Skip to content

Commit a76a8d0

Browse files
Add check for modified securom product activation. (#372)
* Added check for modified securom product activation. Marked as draft because it relies on a recent infotool fix in order to function properly. * Fix variable name change post-rebase. * Use wrapper exporttable, remove unneeded dependancies.
1 parent de35586 commit a76a8d0

File tree

1 file changed

+12
-0
lines changed

1 file changed

+12
-0
lines changed

BinaryObjectScanner/Protection/SecuROM.cs

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,18 @@ public class SecuROM : IExecutableCheck<PortableExecutable>, IPathCheck
4444
if (name.OptionalContains("SecuROM Activate & Play"))
4545
return $"SecuROM Product Activation v{exe.GetInternalVersion()}";
4646

47+
// Fallback for PA if none of the above occur, in the case of companies that used their own modified PA
48+
// variants. PiD refers to this as "SecuROM Modified PA Module".
49+
// Found in Redump entries 111997 (paul.dll) and 56373+56374 (AurParticleSystem.dll). The developers of
50+
// both, Softstar and Aurogon respectively(?), seem to have some connection, and use similar-looking
51+
// modified PA. It probably has its own name like EA's GAM, but I don't currently know what that would be.
52+
// Regardless, even if these are given their own named variant later, this check should remain in order to
53+
// catch other modified PA variants (this would have also caught EA GAM, for example) and to match PiD's
54+
// detection abilities.
55+
name = exe.ExportTable?.ExportNameTable?.Strings?[0];
56+
if (name.OptionalEquals("drm_pagui_doit"))
57+
return $"SecuROM Product Activation - Modified";
58+
4759
// Get the matrosch section, if it exists
4860
if (exe.ContainsSection("matrosch", exact: true))
4961
return $"SecuROM Matroschka Package";

0 commit comments

Comments
 (0)