Add PACE Anti-Piracy InterLok detection (#362)

* Add detection class and test class for PACE Anti-Piracy Interlok * Remove unnecessary empty lines after end of class. * Added missing null check for pex section strings. * Add newline above getversion * GetFirstSectionStrings assigned to variable. * Change getversion in InterLok to use regex. * Final? getversion regex cleanup

Author: HeroponRikiBestest

BinaryObjectScanner.Test/Protection/InterLokTests.cs

@@ -0,0 +1,22 @@
+using System.IO;
+using BinaryObjectScanner.Protection;
+using Xunit;
+
+namespace BinaryObjectScanner.Test.Protection
+{
+ public class InterLokTests
+ {
+ [Fact]
+ public void CheckPortableExecutableTest()
+ {
+ string file = "filename";
+ SabreTools.Models.PortableExecutable.Executable model = new();
+ Stream source = new MemoryStream();
+ SabreTools.Serialization.Wrappers.PortableExecutable pex = new(model, source);
+
+ var checker = new InterLok();
+ string? actual = checker.CheckExecutable(file, pex, includeDebug: false);
+ Assert.Null(actual);
+ }
+ }
+}

BinaryObjectScanner/Protection/InterLok.cs

@@ -0,0 +1,36 @@
+using System.Text.RegularExpressions;
+using BinaryObjectScanner.Interfaces;
+using SabreTools.Serialization.Wrappers;
+
+namespace BinaryObjectScanner.Protection
+{
+ public class InterLok : IExecutableCheck<PortableExecutable>
+ {
+ /// <inheritdoc/>
+ public string? CheckExecutable(string file, PortableExecutable pex, bool includeDebug)
+ {
+ // Get the .rsrc section strings, if they exist
+ var strs = pex.GetFirstSectionStrings(".rsrc");
+ if (strs != null)
+ {
+ // Found in "nfsc_link.exe" in IA item "nfscorigin".
+ // Full string: 
+ // (: ) InterLok PC v2.0, PACE Anti-Piracy, Copyright (C) 1998, ALL RIGHTS RESERVED
+ var match = strs.Find(s => s.Contains("InterLok") && s.Contains("PACE Anti-Piracy"));
+ if (match != null)
+ return $"PACE Anti-Piracy InterLok {GetVersion(match)}";
+ }
+ 
+ return null;
+ }
+ 
+ private static string GetVersion(string match)
+ {
+ var versionMatch = Regex.Match(match, @"(?<=InterLok )(.*?)(?=,)");
+ if (versionMatch.Success)
+ return versionMatch.Value;
+ 
+ return "(Unknown Version - Please report to us on GitHub)";
+ }
+ }
+}