using System.Collections.Concurrent; using System.Collections.Generic; using System.Linq; using BinaryObjectScanner.Interfaces; using BinaryObjectScanner.Matching; using BinaryObjectScanner.Wrappers; namespace BinaryObjectScanner.Protection { public class WTMCDProtect : IPathCheck, IPortableExecutableCheck { /// public string CheckPortableExecutable(string file, PortableExecutable pex, bool includeDebug) { // Get the sections from the executable, if possible var sections = pex?.SectionTable; if (sections == null) return null; string name = pex.FileDescription; if (name?.Contains("Copy Protection Viewer") == true) return "WTM Protection Viewer"; name = pex.LegalTrademarks; if (name?.Contains("WTM Copy Protection") == true) return "WTM Protection Viewer"; name = pex.ProductName; if (name?.Contains("WTM Copy Protection Viewer") == true) return "WTM Protection Viewer"; // Get the code/CODE section strings, if they exist List strs = pex.GetFirstSectionStrings("code") ?? pex.GetFirstSectionStrings("CODE"); if (strs != null) { if (strs.Any(s => s.Contains("wtmdum.imp"))) return "WTM CD Protect"; } // Get the .text section strings, if they exist strs = pex.GetFirstSectionStrings(".text"); if (strs != null) { if (strs.Any(s => s.Contains("WTM DIGITAL Photo Protect"))) return "WTM Protection Viewer"; else if (strs.Any(s => s.Contains("WTM Copy Protection Viewer"))) return "WTM Protection Viewer"; } return null; } /// public ConcurrentQueue CheckDirectoryPath(string path, IEnumerable files) { var matchers = new List { new PathMatchSet(new List { new FilePathMatch("wtmfiles.dat"), new FilePathMatch("Viewer.exe"), }, "WTM Protection Viewer"), }; return MatchUtil.GetAllMatches(files, matchers, any: false); } /// public string CheckFilePath(string path) { // TODO: Add ImageX.imp as a wildcard, if possible var matchers = new List { new PathMatchSet(new FilePathMatch("Image.imp"), "WTM CD Protect"), new PathMatchSet(new FilePathMatch("Image1.imp"), "WTM CD Protect"), new PathMatchSet(new FilePathMatch("imp.dat"), "WTM CD Protect"), new PathMatchSet(new FilePathMatch("wtmfiles.dat"), "WTM Protection Viewer"), }; return MatchUtil.GetFirstMatch(path, matchers, any: true); } } }