From f910fe0632aa25f6654ea677b2b473acd252ebcd Mon Sep 17 00:00:00 2001 From: HeroponRikiBestest Date: Tue, 24 Jun 2025 18:32:50 -0400 Subject: [PATCH 1/3] Added check for modified securom product activation. Marked as draft because it relies on a recent infotool fix in order to function properly. --- BinaryObjectScanner/Protection/SecuROM.cs | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/BinaryObjectScanner/Protection/SecuROM.cs b/BinaryObjectScanner/Protection/SecuROM.cs index 0f59c174..f3e7575a 100644 --- a/BinaryObjectScanner/Protection/SecuROM.cs +++ b/BinaryObjectScanner/Protection/SecuROM.cs @@ -5,6 +5,8 @@ using SabreTools.Matching; using SabreTools.Matching.Content; using SabreTools.Matching.Paths; +using SabreTools.Models.PortableExecutable; +using SabreTools.Serialization; using SabreTools.Serialization.Wrappers; namespace BinaryObjectScanner.Protection @@ -44,6 +46,18 @@ public class SecuROM : IExecutableCheck, IPathCheck if (name.OptionalContains("SecuROM Activate & Play")) return $"SecuROM Product Activation v{pex.GetInternalVersion()}"; + // Fallback for PA if none of the above occur, in the case of companies that used their own modified PA + // variants. PiD refers to this as "SecuROM Modified PA Module". + // Found in Redump entries 111997 (paul.dll) and 56373+56374 (AurParticleSystem.dll). The developers of + // both, Softstar and Aurogon respectively(?), seem to have some connection, and use similar-looking + // modified PA. It probably has its own name like EA's GAM, but I don't currently know what that would be. + // Regardless, even if these are given their own named variant later, this check should remain in order to + // catch other modified PA variants (this would have also caught EA GAM, for example) and to match PiD's + // detection abilities. + name = pex.Model.ExportTable?.ExportNameTable?.Strings?[0]; + if (name.OptionalEquals("drm_pagui_doit")) + return $"SecuROM Product Activation - Modified"; + // Get the matrosch section, if it exists if (pex.ContainsSection("matrosch", exact: true)) return $"SecuROM Matroschka Package"; From 88b34b70882c5daa07811ec023bd7d2614b62365 Mon Sep 17 00:00:00 2001 From: HeroponRikiBestest Date: Mon, 8 Sep 2025 11:47:28 -0400 Subject: [PATCH 2/3] Fix variable name change post-rebase. --- BinaryObjectScanner/Protection/SecuROM.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/BinaryObjectScanner/Protection/SecuROM.cs b/BinaryObjectScanner/Protection/SecuROM.cs index 55bceeea..bce0f362 100644 --- a/BinaryObjectScanner/Protection/SecuROM.cs +++ b/BinaryObjectScanner/Protection/SecuROM.cs @@ -54,7 +54,7 @@ public class SecuROM : IExecutableCheck, IPathCheck // Regardless, even if these are given their own named variant later, this check should remain in order to // catch other modified PA variants (this would have also caught EA GAM, for example) and to match PiD's // detection abilities. - name = pex.Model.ExportTable?.ExportNameTable?.Strings?[0]; + name = exe.Model.ExportTable?.ExportNameTable?.Strings?[0]; if (name.OptionalEquals("drm_pagui_doit")) return $"SecuROM Product Activation - Modified"; From 6f25ff610ecfa508be21f26c47bdfed72b8720ac Mon Sep 17 00:00:00 2001 From: HeroponRikiBestest Date: Mon, 8 Sep 2025 11:50:51 -0400 Subject: [PATCH 3/3] Use wrapper exporttable, remove unneeded dependancies. --- BinaryObjectScanner/Protection/SecuROM.cs | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/BinaryObjectScanner/Protection/SecuROM.cs b/BinaryObjectScanner/Protection/SecuROM.cs index bce0f362..6a49542b 100644 --- a/BinaryObjectScanner/Protection/SecuROM.cs +++ b/BinaryObjectScanner/Protection/SecuROM.cs @@ -5,8 +5,6 @@ using SabreTools.Matching; using SabreTools.Matching.Content; using SabreTools.Matching.Paths; -using SabreTools.Models.PortableExecutable; -using SabreTools.Serialization; using SabreTools.Serialization.Wrappers; namespace BinaryObjectScanner.Protection @@ -54,7 +52,7 @@ public class SecuROM : IExecutableCheck, IPathCheck // Regardless, even if these are given their own named variant later, this check should remain in order to // catch other modified PA variants (this would have also caught EA GAM, for example) and to match PiD's // detection abilities. - name = exe.Model.ExportTable?.ExportNameTable?.Strings?[0]; + name = exe.ExportTable?.ExportNameTable?.Strings?[0]; if (name.OptionalEquals("drm_pagui_doit")) return $"SecuROM Product Activation - Modified";