Protection ID info thread - v6.4.0 (build 08.07.2010)

[Lurkios]

Just wanted to throw in a few things:

First off, thanks for keeping this tool updated - it's saved me A LOT of trouble over the years. The work you've put into it is very much appreciated.

I've noticed the latest version has a tendency to crash a lot under windows 7, generally right in the middle of scan but I can't track it down to any one file. It seems relatively random. I just get the standards windows application crash screen with the option to check for solutions and such. I'd say the crash rate is about 15% of scans, but when it does go it does detect correctly. (I realize you never gave it a go for win7, just letting you know.)

Also, I just wanted to throw in my lot for something like a "lite" version of protection id. I really don't care for all the extra tools, the registry entries or the desktop icons. I'd much rather it saved anything it really needed to save to a .ini, but without all the extra bloat/tools I don't see what it would need to save. Window sizes and such can be reset launch, no big deal. I like "clean" programs. A nice simple protection identifier would be great.

And finally, can you tell me what the "autoplay enabled/disabled" icon does? It's one of the 4 or 5 icons in the upper right (near pin, minimize to tray, etc.), looks like a little cog wheel. When you click it it gets shaded blue, but if I exit out of protection id and go back in it's white again. It doesn't seem to affect the CD or removable device autoplay setting at all - nor does it cause protection id to automatically scan or something like that. If you'd tell me what exactly this option changes (what registry entry) and what it was supposed to have done originally I'd appreciate it.

[TippeX]

hi, thanks for the feedback, windows 7 we do actually test on, we plan a new release pretty soon, which should hopefully fix any windows 7 issues you're having, some of the registry entries (like the context menu ones) will probably remain, the desktop icons can be turned off in the configuration part of pid..

the autoplay enabled icon turns off autoplay (or rather, it responds to the message windows sends when a disk is inserted and autoplay is about to load), but another program on the system can 'override' this if it responds differently to the global message windows sends.. will look into this further on windows 7

[ShadowDuke]

I haven't any issues on win7 x64, not one crash and i've scanned a lot of files lately.

[Tojosu]

where can we get the latest beta's from ? or is is closed secret group ?
i have many new tages games that don't show tages info and also i think tages can detect pid and crash it ?

[Tojosu]

so when is a new version available?
no xmas 09 preview this year?

how does tages make the current version crash ? how is it possible for a non executed data file to make another program crash just when it looks at the inside of it's contents? secret?

[TippeX]

it will be out when its out
tages crash has been fixed as far as i know
crash was caused by scanning past a memory boundary.. nothing magic, nothing secret, just a pointer being invalid

latest betas -> yep its a closed secret group, anyone can apply, but you'd have to have good reasons (ie: not just trying to obtain the latest version.. we look for people with good testing skills)
and well, you have 3 posts and your comment

also i think tages can detect pid and crash it ?

just told me you have no understanding of how pid works, or how processes work,
so you sort of shot yourself in the foot there

[TippeX]

we had a new user coming in posting a url which supposedly had protection id available as a download, the same user made 3 posts with similar content...

as a precautionary measure i deleted the posts...

if anyone does not know where / how to get protection id from a clean source then please use...

pid.gamecopyworld.com

we do NOT post any releases of protection id on ANY other sites except the one above, if you download it from ANYWHERE else, you do so at your own risk.

...

edit : update - i downloaded the supposed file and it was a dll inside a folder called 'key'... so it wasn't protection id, thus the user was spamming some malware / virus crap and got a christmas holiday, be careful of your sources folks

[cdkiller]

hello folks!

We are proud to present you the next and most up2date version of protection id.
it was about time to bring this to the public, as the last version was released back in march.

During development of this version we ported it over to MASM v10,
using the latest compiler & linker available at the moment.

This version of pid features highly optimized scanning routines, resulting in very fast detections.
i.e. a 2 GB setup.exe in processed in less then 1 second (smart mode kicks in).

We tweaked nearly all scans to benefit from our new procs.


core additions / changes

- new: compiled using masm v10 compiler & linker
- new: added in new and optimized scanning routines
- new: protection id is now able to scan inside msi files
- new: clean temp tool (Extensions -> Clean Temp)
- new: added in our own fast internal zlib decompresion routines
- new: compiler detector updated to detect:
- more Visual C++
- appended flash files
- Power Basic
- Watcom C/C++
- MinGW
- GoASM

- update: reporting part on file type, now reports bitness & file subsystem
- update: added in recovery system - if a crash happens when scanning a file/cd/dvd and the crash is in the scanning thread,
the seh system will 'recover' the crash, skipping all other scan modules and simply clean things up.
So a crash when scanning does NOT take protection id down (the crash is reported to the log)
- update: windows error code resolver dialog got a face lift and some added functionality
- update: initial modification to report cpu usage on ALL available cores
- update: shortcuts are now not made if pid is run from a removable drive
- update: added in reporting for uac setting in vista or higher
- update: scan size threshold increased to 50mb
- update: added in the nfo association configuration
- update: compiler detection enabled by default now
- update: adjusted the way the systray worked
- double left click on the pid icon will cause the pid window to be shown / hidden
- right click on the pid icon will cause the right click systray context menu to appear

- bugfix: cab file handler bug fixed
- bugfix: scan file on cd/dvd did not work
- bugfix: fix for shortcuts getting fucked
- bugfix: fixed bug in the seh system, which lead to a crash
- bugfix: file queue stuff (pause, remove, clear all) fully operational again
- bugfix: logic fix, checking section count could technically be wrong if exe was x64
- bugfix: selecting scan folder 2x resulted in it messing up
- bugfix: minor adjustment to avoid closing an invalid handle
- bugfix: fixed output bug on small files
- bugfix: fixed a possible win9x issue
- bugfix: minor gui fixes


detection additions / changes

- new: check_activemark.asm - added exact version detection & more detailed output for v4, v5 & v6 of ActiveMark
- new: check_byteshield.asm - ByteShield detection got heavily updated, now it contains a lot extra more info
- new: check_ea_custom.asm - added in detection for EA Custom Protection (used in The Sims 3)
- new: check_gameguard.asm - GameGuard Launcher Module & it's version got reported
- new: check_hackshield.asm - AhnLab HackShield detection added
- new: check_impulse.asm - Impulse DRM (+ core module) detection added
- new: check_protectdisc.asm - added in new versions: v9.11.0, v9.20.0, v9.25.0 & latest v9.26.0
- new: check_protectdisc.asm - added in detection of how many trial days a Protect Disc exe is allowed to run
- new: check_safedisc.asm - updated to detect clcd32.dll, dplayerx.dll, drvmgt.dll from old safedisc 1 games
- new: check_secureebook.asm - added in Secure eBook Wrapper detection
- new: check_securom.asm - added SecuROM DFA v1 and v2 detection
- new: check_securom.asm - added SecuROM 7 dfa.dll detection
- new: check_securom.asm - added detection for SecuROM 5 and 4 (or lower) dll modules (cms*.dll sintf*.dll)
- new: check_solidshield.asm - added in Tages Setup version detection in solidshield core.dll (if found)
- new: check_solidshield.asm - SolidShield wrapped dlls will be detected now
- new: check_starforce.asm - added in detection of StarForceFileSystem containers (SFFS)
- new: check_steam.asm - added in detection of the Steam Client API Module & report Steam api usage in exe
- new: check_themida.asm - updated to show watermarking on some versions
- new: check_playfirst.asm - added in detection of the Playfirst Game Library
- new: check_playrixwrapper.asm - added Playrix Game Wrapper detection
- new: check_reflexivearcade.asm - added in detection of build 177 & build 178 of the ReflexiveArcade Wrapper
- new: check_robingameswrapper.asm - added in Robin Games Wrapper detection
- new: check_spintop.asm - added SpinTop DRM Module detection
- new: check_mfortress.asm - added MegaFortress detection
- new: check_upx.asm - added in more informative upx info

- new: check_aase.asm - added Aase detection
- new: check_adnexeprotector.asm - added ADN Exe Protector v0.5 detection
- new: check_aliencryptor.asm - added Alien Cryptor v1.0 detection
- new: check_armadillo.asm - added Armadillo v6.40 and v6.60 - v7.00 (or newer) detection
- new: check_aspack.asm - added ASPack v2.2 detection
- new: check_asprotect.asm - added ASProtect v1.4 build 04.01 Beta detection
- new: check_aurastompercrypter.asm - added AuraStomper Crypter detection
- new: check_babelobfuscator.asm - Babel .Net Obfuscator detection added
- new: check_blindspot.asm - BlindSpot File Binder v1.0 detection added
- new: check_deepseaobfuscator.asm - added in DeepSea .Net Obfuscator detection
- new: check_dotfixniceprotect.asm - added version detection for v1.0 - v2.x, v2.8 - v2.9, v3.0 - v3.6
- new: check_dotnetreactor.asm - added in detection of dotNET Reactor v4.0 (or newer)
- new: check_dsrfileprotector.asm - added dSR File Protector detection
- new: check_eprot.asm - added !EProt detection
- new: check_epprotector.asm - added EP Protector v0.1 detection
- new: check_fishnet.asm - added Fish.NET packer detection
- new: check_flyskysoftware.asm - added Fly Sky Software Custom Protector detection
- new: check_hackhoundbinder.asm - added in Hack Hound File Binder detection
- new: check_ionworxidentifier.asm - added Ionworx Identifier SDK Module detection
- new: check_leetcryptor.asm - added LeetCryptor v1 detection
- new: check_moleboxultra.asm - added in MoleBox Ultra v4.x detection
- new: check_pcguard.asm - added detection of latest PC-Guard v5.04
- new: check_alloy.asm - added PGWARE Alloy [generic] detection
- new: check_rdgpolypack.asm - added RDG PolyPack v1.1 detection
- new: check_simbioz.asm - added in SimbiOZ v2.1 detection
- new: check_skycrypt.asm - added in Sky Crypt v2.0 detection
- new: check_stultrapack2.asm - added ST Ultra Pack 2 v0.6s detection
- new: check_themisbinder.asm - added in Themis Binder v0.2 detection
- new: check_upack.asm - added detection of more detailed versions
- new: check_vprotect.asm - added VProtect detection
- new: check_zipworx.asm - added ZipWorx detection

- new: license_bentleyieg.asm - added Bentley IEG License Service detection
- new: license_crypkeysdk.asm - added CrypKey v7.0 (or newer) detection
- new: license_crypkeysdk.asm - added detection of the CrypKey License Service Installer
- new: license_desawarelicensing.asm - added Desaware Licensing System for .NET Module detection
- new: license_elicense.asm - now detecting on a dll it didn't see before
- new: license_interlok.asm - updated to detect PACE InterLok System File
- new: license_reprise.asm - added Reprise License Manager detection
- new: license_sentinelrms.asm - added SafeNet Sentinel RMS v8.x detection

- new: dongle_hasp.asm - NetHASP Network Dongles are detected
- new: dongle_hasp.asm - added in detection of the Aladdin HASP SRM Run-time Environment Installer
- new: dongle_ilok.asm - added in iLok USB Hardware Dongle detection
- new: dongle_matrix.asm - added Matrix Dongle detection
- new. dongle_microdog.asm - added SafeNet MicroDog Driver installer detection
- new: dongle_sentinel.asm - added in detection of Rainbow NetSENTiNEL SUPER PRO Dongle
- new: dongle_syncrosoft.asm - added in SyncroSoft USB Dongle detection

- new: installer_advancedinstaller.asm - added Advanced Installer detection
- new: installer_autoplay_media_studio.asm - added Indigorose - AutoPlay Media Studio
- new: installer_bitrock.asm - added BitRock InstallBuilder Module detection
- new: installer_fenomen.asm - added Fenomen Downloader detection
- new: installer_gamehouse.asm - added GameHouse Installer detection
- new: installer_setupfactory.asm - added detection of Setup Factory v8.x modules
- new: installer_uharcsfx.asm - added UHARC SFX Archive detection

- improved: check_3plock.asm - added in another generic check
- improved: check_enigmaprotector - now detects on an Enigma version it didn't 'see' before
- improved: check_hexalock.asm - optimized HexaLock detection
- improved: check_laserlok.asm - optimized Laserlok scanning speed
- improved: check_protectdisc.asm - tweaked output
- improved: check_safedisc.asm - optimized Safedisc v1 scanning speed
- improved: check_smarte.asm - added in two new checks
- improved: check_starforce.asm - improved scanning speed
- improved: check_steam.asm - updated detection on another steam variant on assassins creed and r6 vegas
- improved: check_tages.asm - improved detection of the Tages protection driver
- improved: check_vob.asm - added one more generic check
- improved: check_execryptor2.asm - code tweaked to reduce false positives

- improved: check_alawar.asm - scanning speed optimizations
- improved: check_elefunwrapper.asm - scanning speed optimizations & reports offset / size of virgin executable
- improved: check_popcapdrm.asm - scanning speed optimizations
- improved: check_reflexivearcade.asm - optimized ReflexiveArcade Wrapper detection

- improved: check_abccryptor.asm - added in a new check
- improved: check_armprotector.asm - added in one more generic check
- improved: check_asdpack.asm - scanning speed optimizations
- improved: check_aspack.asm - scanning speed improvements
- improved: check_asprotect.asm - tweaked version output
- improved: check_atreprotector.asm - added in another generic check
- improved: check_bambam.asm - added in two more checks to tighten detection
- improved: check_beria.asm - improved Beria detection
- improved: check_dalcrypt.asm - added in two new checks
- improved: check_dotfuscator.asm - optimized scanning speed
- improved: check_dotnetprotector.asm - optimized scanning speed
- improved: check_enigmaprotector.asm - added in another generic check
- improved: check_epprotector.asm - code adjusted, made faster
- improved: check_exestealth.asm - optimized scanning speed
- improved: check_ezip.asm - scanning speed optimizations
- improved: check_exestealth.asm - improved scanning speed
- improved: check_gieprotector.asm - optimised the signature scan
- improved: check_kkrunchy.asm - added in detections for old kkrunchy (2003)
- improved: check_mew5.asm - Mew 5 EXE Coder v0.1 detection tweaked
- improved: check_mpress.asm - mpress for dot.net - tweaked detection
- improved: check_mslrh.asm - added in two more generic checks
- improved: check_mucruncher.asm - rewritten MuCruncher detection
- improved: check_mz0ope.asm - added in another check
- improved: check_nidhogg.asm - optimized Nidhogg scanning speed
- improved: check_packitbitch.asm - added in two new checks
- improved: check_polyene.asm - added in more generic checks for PolyEne
- improved: check_punisher.asm - added in three new checks
- improved: check_sevlock.asm - tweaked sevLock detection
- improved: check_simplepack.asm - now detects all the simplepack exe's it didn't detect before
- improved: check_softsentry.asm - added in more checks + optimized scanning speed
- improved: check_spicesnet.asm - added in another check
- improved: check_telock.asm - improved TeLock v1.0 detection
- improved: check_upack.asm - added more detailed version checks, tweaked some detections
- improved: check_upx.asm - fixed possible wrong detection
- improved: check_vbowatch.asm - updated with a better signature
- improved: check_visualprotect.asm - added in one more check
- improved: check_vmprotect.asm - now it detects on a dll it didn't 'see' before
- improved: check_wildtangent.asm - scanning speed optimizations
- improved: check_wlcrypt.asm - optimized WL-Crypt detection
- improved: check_xprotector.asm - added in two heuristic checks
- improved: check_yzpack.asm - tweaked

- improved: dongle_hasphlenvelope.asm - now detects on wrapped sys files too
- improved: dongle_keylok2.asm - improved Key-Lok II Dongle scan speed
- improved: dongle_marx.asm - added in another check
- improved: dongle_sentinel.asm - detects Sentinel on x64 executables
- improved: dongle_wibu.asm - added in another check

- improved: minor tweaks for all license detections
- improved: license_crypkeyinstant.asm - improved scanning speed in files wrapped with CrypKey Instant
- improved: license_crypkeysdk.asm - updated / tweaked CrypKey detection
- improved: license_elicense.asm - improved eLicense scanning speed
- improved: license_haspsl.asm - speed up HASP SL Licensing System scans
- improved: license_interlok.asm - scan speed improvements + added in detection for another 'variant' of InterLok
- improved: license_ntitles.asm - scanning speed improvements

- improved: installer_akinstaller.asm - scanning speed optimizations
- improved: installer_clickteam.asm - improved generic detection
- improved: installer_createinstall.asm - scanning speed optimizations
- improved: installer_gkwaresfx.asm - improved generic detection
- improved: installer_patchwise.asm - now detects a module it did not 'see' before
- improved: installer_rarsfx.asm - updated to handle new winrar sfx

- bugfix: check_starforce.asm - fixed possible crashbug
- bugfix: check_dotnetguard.asm - fixed non register preservation
- bugfix: check_vmprotect.asm - fixed generic detection
- bugfix: check_forgot.asm - fixed non detection
- bugfix: check_quickpacknt.asm - fixed non-detection bug
- bugfix: check_shrinkwrap.asm - fixed non-detection bug
- bugfix: check_upx.asm - fixed a possible wrong detection


CD/DVD/Image file/sector scan

- added in SecuROM v7.40 (or newer) detection via sector scan
- some more updates on the iso making code, and the cddvd_api core
- tweaking the cd/dvd dialog portion, now detects and reports errors better, along with better sector calculations
(will now abort if it detects a css encrypted sector when making an iso)

[ShadowDuke]

very nice work you two

thanks

[Blazkowicz]

Thanks cdkiller.
Already got first PiD crash
I already informed TippeX about it.

[TippeX]

yup. looking into it when rapidshare gives me a slot to get the files, cheers blazi, it should have kicked in a recovery for the crash, if it was during the scan, or did you get the seh window appearing (or.. hopefully not the doctor watson window) ?

[Blazkowicz]

I got seh window.

[TippeX]

strange blazi, the seh window was taken out in the 6.3.5 build (you will only see if if a crash happens when not scanning a file) - we added in a recovery system allowing pid to 'recover' from a crash when scanning the exe's, so you should have seen that output, and not the seh window..

if you can reproduce it, can you please check that the pid version reported in the seh window is 6.3.5.. if not, it'll explain the issue, if so, then im lost

i noticed that some kb update from microsoft blocked writing to the area where we put the context menu stuff, so there is a possibility your context menu is running an older pid (it was in my case)..

the fix for this is to load pid as admin once, enable the context menus, then exit.. it should then be fixed (hopefully)...

/me takes microsoft off his christmas list

[Blazkowicz]

Protection ID v0.6.3.5 DECEMBER has crashed...
Build 12/24/09-20:33:24

Welcome to the scene of the crash.... take me to the hospital

EAX = 000000001h, EBX = 0FFFFFFFFh, ECX = 000001029h, EDX = 000000002h
ESI = 000279080h, EDI = 004A5C4C4h, ESP = 00022FC0Ch, EBP = 00022FD60h

DS = 00023h, ES = 00023h, FS = 0003Bh, GS = 00000h, SS = 00023h
DR0 = 000000000h, DR1 = 000000000h, DR2 = 000000000h, DR3 = 000000000h
DR6 = 000000000h, DR7 = 000000000h

CCW = 0FFFF037Fh, CSW = 0FFFF0120h, CTW = 0FFFFFFFFh, CEO = 0381C745Bh
CES = 00598001Bh, CDO = 038341F48h, CDS = 0FFFF0023h, CR0NPX = 000000000h

Crash @ CS:EIP -> 0001Bh:077421994h, EFlags : 000010202h
Stack @ SS:ESP -> 00023h:00022FC0Ch

Crash Code : 0C0000005h
Crash Report : In Page Error

ThreadID : 023CCh / 09164
ThreadName : PiD Core Thread (thread 1)
Crash Happened in Scan File -> Unknown
Procedure Name : N/A
Crash File Line Range (low) -> 00
Crash File Line Range (high) -> 00
ProtectionID was scanning ->
Last Scan was -> Crash did NOT happen in scan thread
Scan was N/A
Next Scan is -> Crash did NOT happen in scan thread

Thread Start Va / Tag : 0x00408FFD

Pid executable range 0x00400000 -> 0x00574000 (0x00174000 bytes)

Crash address is NOT within pid's image


OS is XP SP3

[TippeX]

intersting, yours crashes for an entirely different reason, i'll try and reproduce it, and maybe increase the crash report data so it might show return addresses, looks like it crashed in kernel32 or user32..