).
|
||||
/// This could indicate that EasyAntiCheat is directly integrated into EA Anti Cheat.
|
||||
///
|
||||
///
|
||||
/// The internal name appears to be "skyfall", as this is the Internal Name set to several EA Anti Cheat files, and the string "C:\dev\gitlab-runner\builds\r5uPUG7E\0\anticheat\skyfall\Build\Retail\EAAntiCheat.Installer.pdb" is present in "EAAntiCheat.Installer.Tool.exe".
|
||||
/// </summary>
|
||||
public class EAAntiCheat : IExecutableCheck<PortableExecutable>, IPathCheck
|
||||
|
||||
@@ -13,7 +13,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// The first archive of this URL that was used by Easy Anti-Cheat appears to be https://web.archive.org/web/20140324145706/https://www.easy.ac/.
|
||||
/// The first URL used for Easy Anti-Cheat appears to be http://easyanticheat.net/, with seemingly the oldest archive being this: https://web.archive.org/web/20071024001450/http://easyanticheat.net/en/.
|
||||
/// There's a version of Easy Anti-Cheat that's bundled into the Epic Online Services, which is known as the EOS version of Easy Anti-Cheat (https://www.pcgamingwiki.com/wiki/Easy_Anti-Cheat).
|
||||
/// Further information and resources:
|
||||
/// Further information and resources:
|
||||
/// List of games protected by Easy Anti-Cheat: https://www.pcgamingwiki.com/wiki/Easy_Anti-Cheat and https://www.easy.ac/en-us/partners/
|
||||
/// https://dev.epicgames.com/docs/services/en-US/GameServices/AntiCheat/index.html
|
||||
/// https://www.unknowncheats.me/wiki/Easy_Anti_Cheat
|
||||
|
||||
@@ -8,7 +8,7 @@ using SabreTools.Serialization.Wrappers;
|
||||
namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// Engine32 is the presumed name of a specific disc check DRM. This disc check merely checks for the presence of a specifically named file on the disc.
|
||||
/// Engine32 is the presumed name of a specific disc check DRM. This disc check merely checks for the presence of a specifically named file on the disc.
|
||||
/// The file "engine32.dll" is always present (hence the name), and is where the disc checking logic is present.
|
||||
/// <see href="https://github.com/TheRogueArchivist/DRML/blob/main/entries/engine32/engine32.md"/>
|
||||
/// </summary>
|
||||
|
||||
@@ -6,7 +6,7 @@ using SabreTools.IO.Matching;
|
||||
namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// Freelock is software intended to allow users to burn a copy protected PSX CD-R.
|
||||
/// Freelock is software intended to allow users to burn a copy protected PSX CD-R.
|
||||
/// It adds multiple garbage tracks to the end of the disc and creates intentional errors on the disc by attempting to burn a corrupted file.
|
||||
/// <see href="https://github.com/TheRogueArchivist/DRML/blob/main/entries/Freelock/Freelock.md"/>
|
||||
/// </summary>
|
||||
|
||||
@@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// Hexalock AutoLock was also able to be used with pressed CD-ROMs (Source: https://web.archive.org/web/20110828214830/http://hexalock.co.il/copyprotection/cdrom).
|
||||
/// One pressed example has been found so far, though it seems that it may not have been hooked into the protection properly, as the game is able to be run directly from files extracted from the installer (Redump entry 95764/IA item "Nova_Spacebound_USA").
|
||||
/// Though the protection seems unused in this sample, the final sectors of this disc are unable to be read by some software/drive combinations, which seems likely to be related to the protection.
|
||||
/// It also allowed you to protect multimedia documents, such as documents or pictures.
|
||||
/// It also allowed you to protect multimedia documents, such as documents or pictures.
|
||||
/// The official website is now dead, but there are a few archives made (https://web.archive.org/web/20110904233743/http://hexalock.co.il/).
|
||||
/// There don't appear to be any archives of the "CD-RX" media available, though it appears that some are still for sale on Amazon:
|
||||
/// https://www.amazon.cn/dp/B000F3RPCI + https://www.amazon.cn/dp/B000F3PJA8
|
||||
@@ -25,7 +25,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// HexaLock AutoLock 4.7 official download archive: https://web.archive.org/web/20140801060304/http://hexalock.co.il/downloads/files/Psetup.exe
|
||||
/// There appears to be another form of copy protection created by HexaLock called HexDVDR, but I have not been able to find a copy of it preserved (Source: https://web.archive.org/web/20140801060150/http://hexalock.co.il/news/2008-03-20/).
|
||||
/// There is an example EXE protected using HexDVDR provided that is still online (https://web.archive.org/web/20140802144000/http://hexalock.co.il/downloads/files/Protected%20Img.zip).
|
||||
/// Patents relating to this protection:
|
||||
/// Patents relating to this protection:
|
||||
/// https://patentimages.storage.googleapis.com/64/d6/b1/91127b030d3503/US20060259975A1.pdf
|
||||
/// https://patentimages.storage.googleapis.com/52/5b/3a/aee21ff4d987e9/US20060123483A1.pdf
|
||||
/// Special thanks to Ribshark for looking into this protection and sharing his research on the topic!
|
||||
|
||||
@@ -7,14 +7,14 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/*
|
||||
* Possible strings for finding INTENIUM Trial & Buy Protection
|
||||
*
|
||||
*
|
||||
* Luxor Only:
|
||||
* - command_buyNowCb - 63 6F 6D 6D 61 6E 64 5F 62 75 79 4E 6F 77 43 62
|
||||
* - command_testTrialCb - 63 6F 6D 6D 61 6E 64 5F 74 65 73 74 54 72 69 61 6C 43 62
|
||||
* - PHRASE_TRIAL - 50 48 52 41 53 45 5F 54 52 49 41 4C
|
||||
* - V_TRIAL_GAME - 56 5F 54 52 49 41 4C 5F 47 41 4D 45
|
||||
* - V_FULL_GAME - 56 5F 46 55 4C 4C 5F 47 41 4D 45
|
||||
*
|
||||
*
|
||||
* Luxor, World, Cradle, and Kingdom:
|
||||
* - Trial + (char)0x00 + P - 54 72 69 61 6C 00 50
|
||||
* + This is possibly followed by a version number. Undetermined if it's the software or protection version.
|
||||
|
||||
@@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Protection
|
||||
if (strs != null)
|
||||
{
|
||||
// Found in "nfsc_link.exe" in IA item "nfscorigin".
|
||||
// Full string:
|
||||
// Full string:
|
||||
// (: ) InterLok PC v2.0, PACE Anti-Piracy, Copyright (C) 1998, ALL RIGHTS RESERVED
|
||||
var match = strs.Find(s => s.Contains("InterLok") && s.Contains("PACE Anti-Piracy"));
|
||||
if (match != null)
|
||||
|
||||
@@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// The internal name of the Kalypso Launcher may be "Styx", as it is present as the File Description and Product Name in various versions of "KalypsoLauncher.dll".
|
||||
/// Kalypso FAQ, which includes information about Kalypso Launcher: https://www.kalypsomedia.com/us/frequently-asked-questions
|
||||
/// It was introduced in or before January 2011, based on this forum post introducing it: https://web.archive.org/web/20120524150700/http://forum.kalypsomedia.com/showthread.php?tid=7909
|
||||
///
|
||||
///
|
||||
/// Known versions:
|
||||
/// 1.2.0.12: Found in Redump entry 95617.
|
||||
/// 2.0.4.2: Newest version as of 3/10/2024, downloaded from updating the installed game from Redump entry 95617.
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// Key2Audio is an audio CD copy protection created by Sony. The initial version, simply called key2audio, appears to simply attempt to make the disc unplayable on a computer.
|
||||
/// Key2Audio is an audio CD copy protection created by Sony. The initial version, simply called key2audio, appears to simply attempt to make the disc unplayable on a computer.
|
||||
/// Further investigation is needed to determine if this first version is able to be detected, or if there's no identifying data present on these.
|
||||
/// The other major version, key2AudioXS, appears to be a standard audio CD protection that uses, at the very least, WMDS DRM, and quite possibly OpenMG as well.
|
||||
/// Key2AudioXS appears to have three sessions total, and some reports online indicate it may have a partially invalid TOC.
|
||||
|
||||
@@ -18,7 +18,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// https://www.cadlinecommunity.co.uk/hc/en-us/articles/201873101-C-dilla-Failing-to-Install-or-Stops-Working-
|
||||
/// https://archive.org/details/acadlt2002cd
|
||||
/// https://archive.org/details/telepower
|
||||
///
|
||||
///
|
||||
/// It seems that C-Dilla License Management System is a newer name for their CD-Secure product, based on this URL (https://web.archive.org/web/20050211004709/http://www.macrovision.com/products/cdsecure/downloads.shtml) leading to a download of LMS.
|
||||
/// Known versions:
|
||||
/// 1.31.34 (1.37.00?) (IA item "PCDDec1995").
|
||||
@@ -28,7 +28,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// 3.24.010 (IA item "ejay_nestle_trial").
|
||||
/// 3.27.000 (https://download.autodesk.com/mne/web/support/3dstudio/C-Dilla3.27.zip).
|
||||
/// 4.11.000 (Possibly an internal version used by SafeCast in Redump entry 95524).
|
||||
///
|
||||
///
|
||||
/// TODO:
|
||||
/// Investigate C-Dilla CD-Compress.
|
||||
/// </summary>
|
||||
|
||||
@@ -68,12 +68,12 @@ namespace BinaryObjectScanner.Protection
|
||||
// The file "DATA16.BML" is also present on this disc but the name is too generic to check for.
|
||||
new(new FilePathMatch("CACTUSPJ.exe"), "PlayJ Music Player (Cactus Data Shield 200)"),
|
||||
|
||||
// Found in "Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427]).
|
||||
// Found in "Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427]).
|
||||
// In "Volumina! - Puur" (7 43218 63282 2), this file is composed of multiple PLJ files combined together.
|
||||
// In later versions, this file is a padded dummy file. ("Ich Habe Einen Traum" by Uwe Busse (Barcode 9 002723 251203)).
|
||||
new(new FilePathMatch("YUCCA.CDS"), "Cactus Data Shield 200"),
|
||||
|
||||
// TODO: Find samples of the following:
|
||||
// TODO: Find samples of the following:
|
||||
new(new FilePathMatch("CDSPlayer.app"), GetCactusDataShieldVersion, "Cactus Data Shield"),
|
||||
new(new FilePathMatch("wmmp.exe"), GetCactusDataShieldVersion, "Cactus Data Shield"),
|
||||
|
||||
@@ -94,12 +94,12 @@ namespace BinaryObjectScanner.Protection
|
||||
// The file "DATA16.BML" is also present on this disc but the name is too generic to check for.
|
||||
new(new FilePathMatch("CACTUSPJ.exe"), "PlayJ Music Player (Cactus Data Shield 200)"),
|
||||
|
||||
// Found in "Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427]),
|
||||
// Found in "Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427]),
|
||||
// In "Volumia! - Puur", this file is composed of multiple PLJ files combined together.
|
||||
// In later versions, this file is a padded dummy file. ("Ich Habe Einen Traum" by Uwe Busse (Barcode 9 002723 251203)).
|
||||
new(new FilePathMatch("YUCCA.CDS"), "Cactus Data Shield 200"),
|
||||
|
||||
// TODO: Find samples of the following:
|
||||
// TODO: Find samples of the following:
|
||||
new(new FilePathMatch("CDSPlayer.app"), "Cactus Data Shield 200"),
|
||||
new(new FilePathMatch("wmmp.exe"), "Cactus Data Shield 200"),
|
||||
|
||||
|
||||
@@ -10,8 +10,8 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// RipGuard was a copy protection made by Macrovision/Rovi to protect movie DVDs. It's known to use bad sectors to impede dumping, one of the relatively rare DVD DRMs to do this.
|
||||
///
|
||||
/// Discs known to have it:
|
||||
///
|
||||
/// Discs known to have it:
|
||||
/// https://forum.redfox.bz/threads/resolved-installs-rootkit-black-lagoon-vol-2-3-region-1.29660/
|
||||
/// https://forum.redfox.bz/threads/resolved-one-on-one-with-tony-horton-vol2-disc3.33901/
|
||||
/// https://moral.net.au/writing/2015/10/10/backing_up_dvds/
|
||||
|
||||
@@ -12,7 +12,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// SafeCast is in the same family of protections as SafeDisc, and appears to mainly be for license management, and doesn't appear to affect the mastering of the disc in any way.
|
||||
/// Although SafeCast is most commonly used in non-game software, there is one game that comes with both SafeDisc and SafeCast protections (Redump entry 83145).
|
||||
/// SafeCast has been confirmed to be present on some programs, such as AutoDesk 3ds Max (IA items CMCD0204 and game-programming-in-c-start-to-finish-2006), Photoshop CS2 (IA item ccd0605), and Boonty Box (IA items PC_Gamer_Disc_7.55_July_2005 and cdrom-pcgamercd7.58).
|
||||
/// TODO: Check Boonty Box samples closer for new possible detections, there are at least more checks for FlexLM possible.
|
||||
/// TODO: Check Boonty Box samples closer for new possible detections, there are at least more checks for FlexLM possible.
|
||||
/// Macrovision bought the company C-Dilla and created SafeCast based on C-Dilla's existing products (https://web.archive.org/web/20030212040047/http://www.auditmypc.com/freescan/readingroom/cdilla.asp).
|
||||
/// There are multiple different versions of SafeCast out there.
|
||||
/// Deep dive of MechWarrior 4 and its expansions, which use SafeDisc, possibly SafeDisc LT, and SafeCast: https://digipres.club/@TheRogueArchivist/110224192068908590
|
||||
@@ -28,7 +28,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// https://archive.org/details/ejay_nestle_trial
|
||||
/// https://archive.org/details/eJayXtremeSoundtraxx
|
||||
/// https://community.ptc.com/t5/Mathcad/SafeCast/td-p/25233
|
||||
/// SafeCast resources:
|
||||
/// SafeCast resources:
|
||||
/// http://web.archive.org/web/20010417222834/http://www.macrovision.com/press_rel3_17_99.html (Press release introducing SafeCast)
|
||||
/// https://web.archive.org/web/20000129013431/http://www.macrovision.com/safecast_faq.html (SafeCast FAQ)
|
||||
/// https://web.archive.org/web/20040223025801/http://www.macrovision.com/products/legacy_products/safecast/safecast_cdilla_faq.shtml
|
||||
@@ -205,7 +205,7 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
// Found in Redump entry 102979.
|
||||
new(new FilePathMatch("SCRfrsh.exe"), "SafeCast"),
|
||||
|
||||
|
||||
// Found in Redump entries 26211 and 95524.
|
||||
new(new FilePathMatch("SCSHD.CSA"), "SafeCast"),
|
||||
|
||||
|
||||
@@ -31,16 +31,16 @@ namespace BinaryObjectScanner.Protection
|
||||
/// https://web.archive.org/web/20041008173722/http://www.macrovision.com/pdfs/safedisc_datasheet.pdf
|
||||
/// https://www.cdmediaworld.com/hardware/cdrom/cd_protections_safedisc.shtml
|
||||
/// https://computerizedaccount.tripod.com/computerizedaccountingtraining/id27.html
|
||||
///
|
||||
///
|
||||
/// SafeDisc Lite/LT is an alternate version of SafeDisc available that was based on SafeDisc 1 (https://web.archive.org/web/20030421023647/http://www.macrovision.com:80/solutions/software/cdrom/SafeDisc_WhitePaper_4-17-02-web.pdf).
|
||||
/// Although seemingly only officially referred to as "SafeDisc LT", a multitude of sources, including one that seemingly worked directly with Macrovision, call it "SafeDisc Lite" (http://www.eclipsedata.com/insidepages.asp?pageID=149).
|
||||
/// It doesn't typically require the disc after installation (unless game files are left on the disc in a minimal installation).
|
||||
/// However, according to the white paper, Mac products can still choose to authenticate on each run.
|
||||
/// However, according to the white paper, Mac products can still choose to authenticate on each run.
|
||||
/// According to the same white paper, it only uses some protection methods of normal SafeDisc without specifying which.
|
||||
/// CDs still contain errors, though typically less (in the ballpark of ~100), and the white paper admits that DVDs with Lite are less secure due to not having this signature.
|
||||
/// It's currently unknown if Lite actually uses an active disc check, or if it just relies on the errors to prevent copying of the disc.
|
||||
/// SafeDisc Lite games are able to be installed and played in situations where bad sectors are not emulated (such as 86box v.4.2.1), meaning it likely doesn't actually check the signature.
|
||||
///
|
||||
///
|
||||
/// Other protections in the Macrovision "Safe-" family of protections that need further investigation:
|
||||
/// SafeScan (https://cdn.loc.gov/copyright/1201/2003/reply/029.pdf).
|
||||
/// SafeDisc HD (https://web.archive.org/web/20000129100449/http://www.macrovision.com/scp_hd.html).
|
||||
@@ -94,7 +94,7 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
name = exe.ProductName;
|
||||
|
||||
// Present on all "CLOKSPL.DLL" versions before SafeDisc 1.06.000. Found on Redump entries 61731 and 66004.
|
||||
// Present on all "CLOKSPL.DLL" versions before SafeDisc 1.06.000. Found on Redump entries 61731 and 66004.
|
||||
if (name.OptionalEquals("SafeDisc CDROM Protection System", StringComparison.OrdinalIgnoreCase))
|
||||
return "SafeDisc 1.00.025-1.01.044";
|
||||
|
||||
@@ -114,7 +114,7 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
name = exe.FileDescription;
|
||||
|
||||
// Present on all "CLOKSPL.EXE" versions before SafeDisc 1.06.000. Found on Redump entries 61731 and 66004.
|
||||
// Present on all "CLOKSPL.EXE" versions before SafeDisc 1.06.000. Found on Redump entries 61731 and 66004.
|
||||
// Only found so far on SafeDisc 1.00.025-1.01.044, but the report is currently left generic due to the generic nature of the check.
|
||||
if (name.OptionalEquals("SafeDisc", StringComparison.OrdinalIgnoreCase))
|
||||
return "SafeDisc";
|
||||
@@ -261,7 +261,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// Unknown if it's a game specific file, but it contains the stxt371 and stxt774 sections.
|
||||
// new(new FilePathMatch("CoreDLL.dll"), "SafeDisc"),
|
||||
|
||||
// Found in seemingly every SafeDisc Lite disc. (CD: Redump entries 25579 and 57986. DVD: Redump entry 63941).
|
||||
// Found in seemingly every SafeDisc Lite disc. (CD: Redump entries 25579 and 57986. DVD: Redump entry 63941).
|
||||
new(new FilePathMatch("00000001.LT1"), "SafeDisc Lite"),
|
||||
new(new FilePathMatch("LTDLL.DLL"), "SafeDisc Lite"),
|
||||
|
||||
@@ -359,14 +359,14 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
// Found in Redump entry 58990.
|
||||
new(new FilePathMatch("SafediskSplash.bmp"), "SafeDisc"),
|
||||
|
||||
|
||||
// Used to distribute SafeDisc driver updates over the internet. Two distinct versions known to exist, with Microsoft also having distributed the later update as well.
|
||||
// Version 1: https://web.archive.org/web/20040614184055/http://www.macrovision.com:80/products/safedisc/safedisc.exe
|
||||
// Version 2: https://web.archive.org/web/20051104123646/http://www.macrovision.com/products/safedisc/safedisc.exe
|
||||
// Microsoft download page: https://web.archive.org/web/20080204081329/http://www.microsoft.com/downloads/details.aspx?FamilyID=eae20f0f-c41c-44fe-84ce-1df707d7a2e9&DisplayLang=en
|
||||
new(new FilePathMatch("safedisc.exe"), "SafeDisc Driver Installer"),
|
||||
|
||||
// Found in seemingly every SafeDisc Lite disc. (CD: Redump entries 25579 and 57986. DVD: Redump entry 63941).
|
||||
// Found in seemingly every SafeDisc Lite disc. (CD: Redump entries 25579 and 57986. DVD: Redump entry 63941).
|
||||
new(new FilePathMatch("00000001.LT1"), "SafeDisc Lite"),
|
||||
new(new FilePathMatch("LTDLL.DLL"), "SafeDisc Lite"),
|
||||
|
||||
@@ -478,7 +478,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// Found in Redump entries 61731 and 66005.
|
||||
"C13493AB753891B8BEE9E4E014896B026C01AC92" => "1.00.025-1.01.044",
|
||||
|
||||
// Found in Redump entries 1882 and 30049.
|
||||
// Found in Redump entries 1882 and 30049.
|
||||
// It is currently unknown why the previous hash covers both the version before this one, and most afterwards, with this one being a consistent outlier between these versions.
|
||||
"2418D791C7B9D4F05BCB01FAF98F770CDF798464" => "1.00.026",
|
||||
|
||||
@@ -709,7 +709,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// This included version doesn't seem to be as accurate as hash checks are, but will be documented here and considered for future use if needed.
|
||||
// "1.0.25 1998/07/30" -> SafeDisc 1.00.025 (Redump entry 66005).
|
||||
// "1.0.26 1998/08/06" -> SafeDisc 1.00.026-1.00.030 (Redump entries 1882, 31575, and 34828).
|
||||
// "1.0.32 1998/11/04" -> SafeDisc 1.00.032-1.00.035 (Redump entries 1883 and 36223).
|
||||
// "1.0.32 1998/11/04" -> SafeDisc 1.00.032-1.00.035 (Redump entries 1883 and 36223).
|
||||
// "1.1.34 1998/11/14" -> SafeDisc 1.01.034 (Redump entries 42155 and 47574).
|
||||
// "1.1.38 1999/01/21" -> SafeDisc 1.01.038 (Redump entry 51459).
|
||||
// "1.1.43 1999/02/25 -> SafeDisc 1.01.043 (Redump entries 34562 and 63304).
|
||||
@@ -805,7 +805,7 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
// File size of "dplayerx.dll" and others is a commonly used indicator of SafeDisc version, though it has been found to not be completely consistent.
|
||||
// Checks for versions 1.2X have been commented out, due to these versions already being detected via more accurate checks.
|
||||
// Examples of "dplayerx.dll" that are detected using these more accurate checks can be found in Redump entries 28810, 30121, and 37982.
|
||||
// Examples of "dplayerx.dll" that are detected using these more accurate checks can be found in Redump entries 28810, 30121, and 37982.
|
||||
|
||||
// Found in Redump entry 34828.
|
||||
81_408 => "1.00.026 (pre-10/1998)",
|
||||
@@ -816,7 +816,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// Found in Redump entries 36223 and 40771.
|
||||
77_824 => "1.00.035",
|
||||
|
||||
// Found in Redump entries 42155 and 47574.
|
||||
// Found in Redump entries 42155 and 47574.
|
||||
115_712 => "1.01.034",
|
||||
|
||||
// Found in Redump entry 42155.
|
||||
@@ -843,7 +843,7 @@ namespace BinaryObjectScanner.Protection
|
||||
163,382 bytes corresponds to SafeDisc 1.30.010 (Redump entries 31526 and 55080).
|
||||
165,888 bytes corresponds to SafeDisc 1.35.000 (Redump entries 9617 and 49552).
|
||||
172,544 bytes corresponds to SafeDisc 1.40.004 (Redump entries 2595 and 30121).
|
||||
173,568 bytes corresponds to SafeDisc 1.41.000-1.41.001 (Redump entries 37832, and 44350).
|
||||
173,568 bytes corresponds to SafeDisc 1.41.000-1.41.001 (Redump entries 37832, and 44350).
|
||||
136,704 bytes corresponds to SafeDisc 1.45.011 (Redump entries 30555 and 55078).
|
||||
138,752 bytes corresponds to SafeDisc 1.50.020 (Redump entries 28810 and 62935).
|
||||
*/
|
||||
@@ -906,7 +906,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// Found in Redump entries 37523 and 66586.
|
||||
"87C0DA1B52681FA8052A915E85699738993BEA72" => "1.11.000",
|
||||
|
||||
// Found in Redump entries 21154 and 37982.
|
||||
// Found in Redump entries 21154 and 37982.
|
||||
"3569FE747311265FDC83CBDF13361B4E06484725" => "1.20.000",
|
||||
|
||||
// Found in Redump entry 37920.
|
||||
@@ -948,7 +948,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// Found in Redump entries 15312 and 48863.
|
||||
"414CAC2BE3D9BE73796D51A15076A5A323ABBF2C" => "2.30.031",
|
||||
|
||||
// Found in Redump entries 9819 and 53658.
|
||||
// Found in Redump entries 9819 and 53658.
|
||||
"126DCA2317DA291CBDE13A91B3FE47BA4719446A" => "2.30.033",
|
||||
|
||||
// Found in Redump entries 9846 and 65642.
|
||||
@@ -988,7 +988,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// Found in Redump entries 36511 and 74338.
|
||||
"E5504C4C31561D38C1F626C851A8D06212EA13E0" => "3.15.010",
|
||||
|
||||
// Found in Redump entries 15383 and 35512.
|
||||
// Found in Redump entries 15383 and 35512.
|
||||
"AABA7B3EF08E80BC55282DA3C3B7AA598379D385" => "3.15.011",
|
||||
|
||||
// Found in Redump entries 58625, 75782, and 84586.
|
||||
@@ -1037,7 +1037,7 @@ namespace BinaryObjectScanner.Protection
|
||||
|
||||
internal static string? GetSafeDiscSplshVersion(string firstMatchedString, List<string>? files)
|
||||
{
|
||||
// Special thanks to TheMechasaur for combing through known SafeDisc games and cataloging the splash-screens used in them, making these detections possible.
|
||||
// Special thanks to TheMechasaur for combing through known SafeDisc games and cataloging the splash-screens used in them, making these detections possible.
|
||||
|
||||
if (string.IsNullOrEmpty(firstMatchedString) || !File.Exists(firstMatchedString))
|
||||
return string.Empty;
|
||||
@@ -1082,7 +1082,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// The next are the files named "000004XX", "000008XX", "00000cXX", and "00001XXX". When one of these is present, they seemingly always come in pairs of 2 with the extensions ".016" and ".256". They're typically present in SafeDisc versions 1.06.000-2.51.021.
|
||||
// Next come the files simply named "0000000X", which still come in pairs with the extensions ".016" and ".256", starting in SafeDisc version 2.60.052 up until version 4.85.000. After this point, there doesn't seem to be any consistent SafeDisc splash-screen used at all.
|
||||
// Starting SafeDisc version 4.00.000, the files with the ".016" extension seem to mostly disappear, with the ".256" files still being present.
|
||||
// Exceptions:
|
||||
// Exceptions:
|
||||
// The files "00000409.016" and "00000409.256" are present in Redump entry 39273, despite it being SafeDisc 2.80.011. This may be because this disc contains some form of SafeDisc Lite as well, which tends to more closely resemble SafeDisc 1.
|
||||
// Redump entry 51597 contains "00000000.016" and "00000000.256", breaking the trend of SafeDisc 4 not having any files with the ".016" extension. This may be due to this being a rerelease, so the splash-screen may have already been present in the original game files and carried over.
|
||||
|
||||
|
||||
@@ -15,12 +15,12 @@ namespace BinaryObjectScanner.Protection
|
||||
/// SafeWrap may have its origins in SafeDisc-related tech if that's the case, further confusing matters.
|
||||
/// This unforuantely has several possible unpleasant implications for current checks, such as if the X.YY.ZZZ version string is a generic property of SafeWrap and can be non-standard when used for different products.
|
||||
/// Currently, no known patents or trademarks for SafeWrap have been found.
|
||||
///
|
||||
///
|
||||
/// Further information and resources:
|
||||
/// Macrovision press release that mentions SafeWrap: https://www.sec.gov/Archives/edgar/data/1027443/000100547701501658/ex99-1.txt
|
||||
/// Macrionvision "Tamper-proof" blurb advertising SafeWrap: https://web.archive.org/web/20030412093353/http://www.macrovision.com/solutions/software/tamper.php3
|
||||
/// SafeAudio news that mentions SafeWrap: https://www.cdmediaworld.com/hardware/cdrom/news/0201/safeaudio_3.shtml
|
||||
/// The titles for a few audio DRM FAQ's include the text "SafeWrap™ Frequently Asked Questions" in the page title, but this may be a copy-paste error:
|
||||
/// The titles for a few audio DRM FAQ's include the text "SafeWrap™ Frequently Asked Questions" in the page title, but this may be a copy-paste error:
|
||||
/// https://web.archive.org/web/20030324080804/http://www.macrovision.com:80/solutions/audio/images/SafeAudio_FAQ_Public_5-02.pdf + https://web.archive.org/web/20030403050432/http://www.macrovision.com:80/solutions/audio/Audio_protection_FAQ_Public_March2003.pdf
|
||||
/// Eclipse SafeAudio news that mentions SafeWrap: http://www.eclipsedata.com/PDFs/21.pdf
|
||||
/// Report to congress that mentions SafeWrap: https://www.uspto.gov/sites/default/files/web/offices/dcom/olia/teachreport.pdf
|
||||
|
||||
@@ -13,7 +13,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// This is further supported by the fact that the "NeacSafe.sys" driver is signed by NetEase.
|
||||
/// Another program by NetEase, MuMu Player, seems to have also included a "NetEase AC" at one point(https://www.pcgamingwiki.com/wiki/MuMu_Player).
|
||||
/// There is also a separate DRM service provided by NetEase called Yidun (http://dun.163.com + http://dun.163.com/locale/en), though this seems to be unrelated.
|
||||
///
|
||||
///
|
||||
/// Additional resources:
|
||||
/// https://www.pcgamingwiki.com/wiki/Naraka:_Bladepoint
|
||||
/// https://github.com/SteamDatabase/FileDetectionRuleSets/pull/235
|
||||
|
||||
@@ -9,19 +9,19 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// nProtect (AKA INCA Internet) (https://nprotect.com/) is a Korean software company that produces several DRM products.
|
||||
///
|
||||
///
|
||||
/// nProtect GameGuard (https://nprotect.com/kr/b2b/prod_gg.html) is anti-cheat software used in a fair amount of online games.
|
||||
/// Partial list of games that use GameGuard: https://en.wikipedia.org/wiki/NProtect_GameGuard.
|
||||
/// Known versions of GameGuard:
|
||||
/// "2024.2.27.1" - Found in GameGuard.des in "Soulworker" (Steam Depot 1377581, Manifest 5092481117079359342).
|
||||
///
|
||||
///
|
||||
/// nProtect KeyCrypt is an anti-keylogging product that seemingly has other DRM functions as well, such as shutting down processes it deems unnecessary (https://en.wikipedia.org/wiki/INCA_Internet#nProtect_Netizen,_nProtect_Personal,_nProtect_Keycrypt)
|
||||
/// TODO: Verify the exact functions of KeyCrypt.
|
||||
///
|
||||
///
|
||||
/// Official sites for KeyCrypt (it is unknown what the difference between them are, as both are still online and active at the same time):
|
||||
/// https://nprotect.com/kr/b2b/prod_kcv.html
|
||||
/// https://nprotect.com/kr/b2b/prod_kcv65.html
|
||||
///
|
||||
///
|
||||
/// Official documents about KeyCrypt:
|
||||
/// https://nprotect.com/nprotect_pdf/nProtect_KeyCryptV.pdf
|
||||
/// https://nprotect.com/nprotect_pdf/nProtect_KeyCrypt.pdf
|
||||
|
||||
@@ -10,7 +10,7 @@ using SabreTools.Serialization.Wrappers;
|
||||
namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// OpenMG is a form of DRM created by Sony to control how music is copied and listened to on PC.
|
||||
/// OpenMG is a form of DRM created by Sony to control how music is copied and listened to on PC.
|
||||
/// It is known to be used with multiple CD audio protections, such as XCP, LabelGate, and quite possibly Key2AudioXS.
|
||||
/// References:
|
||||
/// https://en.wikipedia.org/wiki/OpenMG
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
// Currently implemented as a text file check, more checks are likely possible but currently unknown.
|
||||
// Current checks based off Redump entry 84082 are found in the InstallShield setup.inx file, but the game also checks if the original disc is present in the drive after installation as well, so it seems unlikely for the InstallShield check to be relevant at that stage.
|
||||
// A later version of it can be found in Redump entry 102493, which is found in the InstallShield setup.ins file, and also has a disc check when the game is run. On top of this, there is also a serial number check present. It is currently unknown how to uniquely detect either of them.
|
||||
// The disc checks may be completely generic and undetectable, as these checks seem to be more lax than the installer checks.
|
||||
// The disc checks may be completely generic and undetectable, as these checks seem to be more lax than the installer checks.
|
||||
// <see href="https://github.com/TheRogueArchivist/DRML/blob/main/entries/phenoProtect/phenoProtect.md"/>
|
||||
}
|
||||
}
|
||||
|
||||
@@ -17,8 +17,8 @@ namespace BinaryObjectScanner.Protection
|
||||
/// TODO: Investigate the possible integration between FlexLM and Rainbow Sentinel in IA item "prog-17_202403".
|
||||
/// TODO: Investigate the "NetSentinel Protection System" found in "NSRVOM.EXE" and "NSRVGX.EXE" in IA item "czchip199707cd".
|
||||
/// TODO: Investigate "sntnlusb.sys" (https://www.rainbow.com.my/document/endusertroubleshooting.pdf).
|
||||
///
|
||||
/// Versions:
|
||||
///
|
||||
/// Versions:
|
||||
/// Rainbow Sentinel PD-5.1: IA items "pcwkcd-1296, "CHIPTRMart97", and "bugcd199801".
|
||||
/// Rainbow Sentinel PD-5.1e (Beta): IA item "CHIPTRMart97".
|
||||
/// Rainbow Sentinel PD-5.37: File "CICA 32 For Windows CD-ROM (Walnut Creek) (October 1999) (Disc 4).iso" in IA item "CICA_32_For_Windows_CD-ROM_Walnut_Creek_October_1999".
|
||||
@@ -27,12 +27,12 @@ namespace BinaryObjectScanner.Protection
|
||||
/// Rainbow Sentinel PD-17: IA item "czchip199707cd".
|
||||
/// Rainbow Sentinel PD-30: BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]" and IA item "auto-cad-r14-cdrom".
|
||||
/// Rainbow Sentinel PD-31: BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]" and IA item "auto-cad-r14-cdrom".
|
||||
///
|
||||
///
|
||||
/// Rainbow Sentinel SuperPro 5.0: IA items "chip-cds-2001-08".
|
||||
/// Rainbow Sentinel SuperPro 5.1: IA items "ASMEsMechanicalEngineeringToolkit1997December" and "aplicaciones-windows".
|
||||
///
|
||||
///
|
||||
/// Rainbow SentinelPro 5.1: IA item "pcwkcd-1296".
|
||||
///
|
||||
///
|
||||
/// Rainbow NetSentinel: IA item "czchip199707cd".
|
||||
/// </summary>
|
||||
public class RainbowSentinel : IExecutableCheck<NewExecutable>, IExecutableCheck<PortableExecutable>, IPathCheck
|
||||
@@ -68,7 +68,7 @@ namespace BinaryObjectScanner.Protection
|
||||
0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x20, 0x00,
|
||||
0x50, 0x44, 0x2D, 0x35, 0x2E, 0x31, 0x37
|
||||
}, "Rainbow Sentinel PD-5.17"),
|
||||
|
||||
|
||||
// NetSentinel OS/2 security server
|
||||
// Found in "NSRVOM.EXE" in IA item "czchip199707cd".
|
||||
new(new byte?[]
|
||||
@@ -77,7 +77,7 @@ namespace BinaryObjectScanner.Protection
|
||||
0x6E, 0x65, 0x6C, 0x20, 0x4F, 0x53, 0x2F, 0x32,
|
||||
0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72
|
||||
}, "Rainbow NetSentinel Server for OS/2"),
|
||||
|
||||
|
||||
// NetSentinel Monitor
|
||||
// Found in "OS2MON.EXE" in IA item "czchip199707cd".
|
||||
new(new byte?[]
|
||||
@@ -387,7 +387,7 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
// The Parallel Port driver for Rainbow Sentinel (https://www.rainbow.com.my/document/endusertroubleshooting.pdf).
|
||||
// Unforutnately, the file name overlaps with a file used by Clam Sentinel (https://clamsentinel.sourceforge.net/).
|
||||
// TODO: Add LE check for "SENTINEL.VXD" once LE checks are implemented.
|
||||
// TODO: Add LE check for "SENTINEL.VXD" once LE checks are implemented.
|
||||
// new(new FilePathMatch("SENTINEL.VXD"), "Rainbow Sentinel"),
|
||||
|
||||
// Found in BA entry "Autodesk AutoCAD LT 98 (1998) (CD) [English] [Dutch]" and IA item "auto-cad-r14-cdrom".
|
||||
|
||||
@@ -8,7 +8,7 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// Roxxe was a Czech DRM. It appears to have been a simple disc check that also relied on unusual disc manufacturing and dummy files to attempt to prevent copying.
|
||||
///
|
||||
///
|
||||
/// DRML: https://github.com/TheRogueArchivist/DRML/blob/main/entries/Roxxe/Roxxe.md
|
||||
/// </summary>
|
||||
public class Roxxe : IExecutableCheck<PortableExecutable>, IPathCheck
|
||||
|
||||
@@ -10,7 +10,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// <summary>
|
||||
/// "SVK - Protector"/"Slovak Protector"/SVKP (https://web.archive.org/web/20020604155614/http://www.anticracking.sk/) was a packer created by Pavol Cerven that focused on protecting and obfuscating executables.
|
||||
/// It offered features such as encryption, debugger detection, and protection against memory dumps (https://web.archive.org/web/20020805143050fw_/http://www.anticracking.sk/svkp.html).
|
||||
///
|
||||
///
|
||||
/// Additional resources and documentation:
|
||||
/// SVKP 1.05 demo: https://web.archive.org/web/20020614222838/http://www.anticracking.sk/svkp_setup.rar
|
||||
/// SVKP 1.051 demo: https://web.archive.org/web/20020805001642/http://www.anticracking.sk/svkp_setup.rar
|
||||
|
||||
@@ -79,7 +79,7 @@ namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
return
|
||||
[
|
||||
// Matches most games, but a few like http://redump.org/disc/16541/
|
||||
// Matches most games, but a few like http://redump.org/disc/16541/
|
||||
// are only matched on the 00001/2.TMP files. PiD and other programs
|
||||
// don't detect this game either, though (Aside from the stub)
|
||||
new(new byte?[]
|
||||
|
||||
@@ -67,7 +67,7 @@ namespace BinaryObjectScanner.Protection
|
||||
// new FilePathMatch("steam.exe"),
|
||||
|
||||
new FilePathMatch("steam.ini"),
|
||||
|
||||
|
||||
// TODO: Identify file using MSI property parsing.
|
||||
new FilePathMatch("steam.msi"),
|
||||
}, "Steam"),
|
||||
|
||||
@@ -14,7 +14,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// Details on how these steps work: https://web.archive.org/web/20011107003900/http://jove.prohosting.com/~tzcopy/dev.html
|
||||
/// Worth noting is that all of these features aim exclusively to prevent the protected CD-R from being copied, there are no program/driver/etc. files added to the modified image whatsoever.
|
||||
/// Due to this, it's unlikely that these earlier versions are able to be detected whatsoever.
|
||||
///
|
||||
///
|
||||
/// After V1.1 Beta 9, the original author released the source code, retired from the project, and allowed others to continue the project (https://web.archive.org/web/20030619042134/http://www.tzcopyprotection.tk/).
|
||||
/// Several others began to contribute, with features such a new GUI, new protection steps, new image formats supported, etc. being added.
|
||||
/// Step 4 uses a "ghost" file that is added to the CUE and intended to be present during the start of burning a CD-R, but then modified during the burn so that there are intentional errors at the end of the disc.
|
||||
@@ -23,7 +23,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// There's also a program made by this team called "TZ EXE Protector".
|
||||
/// https://web.archive.org/web/20060225153855/http://www.denet.plus.com/tz/Tzep2beta5.zip
|
||||
/// https://web.archive.org/web/20030205062029/http://snow.prohosting.com/~clone99/tzweb/files.html
|
||||
///
|
||||
///
|
||||
/// Official websites:
|
||||
/// https://web.archive.org/web/20001109225600/http://members.nbci.com/tzcopy/
|
||||
/// https://web.archive.org/web/20030619042134/http://www.tzcopyprotection.tk/
|
||||
@@ -35,7 +35,7 @@ namespace BinaryObjectScanner.Protection
|
||||
/// https://web.archive.org/web/20020203072859/http://www.robert-knight.net/
|
||||
/// https://web.archive.org/web/20021215153849/http://snow.prohosting.com/~clone99/cgi-bin/ikonboard/ikonboard.cgi
|
||||
/// https://web.archive.org/web/20021215180832/http://wave.prohosting.com/~tzcp/cgi-bin/ikonboard/ikonboard.cgi
|
||||
///
|
||||
///
|
||||
/// Versions:
|
||||
/// V1.1 Beta II: https://cmw.mobiletarget.net/?f=tzcopyb2.zip
|
||||
/// V1.1 Beta 3: https://web.archive.org/web/20000820144023/http://members.xoom.com:80/tzcopy/upgb3.zip
|
||||
|
||||
@@ -7,15 +7,15 @@ namespace BinaryObjectScanner.Protection
|
||||
/// Protection created by Oreans and in use since at least before 2009. Known to be used in Book/Music Collector (http://www.alwinhoogerdijk.com/2009/12/24/protecting-software-with-themida/).
|
||||
/// May possibly be used in the PC release of Dynasty Warriors 7 with Xtreme Legends (https://www.pcgamingwiki.com/wiki/Dynasty_Warriors_7_with_Xtreme_Legends).
|
||||
/// Themida/WinLicense/"Code Virtualize" seem to all be interconnected/related to each other, or are all at least part of the SecureEngine suite together (https://www.oreans.com/products.php).
|
||||
///
|
||||
///
|
||||
/// Versions:
|
||||
/// 1.8x - 1.9x (Detect-It-Easy): ArcSoft TotalMedia 3 (http://downloads.fyxm.net/ArcSoft-TotalMedia-23085.html / https://web.archive.org/web/20221114042838/http://files.fyxm.net/23/23085/totalmediatheatre3platinum_retail_tbyb_all.exe).
|
||||
///
|
||||
///
|
||||
/// Further links and resources:
|
||||
/// https://github.com/VenTaz/Themidie
|
||||
/// https://github.com/ergrelet/unlicense
|
||||
/// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Themida.2.sg
|
||||
///
|
||||
///
|
||||
/// TODO:
|
||||
/// Add/Confirm detection for WinLicense/"Code Virtualize".
|
||||
/// Investigate further ArcSoft programs.
|
||||
|
||||
@@ -6,7 +6,7 @@ using SabreTools.IO.Matching;
|
||||
namespace BinaryObjectScanner.Protection
|
||||
{
|
||||
/// <summary>
|
||||
/// WinLock (by B16MCC) is a program that allows the user to create a CD-R with intentional errors.
|
||||
/// WinLock (by B16MCC) is a program that allows the user to create a CD-R with intentional errors.
|
||||
/// It does this by modifying an existing cuesheet to include 3 additional tracks that wiould be created from the file "WinLock.PSX".
|
||||
/// It then allows the user to automatically modify that file while the CD-R is being burnt, causing there to be errors at the end of the disc.
|
||||
/// Note that no additional files are written to the disc itself, the additional tracks created are invalid.
|
||||
|
||||
Reference in New Issue
Block a user