Protection ID info thread - v6.4.0 (build 08.07.2010)

[cdkiller]

The Gilde 2 v1.1 is wrapped with SecuROM 7.27.0010.
as its published by jowood i´d say it gots some custom checks too.

[cdkiller]

v5.2 changelog

- added: Protect DiSC protection level scan (Pro/Basic)
- added: SecuROM exact version detection for lots of v7.27.xxxx and the first of the new v7.28.xxxx
- added: Safedisc API detection Method 1 (available at oep dump of protected exe)
- added: Safedisc API detection Method 2 (scan protected executable)
- added: CDCops detection (scan *.QZ_ file)
- added: JoWood X-Prot v2.x detection
- added: Armadillo v4.54 detection
- added: ActiveMARK v6 detection
- added: Obsidium version detection for most files
- added: Petite v1.2, v1.3, v1.4, v2.2 & v2.3 exact version detection
- improved: Safedisc v4.70 detection in files with removed version string
- improved: SecuROM 7.26 / 7.27 detection, added more checks for detailed version
- improved: JoWood X-Prot v1.x detection improved
- improved: Protect DiSC 6/7 scan, added more detailed versions
- improved: BJFNT detection rewritten (version detection for v1.1, v1.2 & v1.3)
- improved: EXE32Pack detection rewritten (version detection for v1.37, v1.38 & v1.42)
- improved: ExeCryptor2 detection (also fixes possible false detections)
- improved: Krypton detection rewritten (version detection for v0.2, v0.3, v0.4 & v0.5)
- improved: NeoLite detection rewritten (faster & more accurate)
- improved: Obsidium generic detection, added one more check
- improved: PEBundle detection
- improved: PE Lock v1.0x detection rewritten
- improved: PE Pack detection rewritten (version detection for v0.99 & v1.0)
- improved: Perplex PE Protector v1.01 detection rewritten
- improved: PE Shield detection (version detection for v0.1d, v0.2, v0.25 & unknown versions)
- improved: Shrinker detection rewritten (version detection of v3.4, v3.5 & unknown versions)
- improved: SVKP detection rewritten, detection of v1.051, v1.11, v1.3x - v1.4x (or newer)
- improved: YodaCrypt detection rewritten (version detection for v1.1, v1.2 & v1.3)
- improved: detection for lots of minor exe protectors/packers rewritten, including: cEXE, Air EXE Lock,
DEF, EXEProt v1.x, E-Zip, Lamecrypt, NFO, Noodlecrypt, Passlock 2000, PeX,
PE Diminisher, PE Mangle, PE Nguincrypt, PE Ninja, PKLite32, SEPP, Softdefender,
UPX Scrambler, VBO Watch, VG Crypt, Winkrypt, WWPack32
- fixed: possible crash in Xtreme Protector detection when scanning ExeCryptor v2.2.x wrapped files
- removed: Protection Options in Armadillo scan (will be readded & improved later)
- implemented check for Win32 DLLs with EntryPoint 00h (also fixes rare ASPack/ASProtect crash)
- plus several protection version updates (i.e. Obsidium, MoloBox, PE Compact...)

due the amount of changes the version was raised to v5.2
most of the detection routines were recoded, resulting in faster scanning speed & being more accurate.

we´ve made improvements again in detection of the most common used pc game protections.
SecuROM 7.28 detection is here (older ones also updated and wrong detections fixed),
JoWoods new X-Prot will be detected, CDCops detection was added, ActiveMARK´s
latest version 6 will be recognized, Safedisc routine is able to detect the latest v4.70 games
with removed version and protection level (SDAPI or Safedisc Standard).
Protect DiSC detection is up to date (improved exact version scan) and now also detects
if the protection features are Basic / Pro.

thx to the people who helped with the more advanced features :-)

[GLH]

Great Work Again !!!

[Muji-FightR]

Nice work, dude
Arma protection check sounds nice, never knew PiD was actually capable of that

btw, I love MoloBox

[Monty Burns]

What shall I say, buddy ?

Excellent work......again

I may test it in detail, when I find some time.....

[cdkiller]

I may test it in detail, when I find some time.....

thx m8 i will apprecciate any help to trace down the bugs

i already found 2 bugs wich made it in v5.2 :/
1. detecting the safedisc api in non safedisc files (bah, must be drunk when coding this, bug happens very rarely tho but it could happen)
2. starforce 4.50 version display bug

also i´ve improved the safedisc version detection in files with removed version info (FIFA/NBA 2007 = Safedisc 4.60, Madden 2007 = Safedisc 4.70).

[dest4ever]

I think I found one more bug:

-=[ ProtectionID v5.1f ]=- (c) CdKiller & [x/xxx]
Build 15-09-2006....
> Ready

Scanning -> C:\Programme\Gothic III\engine.dll
File Type : Dll, Size : 6841344 (0686400h) Bytes
[!] NSPack compressed !
- Scan Took : 1.843 Seconds




-=[ ProtectionID v5.2 ]=- (c) CdKiller & [x/xxx]
Build 01-11-2006....
> Ready

Scanning -> C:\Programme\Gothic III\engine.dll
File Type : Dll, Size : 6841344 (0686400h) Bytes
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 1.969 Seconds

greetz dest

[cdkiller]

@dest4ever

that was a bug in v5.1f wich got fixed in the current v5.2.
engine.dll isn´t NSPack compressed, it is JoWood´s X-prot dll wrapper (added support for this too now).