Commit Graph

47 Commits

Author SHA1 Message Date
Matt Nadareski
d8aec5aa97 Migrate recent HLLib work to BOS
It's better suited for the model of BOS and not an update to HLLibSharp
2022-12-24 12:57:10 -08:00
Matt Nadareski
3a862f343c Add headers and extensions for Valve 2022-12-23 23:27:14 -08:00
Matt Nadareski
63948767ef Use more granular file opening 2022-12-22 22:03:32 -08:00
Matt Nadareski
4cc441afcf Get rid of code duplication 2022-12-15 00:13:24 -08:00
Matt Nadareski
95dd670c7c Add format note to SFFS, fix magic 2022-12-14 22:15:43 -08:00
Matt Nadareski
1f40c2e052 Fix locking exception 2022-12-14 21:30:53 -08:00
Matt Nadareski
afa8b24ba9 Add MoPaQ printing skeleton 2022-12-14 16:33:26 -08:00
Matt Nadareski
27ceb4ed48 Streamline MS-CAB reading, add to info printing 2022-12-13 23:06:49 -08:00
Matt Nadareski
6171c0defd Fix SFFS not being scanned 2022-12-13 11:55:12 -08:00
TheRogueArchivist
56c27d0b8f Why is there so much StarForce, geez (#180)
* Begin work on overhauling StarForce detection, and to add notes.

* Attempt to add SFFS file detection.

* Fix minor TAGES issue.
2022-12-13 11:42:55 -08:00
Matt Nadareski
dcccd6e313 Remove System.Diagnostics dependency 2022-12-08 22:33:02 -08:00
Matt Nadareski
dcc8915dd2 FileTypes -> SupportedFileType 2022-12-08 21:46:22 -08:00
Matt Nadareski
39f2dd88aa Make it easier to support new file types 2022-12-08 21:32:52 -08:00
Matt Nadareski
b1760d3541 Fix version printing 2022-12-03 23:30:32 -08:00
Matt Nadareski
f78b3daf8b Attempt to use new executable framework 2022-12-03 22:17:48 -08:00
TheRogueArchivist
297514ef17 Overhaul SafeDisc detection (#133)
* Begin overhauling SafeDisc detection

* A new utility method for obtaining the SHA1 hash of a file.
* SHA1-based detection for drvmgt.dll, which is vastly more accurate than the existing size checks.
* (Currently nonfunctional) PEX based checks for newer secdrv.sys versions.
* General clean-up and minor additions.

* Address PR review comments

* Address further PR comments and remove some file size checks

Remove file size checks that are now redundant.

* Add CLCD16 hash based version detection

Add support for detecting a rough version range from the hash of CLCD16.dll, as well as general cleanup.

* Add CLCD32 hash based version detection

Add hash based version checks for CLCD32.dll, which provides reliable detection for 1.X, much more than CLCD16.dll.

* Add CLOKSPL hash based version detection

Add CLOKSPL hash based version detection, which is an excellent indicator of version within 1.X.

* Add detailed SafeDisc version notes, address PR reviews

* Add a note that includes every known SafeDisc and SafeCast version.

* General cleanup and minor detection additions.

* Address PR reviews.

* Various SafeDisc detection improvements

* Add broad version checks for 00000001.TMP.

* Add a few SafeDisc Lite specific CLCD32.DLL checks.

* Remove unneeded dplayerx.dll size checks that were already covered by executable string checks.

* Improve DPlayerX version size checks

Improve DPlayerX existing version size checks and add new ones.

Add new hash checks for previously undetected files.

* Improve secdrv.sys version detection

Improve secdrv.sys version detection using both file size checks and product version checks.

* Fix various false positives

Fix various false positives, as well as incomplete detections.

* Address PR comments

* Properly set check for File Description
2022-08-21 20:20:28 -07:00
Matt Nadareski
1517a66724 Add cabinet finding 2022-07-07 12:11:23 -07:00
Matt Nadareski
b933249ff7 Add resource finding on creation 2022-04-02 16:12:23 -07:00
Matt Nadareski
61c09e3c97 Move resource helpers to PortableExecutable 2022-04-02 15:54:51 -07:00
Matt Nadareski
4b66cd8cd2 Update file version resource handling 2022-04-01 10:16:31 -07:00
SilasLaspada
edc4cc1706 Refactor Setup Factory detection (#115)
* Refactor Setup Factory detection

* Address Setup Factory PR comments

* Fix whitespace
2022-04-01 09:58:02 -07:00
Matt Nadareski
ffb529edb3 Granularly separate out executable types 2022-03-14 10:40:44 -07:00
Matt Nadareski
ec83669d7d Create Executable constructors 2022-03-08 23:03:26 -08:00
Matt Nadareski
56f009ac56 Fail slower on resource parsing (fixes #81) 2022-02-10 10:28:59 -08:00
Matt Nadareski
7b71d7b4bf Fix resource parsing, fix MS-CAB SFX 2021-09-11 21:41:17 -07:00
Matt Nadareski
9d52ca4b4c Fix invalid reads 2021-09-11 20:58:44 -07:00
Matt Nadareski
214e8d41c7 Pre-read 3 most commonly-used section data
This also adds comprehensive notes around the sections used in various protections, how they're used, and what we can do with them. It also adds a couple of various notes based on the findings from the protection audit
2021-09-11 16:47:25 -07:00
Matt Nadareski
f2b9e3a31b Clean up a significant number of TODOs 2021-09-11 00:32:48 -07:00
Matt Nadareski
73dd669c20 Add and use byte array extension methods 2021-09-10 22:35:32 -07:00
Matt Nadareski
bf385f0bbf Identify and use .rsrc item for NSIS 2021-09-10 21:45:14 -07:00
Matt Nadareski
9f676732a4 A little extra safety 2021-09-10 20:59:39 -07:00
Matt Nadareski
5344de96b2 Cleanup and bugfixes; additional notes 2021-09-10 15:32:37 -07:00
Matt Nadareski
e03808fbc5 Fix trailing whitespace in resource strings 2021-09-10 13:54:12 -07:00
Matt Nadareski
373268a6a8 Convert resource checks to header checks 2021-09-10 13:51:32 -07:00
Matt Nadareski
905d440367 Process file info resources; cleanup; refactors 2021-09-10 02:58:59 -07:00
Matt Nadareski
4aaea417f0 Make generic resource finding methods 2021-09-09 18:45:50 -07:00
Matt Nadareski
1028050464 Use resource section to find assembly manifest 2021-09-09 16:29:17 -07:00
Matt Nadareski
f8f02a54f6 Combine VOB into ProtectDISC; add notes
This also means that EVORE is no longer relevant to the code and has been fully removed.
2021-09-07 23:53:05 -07:00
Matt Nadareski
21117e81a3 Fix EVORE IsPEExecutable check 2021-09-01 16:10:06 -07:00
Matt Nadareski
81ce49c219 Fix manifest description finding 2021-08-29 11:15:37 -07:00
Matt Nadareski
b63d4a3da0 Update EVORE 2021-08-28 00:13:19 -07:00
Matt Nadareski
ee0193eb71 Clean up some usings, add note to NSIS 2021-08-27 13:30:24 -07:00
Matt Nadareski
2de4f3f808 Continue exe organization, start IIF migration 2021-08-27 09:42:05 -07:00
Matt Nadareski
7bbed5985b A little EVORE cleanup 2021-08-26 16:05:38 -07:00
Matt Nadareski
3b753c137b Fill out and fix way more executable stuff 2021-08-26 15:48:56 -07:00
Matt Nadareski
6cde7b8bef Reduce redundant code in content matchers now 2021-08-25 20:26:43 -07:00
Matt Nadareski
7548646ba2 Create and use the Tools namespace 2021-08-25 15:09:42 -07:00