Skip to content

Commit d1f1c1f

Browse files
Process some extra securom DLLs, PA versioning (#384)
* Process a few extra securom things * Forgot to remove copy paste * move out of helper
1 parent d969dd6 commit d1f1c1f

File tree

1 file changed

+28
-3
lines changed

1 file changed

+28
-3
lines changed

BinaryObjectScanner/Protection/SecuROM.cs

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
namespace BinaryObjectScanner.Protection
1212
{
1313
// TODO: Investigate SecuROM for Macintosh
14+
// TODO: Think of a way to detect dfe
1415
public class SecuROM : IExecutableCheck<PortableExecutable>, IPathCheck
1516
{
1617
/// <summary>
@@ -100,7 +101,7 @@ public class SecuROM : IExecutableCheck<PortableExecutable>, IPathCheck
100101
/// <inheritdoc/>
101102
public string? CheckExecutable(string file, PortableExecutable exe, bool includeDebug)
102103
{
103-
// Check if executable is a Securom PA Module
104+
// Check if executable is a SecuROM PA module
104105
var paModule = CheckProductActivation(exe);
105106
if (paModule != null)
106107
return paModule;
@@ -114,6 +115,23 @@ public class SecuROM : IExecutableCheck<PortableExecutable>, IPathCheck
114115
return packageType;
115116
}
116117

118+
// Alf.dll
119+
var name = exe.ProductName;
120+
if (name.OptionalEquals("DFA Unlock Dll"))
121+
return $"SecuROM DFA Unlock v{exe.GetInternalVersion()}";
122+
123+
if (name.OptionalEquals("Release Control Unlock Dll"))
124+
return $"SecuROM Release Control Unlock v{exe.GetInternalVersion()}";
125+
126+
// Dfa.dll and ca.dll. The former seems to become the latter later on.
127+
name = exe.FileDescription;
128+
if (name.OptionalEquals("SecuROM Data File Activation Library"))
129+
return $"SecuROM Data File Activation v{exe.GetInternalVersion()}";
130+
131+
// Copyright is only checked because "Content Activation Library" seems broad on its own.
132+
if (name.OptionalEquals("Content Activation Library") && exe.LegalCopyright.OptionalContains("Sony DADC Austria AG"))
133+
return $"SecuROM Content Activation v{exe.GetInternalVersion()}";
134+
117135
if (exe.ContainsSection(".dsstext", exact: true))
118136
return $"SecuROM 8.03.03+";
119137

@@ -470,10 +488,17 @@ private static string GetV8WhiteLabelVersion(PortableExecutable exe)
470488
// Regardless, even if these are given their own named variant later, this check should remain in order to
471489
// catch other modified PA variants (this would have also caught EA GAM, for example) and to match PiD's
472490
// detection abilities.
473-
// TODO: Decide whether to get internal version or not in the future.
491+
474492
name = exe.ExportTable?.ExportNameTable?.Strings?[0];
475493
if (name.OptionalEquals("drm_pagui_doit"))
476-
return $"SecuROM Product Activation - Modified";
494+
{
495+
// Not all of them are guaranteed to have an internal version
496+
var version = exe.GetInternalVersion();
497+
if (string.IsNullOrEmpty(version))
498+
return $"SecuROM Product Activation - Modified";
499+
500+
return $"SecuROM Product Activation v{exe.GetInternalVersion()} - Modified";
501+
}
477502

478503
return null;
479504
}

0 commit comments

Comments
 (0)