1111namespace BinaryObjectScanner . Protection
1212{
1313 // TODO: Investigate SecuROM for Macintosh
14+ // TODO: Think of a way to detect dfe
1415 public class SecuROM : IExecutableCheck < PortableExecutable > , IPathCheck
1516 {
1617 /// <summary>
@@ -100,7 +101,7 @@ public class SecuROM : IExecutableCheck<PortableExecutable>, IPathCheck
100101 /// <inheritdoc/>
101102 public string ? CheckExecutable ( string file , PortableExecutable exe , bool includeDebug )
102103 {
103- // Check if executable is a Securom PA Module
104+ // Check if executable is a SecuROM PA module
104105 var paModule = CheckProductActivation ( exe ) ;
105106 if ( paModule != null )
106107 return paModule ;
@@ -114,6 +115,23 @@ public class SecuROM : IExecutableCheck<PortableExecutable>, IPathCheck
114115 return packageType ;
115116 }
116117
118+ // Alf.dll
119+ var name = exe . ProductName ;
120+ if ( name . OptionalEquals ( "DFA Unlock Dll" ) )
121+ return $ "SecuROM DFA Unlock v{ exe . GetInternalVersion ( ) } ";
122+
123+ if ( name . OptionalEquals ( "Release Control Unlock Dll" ) )
124+ return $ "SecuROM Release Control Unlock v{ exe . GetInternalVersion ( ) } ";
125+
126+ // Dfa.dll and ca.dll. The former seems to become the latter later on.
127+ name = exe . FileDescription ;
128+ if ( name . OptionalEquals ( "SecuROM Data File Activation Library" ) )
129+ return $ "SecuROM Data File Activation v{ exe . GetInternalVersion ( ) } ";
130+
131+ // Copyright is only checked because "Content Activation Library" seems broad on its own.
132+ if ( name . OptionalEquals ( "Content Activation Library" ) && exe . LegalCopyright . OptionalContains ( "Sony DADC Austria AG" ) )
133+ return $ "SecuROM Content Activation v{ exe . GetInternalVersion ( ) } ";
134+
117135 if ( exe . ContainsSection ( ".dsstext" , exact : true ) )
118136 return $ "SecuROM 8.03.03+";
119137
@@ -470,10 +488,17 @@ private static string GetV8WhiteLabelVersion(PortableExecutable exe)
470488 // Regardless, even if these are given their own named variant later, this check should remain in order to
471489 // catch other modified PA variants (this would have also caught EA GAM, for example) and to match PiD's
472490 // detection abilities.
473- // TODO: Decide whether to get internal version or not in the future.
491+
474492 name = exe . ExportTable ? . ExportNameTable ? . Strings ? [ 0 ] ;
475493 if ( name . OptionalEquals ( "drm_pagui_doit" ) )
476- return $ "SecuROM Product Activation - Modified";
494+ {
495+ // Not all of them are guaranteed to have an internal version
496+ var version = exe . GetInternalVersion ( ) ;
497+ if ( string . IsNullOrEmpty ( version ) )
498+ return $ "SecuROM Product Activation - Modified";
499+
500+ return $ "SecuROM Product Activation v{ exe . GetInternalVersion ( ) } - Modified";
501+ }
477502
478503 return null ;
479504 }
0 commit comments