diff --git a/BinaryObjectScanner.Test/Protection/InterLokTests.cs b/BinaryObjectScanner.Test/Protection/InterLokTests.cs new file mode 100644 index 00000000..cbeb5270 --- /dev/null +++ b/BinaryObjectScanner.Test/Protection/InterLokTests.cs @@ -0,0 +1,22 @@ +using System.IO; +using BinaryObjectScanner.Protection; +using Xunit; + +namespace BinaryObjectScanner.Test.Protection +{ + public class InterLokTests + { + [Fact] + public void CheckPortableExecutableTest() + { + string file = "filename"; + SabreTools.Models.PortableExecutable.Executable model = new(); + Stream source = new MemoryStream(); + SabreTools.Serialization.Wrappers.PortableExecutable pex = new(model, source); + + var checker = new InterLok(); + string? actual = checker.CheckExecutable(file, pex, includeDebug: false); + Assert.Null(actual); + } + } +} \ No newline at end of file diff --git a/BinaryObjectScanner/Protection/InterLok.cs b/BinaryObjectScanner/Protection/InterLok.cs new file mode 100644 index 00000000..de06b10c --- /dev/null +++ b/BinaryObjectScanner/Protection/InterLok.cs @@ -0,0 +1,36 @@ +using System.Text.RegularExpressions; +using BinaryObjectScanner.Interfaces; +using SabreTools.Serialization.Wrappers; + +namespace BinaryObjectScanner.Protection +{ + public class InterLok : IExecutableCheck + { + /// + public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug) + { + // Get the .rsrc section strings, if they exist + var strs = pex.GetFirstSectionStrings(".rsrc"); + if (strs != null) + { + // Found in "nfsc_link.exe" in IA item "nfscorigin". + // Full string: + // (: ) InterLok PC v2.0, PACE Anti-Piracy, Copyright (C) 1998, ALL RIGHTS RESERVED + var match = strs.Find(s => s.Contains("InterLok") && s.Contains("PACE Anti-Piracy")); + if (match != null) + return $"PACE Anti-Piracy InterLok {GetVersion(match)}"; + } + + return null; + } + + private static string GetVersion(string match) + { + var versionMatch = Regex.Match(match, @"(?<=InterLok )(.*?)(?=,)"); + if (versionMatch.Success) + return versionMatch.Value; + + return "(Unknown Version - Please report to us on GitHub)"; + } + } +} \ No newline at end of file