BurnOut 1.01 - release notes and download link

vbimport

#1

Hey all!
Here is the next BurnOut version: BurnOut 1.01
https://sourceforge.net/projects/burnout/

changelog:

  • New protection detections:
    -AACS
    -DVD-Movie-PROTECT
    -JoWooD X-Prot v1
    -Protect DVD-Video
    -Ring-Protech
    -Softlock
    -SolidShield
    -Sysiphus DVD
    -XCP

  • 3Plock detection improved

  • Armadillo detection improved

  • CD-Cops detection improved

  • Code Lock detection improved

  • Hexalock AutoLock detection improved

  • JoWooD X-Prot v1 and v2 detection improved

  • JoWooD X-Prot v1 version detection added

  • LaserLock version and build detection added

  • LaserLock Marathon and Laserlock detection improved

  • SafeCast detection improved

  • SafeDisc version detection out of file size improved

  • VOB ProtectCD/DVD Build detection improved

  • EVORE can now be used to get the exact VOB ProtectCD/DVD version

  • ProtectDISC 8.1 detection added

  • ProtectDISC version/build detection improved

  • SecuROM 1-3 detection improved

  • StarForce version detection improved

  • SVK Protector detection improved

  • TAGES detection improved

  • minor changes in app closing procedure

  • minor gui changes (filename display)

  • new functions “ANSItoUnicodeString” and “UnicodetoANSIString”

  • EVORE improved

  • the check if file is executable is now done before file is completely read in

  • the file executed by EVORE is now a copy of the scanned file put to the computer’s temp directory and not the scanned file itself

  • Fixed a Bug which made BurnOut not detect StarForce in protect.dll and protect.exe

  • Fixed a Bug which caused BurnOut to freeze while scanning a ProtectDISC 8.0 protected file

  • New language: Italian (thx to Pispolino)

PS: Can an admim/moderator make the topic “read first”, please?


#3

A new year - a new BurnOut release,
Year 2010 - BurnOut version 1.02.

After many, many months and days I’m very proud to announce next BurnOut release, 1.02.

changes:
*New protection detection:
-ByteShield
-CD-X
-CDSHiELD SE
-Impulse Reactor
-IndyVCD
-SecuROM Product Activation
*LaserLock detection improved
*ProtectDISC version detection improved
*ProtectDISC build detection corrected (ProtectDisc 7.6-x)
*SecuROM 4 version detection improved
*SecuROM 5 version detection improved
*SecuROM 7 version detection improved
*StarForce detection improved
*VOB ProtectCD/DVD version detection added

*switched to .Net 2.0
*shell context menu support (“Scan with BurnOut”)
*GUI changes/improvements
*EVORE is now Vista/Win 7 compatible
*if BurnOut is started for the first time its language is automatically set to the language used by the operating system
*EVORE improved (ProtectDISC 8)
*EVORE improved: check if file is executable and not a dll file before file is executed
*Drag&Drop allows now multiple files, the first one in which a protection is found will be shown
*Added question if file should be scanned if it is bigger than 15 Mb and “scan files bigger than 15 Mb” option is unchecked

Have fun with BurnOut!
gf7


#4

uhuh i guess somebody didn´t test it before releasing…

*New protection detection:
-ByteShield

doesn´t detect on all byteshield softs i scanned (5 games).
i was doing a file scan of every exe/dll the games got.

i.e. All Aspect Warfare Demo v1.18.23

[B][U]AAWDEMO.exe[/U][/B]

[B]burnout: none[/B]

[B]pid:[/B]
Scanning -> H:\ARCHIVE\PC-ISO PROTECTiONS\ByteShield\All Aspect Warfare Demo v1.18.23\AAWDEMO.EXE
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 700416 (0AB000h) Byte(s)
[File Heuristics] -> Flag : 00000000000000001000000000000000 (0x00008000)
[B][!] ByteShield Software Activation Client v1. 0. 0. 1 ![/B]
[i] Server : server105.byteadmin.com / Port : 43
[i] Url : /particle/ParticleServlet
[i] UName : pt_8_708d2d8ee8fb1200788d2d8ee8fb1200_AAWDEMO.EXE_200961915732218
[i] DataFile Combined Url : server105.byteadmin.com:43/particle/ParticleServlet/pt_8_708d2d8ee8fb1200788d2d8ee8fb1200_AAWDEMO.EXE_200961915732218
[CompilerDetect] -> Visual C/C++

  • Scan Took : 0.844 Second(s)

[B][U]AAWDEMO.bbz[/U][/B]

[B]burnout: none[/B]

[B]pid:[/B]
Scanning -> H:\ARCHIVE\PC-ISO PROTECTiONS\ByteShield\All Aspect Warfare Demo v1.18.23\AAWDEMO.bbz
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 3362304 (0334E00h) Byte(s)
[File Heuristics] -> Flag : 00000000000001001000010000000000 (0x00048400)
[B][!] ByteShield Encrypted Executable[/B]
[CompilerDetect] -> Visual C/C++

  • Scan Took : 0.813 Second(s)

[B][U]Byteshield.dll[/U][/B]

[B]burnout: none[/B]

[B]pid:[/B]
Scanning -> H:\ARCHIVE\PC-ISO PROTECTiONS\ByteShield\All Aspect Warfare Demo v1.18.23\Byteshield.dll
File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 277504 (043C00h) Byte(s)
[File Heuristics] -> Flag : 00000000000001101100000000000000 (0x0006C000)
[B][!] ByteShield Component Module !
[i] Encrypted Executable real entrypoint : 0x006595D4
[!] MegaFortress detected ![/B]
[CompilerDetect] -> Visual C/C++

  • Scan Took : 0.907 Second(s)

*New protection detection:
-Impulse Reactor

same here, didn´t detect on any file i checked

i.e. Red.Faction Guerrilla

[B][U]ImpulseReactor.dll[/U][/B]

[B]burnout: none[/B]

[B]pid:[/B]
Scanning -> H:\ARCHIVE\PC-ISO PROTECTiONS\Impulse\Red Faction Guerrilla\ImpulseReactor.dll
File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 1437952 (015F100h) Byte(s)
-> File Appears to be Digitally Signed @ Offset 015E000h, size : 01100h / 04352 byte(s)
[File Heuristics] -> Flag : 00000000000000001000000000000100 (0x00008004)
[B][!] Impulse DRM Core Module v1. 0. 0. 59[/B]
[CompilerDetect] -> Visual C/C++

  • Scan Took : 0.860 Second(s)

*StarForce detection improved

hmmm it didn´t detect most game exes as starforce

i.e. Trine v1.05 (russian)

[B][U]trine.exe[/U][/B]

[B]burnout: none[/B]

[B]pid:[/B]
Scanning -> H:\ARCHIVE\PC-ISO PROTECTiONS\Starforce\Starforce FL-Disc 5.70.07.02 Trine v1.05 (russian) rine.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 4982784 (04C0800h) Byte(s)
[File Heuristics] -> Flag : 00000000000000011100000000000001 (0x0001C001)
[B][?] Possibly StarForce… 4.50 or higher ?[/B]

  • Scan Took : 0.766 Second(s)

btw, protect.dll/exe output looks like in pid…

  • New protection detections:
    SolidShield

??? i don´t see any solidshield detection on all games i checked !!!

i.e. Risen (German)

[B][U]dvm.dll[/U][/B]

[B]burnout: none, but burnout freezes when scanning the SolidShield core module, this one is 108 MB. also it seems the tool only detects till v1.9.8.1 wich is more thzen 1 year old nowadays, recent ones are all undetected or crashing the tool[/B]

[B]pid:[/B]
\dvm.dll
File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 113568720 (06C4EBD0h) Byte(s)
-> File Appears to be Digitally Signed @ Offset 06C4D6C8h, size : 01508h / 05384 byte(s)
-> File has 113258184 (06C02EC8h) bytes of appended data starting at offset 04A800h
[File Heuristics] -> Flag : 00000000000001001100000100000100 (0x0004C104)
[B][!] SolidShield Core.dll [unknown version]
[i] Tages Setup Version: v5.5.7.2[/B]
[CompilerDetect] -> Visual C/C++

  • Scan Took : 2.254 Second(s)

[B][U]Risen.exe[/U][/B]

[B]burnout: none[/B]

[B]pid:[/B]
Risen.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 966496 (0EBF60h) Byte(s)
[x] Warning - FileAlignment seems wrong… is 0x00000200, calculated 0x00000400
-> File Appears to be Digitally Signed @ Offset 0EAA58h, size : 01508h / 05384 byte(s)
-> File has 102488 (019058h) bytes of appended data starting at offset 0D1A00h
[File Heuristics] -> Flag : 00000000000001001100001100010111 (0x0004C317)
[B][!] SolidShield EXE Wrapper detected ![/B]
[CompilerDetect] -> Visual C/C++

  • Scan Took : 0.829 Second(s)

[B][U]PROTECT DiSC[/U][/B]

alot of games are shown as ProtectDisc v9.0.2 wich are really v9.0, v9.1 or v9.2.
also, ProtectDisc v9.0.5 (found in Eishockey Manager 2009 v1.42) doesn´t even exist, it´s v9.5.0
another one, Black Mirror 2, burnout tells v9.1.1 (wich is from year 2008) wich really is 9.11.0 (aug 2009).

another more recent example…
Cobra 11 - Highway Nights Demo

burnout: protectdisc 9.2.5
this is 9.25.0 (!) wich is a MAJOR step forward for the protection system since v9.2.x

it seems the newer versions are copied straight from protection id, but a bit of the wrong version…
versions for older protectdisc are shown right by burnout, while the newer ones are NOT.
getting the real version is still the same way as for older protect disc 8/9.


#5

doooohhh again
just brwosed the sourcecode, the detections can´t be more weak then here.

i.e.

  • open notepad
  • write ‘MZPE.sforce’ without the quotes
  • save as test.exe
  • scan with burnout
  • now the file is magically StarForce 3-5 wrapped and isn´t even a real exe

no pe-file processing here wich is a downfall :doh:
at least check if the file you scan with burnout is a valid win32/64 executable.


#6

Byteshield and Impulse Reactor are just detected when scanning CDs/DVDs.
Hmm interesting, SolidShield should be detected. I will have a look at that!
Concerning ProtectDisc: I think version format is not 9.xx but 9.x.x

no pe-file processing here

That’s because of BurnOut’s programming structure. It worked till now and I think it will work for the next time, too, but I have to admit, it’s not the best ;).


#7

Concerning ProtectDisc: I think version format is not 9.xx but 9.x.x

nope i debugged it, the recent version is v9.26.0, not 9.2.6… it is written in memory by the protect disc loader, enough proof?

also i can give you a short list of all Protect Disc versions in release order:

Protect DiSC v9.1.0 - RTL Biathlon 2009
Protect DiSC v9.2.0 - COBRA 11 BURNING WHEELS
Protect DiSC v9.5.0 - Eishockey Manager 2009 v1.42
Protect DiSC v9.11.0 - Summer Athletics 2009
Protect DiSC v9.20.0 - 15 Days (GERMAN)
Protect DiSC v9.25.0 - Cobra 11: Highway Nights Demo
Protect DiSC v9.26.0 - Cobra 11: Highway Nights Patch 1

Hmm interesting, SolidShield should be detected. I will have a look at that!

not the ones without version info.

failed on:

  • Anno 1404 - Dawn of Discovery
  • Risen (crashes here)
  • Sherlock Holmes jagt Jack the Ripper (crashes here)
  • X3 Terran Conflict v2.1

Byteshield and Impulse Reactor are just detected when scanning CDs/DVDs.

why should the files on cd/dvd be different then the installed files? this makes no sense.


#8

nope i debugged it, the recent version is v9.26.0, not 9.2.6… it is written in memory by the protect disc loader, enough proof?

Sounds good. But ProtectDISC uses some files with 9.2.6 version format. But, … perhaps this is because of x.x.x.x Windows Standard version format.


#9

thats from Handball Manager 2010 v1.60, the ProtectDisc code writtes this into memory. why should it be wrong?

if you check the protectdisc temp/core files thats wrong, as it is not the version of the wrapper.


#10

BurnOut.DeleteFiles(System.IO.Path.GetTempPath, “a*.tmp”)
BurnOut.DeleteFiles(System.IO.Path.GetTempPath, “PCD*.sys”)

is a bit reckless too, what if i saved some file as a_work.tmp… for whatever reasons)… it would be deleted by your code…