Bump version

Prone to too many false positives.

.github/workflows/build_and_test.yml

@@ -16,7 +16,10 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v4
       with:
-        dotnet-version: 9.0.x
+        dotnet-version: |
+            6.0.x
+            8.0.x
+            9.0.x
         
     - name: Run tests
       run: dotnet test
@@ -24,17 +27,11 @@ jobs:
     - name: Run publish script
       run: ./publish-nix.sh -d
 
-    - name: Upload package
-      uses: actions/upload-artifact@v4
-      with:
-        name: 'Nuget Package'
-        path: '*.nupkg'
-
     - name: Upload to rolling
       uses: ncipollo/release-action@v1.14.0
       with:
         allowUpdates: True
-        artifacts: "*.nupkg,*.zip"
+        artifacts: "*.nupkg,*.snupkg,*.zip"
         body: 'Last built commit: ${{ github.sha }}'
         name: 'Rolling Release'
         prerelease: True

.github/workflows/check_pr.yml

@@ -11,10 +11,13 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v4
       with:
-        dotnet-version: 9.0.x
+        dotnet-version: |
+            6.0.x
+            8.0.x
+            9.0.x
       
     - name: Build
       run: dotnet build
 
     - name: Run tests
-      run: dotnet test
+      run: dotnet test

BinaryObjectScanner.Test/BinaryObjectScanner.Test.csproj

@@ -12,14 +12,14 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="coverlet.collector" Version="6.0.2">
+        <PackageReference Include="coverlet.collector" Version="6.0.3">
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
             <PrivateAssets>all</PrivateAssets>
         </PackageReference>
         <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
-        <PackageReference Include="SabreTools.Serialization" Version="1.8.3" />
+        <PackageReference Include="SabreTools.Serialization" Version="1.8.6" />
         <PackageReference Include="xunit" Version="2.9.2" />
-        <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.0">
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
             <PrivateAssets>all</PrivateAssets>
         </PackageReference>

BinaryObjectScanner/BinaryObjectScanner.csproj

@@ -6,19 +6,21 @@
         <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
         <CheckEolTargetFramework>false</CheckEolTargetFramework>
         <IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
+        <IncludeSymbols>true</IncludeSymbols>
         <LangVersion>latest</LangVersion>
         <NoWarn>CS0162;CS0612</NoWarn>
         <Nullable>enable</Nullable>
         <SuppressTfmSupportBuildWarnings>true</SuppressTfmSupportBuildWarnings>
+        <SymbolPackageFormat>snupkg</SymbolPackageFormat>
         <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-        <Version>3.3.2</Version>
+        <Version>3.3.4</Version>
         <!-- Mostly added due to external libraries -->
         <WarningsNotAsErrors>CS8600;CS8601;CS8602;CS8603;CS8604;CS8605;CS8618;CS8625;CS8634;CS8765;IL3000;NU5100</WarningsNotAsErrors>
 
         <!-- Package Properties -->
         <Authors>Matt Nadareski</Authors>
         <Description>Protection scanning library</Description>
-        <Copyright>Copyright (c)2018-2024 Matt Nadareski</Copyright>
+        <Copyright>Copyright (c)2018-2025 Matt Nadareski</Copyright>
         <PackageProjectUrl>https://github.com/SabreTools/</PackageProjectUrl>
         <RepositoryUrl>https://github.com/SabreTools/BinaryObjectScanner</RepositoryUrl>
         <RepositoryType>git</RepositoryType>
@@ -84,14 +86,14 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="SabreTools.Compression" Version="0.6.2" />
-        <PackageReference Include="SabreTools.Hashing" Version="1.4.0" />
-        <PackageReference Include="SabreTools.IO" Version="1.6.1" />
-        <PackageReference Include="SabreTools.Matching" Version="1.5.0" />
-        <PackageReference Include="SabreTools.Models" Version="1.5.7" />
-        <PackageReference Include="SabreTools.Serialization" Version="1.8.3" />
-        <PackageReference Include="UnshieldSharp" Version="1.9.3" />
-        <PackageReference Include="WiseUnpacker" Version="1.5.5" />
+        <PackageReference Include="SabreTools.Compression" Version="0.6.3" />
+        <PackageReference Include="SabreTools.Hashing" Version="1.4.1" />
+        <PackageReference Include="SabreTools.IO" Version="1.6.2" />
+        <PackageReference Include="SabreTools.Matching" Version="1.5.1" />
+        <PackageReference Include="SabreTools.Models" Version="1.5.8" />
+        <PackageReference Include="SabreTools.Serialization" Version="1.8.6" />
+        <PackageReference Include="UnshieldSharp" Version="1.9.4" />
+        <PackageReference Include="WiseUnpacker" Version="1.5.6" />
     </ItemGroup>
 
 </Project>

BinaryObjectScanner/Options.cs

@@ -11,17 +11,22 @@
         public bool ScanArchives { get; set; }
 
         /// <summary>
-        /// Determines if content matches are used or not
+        /// Determines if content matches are used
         /// </summary>
         public bool ScanContents { get; set; }
 
         /// <summary>
-        /// Determines if path matches are used or not
+        /// Determines if path matches are used
         /// </summary>
         public bool ScanPaths { get; set; }
 
         /// <summary>
-        /// Determines if debug information is output or not
+        /// Determines if subdirectories are scanned
+        /// </summary>
+        public bool ScanSubdirectories { get; set; }
+
+        /// <summary>
+        /// Determines if debug information is output
         /// </summary>
         public bool IncludeDebug { get; set; }
     }

BinaryObjectScanner/Packer/ASPack.cs

@@ -656,8 +656,9 @@ namespace BinaryObjectScanner.Packer
 
                 new(new byte?[] { 0x60, 0xE8, 0x41, 0x06, 0x00, 0x00, 0xEB, 0x41 }, "ASPack 1.08.04"),
 
-                new(new byte?[] { 0x60, 0xE8, null, null, null, null, 0xEB }, "ASPack 1.08.04"),
-
+                // Disabled due to being too prone to false positives. 
+                //new(new byte?[] { 0x60, 0xE8, null, null, null, null, 0xEB }, "ASPack 1.08.04"),
+                
                 new(new byte?[] { 0x60, 0xE8, 0x70, 0x05, 0x00, 0x00, 0xEB, 0x4C }, "ASPack 2.00.00"),
 
                 new(new byte?[] { 0x60, 0xE8, 0x48, 0x11, 0x00, 0x00, 0xC3, 0x83 }, "ASPack 2.00.00"),

BinaryObjectScanner/Packer/EmbeddedArchive.cs

@@ -25,7 +25,11 @@ namespace BinaryObjectScanner.Packer
 
                     if (ba.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
                         return "Embedded 7-Zip Archive";
-                    if (ba.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
+                    if (ba.StartsWith([0x50, 0x4B, 0x03, 0x04]))
+                        return "Embedded PKZIP Archive";
+                    if (ba.StartsWith([0x50, 0x4B, 0x05, 0x06]))
+                        return "Embedded PKZIP Archive";
+                    if (ba.StartsWith([0x50, 0x4B, 0x07, 0x08]))
                         return "Embedded PKZIP Archive";
                     if (ba.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
                         return "Embedded RAR Archive";
@@ -39,7 +43,11 @@ namespace BinaryObjectScanner.Packer
             {
                 if (pex.OverlayData.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
                     return "Embedded 7-Zip Archive";
-                if (pex.OverlayData.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
+                if (pex.OverlayData.StartsWith([0x50, 0x4B, 0x03, 0x04]))
+                    return "Embedded PKZIP Archive";
+                if (pex.OverlayData.StartsWith([0x50, 0x4B, 0x05, 0x06]))
+                    return "Embedded PKZIP Archive";
+                if (pex.OverlayData.StartsWith([0x50, 0x4B, 0x07, 0x08]))
                     return "Embedded PKZIP Archive";
                 if (pex.OverlayData.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
                     return "Embedded RAR Archive";
@@ -74,7 +82,11 @@ namespace BinaryObjectScanner.Packer
                 string extension = string.Empty;
                 if (overlayData.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
                     extension = "7z";
-                else if (overlayData.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
+                else if (overlayData.StartsWith([0x50, 0x4B, 0x03, 0x04]))
+                    extension = "zip";
+                else if (overlayData.StartsWith([0x50, 0x4B, 0x05, 0x06]))
+                    extension = "zip";
+                else if (overlayData.StartsWith([0x50, 0x4B, 0x07, 0x08]))
                     extension = "zip";
                 else if (overlayData.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
                     extension = "rar";
@@ -125,7 +137,11 @@ namespace BinaryObjectScanner.Packer
                     string extension = string.Empty;
                     if (ba.StartsWith([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C]))
                         extension = "7z";
-                    else if (ba.StartsWith(SabreTools.Models.PKZIP.Constants.LocalFileHeaderSignatureBytes))
+                    else if (ba.StartsWith([0x50, 0x4B, 0x03, 0x04]))
+                        extension = "zip";
+                    else if (ba.StartsWith([0x50, 0x4B, 0x05, 0x06]))
+                        extension = "zip";
+                    else if (ba.StartsWith([0x50, 0x4B, 0x07, 0x08]))
                         extension = "zip";
                     else if (ba.StartsWith([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00]))
                         extension = "rar";

BinaryObjectScanner/Packer/WiseInstaller.cs

@@ -105,53 +105,24 @@ namespace BinaryObjectScanner.Packer
         private static FormatProperty? MatchesNEVersion(NewExecutable nex)
         {
             // TODO: Offset is _not_ the EXE header address, rather where the data starts. Fix this.
-            switch (nex.Model.Stub?.Header?.NewExeHeaderAddr)
+            return (nex.Model.Stub?.Header?.NewExeHeaderAddr) switch
             {
-                case 0x84b0:
-                    return new FormatProperty { Dll = false, ArchiveStart = 0x11, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = true };
-
-                case 0x3e10:
-                    return new FormatProperty { Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false };
-
-                case 0x3e50:
-                    return new FormatProperty { Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false };
-
-                case 0x3c20:
-                    return new FormatProperty { Dll = false, ArchiveStart = 0x1e, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false };
-
-                case 0x3c30:
-                    return new FormatProperty { Dll = false, ArchiveStart = 0x22, ArchiveEnd = -1, InitText = false, FilenamePosition = 0x04, NoCrc = false };
-
-                case 0x3660:
-                    return new FormatProperty { Dll = false, ArchiveStart = 0x40, ArchiveEnd = 0x3c, InitText = false, FilenamePosition = 0x04, NoCrc = false };
-
-                case 0x36f0:
-                    return new FormatProperty { Dll = false, ArchiveStart = 0x48, ArchiveEnd = 0x44, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-                case 0x3770:
-                    return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-                case 0x3780:
-                    return new FormatProperty { Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-                case 0x37b0:
-                    return new FormatProperty { Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-                case 0x37d0:
-                    return new FormatProperty { Dll = true, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-                case 0x3c80:
-                    return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
-
-                case 0x3bd0:
-                    return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
-
-                case 0x3c10:
-                    return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
-
-                default:
-                    return null;
-            }
+                0x84b0 => new FormatProperty { ArchiveEnd = -1 },
+                0x3e10 => new FormatProperty { ArchiveEnd = -1 },
+                0x3e50 => new FormatProperty { ArchiveEnd = -1 },
+                0x3c20 => new FormatProperty { ArchiveEnd = -1 },
+                0x3c30 => new FormatProperty { ArchiveEnd = -1 },
+                0x3660 => new FormatProperty { ArchiveEnd = 0x3c },
+                0x36f0 => new FormatProperty { ArchiveEnd = 0x44 },
+                0x3770 => new FormatProperty { ArchiveEnd = 0x4c },
+                0x3780 => new FormatProperty { ArchiveEnd = 0x4c },
+                0x37b0 => new FormatProperty { ArchiveEnd = 0x4c },
+                0x37d0 => new FormatProperty { ArchiveEnd = 0x4c },
+                0x3c80 => new FormatProperty { ArchiveEnd = 0x4c },
+                0x3bd0 => new FormatProperty { ArchiveEnd = 0x4c },
+                0x3c10 => new FormatProperty { ArchiveEnd = 0x4c },
+                _ => null,
+            };
         }
 
         /// <summary>
@@ -161,40 +132,24 @@ namespace BinaryObjectScanner.Packer
         /// <returns>True if it matches a known version, false otherwise</returns>
         private static FormatProperty? GetPEFormat(PortableExecutable pex)
         {
-            if (pex.OverlayAddress == 0x6e00
-                && pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4
-                && pex.GetFirstSection(".data")?.VirtualSize == 0x1528)
-                return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
+            // Get the current format
+            var current = new FormatProperty
+            {
+                ExecutableType = ExecutableType.PE,
+                CodeSectionLength = (int?)pex.GetFirstSection(".text")?.VirtualSize ?? -1,
+                DataSectionLength = (int?)pex.GetFirstSection(".data")?.VirtualSize ?? -1,
+            };
 
-            else if (pex.OverlayAddress == 0x6e00
-                && pex.GetFirstSection(".text")?.VirtualSize == 0x3cf4
-                && pex.GetFirstSection(".data")?.VirtualSize == 0x1568)
-                return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-            else if (pex.OverlayAddress == 0x6e00
-                && pex.GetFirstSection(".text")?.VirtualSize == 0x3d54)
-                return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-            else if (pex.OverlayAddress == 0x6e00
-                && pex.GetFirstSection(".text")?.VirtualSize == 0x3d44)
-                return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-            else if (pex.OverlayAddress == 0x6e00
-                && pex.GetFirstSection(".text")?.VirtualSize == 0x3d04)
-                return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
+            // Search known formats
+            foreach (var format in FormatProperty.KnownFormats)
+            {
+                if (current.Equals(format))
+                    return format;
+            }
 
             // Found in Binary.WiseCustomCalla
-            else if (pex.OverlayAddress == 0x6200)
-                return new FormatProperty { Dll = true, ArchiveStart = 0x62, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
-
-            else if (pex.OverlayAddress == 0x3000)
-                return new FormatProperty { Dll = false, ArchiveStart = 0x50, ArchiveEnd = 0x4c, InitText = false, FilenamePosition = 0x1c, NoCrc = false };
-
-            else if (pex.OverlayAddress == 0x3800)
-                return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
-
-            else if (pex.OverlayAddress == 0x3a00)
-                return new FormatProperty { Dll = true, ArchiveStart = 0x5a, ArchiveEnd = 0x4c, InitText = true, FilenamePosition = 0x1c, NoCrc = false };
+            if (pex.OverlayAddress == 0x6200)
+                return new FormatProperty { ArchiveEnd = 0x4c };
 
             return null;
         }

BinaryObjectScanner/Protection/Denuvo.cs

@@ -90,7 +90,9 @@ namespace BinaryObjectScanner.Protection
 
             // TODO: Re-enable all Entry Point checks after implementing
             if (pex.ContainsSection(".arch")
-                || pex.ContainsSection(".srdata")
+                // Disabled scanning in files with the ".srdata" section due to numerous false positives.
+                // These include Redump entry 112733 and Bus Hound 5.04 (https://web.archive.org/web/20070129204350/http://www.perisoft.net/bin/bhe504.exe).
+                // || pex.ContainsSection(".srdata")
                 || !string.IsNullOrEmpty(timingMatch))
             {
                 if (pex.Model.OptionalHeader?.Magic == OHMN.PE32Plus)

BinaryObjectScanner/Protection/HexalockAutoLock.cs

@@ -57,7 +57,25 @@ namespace BinaryObjectScanner.Protection
                 if (strs.Exists(s => s.Contains("mfint.dll")))
                     return "Hexalock Autolock";
             }
-
+            
+            // Get the code/CODE section strings, if they exist
+            strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE");
+            if (strs != null)
+            {
+                // Found in "launcher.exe" in "Sea Adventure / Adventure de la Mer" by Compedia.
+                if (strs.Exists(s => s.Contains("mfint.dll")))
+                    return "Hexalock Autolock";
+            }
+            
+            // Get the UPX1 section strings, if they exist
+            strs = pex.GetFirstSectionStrings("UPX1");
+            if (strs != null)
+            {
+                // Found in "postmanpat.exe" in "Postman Pat" by Compedia.
+                if (strs.Exists(s => s.Contains("mfint.dll")))
+                    return "Hexalock Autolock";
+            }
+            
             return null;
         }
 

BinaryObjectScanner/Protection/Macrovision.SafeDisc.cs

@@ -525,6 +525,27 @@ namespace BinaryObjectScanner.Protection
                 // Found in Redump entries 11638/11639, 52606, 62505, 85338/85339, 95322/95324, 119414, and 119415.
                 "6492B6164D40633C7AAAC882EF1BA55E6931DBDC" => "2.90.040",
 
+                // Found in Redump entry 116357.
+                "CC1818B15AD1D0510602D556AB0AFFB8011ECF4F" => "2.90.045",
+
+                // Found in Redump entries 13230 and 68204.
+                "E481642064018AD02CE1FA524E539C89B80B8116" => "3.10.020",
+
+                // Found in Redump entries 36511 and 74338.
+                "6950E54EFAE8A00D2F54BEAAE34FBE13C9555BB8" => "3.15.010",
+
+                // Found in Redump entries 15383 and 35512.
+                "86EBAD43D87C2192FAF457BE922E21963FE8A16C" => "3.15.011",
+
+                // Found in Redump entries 30404, 31621/31623, 56748, 58625, and 64355-64358. TODO: Test 84586.
+                "553BA02CCAE2298C6E14F695EA172EB2B47E6798" => "3.20.020",
+
+                // Found in Redump entries 20728, 53667/53668/76775, 58625, 64255, 75782, 84985, 91552, 102135, and 102806.
+                "CCC4797FDC387FB5E08F87C1830F43F9B7A28726" => "3.20.022",
+
+                // Found in Redump entries 20729, 28257, 54268-5427, 63810-63813, and 86177.
+                "E931EEC20B4A7032BDAD5DC1D76E740A08A6321B" => "3.20.024",
+
                 _ => "Unknown Version (Report this to us on GitHub)",
             };
         }

BinaryObjectScanner/Protection/Macrovision.cs

@@ -474,9 +474,9 @@ namespace BinaryObjectScanner.Protection
 
             // Begin reading 2 bytes after "BoG_ *90.0&!!  Yy>" for older versions
             int index = positions[0] + 18 + 2;
-            int version = fileContent.ReadInt32(ref index);
-            int subVersion = fileContent.ReadInt32(ref index);
-            int subsubVersion = fileContent.ReadInt32(ref index);
+            int version = fileContent.ReadInt32LittleEndian(ref index);
+            int subVersion = fileContent.ReadInt32LittleEndian(ref index);
+            int subsubVersion = fileContent.ReadInt32LittleEndian(ref index);
 
             if (version != 0)
             {
@@ -486,9 +486,9 @@ namespace BinaryObjectScanner.Protection
 
             // Begin reading 14 bytes after "BoG_ *90.0&!!  Yy>" for newer versions
             index = positions[0] + 18 + 14;
-            version = fileContent.ReadInt32(ref index);
-            subVersion = fileContent.ReadInt32(ref index);
-            subsubVersion = fileContent.ReadInt32(ref index);
+            version = fileContent.ReadInt32LittleEndian(ref index);
+            subVersion = fileContent.ReadInt32LittleEndian(ref index);
+            subsubVersion = fileContent.ReadInt32LittleEndian(ref index);
 
             if (version != 0)
             {
@@ -662,13 +662,30 @@ namespace BinaryObjectScanner.Protection
                     // Found in Redump entries 11638/11639, 52606, 62505, 85338/85339, 95322/95324, 119414, and 119415.
                     or "2.90.040"
 
-                    // Source not documented.
+                    // Found in Redump entry 116357.
+                    // This version is particularly unusual, as it was in a game released in late 2007, when 2.90.040 was used from 2004/2005.
+                    // It also doesn't appear to contain the SecDrv or DrvMgt drivers. It may be a Long Term Support release of SafeDisc 2 for customers unwilling or unable to use SafeDisc 3+.
+                    or "2.90.045"
+
+                    // Found in Redump entries 13230 and 68204.
                     or "3.10.020"
+
+                    // Found in Redump entries 36511 and 74338.
                     or "3.15.010"
+
+                    // Found in Redump entries 15383 and 35512.
                     or "3.15.011"
+
+                    // Found in Redump entries 30404, 31621/31623, 56748, 58625, and 64355-64358.
                     or "3.20.020"
+
+                    // Found in Redump entries 20728, 53667/53668/76775, 58625, 64255, 75782, 84985, 91552, 102135, and 102806.
                     or "3.20.022"
+
+                    // Found in Redump entries 20729, 28257, 54268-5427, 63810-63813, and 86177.
                     or "3.20.024"
+
+                    // Source not documented.
                     or "4.00.000"
                     or "4.00.001"
                     or "4.00.002"

BinaryObjectScanner/Protection/SolidShield.cs

@@ -27,6 +27,10 @@ namespace BinaryObjectScanner.Protection
             else if (name.OptionalStartsWith("Activation Manager", StringComparison.OrdinalIgnoreCase))
                 return $"SolidShield Activation Manager Module {GetInternalVersion(pex)}";
 
+            // Found in Redump entry 63719.
+            else if (name.OptionalStartsWith("Solidshield - Activation Wizard", StringComparison.OrdinalIgnoreCase))
+                return $"SolidShield Activation Manager Module {GetInternalVersion(pex)}";
+
             // Found in "tvdm.dll" in Redump entry 68166.
             else if (name.OptionalStartsWith("Solidshield Library", StringComparison.OrdinalIgnoreCase))
                 return $"SolidShield {GetInternalVersion(pex)}";

BinaryObjectScanner/Scanner.cs

@@ -31,11 +31,13 @@ namespace BinaryObjectScanner
         /// <param name="scanArchives">Enable scanning archive contents</param>
         /// <param name="scanContents">Enable including content detections in output</param>
         /// <param name="scanPaths">Enable including path detections in output</param>
+        /// <param name="scanSubdirectories">Enable scanning subdirectories</param>
         /// <param name="includeDebug">Enable including debug information</param>
         /// <param name="fileProgress">Optional progress callback</param>
         public Scanner(bool scanArchives,
             bool scanContents,
             bool scanPaths,
+            bool scanSubdirectories,
             bool includeDebug,
             IProgress<ProtectionProgress>? fileProgress = null)
         {
@@ -44,6 +46,7 @@ namespace BinaryObjectScanner
                 ScanArchives = scanArchives,
                 ScanContents = scanContents,
                 ScanPaths = scanPaths,
+                ScanSubdirectories = scanSubdirectories,
                 IncludeDebug = includeDebug,
             };
 
@@ -93,7 +96,8 @@ namespace BinaryObjectScanner
                 if (Directory.Exists(path))
                 {
                     // Enumerate all files at first for easier access
-                    List<string> files = [.. IOExtensions.SafeGetFiles(path, "*", SearchOption.AllDirectories)];
+                    SearchOption searchOption = _options.ScanSubdirectories ? SearchOption.AllDirectories : SearchOption.TopDirectoryOnly;
+                    List<string> files = [.. IOExtensions.SafeGetFiles(path, "*", searchOption)];
 
                     // Scan for path-detectable protections
                     if (_options.ScanPaths)

ExtractionTool/ExtractionTool.csproj

@@ -9,7 +9,7 @@
         <Nullable>enable</Nullable>
         <SuppressTfmSupportBuildWarnings>true</SuppressTfmSupportBuildWarnings>
         <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-        <Version>3.3.2</Version>
+        <Version>3.3.4</Version>
     </PropertyGroup>
 
     <!-- Support All Frameworks -->
@@ -36,29 +36,29 @@
 
     <!-- These are needed for dealing with native Windows DLLs -->
     <ItemGroup Condition="'$(RuntimeIdentifier)'=='win-x86'">
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\CascLib.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\native\CascLib.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>CascLib.dll</TargetPath>
         </ContentWithTargetPath>
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\mspack.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\native\mspack.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>mspack.dll</TargetPath>
         </ContentWithTargetPath>
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\StormLib.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\native\StormLib.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>StormLib.dll</TargetPath>
         </ContentWithTargetPath>
     </ItemGroup>
     <ItemGroup Condition="'$(RuntimeIdentifier)'=='win-x64'">
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x64\CascLib.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x64\native\CascLib.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>CascLib.dll</TargetPath>
         </ContentWithTargetPath>
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x64\StormLib.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x64\native\StormLib.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>StormLib.dll</TargetPath>
@@ -70,8 +70,8 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="SabreTools.IO" Version="1.6.1" />
-        <PackageReference Include="SabreTools.Serialization" Version="1.8.3" />
+        <PackageReference Include="SabreTools.IO" Version="1.6.2" />
+        <PackageReference Include="SabreTools.Serialization" Version="1.8.6" />
     </ItemGroup>
 
 </Project>

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2018-2023 Matt Nadareski
+Copyright (c) 2018-2025 Matt Nadareski
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

ProtectionScan/Options.cs

@@ -29,11 +29,17 @@ namespace ProtectionScan
         /// Scan file contents during protection scanning
         /// </summary>
         public bool ScanContents { get; private set; } = true;
+
         /// <summary>
         /// Scan file paths during protection scanning
         /// </summary>
         public bool ScanPaths { get; private set; } = true;
 
+        /// <summary>
+        /// Scan subdirectories during protection scanning
+        /// </summary>
+        public bool ScanSubdirectories { get; set; } = true;
+
         #endregion
 
         /// <summary>
@@ -74,11 +80,16 @@ namespace ProtectionScan
                         options.ScanContents = false;
                         break;
 
-                    case "-ns":
+                    case "-np":
                     case "--no-paths":
                         options.ScanPaths = false;
                         break;
 
+                    case "-ns":
+                    case "--no-subdirs":
+                        options.ScanSubdirectories = false;
+                        break;
+
                     default:
                         options.InputPaths.Add(arg);
                         break;
@@ -109,7 +120,8 @@ namespace ProtectionScan
             Console.WriteLine("-d, --debug              Enable debug mode");
             Console.WriteLine("-nc, --no-contents       Disable scanning for content checks");
             Console.WriteLine("-na, --no-archives       Disable scanning archives");
-            Console.WriteLine("-ns, --no-paths          Disable scanning for path checks");
+            Console.WriteLine("-np, --no-paths          Disable scanning for path checks");
+            Console.WriteLine("-ns, --no-subdirs        Disable scanning subdirectories");
         }
     }
 }

ProtectionScan/Program.cs

@@ -35,6 +35,7 @@ namespace ProtectionScan
                 options.ScanArchives,
                 options.ScanContents,
                 options.ScanPaths,
+                options.ScanSubdirectories,
                 options.Debug,
                 fileProgress);
 

ProtectionScan/ProtectionScan.csproj

@@ -9,7 +9,7 @@
         <Nullable>enable</Nullable>
         <SuppressTfmSupportBuildWarnings>true</SuppressTfmSupportBuildWarnings>
         <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-        <Version>3.3.2</Version>
+        <Version>3.3.4</Version>
     </PropertyGroup>
 
     <!-- Support All Frameworks -->
@@ -28,29 +28,29 @@
 
     <!-- These are needed for dealing with native Windows DLLs -->
     <ItemGroup Condition="'$(RuntimeIdentifier)'=='win-x86'">
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\CascLib.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\native\CascLib.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>CascLib.dll</TargetPath>
         </ContentWithTargetPath>
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\mspack.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\native\mspack.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>mspack.dll</TargetPath>
         </ContentWithTargetPath>
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\StormLib.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x86\native\StormLib.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>StormLib.dll</TargetPath>
         </ContentWithTargetPath>
     </ItemGroup>
     <ItemGroup Condition="'$(RuntimeIdentifier)'=='win-x64'">
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x64\CascLib.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x64\native\CascLib.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>CascLib.dll</TargetPath>
         </ContentWithTargetPath>
-        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x64\StormLib.dll">
+        <ContentWithTargetPath Include="..\BinaryObjectScanner\runtimes\win-x64\native\StormLib.dll">
             <CopyToOutputDirectory>Always</CopyToOutputDirectory>
             <CopyToPublishDirectory>Always</CopyToPublishDirectory>
             <TargetPath>StormLib.dll</TargetPath>

publish-nix.sh

@@ -62,8 +62,6 @@ SINGLE_FILE_CAPABLE=("net5.0" "net6.0" "net7.0" "net8.0" "net9.0")
 VALID_APPLE_FRAMEWORKS=("net6.0" "net7.0" "net8.0" "net9.0")
 VALID_CROSS_PLATFORM_FRAMEWORKS=("netcoreapp3.1" "net5.0" "net6.0" "net7.0" "net8.0" "net9.0")
 VALID_CROSS_PLATFORM_RUNTIMES=("win-arm64" "linux-x64" "linux-arm64" "osx-x64" "osx-arm64")
-NON_DLL_FRAMEWORKS=("net20" "net35")
-NON_DLL_RUNTIMES=("win-arm64" "linux-x64" "linux-arm64" "osx-x64" "osx-arm64")
 
 # Only build if requested
 if [ $NO_BUILD = false ]; then
@@ -180,22 +178,10 @@ if [ $NO_ARCHIVE = false ]; then
             # Only include Debug if set
             if [ $INCLUDE_DEBUG = true ]; then
                 cd $BUILD_FOLDER/ExtractionTool/bin/Debug/${FRAMEWORK}/${RUNTIME}/publish/
-                if [[ $(echo ${NON_DLL_FRAMEWORKS[@]} | fgrep -w $FRAMEWORK) ]]; then
-                    zip -r $BUILD_FOLDER/ExtractionTool_${FRAMEWORK}_${RUNTIME}_debug.zip . -x 'CascLib.dll' -x 'mspack.dll' -x 'StormLib.dll'
-                elif [[ $(echo ${NON_DLL_RUNTIMES[@]} | fgrep -w $RUNTIME) ]]; then
-                    zip -r $BUILD_FOLDER/ExtractionTool_${FRAMEWORK}_${RUNTIME}_debug.zip . -x 'CascLib.dll' -x 'mspack.dll' -x 'StormLib.dll'
-                else
-                    zip -r $BUILD_FOLDER/ExtractionTool_${FRAMEWORK}_${RUNTIME}_debug.zip .
-                fi
+                zip -r $BUILD_FOLDER/ExtractionTool_${FRAMEWORK}_${RUNTIME}_debug.zip .
             fi
             cd $BUILD_FOLDER/ExtractionTool/bin/Release/${FRAMEWORK}/${RUNTIME}/publish/
-            if [[ $(echo ${NON_DLL_FRAMEWORKS[@]} | fgrep -w $FRAMEWORK) ]]; then
-                zip -r $BUILD_FOLDER/ExtractionTool_${FRAMEWORK}_${RUNTIME}_release.zip . -x 'CascLib.dll' -x 'mspack.dll' -x 'StormLib.dll'
-            elif [[ $(echo ${NON_DLL_RUNTIMES[@]} | fgrep -w $RUNTIME) ]]; then
-                zip -r $BUILD_FOLDER/ExtractionTool_${FRAMEWORK}_${RUNTIME}_release.zip . -x 'CascLib.dll' -x 'mspack.dll' -x 'StormLib.dll'
-            else
-                zip -r $BUILD_FOLDER/ExtractionTool_${FRAMEWORK}_${RUNTIME}_release.zip .
-            fi
+            zip -r $BUILD_FOLDER/ExtractionTool_${FRAMEWORK}_${RUNTIME}_release.zip .
         done
     done
 
@@ -224,22 +210,10 @@ if [ $NO_ARCHIVE = false ]; then
             # Only include Debug if set
             if [ $INCLUDE_DEBUG = true ]; then
                 cd $BUILD_FOLDER/ProtectionScan/bin/Debug/${FRAMEWORK}/${RUNTIME}/publish/
-                if [[ $(echo ${NON_DLL_FRAMEWORKS[@]} | fgrep -w $FRAMEWORK) ]]; then
-                    zip -r $BUILD_FOLDER/ProtectionScan_${FRAMEWORK}_${RUNTIME}_debug.zip . -x 'CascLib.dll' -x 'mspack.dll' -x 'StormLib.dll'
-                elif [[ $(echo ${NON_DLL_RUNTIMES[@]} | fgrep -w $RUNTIME) ]]; then
-                    zip -r $BUILD_FOLDER/ProtectionScan_${FRAMEWORK}_${RUNTIME}_debug.zip . -x 'CascLib.dll' -x 'mspack.dll' -x 'StormLib.dll'
-                else
-                    zip -r $BUILD_FOLDER/ProtectionScan_${FRAMEWORK}_${RUNTIME}_debug.zip .
-                fi
+                zip -r $BUILD_FOLDER/ProtectionScan_${FRAMEWORK}_${RUNTIME}_debug.zip .
             fi
             cd $BUILD_FOLDER/ProtectionScan/bin/Release/${FRAMEWORK}/${RUNTIME}/publish/
-            if [[ $(echo ${NON_DLL_FRAMEWORKS[@]} | fgrep -w $FRAMEWORK) ]]; then
-                zip -r $BUILD_FOLDER/ProtectionScan_${FRAMEWORK}_${RUNTIME}_release.zip . -x 'CascLib.dll' -x 'mspack.dll' -x 'StormLib.dll'
-            elif [[ $(echo ${NON_DLL_RUNTIMES[@]} | fgrep -w $RUNTIME) ]]; then
-                zip -r $BUILD_FOLDER/ProtectionScan_${FRAMEWORK}_${RUNTIME}_release.zip . -x 'CascLib.dll' -x 'mspack.dll' -x 'StormLib.dll'
-            else
-                zip -r $BUILD_FOLDER/ProtectionScan_${FRAMEWORK}_${RUNTIME}_release.zip .
-            fi
+            zip -r $BUILD_FOLDER/ProtectionScan_${FRAMEWORK}_${RUNTIME}_release.zip .
         done
     done
 

publish-win.ps1

@@ -53,8 +53,6 @@ $SINGLE_FILE_CAPABLE = @('net5.0', 'net6.0', 'net7.0', 'net8.0', 'net9.0')
 $VALID_APPLE_FRAMEWORKS = @('net6.0', 'net7.0', 'net8.0', 'net9.0')
 $VALID_CROSS_PLATFORM_FRAMEWORKS = @('netcoreapp3.1', 'net5.0', 'net6.0', 'net7.0', 'net8.0', 'net9.0')
 $VALID_CROSS_PLATFORM_RUNTIMES = @('win-arm64', 'linux-x64', 'linux-arm64', 'osx-x64', 'osx-arm64')
-$NON_DLL_FRAMEWORKS = @('net20', 'net35')
-$NON_DLL_RUNTIMES = @('win-arm64', 'linux-x64', 'linux-arm64', 'osx-x64', 'osx-arm64')
 
 # Only build if requested
 if (!$NO_BUILD.IsPresent) {
@@ -161,21 +159,11 @@ if (!$NO_ARCHIVE.IsPresent) {
             # Only include Debug if set
             if ($INCLUDE_DEBUG.IsPresent) {
                 Set-Location -Path $BUILD_FOLDER\ExtractionTool\bin\Debug\${FRAMEWORK}\${RUNTIME}\publish\
-                if ($NON_DLL_FRAMEWORKS -contains $FRAMEWORK -or $NON_DLL_RUNTIMES -contains $RUNTIME) {
-                    7z a -tzip -x'!CascLib.dll' -x'!mspack.dll' -x'!StormLib.dll' $BUILD_FOLDER\ExtractionTool_${FRAMEWORK}_${RUNTIME}_debug.zip *
-                }
-                else {
-                    7z a -tzip $BUILD_FOLDER\ExtractionTool_${FRAMEWORK}_${RUNTIME}_debug.zip *
-                }
+                7z a -tzip $BUILD_FOLDER\ExtractionTool_${FRAMEWORK}_${RUNTIME}_debug.zip *
             }
         
             Set-Location -Path $BUILD_FOLDER\ExtractionTool\bin\Release\${FRAMEWORK}\${RUNTIME}\publish\
-            if ($NON_DLL_FRAMEWORKS -contains $FRAMEWORK -or $NON_DLL_RUNTIMES -contains $RUNTIME) {
-                7z a -tzip -x'!CascLib.dll' -x'!mspack.dll' -x'!StormLib.dll' $BUILD_FOLDER\ExtractionTool_${FRAMEWORK}_${RUNTIME}_release.zip *
-            }
-            else {
-                7z a -tzip $BUILD_FOLDER\ExtractionTool_${FRAMEWORK}_${RUNTIME}_release.zip *
-            }
+            7z a -tzip $BUILD_FOLDER\ExtractionTool_${FRAMEWORK}_${RUNTIME}_release.zip *
         }
     }
 
@@ -200,21 +188,11 @@ if (!$NO_ARCHIVE.IsPresent) {
             # Only include Debug if set
             if ($INCLUDE_DEBUG.IsPresent) {
                 Set-Location -Path $BUILD_FOLDER\ProtectionScan\bin\Debug\${FRAMEWORK}\${RUNTIME}\publish\
-                if ($NON_DLL_FRAMEWORKS -contains $FRAMEWORK -or $NON_DLL_RUNTIMES -contains $RUNTIME) {
-                    7z a -tzip -x'!CascLib.dll' -x'!mspack.dll' -x'!StormLib.dll' $BUILD_FOLDER\ProtectionScan_${FRAMEWORK}_${RUNTIME}_debug.zip *
-                }
-                else {
-                    7z a -tzip $BUILD_FOLDER\ProtectionScan_${FRAMEWORK}_${RUNTIME}_debug.zip *
-                }
+                7z a -tzip $BUILD_FOLDER\ProtectionScan_${FRAMEWORK}_${RUNTIME}_debug.zip *
             }
         
             Set-Location -Path $BUILD_FOLDER\ProtectionScan\bin\Release\${FRAMEWORK}\${RUNTIME}\publish\
-            if ($NON_DLL_FRAMEWORKS -contains $FRAMEWORK -or $NON_DLL_RUNTIMES -contains $RUNTIME) {
-                7z a -tzip -x'!CascLib.dll' -x'!mspack.dll' -x'!StormLib.dll' $BUILD_FOLDER\ProtectionScan_${FRAMEWORK}_${RUNTIME}_release.zip *
-            }
-            else {
-                7z a -tzip $BUILD_FOLDER\ProtectionScan_${FRAMEWORK}_${RUNTIME}_release.zip *
-            }
+            7z a -tzip $BUILD_FOLDER\ProtectionScan_${FRAMEWORK}_${RUNTIME}_release.zip *
         }
     }