Add PACE Anti-Piracy InterLok detection

BinaryObjectScanner.Test/Protection/InterLokTests.cs

@@ -0,0 +1,22 @@
+using System.IO;
+using BinaryObjectScanner.Protection;
+using Xunit;
+
+namespace BinaryObjectScanner.Test.Protection
+{
+    public class InterLokTests
+    {
+        [Fact]
+        public void CheckPortableExecutableTest()
+        {
+            string file = "filename";
+            SabreTools.Models.PortableExecutable.Executable model = new();
+            Stream source = new MemoryStream();
+            SabreTools.Serialization.Wrappers.PortableExecutable pex = new(model, source);
+
+            var checker = new InterLok();
+            string? actual = checker.CheckExecutable(file, pex, includeDebug: false);
+            Assert.Null(actual);
+        }
+    }
+}

BinaryObjectScanner/Protection/InterLok.cs

@@ -0,0 +1,36 @@
+using System.Text.RegularExpressions;
+using BinaryObjectScanner.Interfaces;
+using SabreTools.Serialization.Wrappers;
+
+namespace BinaryObjectScanner.Protection
+{
+    public class InterLok : IExecutableCheck<PortableExecutable>
+    {
+        /// <inheritdoc/>
+        public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
+        {
+            // Get the .rsrc section strings, if they exist
+            var strs = pex.GetFirstSectionStrings(".rsrc");
+            if (strs != null)
+            {
+                // Found in "nfsc_link.exe" in IA item "nfscorigin".
+                // Full string: 
+                // (: ) InterLok PC v2.0, PACE Anti-Piracy, Copyright (C) 1998, ALL RIGHTS RESERVED
+                var match = strs.Find(s => s.Contains("InterLok") && s.Contains("PACE Anti-Piracy"));
+                if (match != null)
+                    return $"PACE Anti-Piracy InterLok {GetVersion(match)}";
+            }
+
+            return null;
+        }
+
+        private static string GetVersion(string match)
+        {
+            var versionMatch = Regex.Match(match, @"(?<=InterLok )(.*?)(?=,)");
+            if (versionMatch.Success)
+                return versionMatch.Value;
+
+            return "(Unknown Version - Please report to us on GitHub)";
+        }
+    }
+}