yes, you can enable it in the settings.

and its off by default now too, the next release (lets say its probably christmas time)... will have a lot of fixes and things that were done (based on feedback) but never went live as the project sort of 'paused' when cdkiller vanished..

we have plantly Packer detector, so we feel enouth for it, we don't need total too much bullshit. so plan to release or say no it's up to yourself, not important.

i plan a christmas public release like i said, with updated signatures and so on... then the move to pid 7 is planned... if you dont like it, then simply dont download it... its not that difficult

ProtectionID 6.5.5 - halloween public release 31/10/2013

Hi, heres the 6.5.5 public release, a lot of bugfixes and tweaks (incl the win 7 one which i still get emails for), and some new additions,
hopefully you'll like it... the last final version is probably going to be on christmas, where i will add anything missed, and fix any outstanding
bugs, then its a switch to developing pid 7 which will be quite different (and various flavors for people who just want the scanning etc)

so, please send the bug reports in for this version to the usual email address and i'll make sure to include them to the next public release (most likely 24/12/2013)

and as usual, thanks to the beta team and those who supplied files, you helped make protection id what it is today...

cdkiller - if you see this, get in touch please m8

below is the long list of the fixes / updates some were lost but this is about all i can remember doing :)

[virus total results]

https://www.virustotal.com/en-gb/file/58863c3654db45df49444fafde26ef03a2411ba305dee858cd8c9ae36c4ad415/analysis/1383250270/

SHA256: 58863c3654db45df49444fafde26ef03a2411ba305dee858cd8c9ae36c4ad415
File name: protection_id.exe
Detection ratio: 2 / 46
Analysis date: 2013-10-31 20:11:10 UTC ( 0 minutes ago )

* Microsoft VirTool:Win32/Obfuscator.AX
* Bkav HW32.TsCabk.cyiu

both of the detections are false positives...

the microsoft one i've known for a while (windows 8 windows defender blocked protection id during some tests, and i had 1 email about this), so
please add it to be excluded (provided the sha256 hash matches the above one

Bkav i had never heard of until today...

have fun, hope to hear back,
Download: http://pid.gamecopyworld.com/ProtectionId.655.halloween.2013.rar

ESET Smart security don’t allow me to run.

strange, eset didnt show a thing in the virus total scan...
so ensure you downloaded it from the proper site (pid.gamecopyworld.com), if so then add an exclusion..

i have same problem for ESET !

BR

Try submitting for false positive. Maybe if they see a few req for same exe, they will take more interest to correct it. None of the private beta builds are flagged, just the public release.

New release:

6.6.7 coming soonish, working on a few updates.. maybe a week or so but i hope you all like v 6.6.6 :)

any bugs, ideas, false positives etc please email me (if its a false positive or something not detected please email me a link to download the file too)...

ProtectionID v6.6.7
2014-12-24

Changelog:
Download:

that was quick, i had only updated the site 5 minutes before your post... so i think you win the ninja award today

Unfortunately, haven't yet command line support. No way to call as '> PrID victim.exe' or '> PrID *.dll'.

It has command line support. You just need to add a '-scan' parameter to the command line. :)
>prid -scan victim.exe

again same as last year version, antivirus does not like this

upload a not crypted version please

what antivirus? and its documented in the nfo file about some antiviruses and false positvies.. simply add an exclusion until they get round to whitelisting..

"same as last year" .. there was more than one release in the past year m8

uploading a non crypted version isnt going to happen, its not my fault the av is a false positive on some av's and im not going to do multiple releases with stuff turned on / off, that makes maintainance a total pain

also, (this is highly ironic), if i remove the encryption (i've tested this, and indeed, this was one of the reasons crypto was added), some anti viruses see some signatures for detection and raise those as false positive.. so its a no win situation

Does anyone know what "WhiteLabel (SecuROM) protection Detected" means? What is this "Whitelabel" tag?

Looks like variant of Securom.

Just a hunch, but I think he might have guessed that bit :P

I'm understand, he groaned for my post. I'm guilty, really sorry. :D

then upload a crypted version made by other cryptor

which cryptor would you suggest?

whitelabel means it was renamed and could be 'rebranded' (dss was one of the common names), whitelabel like on records etc

http://en.wikipedia.org/wiki/White-label_product

repack
 

enigma or vmprotect are ok but private cause public licenceses are antivirus blacklisted

ProtectionID v6.7.0
31-10-2015

Download:

repack with else packer cause it is blocked as virused

no, i havent changed the crypt used on it in years, and im not planning to
and i mentioned the av is a false positive
so simple solution - add the folder to exclusions, or simply dont use it
simple as that, raising the same thing over and over is really boring

and if you see the virus total link i supplied on the home page, you'll see its 1 hit, from microsoft, which always falsely detect that, it will be whitelisted soon hopefully, but for now, the only way to get around it is add the exe to the exclusion list

also, its is NOT fucking virused... if it is, please show me the viral code oh wise one

new virustotal report -> https://www.virustotal.com/en/file/544cdc44c9cb8b9eb0043ccbd89309e88a380a1aacbcd3fb342297bd27626226/analysis/

so only a few hours after release it went to 19/55 'hits' (which i documented on the pid home page), 5 bad votes and 35 good ones, and then some attempt of a hack on the home page too, by someone looking for the source code (or anything related), looking for /jenkins folders etc... which is comical as the source isnt on the home site :)

now, as you can see, i hide nothing... the only av currently flagging pid as 'bad' is microsoft (windows defender etc), which is a false positive, and has happened for a long time, so adding the protectionid exe to the exclusion list is the only way to solve that

i've had no feedback of crashing or anything currently, so i hope that implies the release was a success

Excellent Release but can't get Context Menu to function!
 

turn off the fucking colors for a start.. it looks dumb
i guess you did it for attention, it almost worked in the opposite way...

if the context menu doesnt work, then try running protectionid as administrator and doing it then.. it should work and stick.. im guessing you're on windows 10 or similar.. which doesnt let the context menu stuff happen unless admin access is given.. also the code hasnt changed for that part in many many years, so its not a 'new' bug..

1. run as admin
2. turn on context menu
3. exit
4. dont run as admin.. should all be fine then, and pid doesnt really benefit from having admin privs anyway

Protection ID v6.7.5
 

Protection ID v6.7.5
24-12-2015

Download:

Protection ID v6.8.0 ( Halloween 2016) Released.
31-10-2016

Download Here :

wow, someone noticed :)

I am sure that just like me, the entire reversing community would have been waiting for this release :)

Great job , I must say ! :)

@evlncrn8 out of interest, how many of your detection rules do you think would be portable to Yara? I think it could definitely improve the maintainability of the code and people can use the signatures with their favorite tools that support Yara.

I was thinking of the exact same thing for the past few days since the Beta version of the Protection ID was out...

Would be really nice if it could be ported to Yara :)

Thank you once again @evlncrn8 for this wonderful tool.

Just one quick suggestion :

Would it be possible to implement the Drag-and-Drop functionality in future versions if possible ?

For the last few versions we have to manually choose the file(s) or folder(s) ...

Thank you :)

Make sure ProtectionID runs with the same privs as your file browser. Windows has this annoying thing were privileges with drag/drop cannot cross...

shows now
>>Internal server error. Please contact system administrator.

could be fixed or re-upped?
thx

Mirror link
http://rgho.st/6ZFMhWcSX