SabreTools
[Protection] Add PopCap DRM Protect
Inhouse copy protection used by shareware PopCap games, seemingly replacing the previous use of ActiveMARK. Seems to make use of a drm.xml found in various places depending on the time the game was released, with earlier versions placing drm.xml in the folder "drm/common", later versions in the root directory of the game. Later versions use a seemingly obfuscated drm.xml.bin, with every version of the xml/bin having a corresponding .sig file. The "main" exe is actually just a wrapper for the actual executable, seemingly stored in a DAT file with the same name. When the wrapper is run, it extracts the real executable as a hidden file in the working directory with the name popcap1.exe (not sure if there are others). Strings worth investigating: "?popcapdrmprotect!", "?popcapdrmprotend!", and "!YN00000PACPOPPOPCAPPACPOPPOPCAPBUILDINFOMARKERPACPOPPOPCAPPACPOPPOPCAPXXXXXXXXX". Files that may worth doing checks for: "drm.xml", "drm.xml.sig", "drm.xml.bin", "drm.xml.bin.sig", "drmss.jpg".
Seems to also have a CD equivalent, the following disc appears to have it: http://redump.org/disc/59954
Files to investigate:
