SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-21 00:05:06 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Reduce PE boilerplate

Browse Source
This commit is contained in:
Matt Nadareski
2024-12-02 00:58:52 -05:00
parent a6b494841f
commit ff2b27c6d0
98 changed files with 33 additions and 518 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
BinaryObjectScanner/Protection/ActiveMARK.cs
View File

@@ -35,11 +35,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the entry point data, if it exists
if (pex.EntryPointData != null)
{

7
BinaryObjectScanner/Protection/AegiSoft.cs
View File

@@ -22,11 +22,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// There are possibly identifying Product Names for some files used in AegiSoft License Manager, but they were deemed too overmatching to use for the time being (Found in Redump entry 73521/IA item "Nova_HoyleCasino99USA")..
// "Asc001.dll" has the Product Name "Install Dynamic Link Library".
// "Asc002.dll" has the Product Name "Transact Dynamic Link Library".
@@ -53,7 +48,7 @@ namespace BinaryObjectScanner.Protection
// ÿÿÿÿ\\.\ASCLM
new(new byte?[]
{
0xFF, 0xFF, 0xFF, 0xFF, 0x5C, 0x5C, 0x2E, 0x5C,
0xFF, 0xFF, 0xFF, 0xFF, 0x5C, 0x5C, 0x2E, 0x5C,
0x41, 0x53, 0x43, 0x4C, 0x4D
}, "AegiSoft License Manager"),
};

5
BinaryObjectScanner/Protection/AlphaROM.cs
View File

@@ -47,11 +47,6 @@ namespace BinaryObjectScanner.Protection
// TODO: Add support for detecting Alpha-ROM found in older games made with the RealLive engine.
// TODO: Add version detection for Alpha-ROM.
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)

11
BinaryObjectScanner/Protection/Armadillo.cs
View File

@@ -3,7 +3,7 @@ using BinaryObjectScanner.Interfaces;
using SabreTools.Serialization.Wrappers;
namespace BinaryObjectScanner.Protection
{
{
/// <summary>
/// Armadillo was a license manager, packer, and DRM by "The Silicon Realm Toolworks": https://web.archive.org/web/20030203101931/http://www.siliconrealms.com/armadillo.shtml
/// They were later bought by Digital River, and updated their website: https://web.archive.org/web/20031203021152/http://www.siliconrealms.com/armadillo.shtml
@@ -13,21 +13,16 @@ namespace BinaryObjectScanner.Protection
/// Digital River itself also advertised Armadillo at first: https://web.archive.org/web/20040116043029/http://www.digitalriver.com:80/corporate/solutions06.shtml
/// But then only advertised SoftwarePassport once it was released: https://web.archive.org/web/20040604065907/http://www.digitalriver.com/corporate/solutions06.shtml
/// </summary>
// TODO: Add extraction
// TODO: Add version checking, if possible
// https://raw.githubusercontent.com/wolfram77web/app-peid/master/userdb.txt
public class Armadillo : IExtractableExecutable<PortableExecutable>
{
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .nicode section, if it exists
if (pex.ContainsSection(".nicode", exact: true))
return "Armadillo";

5
BinaryObjectScanner/Protection/ByteShield.cs
View File

@@ -42,11 +42,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "LineRider2.exe" in Redump entry 6236
var name = pex.FileDescription;
if (name.OptionalEquals("ByteShield Client"))

5
BinaryObjectScanner/Protection/CDCheck.cs
View File

@@ -8,11 +8,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.Comments;
if (name.OptionalContains("CDCheck utlity for Microsoft Game Studios"))
return "Microsoft Game Studios CD Check";

5
BinaryObjectScanner/Protection/CDDVDCops.cs
View File

@@ -163,11 +163,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the stub executable data, if it exists
if (pex.StubExecutableData != null)
{

7
BinaryObjectScanner/Protection/CDGuard.cs
View File

@@ -25,11 +25,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate the numerous ".guard" sections present in "Randevu.exe" in Redump entry 97142.
// Get the export directory table
@@ -47,7 +42,7 @@ namespace BinaryObjectScanner.Protection
// Found in "Randevu.exe" in Redump entry 97142.
bool match = Array.Exists(pex.Model.ImportTable.ImportDirectoryTable, idte => idte?.Name != null && idte.Name.Equals("cdguard.dll", StringComparison.OrdinalIgnoreCase));
if (match)
return "CD-Guard Copy Protection System";
return "CD-Guard Copy Protection System";
}
return null;

5
BinaryObjectScanner/Protection/CDKey.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.InternalName;
if (name.OptionalEquals("CDKey", StringComparison.OrdinalIgnoreCase))
return "CD-Key / Serial";

5
BinaryObjectScanner/Protection/CDLock.cs
View File

@@ -30,11 +30,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section, if it exists
var dataSectionRaw = pex.GetFirstSectionData(".data") ?? pex.GetFirstSectionData("DATA");
if (dataSectionRaw != null)

5
BinaryObjectScanner/Protection/CDSHiELDSE.cs
View File

@@ -8,11 +8,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Indicates Hypertech Crack Proof as well?
//// Get the import directory table
//if (pex.Model.ImportTable?.ImportDirectoryTable != null)

5
BinaryObjectScanner/Protection/CenegaProtectDVD.cs
View File

@@ -17,11 +17,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the export directory table
if (pex.Model.ExportTable?.ExportDirectoryTable != null)
{

5
BinaryObjectScanner/Protection/Channelware.cs
View File

@@ -25,11 +25,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "AbeWincw.dll" in Redump entry 116358 and in "TOYSGMcw.dll" in the "TOYSTORY" installation folder from Redump entry 12354.
var name = pex.ProductName;
if (name.OptionalEquals("ChannelWare Utilities"))

5
BinaryObjectScanner/Protection/ChosenBytesCodeLock.cs
View File

@@ -24,11 +24,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "Code-Lock.ocx" in Code-Lock version 2.35.
// Also worth noting is the File Description for this file, which is "A future for you, a challenge for the rest.".
var name = pex.ProductName;

6
BinaryObjectScanner/Protection/CopyKiller.cs
View File

@@ -20,12 +20,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// TODO: Figure out how to differentiate between V3.99 and V3.99a.
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Figure out why this check doesn't work.
// Found in "autorun.exe" in CopyKiller V3.64, V3.99, and V3.99a.
var name = pex.ProductName;

5
BinaryObjectScanner/Protection/CopyLok.cs
View File

@@ -25,11 +25,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// If there are more than 2 icd-prefixed sections, then we have a match
// Though this is the same name that SafeDisc uses for protected executables, this seems to be a coincidence.
// Found in Redump entries 31557, 31674, 31675, 31708, 38239, 44210, and 53929.

5
BinaryObjectScanner/Protection/CrypKey.cs
View File

@@ -15,11 +15,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)

5
BinaryObjectScanner/Protection/Cucko.cs
View File

@@ -15,11 +15,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .text section, if it exists
var textData = pex.GetFirstSectionData(".text");
if (textData != null)

5
BinaryObjectScanner/Protection/Denuvo.cs
View File

@@ -34,11 +34,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// All current checks for Denuvo Anti-Cheat come from Doom Eternal Update 1 (Steam Depot 782332, Manifest 7064393210727378308).
// Found in "denuvo-anti-cheat.sys".

5
BinaryObjectScanner/Protection/DigiGuard.cs
View File

@@ -28,11 +28,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "Start.exe" in IA item "Nova_DellBigWIGDVD_USA"/Redump entry 108588.
var name = pex.FileDescription;
if (name.OptionalEquals("DigiGuard3 Client"))

5
BinaryObjectScanner/Protection/DiscGuard.cs
View File

@@ -40,11 +40,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "IOSLinksys.dll" (Redump entries 31914, 46743, 46961, 79284, and 79374).
var name = pex.FileDescription;
if (name.OptionalStartsWith("IOSLinkNT", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/EAAntiCheat.cs
View File

@@ -21,11 +21,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
// Found in "EAAntiCheat.GameServiceLauncher.exe" and "EAAntiCheat.Installer.exe" in "Plants vs. Zombies: Battle for Neighborville" (Steam Depot 1262241, Manifest 8124759833120741594).
if (!string.IsNullOrEmpty(name) && name!.Contains("EA Anticheat"))

5
BinaryObjectScanner/Protection/EasyAntiCheat.cs
View File

@@ -24,11 +24,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
// Found in "VideoHorrorSociety.exe" ("Video Horror Society", Patch 1.0.70309, Steam).
if (!string.IsNullOrEmpty(name) && name!.Contains("Easy Anti-Cheat Bootstrapper (EOS)"))

5
BinaryObjectScanner/Protection/ElectronicArts.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("EReg MFC Application"))
return $"EA CdKey Registration Module {pex.GetInternalVersion()}";

5
BinaryObjectScanner/Protection/Engine32.cs
View File

@@ -17,11 +17,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Most every tested sample of "engine32.dll" has a product name of "engine32", and the file description typically follows the naming pattern of "[Game Name] DLL-helper".
// Detects Engine32 within the game executables that contain it.

5
BinaryObjectScanner/Protection/GFWL.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalStartsWith("Games for Windows - LIVE Zero Day Piracy Protection", StringComparison.OrdinalIgnoreCase))
return $"Games for Windows LIVE - Zero Day Piracy Protection Module {pex.GetInternalVersion()}";

5
BinaryObjectScanner/Protection/Gefest.cs
View File

@@ -21,11 +21,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the header padding strings, if it exists
if (pex.HeaderPaddingStrings != null)
{

5
BinaryObjectScanner/Protection/HexaLock.cs
View File

@@ -34,11 +34,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Fix the following checks, as this information is visible via Windows Explorer but isn't currently being seen by BOS.
// Found in "HCPSMng.exe".
var name = pex.FileDescription;

5
BinaryObjectScanner/Protection/ImpulseReactor.cs
View File

@@ -15,11 +15,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("ImpulseReactor Dynamic Link Library"))
return $"Impulse Reactor Core Module {pex.GetInternalVersion()}";

5
BinaryObjectScanner/Protection/Intenium.cs
View File

@@ -24,11 +24,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
if (pex.FindGenericResource("NO NESTED PRMS SUPPORTED").Count > 0)
return "INTENIUM Trial & Buy Protection";

5
BinaryObjectScanner/Protection/JoWood.cs
View File

@@ -16,11 +16,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .ext section, if it exists
if (pex.ContainsSection(".ext ", exact: true))
{

5
BinaryObjectScanner/Protection/KalypsoLauncher.cs
View File

@@ -23,11 +23,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate if there are any viable checks for the game EXE itself.
// "Styx" is found as the File Description and Product Name in "KalypsoLauncher.dll", but checks aren't included due to the risk of false positives.

5
BinaryObjectScanner/Protection/LabelGate.cs
View File

@@ -21,11 +21,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Should be present on all LabelGate CD2 discs (Redump entry 95010 and product ID SVWC-7185).
var name = pex.FileDescription;
if (name.OptionalStartsWith("MAGIQLIP2 Installer", StringComparison.OrdinalIgnoreCase))

7
BinaryObjectScanner/Protection/LaserLok.cs
View File

@@ -49,11 +49,6 @@ namespace BinaryObjectScanner.Protection
// 0x33
// }, "LaserLok 5"),
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Packed by SPEEnc V2 Asterios Parlamentas.PE
byte?[] check =
[
@@ -188,7 +183,7 @@ namespace BinaryObjectScanner.Protection
return Encoding.ASCII.GetString(sectionContent, position + 76, 4);
}
public static string? GetVersion16Bit(string firstMatchedString, IEnumerable<string>? files)
private static string? GetVersion16Bit(string firstMatchedString, IEnumerable<string>? files)
{
if (!File.Exists(firstMatchedString))
return string.Empty;

5
BinaryObjectScanner/Protection/MGIRegistration.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.ProductName;
// Found in "Register.dll" in IA item "MGIPhotoSuite4.0AndPhotoVista2.02001".

5
BinaryObjectScanner/Protection/Macrovision.CDilla.cs
View File

@@ -62,11 +62,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? CDillaCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
// Found in in "cdilla52.dll" from C-Dilla LMS version 3.24.010.

5
BinaryObjectScanner/Protection/Macrovision.CactusDataShield.cs
View File

@@ -35,11 +35,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? CactusDataShieldCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)

5
BinaryObjectScanner/Protection/Macrovision.FLEXnet.cs
View File

@@ -14,11 +14,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? FLEXnetCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.ProductName;
// Found in "IsSvcInstDanceEJay7.dll" in IA item "computer200709dvd" (Dance eJay 7).

5
BinaryObjectScanner/Protection/Macrovision.RipGuard.cs
View File

@@ -21,11 +21,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? RipGuardCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "RGASDEV.SYS" in the Black Lagoon Season 1 DVD Steelbook box set (Geneon ID 12970).
var name = pex.FileDescription;
if (name.OptionalEquals("rgasdev", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/Macrovision.SafeCast.cs
View File

@@ -69,11 +69,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? SafeCastCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate import hint/name table entry "CdaSysInstall"
// TODO: Investigate string table entries: "CDWP02DG", "CDWP02DG", "CDWS02DG"
// TODO: Invesitgate if the "AdobeLM.dll" file (along with mentions of "AdobeLM" in executables) uniquely identifies SafeCast, or if it can be used with different DRM. (Found in IA item ccd0605)

5
BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs
View File

@@ -43,11 +43,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc cref="Interfaces.IExecutableCheck{T}.CheckExecutable(string, T, bool)"/>
internal static string? SafeDiscCheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in Redump entry 57986.
if (pex.Model.ImportTable?.HintNameTable != null)
{

5
BinaryObjectScanner/Protection/Macrovision.cs
View File

@@ -46,11 +46,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Check for specific indications for individual Macrovision protections.
var resultsList = new List<string>();

5
BinaryObjectScanner/Protection/MediaCloQ.cs
View File

@@ -18,11 +18,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in scvfy.exe on "Charley Pride - A Tribute to Jim Reeves" (barcode "7 816190222-2 4").
var name = pex.FileDescription;
if (name.OptionalStartsWith("scvfy MFC Application", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/MediaMax.cs
View File

@@ -18,11 +18,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Used to detect "LicGen.exe", found on "All That I Am" by Santana (Barcode 8 2876-59773-2 6)
var name = pex.FileDescription;
if (name.OptionalStartsWith("LicGen Module", StringComparison.OrdinalIgnoreCase))

4
BinaryObjectScanner/Protection/NEACProtect.cs
View File

@@ -25,10 +25,6 @@ namespace BinaryObjectScanner.Protection
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Most of the relevant executables are highly obfuscated, making executable detection mostly impractical.
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .neac0 and .neac1 sections, if they exist.
// Found in "NeacSafe64.sys" and "NeacSafe.sys".

5
BinaryObjectScanner/Protection/NProtect.cs
View File

@@ -33,11 +33,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate if there are any viable checks for the game EXE itself.
var name = pex.FileDescription;

5
BinaryObjectScanner/Protection/OnlineRegistration.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Is this too broad in general?
var name = pex.InternalName;
if (name.OptionalStartsWith("EReg", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/OpenMG.cs
View File

@@ -19,11 +19,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in many different OpenMG related files ("Touch" by Amerie).
var name = pex.LegalTrademarks;
if (name.OptionalStartsWith("OpenMG", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/Origin.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalEquals("Origin", StringComparison.OrdinalIgnoreCase))
return "Origin";

5
BinaryObjectScanner/Protection/PlayJ.cs
View File

@@ -16,11 +16,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "PlayJ.exe" (https://web.archive.org/web/20010417025347/http://dlp.playj.com:80/playj/PlayJIns266.exe) and "CACTUSPJ.exe" ("Volumia!" by Puur (Barcode 7 43218 63282 2) (Discogs Release Code [r795427])).
var name = pex.FileDescription;
if (name.OptionalStartsWith("PlayJ Music Player", StringComparison.OrdinalIgnoreCase))

6
BinaryObjectScanner/Protection/ProtectDisc.cs
View File

@@ -16,12 +16,8 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the 4th and 5th sections, if they exist (example names: ACE4/ACE5) (Found in Redump entries 94792, 94793)
var sections = pex.Model.SectionTable ?? [];
for (int i = 3; i < sections.Length; i++)
{
var nthSectionData = pex.GetSectionData(i);

5
BinaryObjectScanner/Protection/RainbowSentinel.cs
View File

@@ -129,11 +129,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Figure out why resources for "RNBOVTMP.DLL", "SENTTEMP.DLL", "SNTI386.DLL", and "SX32W.DL_"/"SX32W.DLL" aren't getting read properly, causing checks for these files to not work.
var name = pex.FileDescription;

5
BinaryObjectScanner/Protection/RealArcade.cs
View File

@@ -18,11 +18,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data");
if (strs != null)

5
BinaryObjectScanner/Protection/Roxxe.cs
View File

@@ -16,11 +16,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the code/CODE section strings, if they exist
var strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
if (strs != null)

5
BinaryObjectScanner/Protection/SVKP.cs
View File

@@ -26,11 +26,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Investigate the "Debugger or tool for monitoring detected!!!.Application cannot be run with debugger or monitoring tool(s) loaded!. Please unload it and restart the application" strings present in seemingly every version.
// Get the entry point data, if it exists.

6
BinaryObjectScanner/Protection/SecuROM.cs
View File

@@ -14,11 +14,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("SecuROM PA"))
return $"SecuROM Product Activation v{pex.GetInternalVersion()}";
@@ -62,6 +57,7 @@ namespace BinaryObjectScanner.Protection
}
// Get the sections 5+, if they exist (example names: .fmqyrx, .vcltz, .iywiak)
var sections = pex.Model.SectionTable ?? [];
for (int i = 4; i < sections.Length; i++)
{
var nthSection = sections[i];

6
BinaryObjectScanner/Protection/SmartE.cs
View File

@@ -11,12 +11,8 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the last section strings, if they exist
var sections = pex.Model.SectionTable ?? [];
var strs = pex.GetSectionStrings(sections.Length - 1);
if (strs != null)
{

5
BinaryObjectScanner/Protection/SoftLock.cs
View File

@@ -16,11 +16,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP"
var name = pex.InternalName;
if (name.OptionalEquals("Softlock Protected Application"))

6
BinaryObjectScanner/Protection/SolidShield.cs
View File

@@ -17,11 +17,6 @@ namespace BinaryObjectScanner.Protection
{
// TODO: Investigate ".pseudo" section found in "tvdm.dll" in Redump entry 68166.
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalStartsWith("DVM Library", StringComparison.OrdinalIgnoreCase))
return $"SolidShield {pex.GetInternalVersion()}";
@@ -76,6 +71,7 @@ namespace BinaryObjectScanner.Protection
return "SolidShield EXE Wrapper v1";
// Search the last two available sections
var sections = pex.Model.SectionTable ?? [];
for (int i = Math.Max(sections.Length - 2, 0); i < sections.Length; i++)
{
// Get the nth section strings, if they exist

7
BinaryObjectScanner/Protection/StarForce.cs
View File

@@ -19,11 +19,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// TODO: Find what fvinfo field actually maps to this
var name = pex.FileDescription;
@@ -65,7 +60,7 @@ namespace BinaryObjectScanner.Protection
if (name.OptionalEquals("CORE.ADMIN", StringComparison.Ordinal))
return $"StarForce {pex.GetInternalVersion()}";
// These checks currently disabled due being possibly too generic:
// Found in "protect.dll" in Redump entry 94805.
// if (name.OptionalEquals("CORE.DLL", StringComparison.Ordinal))

5
BinaryObjectScanner/Protection/Steam.cs
View File

@@ -11,11 +11,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("Steam Autorun Setup"))
return "Steam";

5
BinaryObjectScanner/Protection/Sysiphus.cs
View File

@@ -9,11 +9,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .data/DATA section strings, if they exist
var strs = pex.GetFirstSectionStrings(".data") ?? pex.GetFirstSectionStrings("DATA");
if (strs != null)

5
BinaryObjectScanner/Protection/Tages.cs
View File

@@ -14,11 +14,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Known TAGES Driver Setup filenames:
// - DrvSetup.exe
// - DrvSetup_x64.exe

5
BinaryObjectScanner/Protection/Themida.cs
View File

@@ -26,11 +26,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the "Arcsoft " section strings, if they exist
var strs = pex.GetFirstSectionStrings("Arcsoft ");
if (strs != null)

7
BinaryObjectScanner/Protection/ThreePLock.cs
View File

@@ -13,12 +13,7 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
//This produced false positives in some DirectX 9.0c installer files
// This produced false positives in some DirectX 9.0c installer files
//"Y" + (char)0xC3 + "U" + (char)0x8B + (char)0xEC + (char)0x83 + (char)0xEC + "0SVW"
// Get the .ldr and .ldt sections, if they exist

5
BinaryObjectScanner/Protection/ThreeTwoOneStudios.cs
View File

@@ -8,11 +8,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Check the dialog box resources
if (pex.FindDialogByTitle("321Studios Activation").Count > 0)
return $"321Studios Online Activation";

5
BinaryObjectScanner/Protection/Uplay.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("Ubisoft Connect Installer"))
return "Uplay / Ubisoft Connect";

5
BinaryObjectScanner/Protection/WMDS.cs
View File

@@ -18,11 +18,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Found on "All That I Am" by Santana (Barcode 8 2876-59773-2 6)
var name = pex.FileDescription;
if (name.OptionalStartsWith("Windows Media Data Session Licensing Engine", StringComparison.OrdinalIgnoreCase))

5
BinaryObjectScanner/Protection/WTMCDProtect.cs
View File

@@ -12,11 +12,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
var name = pex.FileDescription;
if (name.OptionalContains("Copy Protection Viewer"))
return "WTM Protection Viewer";

5
BinaryObjectScanner/Protection/XCP.cs
View File

@@ -13,11 +13,6 @@ namespace BinaryObjectScanner.Protection
/// <inheritdoc/>
public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
{
// Get the sections from the executable, if possible
var sections = pex.Model.SectionTable;
if (sections == null)
return null;
// Get the .rdata section strings, if they exist
List<string>? strs = pex.GetFirstSectionStrings(".rdata");
if (strs != null)