SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-08 18:06:34 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Reduce PE boilerplate

Browse Source
This commit is contained in:
Matt Nadareski
2024-12-02 00:58:52 -05:00
parent a6b494841f
commit ff2b27c6d0
98 changed files with 33 additions and 518 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
BinaryObjectScanner/GameEngine/RenderWare.cs
View File

@@ -20,18 +20,13 @@ namespace BinaryObjectScanner.GameEngine
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in Redump entries 20138, 55823, and 102493.
bool rwcsegSection = pex.ContainsSection("_rwcseg", exact: true);
// Found in Redump entry 20138.
bool rwdsegSection = pex.ContainsSection("_rwdseg", exact: true);
// TODO: Check if this indicates a specific version, or if these sections are present in multiple.
if (rwcsegSection || rwdsegSection)
if (rwcsegSection || rwdsegSection)
return "RenderWare";
return null;

5
BinaryObjectScanner/Packer/ASPack.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .aspack section, if it exists
if (pex.ContainsSection(".aspack", exact: true))
return "ASPack 2.29";

5
BinaryObjectScanner/Packer/AdvancedInstaller.cs
View File

@@ -10,11 +10,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .rdata section strings, if they exist
var strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)

5
BinaryObjectScanner/Packer/AutoPlayMediaStudio.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Known to detect versions 5.0.0.3 - 8.1.0.0
var name = pex.ProductName;
if (name.OptionalStartsWith("AutoPlay Media Studio", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Packer/CExe.cs
View File

@@ -17,11 +17,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// If there are exactly 2 resources with type 99
if (pex.FindResourceByNamedType("99, ").Count == 2)
return "CExe";

5
BinaryObjectScanner/Packer/DotFuscator.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .text section strings, if they exist
var strs = pex.GetFirstSectionStrings(".text");
if (strs != null)

34
BinaryObjectScanner/Packer/DotNetReactor.cs
View File

@@ -22,10 +22,6 @@ namespace BinaryObjectScanner.Packer
{
// TODO: Detect version
// TODO: Further refine checks using https://github.com/horsicq/Detect-It-Easy/blob/075a70b1484d1d84d1dc37c86aac16188d5a84e7/db/PE/NetReactor.2.sg and https://github.com/cod3nym/detection-rules/blob/main/yara/dotnet/obf_net_reactor.yar
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .text section, if it exists
var textData = pex.GetFirstSectionData(".text");
@@ -38,9 +34,9 @@ namespace BinaryObjectScanner.Packer
new(new byte?[]
{
0x3C, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
0x49, 0x6D, 0x70, 0x6C, 0x65, 0x6D, 0x65, 0x6E,
0x49, 0x6D, 0x70, 0x6C, 0x65, 0x6D, 0x65, 0x6E,
0x74, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x44, 0x65,
0x74, 0x61, 0x69, 0x6C, 0x73, 0x3E, 0x7B, null,
0x74, 0x61, 0x69, 0x6C, 0x73, 0x3E, 0x7B, null,
null, null, null, null, null, null, null, 0x2D,
null, null, null, null, 0x2D, null, null, null,
null, 0x2D, null, null, null, null, 0x2D, null,
@@ -54,7 +50,7 @@ namespace BinaryObjectScanner.Packer
new(new byte?[]
{
0x3C, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
0x49, 0x6D, 0x70, 0x6C, 0x65, 0x6D, 0x65, 0x6E,
0x49, 0x6D, 0x70, 0x6C, 0x65, 0x6D, 0x65, 0x6E,
0x74, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x44, 0x65,
0x74, 0x61, 0x69, 0x6C, 0x73, 0x3E, 0x00, 0x52,
0x53, 0x41
@@ -64,24 +60,24 @@ namespace BinaryObjectScanner.Packer
// 3{.[9].-.[9].-.[9].}
new(new byte?[]
{
0x33, 0x7B, 0x00, null, null, null, null, null,
null, null, null, null, 0x00, 0x2D, 0x00, null,
null, null, null, null, null, null, null, null,
0x00, 0x2D, 0x00, null, null, null, null, null,
null, null, null, null, 0x00, 0x2D, 0x00, null,
null, null, null, null, null, null, null, null,
0x00, 0x7D, 0x00
0x33, 0x7B, 0x00, null, null, null, null, null,
null, null, null, null, 0x00, 0x2D, 0x00, null,
null, null, null, null, null, null, null, null,
0x00, 0x2D, 0x00, null, null, null, null, null,
null, null, null, null, 0x00, 0x2D, 0x00, null,
null, null, null, null, null, null, null, null,
0x00, 0x7D, 0x00
}, ".NET Reactor (Unconfirmed - Please report to us on GitHub)"),
// Adapted from https://github.com/cod3nym/detection-rules/blob/main/yara/dotnet/obf_net_reactor.yar and confirmed to work with "KalypsoLauncher.dll" from Redump entry 95617.
// <Module>{[8]-[4]-[4]-[4]-[12]}
new(new byte?[]
{
0x3C, 0x4D, 0x6F, 0x64, 0x75, 0x6C, 0x65, 0x3E,
0x7B, null, null, null, null, null, null, null,
null, 0x2D, null, null, null, null, 0x2D, null,
null, null, null, 0x2D, null, null, null, null,
0x2D, null, null, null, null, null, null, null,
0x3C, 0x4D, 0x6F, 0x64, 0x75, 0x6C, 0x65, 0x3E,
0x7B, null, null, null, null, null, null, null,
null, 0x2D, null, null, null, null, 0x2D, null,
null, null, null, 0x2D, null, null, null, null,
0x2D, null, null, null, null, null, null, null,
null, null, null, null, null, 0x7D
}, ".NET Reactor (Unconfirmed - Please report to us on GitHub)")
};

5
BinaryObjectScanner/Packer/EXEStealth.cs
View File

@@ -39,11 +39,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// The ExeS/EXES/*mtw sections seem to map to the Import Table
// 2.6/2.51
// `ExeStealth - www.webtoolmaster.com`

5
BinaryObjectScanner/Packer/EmbeddedArchive.cs
View File

@@ -15,11 +15,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the resources that have a PKZIP signature
if (pex.ResourceData != null)
{

5
BinaryObjectScanner/Packer/EmbeddedExecutable.cs
View File

@@ -15,11 +15,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the resources that have an executable signature
if (pex.ResourceData != null)
{

5
BinaryObjectScanner/Packer/GenteeInstaller.cs
View File

@@ -10,11 +10,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)

5
BinaryObjectScanner/Packer/HyperTechCrackProof.cs
View File

@@ -14,11 +14,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// This check may be overly limiting, as it excludes the sample provided to DiE (https://github.com/horsicq/Detect-It-Easy/issues/102).
// TODO: Find further samples and invesitgate if the "peC" section is only present on specific versions.
bool importTableMatch = Array.Exists(pex.Model.ImportTable?.ImportDirectoryTable ?? [],

5
BinaryObjectScanner/Packer/InnoSetup.cs
View File

@@ -34,11 +34,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)

7
BinaryObjectScanner/Packer/InstallAnywhere.cs
View File

@@ -11,12 +11,7 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name= pex.FileDescription;
var name = pex.FileDescription;
if (name.OptionalStartsWith("InstallAnywhere Self Extractor", StringComparison.OrdinalIgnoreCase))
return $"InstallAnywhere {GetVersion(pex)}";

7
BinaryObjectScanner/Packer/InstallerVISE.cs
View File

@@ -11,11 +11,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)
@@ -23,7 +18,7 @@ namespace BinaryObjectScanner.Packer
if (strs.Exists(s => s.Contains("ViseMain")))
return "Installer VISE";
}
return null;
}

7
BinaryObjectScanner/Packer/IntelInstallationFramework.cs
View File

@@ -10,12 +10,7 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name= pex.FileDescription;
var name = pex.FileDescription;
if (name.OptionalEquals("Intel(R) Installation Framework", StringComparison.OrdinalIgnoreCase)
|| name.OptionalEquals("Intel Installation Framework", StringComparison.OrdinalIgnoreCase))
{

7
BinaryObjectScanner/Packer/MicrosoftCABSFX.cs
View File

@@ -11,12 +11,7 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name= pex.InternalName;
var name = pex.InternalName;
if (name.OptionalEquals("Wextract", StringComparison.OrdinalIgnoreCase))
return $"Microsoft CAB SFX {GetVersion(pex)}";

5
BinaryObjectScanner/Packer/NSIS.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.AssemblyDescription;
if (name.OptionalStartsWith("Nullsoft Install System"))
return $"NSIS {name!.Substring("Nullsoft Install System".Length).Trim()}";

5
BinaryObjectScanner/Packer/NeoLite.cs
View File

@@ -19,11 +19,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .neolit section, if it exists.
// TODO: Check if this section is also present in NeoLite 1.X.
if (pex.ContainsSection(".neolit", exact: true))

7
BinaryObjectScanner/Packer/PECompact.cs
View File

@@ -10,11 +10,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// 0x4F434550 is "PECO"
if (pex.Model.COFFFileHeader?.PointerToSymbolTable == 0x4F434550)
return "PE Compact v1.x";
@@ -32,7 +27,7 @@ namespace BinaryObjectScanner.Packer
{
if (textSection.PointerToLinenumbers != 0)
return $"PE Compact v{textSection.PointerToLinenumbers} (internal version)";
return "PE Compact v2.x (or newer)";
}

5
BinaryObjectScanner/Packer/Petite.cs
View File

@@ -10,11 +10,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .petite section, if it exists -- TODO: Is there a version number that can be found?
if (pex.ContainsSection(".petite", exact: true))
return "PEtite";

5
BinaryObjectScanner/Packer/SetupFactory.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Known to detect versions 7.0.5.1 - 9.1.0.0
var name = pex.LegalCopyright;
if (name.OptionalStartsWith("Setup Engine", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Packer/SevenZipSFX.cs
View File

@@ -8,11 +8,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the assembly description, if possible
if (pex.AssemblyDescription.OptionalStartsWith("7-Zip Self-extracting Archive"))
return $"7-Zip SFX {pex.AssemblyDescription!.Substring("7-Zip Self-extracting Archive ".Length)}";

5
BinaryObjectScanner/Packer/Shrinker.cs
View File

@@ -10,11 +10,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .shrink0 and .shrink2 sections, if they exist -- TODO: Confirm if both are needed or either/or is fine
if (pex.ContainsSection(".shrink0", true) || pex.ContainsSection(".shrink2", true))
return "Shrinker";

5
BinaryObjectScanner/Packer/UPX.cs
View File

@@ -17,11 +17,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Check header padding strings
if (pex.HeaderPaddingStrings != null && pex.HeaderPaddingStrings.Count > 0)
{

5
BinaryObjectScanner/Packer/WinRARSFX.cs
View File

@@ -8,11 +8,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.AssemblyDescription;
if (name.OptionalContains("WinRAR archiver"))
return "WinRAR SFX";

5
BinaryObjectScanner/Packer/WinZipSFX.cs
View File

@@ -39,11 +39,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Check the export directory table, if it exists
if (pex.Model.ExportTable?.ExportDirectoryTable != null)
{

5
BinaryObjectScanner/Packer/WiseInstaller.cs
View File

@@ -43,11 +43,6 @@ namespace BinaryObjectScanner.Packer
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// If we match a known header
if (GetPEFormat(pex) != null)
return "Wise Installation Wizard Module";

5
BinaryObjectScanner/Protection/ActiveMARK.cs
View File

@@ -35,11 +35,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the entry point data, if it exists
if (pex.EntryPointData != null)
{

7
BinaryObjectScanner/Protection/AegiSoft.cs
View File

@@ -22,11 +22,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// There are possibly identifying Product Names for some files used in AegiSoft License Manager, but they were deemed too overmatching to use for the time being (Found in Redump entry 73521/IA item "Nova_HoyleCasino99USA")..
// "Asc001.dll" has the Product Name "Install Dynamic Link Library".
// "Asc002.dll" has the Product Name "Transact Dynamic Link Library".
@@ -53,7 +48,7 @@ namespace BinaryObjectScanner.Protection
// ÿÿÿÿ\\.\ASCLM
new(new byte?[]
{
0xFF, 0xFF, 0xFF, 0xFF, 0x5C, 0x5C, 0x2E, 0x5C,
0xFF, 0xFF, 0xFF, 0xFF, 0x5C, 0x5C, 0x2E, 0x5C,
0x41, 0x53, 0x43, 0x4C, 0x4D
}, "AegiSoft License Manager"),
};

5
BinaryObjectScanner/Protection/AlphaROM.cs
View File

@@ -47,11 +47,6 @@ namespace BinaryObjectScanner.Protection
// TODO: Add support for detecting Alpha-ROM found in older games made with the RealLive engine.
// TODO: Add version detection for Alpha-ROM.
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)

11
BinaryObjectScanner/Protection/Armadillo.cs
View File

@@ -3,7 +3,7 @@ using BinaryObjectScanner.Interfaces;
using SabreTools.Serialization.Wrappers;
namespace BinaryObjectScanner.Protection
{
{
/// <summary>
/// Armadillo was a license manager, packer, and DRM by "The Silicon Realm Toolworks": https://web.archive.org/web/20030203101931/http://www.siliconrealms.com/armadillo.shtml
/// They were later bought by Digital River, and updated their website: https://web.archive.org/web/20031203021152/http://www.siliconrealms.com/armadillo.shtml
@@ -13,21 +13,16 @@ namespace BinaryObjectScanner.Protection
/// Digital River itself also advertised Armadillo at first: https://web.archive.org/web/20040116043029/http://www.digitalriver.com:80/corporate/solutions06.shtml
/// But then only advertised SoftwarePassport once it was released: https://web.archive.org/web/20040604065907/http://www.digitalriver.com/corporate/solutions06.shtml
/// </summary>
// TODO: Add extraction
// TODO: Add version checking, if possible
// https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt
public class Armadillo : IExtractableExecutable<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .nicode section, if it exists
if (pex.ContainsSection(".nicode", exact: true))
return "Armadillo";

5
BinaryObjectScanner/Protection/ByteShield.cs
View File

@@ -42,11 +42,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "LineRider2.exe" in Redump entry 6236
var name = pex.FileDescription;
if (name.OptionalEquals("ByteShield Client"))

5
BinaryObjectScanner/Protection/CDCheck.cs
View File

@@ -8,11 +8,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.Comments;
if (name.OptionalContains("CDCheck utlity for Microsoft Game Studios"))
return "Microsoft Game Studios CD Check";

5
BinaryObjectScanner/Protection/CDDVDCops.cs
View File

@@ -163,11 +163,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the stub executable data, if it exists
if (pex.StubExecutableData != null)
{

7
BinaryObjectScanner/Protection/CDGuard.cs
View File

@@ -25,11 +25,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate the numerous ".guard" sections present in "Randevu.exe" in Redump entry 97142.
// Get the export directory table
@@ -47,7 +42,7 @@ namespace BinaryObjectScanner.Protection
// Found in "Randevu.exe" in Redump entry 97142.
bool match = Array.Exists(pex.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name != null && idte.Name.Equals("cdguard.dll", StringComparison.OrdinalIgnoreCase));
if (match)
return "CD-Guard Copy Protection System";
return "CD-Guard Copy Protection System";
}
return null;

5
BinaryObjectScanner/Protection/CDKey.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.InternalName;
if (name.OptionalEquals("CDKey", StringComparison.OrdinalIgnoreCase))
return "CD-Key / Serial";

5
BinaryObjectScanner/Protection/CDLock.cs
View File

@@ -30,11 +30,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)

5
BinaryObjectScanner/Protection/CDSHiELDSE.cs
View File

@@ -8,11 +8,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Indicates Hypertech Crack Proof as well?
//// Get the import directory table
//if (pex.Model.ImportTable?.ImportDirectoryTable != null)

5
BinaryObjectScanner/Protection/CenegaProtectDVD.cs
View File

@@ -17,11 +17,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the export directory table
if (pex.Model.ExportTable?.ExportDirectoryTable != null)
{

5
BinaryObjectScanner/Protection/Channelware.cs
View File

@@ -25,11 +25,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "AbeWincw.dll" in Redump entry 116358 and in "TOYSGMcw.dll" in the "TOYSTORY" installation folder from Redump entry 12354.
var name = pex.ProductName;
if (name.OptionalEquals("ChannelWare Utilities"))

5
BinaryObjectScanner/Protection/ChosenBytesCodeLock.cs
View File

@@ -24,11 +24,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "Code-Lock.ocx" in Code-Lock version 2.35.
// Also worth noting is the File Description for this file, which is "A future for you, a challenge for the rest.".
var name = pex.ProductName;

6
BinaryObjectScanner/Protection/CopyKiller.cs
View File

@@ -20,12 +20,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// TODO: Figure out how to differentiate between V3.99 and V3.99a.
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Figure out why this check doesn't work.
// Found in "autorun.exe" in CopyKiller V3.64, V3.99, and V3.99a.
var name = pex.ProductName;

5
BinaryObjectScanner/Protection/CopyLok.cs
View File

@@ -25,11 +25,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// If there are more than 2 icd-prefixed sections, then we have a match
// Though this is the same name that SafeDisc uses for protected executables, this seems to be a coincidence.
// Found in Redump entries 31557, 31674, 31675, 31708, 38239, 44210, and 53929.

5
BinaryObjectScanner/Protection/CrypKey.cs
View File

@@ -15,11 +15,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)

5
BinaryObjectScanner/Protection/Cucko.cs
View File

@@ -15,11 +15,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .text section, if it exists
var textData = pex.GetFirstSectionData(".text");
if (textData != null)

5
BinaryObjectScanner/Protection/Denuvo.cs
View File

@@ -34,11 +34,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// All current checks for Denuvo Anti-Cheat come from Doom Eternal Update 1 (Steam Depot 782332, Manifest 7064393210727378308).
// Found in "denuvo-anti-cheat.sys".

5
BinaryObjectScanner/Protection/DigiGuard.cs
View File

@@ -28,11 +28,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "Start.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588.
var name = pex.FileDescription;
if (name.OptionalEquals("DigiGuard3 Client"))

5
BinaryObjectScanner/Protection/DiscGuard.cs
View File

@@ -40,11 +40,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374).
var name = pex.FileDescription;
if (name.OptionalStartsWith("IOSLinkNT", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/EAAntiCheat.cs
View File

@@ -21,11 +21,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
// Found in "EAAntiCheat.GameServiceLauncher.exe" and "EAAntiCheat.Installer.exe" in "Plants vs. Zombies: Battle for Neighborville" (Steam Depot 1262241, Manifest 8124759833120741594).
if (!string.IsNullOrEmpty(name) && name!.Contains("EA Anticheat"))

5
BinaryObjectScanner/Protection/EasyAntiCheat.cs
View File

@@ -24,11 +24,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
// Found in "VideoHorrorSociety.exe" ("Video Horror Society", Patch 1.0.70309, Steam).
if (!string.IsNullOrEmpty(name) && name!.Contains("Easy Anti-Cheat Bootstrapper (EOS)"))

5
BinaryObjectScanner/Protection/ElectronicArts.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("EReg MFC Application"))
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";

5
BinaryObjectScanner/Protection/Engine32.cs
View File

@@ -17,11 +17,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Most every tested sample of "engine32.dll" has a product name of "engine32", and the file description typically follows the naming pattern of "[Game Name] DLL-helper".
// Detects Engine32 within the game executables that contain it.

5
BinaryObjectScanner/Protection/GFWL.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalStartsWith("Games for Windows - LIVE Zero Day Piracy Protection", StringComparison.OrdinalIgnoreCase))
return $"Games for Windows LIVE - Zero Day Piracy Protection Module {pex.GetInternalVersion()}";

5
BinaryObjectScanner/Protection/Gefest.cs
View File

@@ -21,11 +21,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the header padding strings, if it exists
if (pex.HeaderPaddingStrings != null)
{

5
BinaryObjectScanner/Protection/HexaLock.cs
View File

@@ -34,11 +34,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Fix the following checks, as this information is visible via Windows Explorer but isn't currently being seen by BOS.
// Found in "HCPSMng.exe".
var name = pex.FileDescription;

5
BinaryObjectScanner/Protection/ImpulseReactor.cs
View File

@@ -15,11 +15,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("ImpulseReactor Dynamic Link Library"))
return $"Impulse Reactor Core Module {pex.GetInternalVersion()}";

5
BinaryObjectScanner/Protection/Intenium.cs
View File

@@ -24,11 +24,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
if (pex.FindGenericResource("NO NESTED PRMS SUPPORTED").Count > 0)
return "INTENIUM Trial & Buy Protection";

5
BinaryObjectScanner/Protection/JoWood.cs
View File

@@ -16,11 +16,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .ext section, if it exists
if (pex.ContainsSection(".ext ", exact: true))
{

5
BinaryObjectScanner/Protection/KalypsoLauncher.cs
View File

@@ -23,11 +23,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate if there are any viable checks for the game EXE itself.
// "Styx" is found as the File Description and Product Name in "KalypsoLauncher.dll", but checks aren't included due to the risk of false positives.

5
BinaryObjectScanner/Protection/LabelGate.cs
View File

@@ -21,11 +21,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Should be present on all LabelGate CD2 discs (Redump entry 95010 and product ID SVWC-7185).
var name = pex.FileDescription;
if (name.OptionalStartsWith("MAGIQLIP2 Installer", StringComparison.OrdinalIgnoreCase))

7
BinaryObjectScanner/Protection/LaserLok.cs
View File

@@ -49,11 +49,6 @@ namespace BinaryObjectScanner.Protection
// 0x33
// }, "LaserLok 5"),
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Packed by SPEEnc V2 Asterios Parlamentas.PE
byte?[] check =
[
@@ -188,7 +183,7 @@ namespace BinaryObjectScanner.Protection
return Encoding.ASCII.GetString(sectionContent, position + 76, 4);
}
public static string? GetVersion16Bit(string firstMatchedString, IEnumerable<string>? files)
private static string? GetVersion16Bit(string firstMatchedString, IEnumerable<string>? files)
{
if (!File.Exists(firstMatchedString))
return string.Empty;

5
BinaryObjectScanner/Protection/MGIRegistration.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.ProductName;
// Found in "Register.dll" in IA item "MGIPhotoSuite4.0AndPhotoVista2.02001".

5
BinaryObjectScanner/Protection/Macrovision.CDilla.cs
View File

@@ -62,11 +62,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? CDillaCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
// Found in in "cdilla52.dll" from C-Dilla LMS version 3.24.010.

5
BinaryObjectScanner/Protection/Macrovision.CactusDataShield.cs
View File

@@ -35,11 +35,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? CactusDataShieldCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)

5
BinaryObjectScanner/Protection/Macrovision.FLEXnet.cs
View File

@@ -14,11 +14,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? FLEXnetCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.ProductName;
// Found in "IsSvcInstDanceEJay7.dll" in IA item "computer200709dvd" (Dance eJay 7).

5
BinaryObjectScanner/Protection/Macrovision.RipGuard.cs
View File

@@ -21,11 +21,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? RipGuardCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "RGASDEV.SYS" in the Black Lagoon Season 1 DVD Steelbook box set (Geneon ID 12970).
var name = pex.FileDescription;
if (name.OptionalEquals("rgasdev", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/Macrovision.SafeCast.cs
View File

@@ -69,11 +69,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? SafeCastCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate import hint/name table entry "CdaSysInstall"
// TODO: Investigate string table entries: "CDWP02DG", "CDWP02DG", "CDWS02DG"
// TODO: Invesitgate if the "AdobeLM.dll" file (along with mentions of "AdobeLM" in executables) uniquely identifies SafeCast, or if it can be used with different DRM. (Found in IA item ccd0605)

5
BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs
View File

@@ -43,11 +43,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? SafeDiscCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in Redump entry 57986.
if (pex.Model.ImportTable?.HintNameTable != null)
{

5
BinaryObjectScanner/Protection/Macrovision.cs
View File

@@ -46,11 +46,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Check for specific indications for individual Macrovision protections.
var resultsList = new List<string>();

5
BinaryObjectScanner/Protection/MediaCloQ.cs
View File

@@ -18,11 +18,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in scvfy.exe on "Charley Pride - A Tribute to Jim Reeves" (barcode "7 816190222-2 4").
var name = pex.FileDescription;
if (name.OptionalStartsWith("scvfy MFC Application", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/MediaMax.cs
View File

@@ -18,11 +18,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Used to detect "LicGen.exe", found on "All That I Am" by Santana (Barcode 8 2876-59773-2 6)
var name = pex.FileDescription;
if (name.OptionalStartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase))

4
BinaryObjectScanner/Protection/NEACProtect.cs
View File

@@ -25,10 +25,6 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Most of the relevant executables are highly obfuscated, making executable detection mostly impractical.
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .neac0 and .neac1 sections, if they exist.
// Found in "NeacSafe64.sys" and "NeacSafe.sys".

5
BinaryObjectScanner/Protection/NProtect.cs
View File

@@ -33,11 +33,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate if there are any viable checks for the game EXE itself.
var name = pex.FileDescription;

5
BinaryObjectScanner/Protection/OnlineRegistration.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Is this too broad in general?
var name = pex.InternalName;
if (name.OptionalStartsWith("EReg", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/OpenMG.cs
View File

@@ -19,11 +19,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in many different OpenMG related files ("Touch" by Amerie).
var name = pex.LegalTrademarks;
if (name.OptionalStartsWith("OpenMG", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/Origin.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalEquals("Origin", StringComparison.OrdinalIgnoreCase))
return "Origin";

5
BinaryObjectScanner/Protection/PlayJ.cs
View File

@@ -16,11 +16,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "PlayJ.exe" (https://web.archive.org/web/20010417025347/http://dlp.playj.com:80/playj/PlayJIns266.exe) and "CACTUSPJ.exe" ("Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427])).
var name = pex.FileDescription;
if (name.OptionalStartsWith("PlayJ Music Player", StringComparison.OrdinalIgnoreCase))

6
BinaryObjectScanner/Protection/ProtectDisc.cs
View File

@@ -16,12 +16,8 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the 4th and 5th sections, if they exist (example names: ACE4/ACE5) (Found in Redump entries 94792, 94793)
var sections = pex.Model.SectionTable ?? [];
for (int i = 3; i < sections.Length; i++)
{
var nthSectionData = pex.GetSectionData(i);

5
BinaryObjectScanner/Protection/RainbowSentinel.cs
View File

@@ -129,11 +129,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Figure out why resources for "RNBOVTMP.DLL", "SENTTEMP.DLL", "SNTI386.DLL", and "SX32W.DL_"/"SX32W.DLL" aren't getting read properly, causing checks for these files to not work.
var name = pex.FileDescription;

5
BinaryObjectScanner/Protection/RealArcade.cs
View File

@@ -18,11 +18,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data");
if (strs != null)

5
BinaryObjectScanner/Protection/Roxxe.cs
View File

@@ -16,11 +16,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)

5
BinaryObjectScanner/Protection/SVKP.cs
View File

@@ -26,11 +26,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate the "Debugger or tool for monitoring detected!!!.Application cannot be run with debugger or monitoring tool(s) loaded!. Please unload it and restart the application" strings present in seemingly every version.
// Get the entry point data, if it exists.

6
BinaryObjectScanner/Protection/SecuROM.cs
View File

@@ -14,11 +14,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("SecuROM PA"))
return $"SecuROM Product Activation v{pex.GetInternalVersion()}";
@@ -62,6 +57,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the sections 5+, if they exist (example names: .fmqyrx, .vcltz, .iywiak)
var sections = pex.Model.SectionTable ?? [];
for (int i = 4; i < sections.Length; i++)
{
var nthSection = sections[i];

6
BinaryObjectScanner/Protection/SmartE.cs
View File

@@ -11,12 +11,8 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the last section strings, if they exist
var sections = pex.Model.SectionTable ?? [];
var strs = pex.GetSectionStrings(sections.Length - 1);
if (strs != null)
{

5
BinaryObjectScanner/Protection/SoftLock.cs
View File

@@ -16,11 +16,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
var name = pex.InternalName;
if (name.OptionalEquals("Softlock Protected Application"))

6
BinaryObjectScanner/Protection/SolidShield.cs
View File

@@ -17,11 +17,6 @@ namespace BinaryObjectScanner.Protection
{
// TODO: Investigate ".pseudo" section found in "tvdm.dll" in Redump entry 68166.
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalStartsWith("DVM Library", StringComparison.OrdinalIgnoreCase))
return $"SolidShield {pex.GetInternalVersion()}";
@@ -76,6 +71,7 @@ namespace BinaryObjectScanner.Protection
return "SolidShield EXE Wrapper v1";
// Search the last two available sections
var sections = pex.Model.SectionTable ?? [];
for (int i = Math.Max(sections.Length - 2, 0); i < sections.Length; i++)
{
// Get the nth section strings, if they exist

7
BinaryObjectScanner/Protection/StarForce.cs
View File

@@ -19,11 +19,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Find what fvinfo field actually maps to this
var name = pex.FileDescription;
@@ -65,7 +60,7 @@ namespace BinaryObjectScanner.Protection
if (name.OptionalEquals("CORE.ADMIN", StringComparison.Ordinal))
return $"StarForce {pex.GetInternalVersion()}";
// These checks currently disabled due being possibly too generic:
// Found in "protect.dll" in Redump entry 94805.
// if (name.OptionalEquals("CORE.DLL", StringComparison.Ordinal))

5
BinaryObjectScanner/Protection/Steam.cs
View File

@@ -11,11 +11,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("Steam Autorun Setup"))
return "Steam";

5
BinaryObjectScanner/Protection/Sysiphus.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)

5
BinaryObjectScanner/Protection/Tages.cs
View File

@@ -14,11 +14,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Known TAGES Driver Setup filenames:
// - DrvSetup.exe
// - DrvSetup_x64.exe

5
BinaryObjectScanner/Protection/Themida.cs
View File

@@ -26,11 +26,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the "Arcsoft " section strings, if they exist
var strs = pex.GetFirstSectionStrings("Arcsoft ");
if (strs != null)

7
BinaryObjectScanner/Protection/ThreePLock.cs
View File

@@ -13,12 +13,7 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
//This produced false positives in some DirectX 9.0c installer files
// This produced false positives in some DirectX 9.0c installer files
//"Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// Get the .ldr and .ldt sections, if they exist

5
BinaryObjectScanner/Protection/ThreeTwoOneStudios.cs
View File

@@ -8,11 +8,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Check the dialog box resources
if (pex.FindDialogByTitle("321Studios Activation").Count > 0)
return $"321Studios Online Activation";

5
BinaryObjectScanner/Protection/Uplay.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("Ubisoft Connect Installer"))
return "Uplay / Ubisoft Connect";

5
BinaryObjectScanner/Protection/WMDS.cs
View File

@@ -18,11 +18,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found on "All That I Am" by Santana (Barcode 8 2876-59773-2 6)
var name = pex.FileDescription;
if (name.OptionalStartsWith("Windows Media Data Session Licensing Engine", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/WTMCDProtect.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("Copy Protection Viewer"))
return "WTM Protection Viewer";

5
BinaryObjectScanner/Protection/XCP.cs
View File

@@ -13,11 +13,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .rdata section strings, if they exist
List<string>? strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)