mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-02-14 05:36:07 +00:00
43 lines
2.3 KiB
C#
43 lines
2.3 KiB
C#
using BinaryObjectScanner.Interfaces;
|
|
using SabreTools.Serialization.Wrappers;
|
|
|
|
namespace BinaryObjectScanner.Protection
|
|
{
|
|
/// <summary>
|
|
/// Protection created by Oreans and in use since at least before 2009. Known to be used in Book/Music Collector (http://www.alwinhoogerdijk.com/2009/12/24/protecting-software-with-themida/).
|
|
/// May possibly be used in the PC release of Dynasty Warriors 7 with Xtreme Legends (https://www.pcgamingwiki.com/wiki/Dynasty_Warriors_7_with_Xtreme_Legends).
|
|
/// Themida/WinLicense/"Code Virtualize" seem to all be interconnected/related to each other, or are all at least part of the SecureEngine suite together (https://www.oreans.com/products.php).
|
|
///
|
|
/// Versions:
|
|
/// 1.8x - 1.9x (Detect-It-Easy): ArcSoft TotalMedia 3 (http://downloads.fyxm.net/ArcSoft-TotalMedia-23085.html / https://web.archive.org/web/20221114042838/http://files.fyxm.net/23/23085/totalmediatheatre3platinum_retail_tbyb_all.exe).
|
|
///
|
|
/// Further links and resources:
|
|
/// https://github.com/VenTaz/Themidie
|
|
/// https://github.com/ergrelet/unlicense
|
|
/// https://github.com/horsicq/Detect-It-Easy/blob/master/db/PE/Themida.2.sg
|
|
///
|
|
/// TODO:
|
|
/// Add/Confirm detection for WinLicense/"Code Virtualize".
|
|
/// Investigate further ArcSoft programs.
|
|
/// Investigate PUBG (possibly older versions) (https://www.pcgamingwiki.com/wiki/PUBG:_Battlegrounds).
|
|
/// </summary>
|
|
public class Themida : IExecutableCheck<PortableExecutable>
|
|
{
|
|
/// <inheritdoc/>
|
|
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
|
|
{
|
|
// Get the "Arcsoft " section strings, if they exist
|
|
var strs = exe.GetFirstSectionStrings("Arcsoft ");
|
|
if (strs is not null)
|
|
{
|
|
// Found in "uDigital Theatre.exe" in http://downloads.fyxm.net/ArcSoft-TotalMedia-23085.html (https://web.archive.org/web/20221114042838/http://files.fyxm.net/23/23085/totalmediatheatre3platinum_retail_tbyb_all.exe).
|
|
// TODO: Investigate "uDRMCheck.dll" in the same product to see if it's related to Themida, or if it's a different form of DRM.
|
|
if (strs.Exists(s => s.Contains("Themida")))
|
|
return "Themida";
|
|
}
|
|
|
|
return null;
|
|
}
|
|
}
|
|
}
|