Protection ID info thread - v6.4.0 (build 08.07.2010)

[GLH]

[Eversun]

Hello, I ran this tool and deleted the attend data, but when I ran the exe, no error, no open, nothing happened. I use this tool again to check it again, it said:

Scanning -> F:\Games\COD2TC\CoD2SP_s.exe
File Type : Exe, Size : 1789952 (01B5000h) Bytes
[!] Safedisc 4.60.000 detected but verification not successfull
assuming exe includes a faked Safedisc version or it has been cracked !
[!] Possible CD/DVD-Key or Serial Check -> cdkey
- Scan Took : 0.828 Seconds


so was there anything wrong with it? Thank you.

[TippeX]

Originally Posted by Eversun

Hello, I ran this tool and deleted the attend data

you mean appended data?

if so, why did you delete it, chances are the protection/crack needs it

[cdkiller]

Scanning -> I:\__pid collect\PC-GAME PROTECTiONS\Safedisc\Safedisc 4.60.000 (Call of Duty 2).exe
File Type : Exe, Size : 3139086 (02FE60Eh) Bytes
-> File has 1353230 (014A60Eh) bytes of appended data starting at offset 01B4000h
[!] Safedisc 4.60.000 detected !
[!] Possible CD/DVD-Key or Serial Check -> cdkey
- Scan Took : 1.391 Seconds

like tippex said, the appended data is part of the safedisc protection.

[!] Safedisc 4.60.000 detected but verification not successfull
assuming exe includes a faked Safedisc version or it has been cracked !

u thought you can crack safedisc when removing the appended data?
it´s not that easy. u need a debugger, bypass the anti-dbg, get to the (hardcoded) oep, dump, fix imports, fix redirected calls, recover stolen bytes and rebuild the exe.

[cdkiller]

this safedisc discussion made me have a deeper look at it
i´ve coded a better version detection when the version is removed.

-=[ ProtectionID v6.0 *PRiVATE* ALPHA ]=- (c) CDKiLLER & [x/xxx]
Build 2006-03-31
> Ready

Scanning -> I:\__pid collect\PC-GAME PROTECTiONS\Safedisc\Safedisc 4.xx.xxx (real v4.00.001) (NBA Live 2006).exe
File Type : Exe, Size : 10668852 (0A2CB34h) Bytes
-> File has 1481524 (0169B34h) bytes of appended data starting at offset 08C3000h
[!] Safedisc v3.20 - v4.xx or newer [removed version] detected !
[!] removed version is Safedisc v4.00.000 - v4.00.003
[!] Possible CD/DVD-Key or Serial Check -> Unregistered
- Scan Took : 2.437 Seconds

Scanning -> I:\__pid collect\PC-GAME PROTECTiONS\Safedisc\Safedisc 4.xx.xxx + Custom (real v4.60.000) (Need For Speed Most Wanted v1.3).exe
File Type : Exe, Size : 7254894 (06EB36Eh) Bytes
-> File has 1192814 (012336Eh) bytes of appended data starting at offset 05C8000h
[!] Safedisc v3.20 - v4.xx or newer [removed version] detected !
[!] removed version is Safedisc v4.50.000 - v4.60.000
[!] Possible CD/DVD-Check String -> Please insert
[!] Possible CD/DVD-Key or Serial Check -> CDKey
- Scan Took : 1.735 Seconds

---------------

here´s a list with a few games without any version info:
Flatout
Knight Rider 2
Need For Speed Underground 2
Need For Speed Most Wanted
NHL 2006
NBA Live 2006

i´ve only seen EA games without version info in it...

now you´ll see the version, not 100% exact but better than before (v3.20 - v4.xx or newer)

[Monty Burns]

Hi mate,

good to here you are making progress.

I have got two questions:

1) When will the next "public" be released ?
2) Will it also detect the most common app protectors/packers (I think, you know what I mean: Das Gürteltier mit all seinen Facetten, z.B.)


Greetz

Monty

[cdkiller]

Das Gürteltier mit all seinen Facetten

yeah the Armadillo protection has been improved a lot. PID can detect versions like v4.00 - v4.05, v4.10 - v4.20, v4.30, v4.40...
i´m also thinking about detections if some arma features like Import Elemination, Debug-Blocker, Copy-Mem2 etc are used.

When will the next "public" be released ?

during the following week.
no big changes thou, "just" updated and improved detections.
v6.0 will be the big one

[Monty Burns]

Originally Posted by cdkiller

yeah the Armadillo protection has been improved a lot. PID can detect versions like v4.00 - v4.05, v4.10 - v4.20, v4.30, v4.40...
i´m also thinking about detections if some arma features like Import Elemination, Debug-Blocker, Copy-Mem2 etc are used.

REALLY ??

Oh man, that sounds fantastic. I don't know how this could be coded, but anyway...when you tell me it does, I think I can rely on you
Detecting certain arma versions (e.g. 4.10 and NOT 3.78-4.xx, like PEID does) would already be rather cool, but detecting IAT elimination, CopyMem II, Code-Splicing, Nanomites, etc., would be..................
well, I am speechless

Can't hardly wait to see this tool "in action".

[GLH]

Originally Posted by cdkiller

v6.0 will be the big one

I cannot expect it...

[cdkiller]

v5.1 is ready to download

The last public version (v5.0 Final c) was released 14.12.2004.
Right after releasing it, the development of v6.0 has began and still continues.
Now we release v5.1 to keep you up to date. No core changes, just some files from v6.0 alpha thrown into v5 ;-)
New protections were added, important ones got updated and improved, bugs got fixed...

here´s the changelog:

- added: JoWood X-Prot detection
- added: Laserlok Marathon detection
- added: Protect DiSC detection
- added: Ring-Protech detection
- added: SecuROM v7.xx.xx detection
- added: SmartE Copy Protection detection
- added: Starforce v3.x version is now displayed with build number
- added: Tages v5 detection
- added: VOB Protect CD/DVD v5.9x with build number detection instead of showing "VOB Protect CD/DVD [modified version] detected"
- added: ACProtect version detection for v1.09, v1.10, v1.20, v1.21, v1.22, v1.23, v1.3c, v1.32, v1.35 / v1.40, v1.41 and v2.0
- added: Armadillo version detection for v1.00 - v1.84, v2.00 - v2.40, v2.60 - v3.00, v3.05 - v3.20
v3.30 - v3.61, v3.70 - v3.75, v3.76 - v3.77, v3.78, v4.00 - v4.05, v4.10 - v4.20, v4.30 and v4.40
- added: ASProtect version detection for v1.0, v1.1, v1.11, v1.2, 1.22 - v1.23 Beta, 1.23 RC4 - 1.3.08.24, 1.23 RC4 (Registered),
v1.31, v1.32, v1.33, v2.0 Alpha and v2.1 - v2.11
- added: EXE Cryptor v2.0 - v2.1.xx, v2.2.0 - v2.2.4 and v2.3.0 - v2.3.7 detection
- added: FSG v1.0, v1.2, v1.3 - v1.31, v1.3.3, v1.33a and v2.0 detection
- added: PE Compact v2.xx generic detection
- added: PE Compact version detection for v1.00 - v1.3x, v1.40 - v1.50, v1.55, v1.56 - v1.65, v1.66 - v1.84,
v2.0 Beta Build v52, v2.00 - v2.10 and v2.20 - v2.64
- added: some more CD/DVD-Check detections
- improved: Laserlok detection
- improved: Safedisc [generic v1, v2, v3, v4] verification code making it possible to detect a faked Safedisc protection were the SD string
'BoG_ *90.0&!! Yy>' was simply added to the PE header, also added another piece of code checking for 'real' Safedisc
- improved: Safedisc v3.20 - v4.xx [unknown version] is more accurate due new checks
(i.e. NBA Live 2006, version is removed, PID detects 'Safedisc v4.00.001 - v4.00.003)
- improved: Safecast detection in safecast´ed executables
- improved: SecuROM detection, added one more check to speed up scanning in non SecuROM´ed files
- improved: StarForce detection
- improved: UPX detection
- improved: VOB Protect CD/DVD detection completely rewritten

protection id is going to be more than a pc-game protection scanner in the next release. the most important application protections are already be detected in this version. a lot more will follow later.

heh just noticed my post count beeing at 1111

[Grumpy]

Well done buddy. Nice work as usual.

[Monty Burns]

Yepp, just tested it on some Arma, AsProtect, Aspack, ExeCryptor etc. files.....very, very nice work.

Many Thanx, dude!

[bclkostra]

http://i.have.been.banned.for.advertising Visit This New Software

[coffin filler]

He he made me giggle. (I have been banned for advertizing) straight to the point Jor forster.

[cdkiller]

seems like it´s time for v5.1b

Tages detection is broken in Act Of War High Tension.
seems like a new version (v5.4.x.x ?) or a custom one.

also i´ll include "TryMedia ActiveMark" and "KochMedia ePolice" detection cos they´r used in lots of "digital download" versions of pcgames.

the armadillo / asprotect detection will also receive an update to recognize the latest version.