Consolidate field string checks (fixes #141)

This commit is contained in:
Matt Nadareski
2022-08-21 20:34:59 -07:00
parent 297514ef17
commit e2492c9e5b
22 changed files with 62 additions and 62 deletions

View File

@@ -25,13 +25,13 @@ namespace BurnOutSharp.PackerType
// Known to detect versions 5.0.0.3 - 8.1.0.0
string name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("AutoPlay Media Studio", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("AutoPlay Media Studio", StringComparison.OrdinalIgnoreCase) == true)
return $"AutoPlay Media Studio {GetVersion(pex)}";
// Currently too vague, may be re-enabled in the future
/*
name = Utilities.GetLegalCopyright(pex);
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Runtime Engine", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Runtime Engine", StringComparison.OrdinalIgnoreCase) == true)
return $"AutoPlay Media Studio {GetVersion(pex)}";
*/

View File

@@ -23,11 +23,11 @@ namespace BurnOutSharp.PackerType
return null;
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("InstallAnywhere Self Extractor", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("InstallAnywhere Self Extractor", StringComparison.OrdinalIgnoreCase) == true)
return $"InstallAnywhere {GetVersion(pex)}";
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("InstallAnywhere", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("InstallAnywhere", StringComparison.OrdinalIgnoreCase) == true)
return $"InstallAnywhere {GetVersion(pex)}";
return null;

View File

@@ -25,11 +25,11 @@ namespace BurnOutSharp.PackerType
return null;
string name = pex.InternalName;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("Wextract", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("Wextract", StringComparison.OrdinalIgnoreCase) == true)
return $"Microsoft CAB SFX {GetVersion(pex)}";
name = pex.OriginalFileName;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("WEXTRACT.EXE", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("WEXTRACT.EXE", StringComparison.OrdinalIgnoreCase) == true)
return $"Microsoft CAB SFX {GetVersion(pex)}";
// Get the .data section, if it exists

View File

@@ -25,16 +25,16 @@ namespace BurnOutSharp.PackerType
// Known to detect versions 7.0.5.1 - 9.1.0.0
string name = pex.LegalCopyright;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Setup Engine", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Setup Engine", StringComparison.OrdinalIgnoreCase) == true)
return $"Setup Factory {GetVersion(pex)}";
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Setup Factory", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Setup Factory", StringComparison.OrdinalIgnoreCase) == true)
return $"Setup Factory {GetVersion(pex)}";
// Known to detect version 5.0.1 - 6.0.1.3
name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Setup Factory", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Setup Factory", StringComparison.OrdinalIgnoreCase) == true)
return $"Setup Factory {GetVersion(pex)}";
// Longer version of the check that can be used if false positves become an issue:

View File

@@ -15,7 +15,7 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.InternalName;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("CDKey", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("CDKey", StringComparison.OrdinalIgnoreCase) == true)
return "CD-Key / Serial";
return null;

View File

@@ -40,17 +40,17 @@ namespace BurnOutSharp.ProtectionType
// Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374).
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("IOSLinkNT", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("IOSLinkNT", StringComparison.OrdinalIgnoreCase) == true)
return $"DiscGuard";
// Found in "T29.dll" (Redump entry 31914).
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("DiscGuard (tm)", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("DiscGuard (tm)", StringComparison.OrdinalIgnoreCase) == true)
return $"DiscGuard";
// Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374).
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("TTR Technologies Ltd. DiscGuard (tm)", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("TTR Technologies Ltd. DiscGuard (tm)", StringComparison.OrdinalIgnoreCase) == true)
return $"DiscGuard";
// Get the .vbn section, if it exists

View File

@@ -18,15 +18,15 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.Contains("EReg MFC Application"))
if (name?.Contains("EReg MFC Application") == true)
return $"EA CdKey Registration Module {Utilities.GetInternalVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.Contains("Registration code installer program"))
else if (name?.Contains("Registration code installer program") == true)
return $"EA CdKey Registration Module {Utilities.GetInternalVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.Equals("EA DRM Helper", StringComparison.OrdinalIgnoreCase))
else if (name?.Equals("EA DRM Helper", StringComparison.OrdinalIgnoreCase) == true)
return $"EA DRM Protection {Utilities.GetInternalVersion(pex)}";
name = pex.InternalName;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("CDCode", StringComparison.Ordinal))
if (name?.Equals("CDCode", StringComparison.Ordinal) == true)
return $"EA CdKey Registration Module {Utilities.GetInternalVersion(pex)}";
var resource = pex.FindResource(dataContains: "A\0b\0o\0u\0t\0 \0C\0D\0K\0e\0y");

View File

@@ -19,9 +19,9 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Games for Windows - LIVE Zero Day Piracy Protection", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Games for Windows - LIVE Zero Day Piracy Protection", StringComparison.OrdinalIgnoreCase) == true)
return $"Games for Windows LIVE - Zero Day Piracy Protection Module {Utilities.GetInternalVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Games for Windows", StringComparison.OrdinalIgnoreCase))
else if (name?.StartsWith("Games for Windows", StringComparison.OrdinalIgnoreCase) == true)
return $"Games for Windows LIVE {Utilities.GetInternalVersion(pex)}";
// Get the .rdata section, if it exists

View File

@@ -42,16 +42,16 @@ namespace BurnOutSharp.ProtectionType
// TODO: Fix the following checks, as this information is visible via Windows Explorer but isn't currently being seen by BOS.
// Found in "HCPSMng.exe".
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("HCPS Manager", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("HCPS Manager", StringComparison.OrdinalIgnoreCase) == true)
return $"Hexalock AutoLock 4.5";
// Found in the file typically named "Start_Here.exe".
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("HCPS Loader", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("HCPS Loader", StringComparison.OrdinalIgnoreCase) == true)
return $"Hexalock AutoLock 4.5";
// Found in both "HCPSMng.exe" and in the file typically named "Start_Here.exe".
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("HCPS", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("HCPS", StringComparison.OrdinalIgnoreCase) == true)
return $"Hexalock AutoLock 4.5";
return null;

View File

@@ -20,15 +20,15 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.Contains("ImpulseReactor Dynamic Link Library"))
if (name?.Contains("ImpulseReactor Dynamic Link Library") == true)
return $"Impulse Reactor Core Module {Utilities.GetInternalVersion(pex)}";
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.Contains("ImpulseReactor Dynamic Link Library"))
if (name?.Contains("ImpulseReactor Dynamic Link Library") == true)
return $"Impulse Reactor Core Module {Utilities.GetInternalVersion(pex)}";
name = pex.OriginalFileName;
if (!string.IsNullOrWhiteSpace(name) && name.Contains("ReactorActivate.exe"))
if (name?.Contains("ReactorActivate.exe") == true)
return $"Stardock Product Activation {Utilities.GetInternalVersion(pex)}";
// Get the .rdata section, if it exists

View File

@@ -27,11 +27,11 @@ namespace BurnOutSharp.ProtectionType
// Should be present on all LabelGate CD2 discs (Redump entry 95010 and product ID SVWC-7185).
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("MAGIQLIP2 Installer", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("MAGIQLIP2 Installer", StringComparison.OrdinalIgnoreCase) == true)
return $"LabelGate CD2 Media Player";
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("MQSTART", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("MQSTART", StringComparison.OrdinalIgnoreCase) == true)
return $"LabelGate CD2 Media Player";
// Get the .data section, if it exists

View File

@@ -32,12 +32,12 @@ namespace BurnOutSharp.ProtectionType
// Found in scvfy.exe on "Charley Pride - A Tribute to Jim Reeves" (barcode "7 816190222-2 4").
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("scvfy MFC Application", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("scvfy MFC Application", StringComparison.OrdinalIgnoreCase) == true)
return $"MediaCloQ";
// Found in scvfy.exe on "Charley Pride - A Tribute to Jim Reeves" (barcode "7 816190222-2 4").
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("scvfy Application", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("scvfy Application", StringComparison.OrdinalIgnoreCase) == true)
return $"MediaCloQ";
return null;

View File

@@ -25,11 +25,11 @@ namespace BurnOutSharp.ProtectionType
// Used to detect "LicGen.exe", found on "All That I Am" by Santana (Barcode 8 2876-59773-2 6)
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase) == true)
return $"MediaMax CD-3";
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase) == true)
return $"MediaMax CD-3";
var resource = pex.FindResource(dataContains: "Cd3Ctl");

View File

@@ -17,7 +17,7 @@ namespace BurnOutSharp.ProtectionType
// TODO: Is this too broad in general?
string name = pex.InternalName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("EReg", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("EReg", StringComparison.OrdinalIgnoreCase) == true)
return $"Executable-Based Online Registration {Utilities.GetInternalVersion(pex)}";
return null;

View File

@@ -25,38 +25,38 @@ namespace BurnOutSharp.ProtectionType
// Found in many different OpenMG related files ("Touch" by Amerie).
string name = pex.LegalTrademarks;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("OpenMG", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("OpenMG", StringComparison.OrdinalIgnoreCase) == true)
return $"OpenMG";
// Found in "OMGDBP.OCX" ("Touch" by Amerie).
name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("LGDiscComp Module", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("LGDiscComp Module", StringComparison.OrdinalIgnoreCase) == true)
return $"OpenMG";
// Found in "OMGDWRAP.DLL" ("Touch" by Amerie).
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("LGDSimplePlayer Module", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("LGDSimplePlayer Module", StringComparison.OrdinalIgnoreCase) == true)
return $"OpenMG";
// Found in "OMGLGD.DLL" ("Touch" by Amerie).
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("omglgd Module", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("omglgd Module", StringComparison.OrdinalIgnoreCase) == true)
return $"OpenMG";
// Found in "OMGUTILS.DLL" ("Touch" by Amerie).
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("OpenMG Utility", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("OpenMG Utility", StringComparison.OrdinalIgnoreCase) == true)
return $"OpenMG";
// Found in "SALWRAP.DLL" ("Touch" by Amerie).
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Secure Application Loader Wrapper", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Secure Application Loader Wrapper", StringComparison.OrdinalIgnoreCase) == true)
return $"OpenMG";
// Found in "SDKHM.DLL" ("Touch" by Amerie).
// Not every copy of this file has this File Description (Redump entry 95010).
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("SDKHM (KEEP)", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("SDKHM (KEEP)", StringComparison.OrdinalIgnoreCase) == true)
return $"OpenMG";
// Found in "SDKHM.EXE" ("Touch" by Amerie).
// Not every copy of this file has this File Description (Redump entry 95010).
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("SDKHM (KEPT)", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("SDKHM (KEPT)", StringComparison.OrdinalIgnoreCase) == true)
return $"OpenMG";
return null;

View File

@@ -18,11 +18,11 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("Origin", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("Origin", StringComparison.OrdinalIgnoreCase) == true)
return "Origin";
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("Origin", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("Origin", StringComparison.OrdinalIgnoreCase) == true)
return "Origin";
return null;

View File

@@ -40,16 +40,16 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("SafeCast2", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("SafeCast2", StringComparison.OrdinalIgnoreCase) == true)
return $"SafeCast";
// Present in "secdrv.sys" files found in SafeDisc 2.80.010+.
if (!string.IsNullOrWhiteSpace(name) && name.Equals("Macrovision SECURITY Driver", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("Macrovision SECURITY Driver", StringComparison.OrdinalIgnoreCase) == true)
return $"SafeDisc Security Driver {GetSecDrvExecutableVersion(pex)}";
// Present on all "CLOKSPL.DLL" versions before SafeDisc 1.06.000. Found on Redump entries 61731 and 66004.
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("SafeDisc CDROM Protection System", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("SafeDisc CDROM Protection System", StringComparison.OrdinalIgnoreCase) == true)
return $"SafeDisc 1.00.025-1.01.044";
// Get the .text section, if it exists
@@ -81,7 +81,7 @@ namespace BurnOutSharp.ProtectionType
// Present on all "CLOKSPL.EXE" versions before SafeDisc 1.06.000. Found on Redump entries 61731 and 66004.
// Only found so far on SafeDisc 1.00.025-1.01.044, but the report is currently left generic due to the generic nature of the check.
name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("SafeDisc", StringComparison.OrdinalIgnoreCase))
if (name?.Equals("SafeDisc", StringComparison.OrdinalIgnoreCase) == true)
return $"SafeDisc";
// TODO: Add entry point check

View File

@@ -21,7 +21,7 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.Contains("SecuROM PA"))
if (name?.Contains("SecuROM PA") == true)
return $"SecuROM PA v{Utilities.GetInternalVersion(pex)}";
// Get the matrosch section, if it exists

View File

@@ -22,19 +22,19 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("DVM Library", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("DVM Library", StringComparison.OrdinalIgnoreCase) == true)
return $"SolidShield {Utilities.GetInternalVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Solidshield Activation Library", StringComparison.OrdinalIgnoreCase))
else if (name?.StartsWith("Solidshield Activation Library", StringComparison.OrdinalIgnoreCase) == true)
return $"SolidShield Core.dll {Utilities.GetInternalVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Activation Manager", StringComparison.OrdinalIgnoreCase))
else if (name?.StartsWith("Activation Manager", StringComparison.OrdinalIgnoreCase) == true)
return $"SolidShield Activation Manager Module {GetInternalVersion(pex)}";
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Solidshield Activation Library", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Solidshield Activation Library", StringComparison.OrdinalIgnoreCase) == true)
return $"SolidShield Core.dll {Utilities.GetInternalVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Solidshield Library", StringComparison.OrdinalIgnoreCase))
else if (name?.StartsWith("Solidshield Library", StringComparison.OrdinalIgnoreCase) == true)
return $"SolidShield Core.dll {Utilities.GetInternalVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Activation Manager", StringComparison.OrdinalIgnoreCase))
else if (name?.StartsWith("Activation Manager", StringComparison.OrdinalIgnoreCase) == true)
return $"SolidShield Activation Manager Module {GetInternalVersion(pex)}";
// Get the .init section, if it exists

View File

@@ -19,18 +19,18 @@ namespace BurnOutSharp.ProtectionType
return null;
string name = pex.LegalCopyright;
if (!string.IsNullOrWhiteSpace(name) && name.Contains("Protection Technology")) // Protection Technology (StarForce)?
if (name?.Contains("Protection Technology") == true) // Protection Technology (StarForce)?
return $"StarForce {Utilities.GetInternalVersion(pex)}";
name = pex.InternalName;
if (!string.IsNullOrWhiteSpace(name) && name.Equals("CORE.EXE", StringComparison.Ordinal))
if (name?.Equals("CORE.EXE", StringComparison.Ordinal) == true)
return $"StarForce {Utilities.GetInternalVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.Equals("protect.exe", StringComparison.Ordinal))
else if (name?.Equals("protect.exe", StringComparison.Ordinal) == true)
return $"StarForce {Utilities.GetInternalVersion(pex)}";
// TODO: Find what fvinfo field actually maps to this
name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.Contains("Protected Module"))
if (name?.Contains("Protected Module") == true)
return $"StarForce 5";
// TODO: Check to see if there are any missing checks

View File

@@ -30,15 +30,15 @@ namespace BurnOutSharp.ProtectionType
// - TagesClient.dat (Does not always exist)
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("TagesSetup", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("TagesSetup", StringComparison.OrdinalIgnoreCase) == true)
return $"TAGES Driver Setup {GetVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Tagès activation client", StringComparison.OrdinalIgnoreCase))
else if (name?.StartsWith("Tagès activation client", StringComparison.OrdinalIgnoreCase) == true)
return $"TAGES Activation Client {GetVersion(pex)}";
name = pex.ProductName;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Application TagesSetup", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Application TagesSetup", StringComparison.OrdinalIgnoreCase) == true)
return $"TAGES Driver Setup {GetVersion(pex)}";
else if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("T@GES", StringComparison.OrdinalIgnoreCase))
else if (name?.StartsWith("T@GES", StringComparison.OrdinalIgnoreCase) == true)
return $"TAGES Activation Client {GetVersion(pex)}";
// TODO: Add entry point check

View File

@@ -24,7 +24,7 @@ namespace BurnOutSharp.ProtectionType
// Found on "All That I Am" by Santana (Barcode 8 2876-59773-2 6)
string name = pex.FileDescription;
if (!string.IsNullOrWhiteSpace(name) && name.StartsWith("Windows Media Data Session Licensing Engine", StringComparison.OrdinalIgnoreCase))
if (name?.StartsWith("Windows Media Data Session Licensing Engine", StringComparison.OrdinalIgnoreCase) == true)
return $"Windows Media Data Session DRM";
// Get the .rdata section, if it exists