SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-02-04 05:35:49 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

[Installer] Add PopCap Installer detection #51

New Issue
Open
opened 2026-01-29 21:05:24 +00:00 by claunia · 1 comment
claunia commented 2026-01-29 21:05:24 +00:00
Owner
Copy Link

Originally created by @TheRogueArchivist on GitHub (Jan 12, 2022).

Installer used by PopCap shareware games for a period of at least around 2004-2010. Files can be easily extracted using 7-zip, with two root folders ("cfg" and "files") being present. The "files" folder seems to contain the exact files as dropped into the installation directory. I haven't been able to find identifying strings in every sample I have, but some have "popcap" very early in the header, and others having "!popcapinstallersig!" somewhat later in the header. It tentatively seems that older games use "popcap" and newer ones use "!popcapinstallersig!", but this isn't for sure yet. According to 7-zip, these installers use at least 2 different compression methods, MSZip and LZX:21. I'm hoping that these should be able to be extracted by BOS, which would greatly aid in detection of PopCap DRM Protect (When added) and ActiveMARK.

7zFM_BR2Qtfgifx

7zFM_64YNArOq2X

Originally created by @TheRogueArchivist on GitHub (Jan 12, 2022). Installer used by PopCap shareware games for a period of at least around 2004-2010. Files can be easily extracted using 7-zip, with two root folders ("cfg" and "files") being present. The "files" folder seems to contain the exact files as dropped into the installation directory. I haven't been able to find identifying strings in every sample I have, but some have "popcap" very early in the header, and others having "!popcapinstallersig!" somewhat later in the header. It tentatively seems that older games use "popcap" and newer ones use "!popcapinstallersig!", but this isn't for sure yet. According to 7-zip, these installers use at least 2 different compression methods, MSZip and LZX:21. I'm hoping that these should be able to be extracted by BOS, which would greatly aid in detection of PopCap DRM Protect (When added) and ActiveMARK. ![7zFM_BR2Qtfgifx](https://user-images.githubusercontent.com/24215969/149040733-6c3c7c9b-e0a0-49db-a594-243858c9b128.png) ![7zFM_64YNArOq2X](https://user-images.githubusercontent.com/24215969/149040738-0daf77e7-5abd-46a3-aeaf-c7245bd854a6.png)
claunia commented 2026-01-29 21:05:24 +00:00
Author
Owner
Copy Link

@mnadareski commented on GitHub (Sep 7, 2025):

If there are any links or references for what items may contain this, please provide them.

@mnadareski commented on GitHub (Sep 7, 2025): If there are any links or references for what items may contain this, please provide them.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
help wanted
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SabreTools/BinaryObjectScanner#51
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?