using System.Collections.Concurrent; using System.Collections.Generic; using System.Linq; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; namespace BinaryObjectScanner.Protection { /// /// /// /// /// public class SoftLock : IPortableExecutableCheck, IPathCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { // Get the sections from the executable, if possible var sections = pex?.SectionTable; if (sections == null) return null; // Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP" string name = pex.InternalName; if (name?.Equals("Softlock Protected Application") == true) return "SoftLock"; // Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP" name = pex.Comments; if (name?.Equals("Softlock Protected Application") == true) return "SoftLock"; // Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP" var stMatch = pex.FindStringTableByEntry("Softlock CD"); if (stMatch.Any()) return "SoftLock"; // Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP" stMatch = pex.FindStringTableByEntry("Softlock USB Key"); if (stMatch.Any()) return "SoftLock"; // Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP" var dbMatch = pex.FindDialogByTitle("Softlock Protection Kit"); if (dbMatch.Any()) return "SoftLock"; // Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP" dbMatch = pex.FindDialogByTitle("About Softlock Protected Application"); if (dbMatch.Any()) return "SoftLock"; // Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP" dbMatch = pex.FindDialogBoxByItemTitle("www.softlock.net"); if (dbMatch.Any()) return "SoftLock"; // TODO: See if the version number is anywhere else // TODO: Parse the version number out of the dialog box item // Found in "IALib.DLL" in IA item "TAFSEERVER4SETUP" dbMatch = pex.FindDialogBoxByItemTitle("Softlock Protected Application Version 1.0"); if (dbMatch.Any()) return "SoftLock"; // There are many mentions of USB dongle and CD protection in the various string tables // and dialog boxes. See if any of those are unique to SoftLock. // Get strings from .section, if possible var strings = pex.GetFirstSectionStrings(".section"); if (strings != null && strings.Any()) { // Found in "TafseerVer4.exe" in IA item "TAFSEERVER4SETUP" if (strings.Any(s => s?.Contains("SOFTLOCKPROTECTION") == true)) return "SoftLock"; } // Investigate if the ".section" section is an indicator of SoftLock return null; } /// public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files) { var matchers = new List { new PathMatchSet(new List { new PathMatch(needle: "SOFTLOCKC.dat", useEndsWith: true), new PathMatch("SOFTLOCKI.dat", useEndsWith: true), }, "SoftLock"), }; return MatchUtil.GetAllMatches(files, matchers, any: false); } /// public string CheckFilePath(string path) { var matchers = new List { new PathMatchSet(new PathMatch("SOFTLOCKC.dat", useEndsWith: true), "SoftLock"), new PathMatchSet(new PathMatch("SOFTLOCKI.dat", useEndsWith: true), "SoftLock"), }; return MatchUtil.GetFirstMatch(path, matchers, any: true); } } }