Skip to content

Instantly share code, notes, and snippets.

@h0ffy
Last active December 2, 2024 19:26
Show Gist options
  • Save h0ffy/a76285f500db6def6891e2aff0eef759 to your computer and use it in GitHub Desktop.
Save h0ffy/a76285f500db6def6891e2aff0eef759 to your computer and use it in GitHub Desktop.
JennyDoc

SECRETS

Secrets Regex
amzn.mws]{8}-[0-9a-f]{4}-10-9a-f1{4}-[0-9a,]{4}-[0-9a-f]{12}
(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
https:\/\/hooks.slack.com\/services\/T[a-zA-Z0-9_]{8}\/B[a-zA-Z0-9_]{8}\/[a-zA-Z0-9_]{24}
virustotal[_-]?apikey(=| =|:| :)
TOKEN[\\-|_|A-Z0-9]_(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10}
xoxb-[0-9A-Za-z\\-]{50}
xoxp-[0-9A-Za-z\\-]{71}
token=[0-9A-Za-z\\-]{5,100}
[0-9a-f]{32}-us[0-9]{1,2}
AIza[0-9A-Za-z\\-_]{35}
AAAA[a-zA-Z0-9_-]{5,100}:[a-zA-Z0-9_-]{140}
(ftp|ftps|http|https)://[A-Za-z0-9-_:\.~]+(@)
(API|api)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{10}
(token|TOKEN)(:|=| : | = )("|')[ 0-9A-Za-z\\-]{10}
(SECRET|secret)(:|=| : | = )("|')[0-9A-Za-z\\-]{10}
(key|KEY)(:|=)[0-9A-Za-z\\-]{10}
secret[_-]?0(=| =|:| :)
(password|PASSWORD)(:|=| : | = )("|')[0-9A-Za-z\\-]{10}
[0-9(+-[0-9A-Za-z*]{32}.apps.qooqleusercontent.com
R*[0-9a-f]{32}
sk*live*[0-9a-z]{32}
access*token,production$[0-9a-z]{161[0-9a,]{32}
key-[0-9a-zA-Z]{32}
xox[baprs]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}
AKIA[0-9A-Z]{16}
basic [a-zA-Z0-9]
bearer [a-zA-Z0-9]
amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
EAACEdEose0cBA[0-9A-Za-z]+
(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}
[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K].*['|\"][0-9a-f]{32}['|\"]
(GITHUB|github)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{10}
AIza[0-9A-Za-z\\-\_]{35}
(?i)(google|gcp|youtube|drive|yt)(.{0,20})?['\"]AIza[0-9a-z\\-\_]{35}]['\"]
AIza[0-9A-Za-z\\-_]{35}
[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com
AIza[0-9A-Za-z\\-_]{35}
ya29\\.[0-9A-Za-z\\-_]+
AIza[0-9A-Za-z\\-_]{35}
key-[0-9a-zA-Z]{32}
(?<=mailto:)[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9.-]{10}
sk*live*[0-9a-z]{32}
xox[baprs]-([0-9a-zA-Z]{10,48})
https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}
(?:r|s)k*live*[0-9a-zA-Z]{24}
sqOatp-[0-9A-Za-z\\-_]{22}
sq0csp-[ 0-9A-Za-z\\-_]{43}
SK[0-9a-fA-F]{32}
(?i)twitter(.{0,20})?['\"][0-9a-z]{18,25}
[t|T][w|W][i|I][t|T][t|T][e|E][r|R].{0,30}['\"\\s][0-9a-zA-Z]{35,44}['\"\\s]
(?i)twitter(.{0,20})?['\"][0-9a-z]{35,44}
AAAA[A-Za-z0-9_-]{5,100}:[A-Za-z0-9_-]{140}
6L[0-9A-Za-z-_]{38}|^6[0-9a-zA-Z_-]{39}$
ya29\.[0-9A-Za-z\-_]+
amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
s3\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\.s3\.amazonaws.com
[a-zA-Z0-9-\.\_]+\.s3\.amazonaws\.com
s3://[a-zA-Z0-9-\.\_]+
s3-[a-zA-Z0-9-\.\_\/]
s3.amazonaws.com/[a-zA-Z0-9-\.\_]
basic [a-zA-Z0-9=:_\+\/-]{5,100}
bearer [a-zA-Z0-9_\-\.=:_\+\/]{5,100}
api[key|_key|\s+]+[a-zA-Z0-9_\-]{7,100}
key-[0-9a-zA-Z]{32}
SK[0-9a-fA-F]{32}
AC[a-zA-Z0-9_\-]{32}
AP[a-zA-Z0-9_\-]{32}
access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}
sq0csp-[ 0-9A-Za-z\-_]{43}|sq0[a-z]{3}-[0-9A-Za-z\-_]{22,43}
sqOatp-[0-9A-Za-z\-_]{22}|EAAA[a-zA-Z0-9]{60}
sk_live_[0-9a-zA-Z]{24}
rk_live_[0-9a-zA-Z]{24}
[a-zA-Z0-9_-]*:[a-zA-Z0-9_\-]+@github\.com*
ey[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$
\"api*token\":\"(xox[a-zA-Z]-[a-zA-Z0-9-]+)\"
([-]+BEGIN [^\s]+ PRIVATE KEY[-]+[\s]*[^-]\_[-]+END [^\s]+ PRIVATE KEY[-]+)
(JEKYLL_GITHUB_TOKEN|JEKYLL_GITHUB_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(SF_USERNAMEsalesforce|SF_USERNAMESALESFORCE)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(access_key|ACCESS_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(access_token|ACCESS_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(amazonaws|AMAZONAWS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(apiSecret|APISECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(api_key|API_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(api_secret|API_SECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(apidocs|APIDOCS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(apikey|APIKEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(app_key|APP_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(app_secret|APP_SECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(appkey|APPKEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(appkeysecret|APPKEYSECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(application_key|APPLICATION_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(appsecret|APPSECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(appspot|APPSPOT)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(auth|AUTH)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(auth_token|AUTH_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(authorizationToken|AUTHORIZATIONTOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(aws_access|AWS_ACCESS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(aws_access_key_id|AWS_ACCESS_KEY_ID)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(aws_key|AWS_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(aws_secret|AWS_SECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]7}
(aws_token|AWS_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(bashrcpassword|BASHRCPASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(bucket_password|BUCKET_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(client_secret|CLIENT_SECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(cloudfront|CLOUDFRONT)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(codecov_token|CODECOV_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(config|CONFIG)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(conn.login|CONN.LOGIN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(connectionstring|CONNECTIONSTRING)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(consumer_key|CONSUMER_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(credentials|CREDENTIALS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(database_password|DATABASE_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(db_password|DB_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(db_username|DB_USERNAME)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(dbpasswd|DBPASSWD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(dbpassword|DBPASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(dbuser|DBUSER)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{3}
(dot-files|DOT-FILES)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(dotfiles|DOTFILES)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(encryption_key|ENCRYPTION_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(fabricApiSecret|FABRICAPISECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(fb_secret|FB_SECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(firebase|FIREBASE)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(ftp|FTP)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(gh_token|GH_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(github_key|GITHUB_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(github_token|GITHUB_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(gitlab|GITLAB)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(gmail_password|GMAIL_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(gmail_username|GMAIL_USERNAME)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(api.googlemapsAIza|API.GOOGLEMAPSAIZA)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(herokuapp|HEROKUAPP)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(internal|INTERNAL)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(irc_pass|IRC_PASS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(key|KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(keyPassword|KEYPASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(ldap_password|LDAP_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(ldap_username|LDAP_USERNAME)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(login|LOGIN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(mailchimp|MAILCHIMP)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(mailgun|MAILGUN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(master_key|MASTER_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(mydotfiles|MYDOTFILES)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(mysql|MYSQL)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(node_env|NODE_ENV)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(npmrc_auth|NPMRC_AUTH)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(oauth_token|OAUTH_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(pass|PASS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(passwd|PASSWD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(password|PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(passwords|PASSWORDS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(pemprivate|PEMPRIVATE)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(preprod|PREPROD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(private_key|PRIVATE_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(prod|PROD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(pwd|PWD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(pwds|PWDS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(rds.amazonaws.compassword|RDS.AMAZONAWS.COMPASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(redis_password|REDIS_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(root_password|ROOT_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(secret|SECRET)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(secret.password|SECRET.PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(secret_access_key|SECRET_ACCESS_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(secret_key|SECRET_KEY)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(secret_token|SECRET_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(secrets|SECRETS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(secure|SECURE)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(security_credentials|SECURITY_CREDENTIALS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(send.keys|SEND.KEYS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(send_keys|SEND_KEYS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(sf_username|SF_USERNAME)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(slack_api|SLACK_API)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(slack_token|SLACK_TOKEN)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(sql_password|SQL_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(ssh|SSH)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(ssh2_auth_password|SSH2_AUTH_PASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(sshpass|SSHPASS)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(staging|STAGING)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(stg|STG)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(storePassword|STOREPASSWORD)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(stripe|STRIPE)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(swagger|SWAGGER)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}
(testuser|TESTUSER)(:|=| : | = )( |"|')[0-9A-Za-z\\-]{5,100}

Credentials Files

Credentials Files
passwd = ^passwd$
shadow = ^shadow$

Database Files

Database Files
access = \.accdb$
access = \.mdb$
db = \.db$
dbf = \.dbf$
mdb = \.mdb$
sqlite = \.sqlite$
sqlite3 = \.sqlite3$
sqlitedb = \.sqlitedb$
sqlitedb3 = \.sqlitedb3$
sql = \.sql$

Encrypted Files

Encrypted Files
aes = \.aes$
aes256 = \.aes256$
aes256_cbc = \.aes256_cbc$
aes256_cfb = \.aes256_cfb$
aes256_ecb = \.aes256_ecb$
aes256_ofb = \.aes256_ofb$
aes256_xts = \.aes256_xts$
aes256_xts_128 = \.aes256_xts_128$
aes256_xts_256 = \.aes256_xts_256$

Backup Files

Backup Files ```regex bak = \.bak$ backup = \.backup$ ```

Configuration Files

Configuration Files
cfg = \.cfg$
conf = \.conf$
config = \.config$
ini = \.ini$
json = \.json$
xml = \.xml$
yml = \.yml$
yaml = \.yaml$

Executable Files

Executable Files
exe = \.exe$

SDK

SDK Detection
Adobe_Flash[] = (?:^|/)Flash[ _]?Player(?:$|/|\.)
Adobe_Flash[] = (?:^|/)StandalonePlayerLocalizable\.strings(?:$|/)
Allegro[] = (?:^|/)allegro-5\.2\.dll$
Allegro[] = (?:^|/)liballeg(?:ro)?\.so
AMD_FidelityFX[] = (?:^|/)amd_fidelityfx_(?:dx12|vk)\.dll$
AMD_FidelityFX[] = (?:^|/)ffx_fsr2_api_x(?:64|86)\.dll$
AMD_GPU_Services = (?:^|/)amd_ags(?:_x(?:64|86))?\.dll$
AMD_TrueAudio_Next = (?:^|/)TrueAudioNext\.dll$
Anzu = (?:^|/)(?:lib)?anzu\.dll$
Autodesk_FBX = fbxsdk
Awesomium = (?:^|/)Awesomium(?:\.dll|_process\.exe)$
Azure_Playfab_Party[] = (?:^|/)Party(?:Win|Win7|Win32|XboxLive|XboxLiveWin32)?\.dll$
Azure_Playfab_Party[] = (?:^|/)XPlatCppWindows\.dll$
BASS = (?:^|/)(?:bass(?:flac|midi)?\.dll|libbass\.(?:dylib|so))$
Bink_Video = (?:^|/)bink2?w(?:64|32)?\.dll$
Box2D = (?:^|/)box2d\.(?:(?:XNA\.)?dll|txt|wasm)$
BugTrap = (?:^|/)BugTrapU?(?:-x64)?\.dll$
CEF = (?:^|/)libcef\.(?:dll|so)$
Coherent_Gameface_OR_Prysm = (?:^|/)cohtml\.windowsdesktop\.dll$
CRIWARE[] = (?:^|/)data(?:1|000)?\.cpk$
CRIWARE[] = \.(?:sfd|usm|adx|acb|awb)$
CRIWARE[] = (?:^|/)cri_ware_unity\.dll$
cURL = curl(?:module|lib|d|-?[34]|-ttv|-x64|64|_pluginw64_release)?\.(?:dll|exe|lib|so|so\.[34]|so\.[34]\.[0-9]{1,3}\.[0-9]{1,3})$
DirectStorage = (?:^|/)dstorage\.dll$
Discord = (?:^|/)(?:lib)?discord(?:|-rpc|_game_sdk)\.(?:dll|dylib|so)$
E-mote = ^emotedriver\.dll$
EpicOnlineServices = (?:^|/)(?:lib)?eossdk
FluidSynth = fluidsynth
FMOD = (?:^|/)(?:lib)?fmod(?:l|ex|exl|studio|studiol)?(?:64)?\.(?:dylib|dll|so)$
FreeImage = (?:^|/)FreeImage(?:\.so|\.dll)$
Game_Development_Kit = (?:^|/)(?:XGamingRuntime(?:Thunks)?|XCurl|Microsoft_Xbox_Services_141_GDK_C_Thunks)\.dll$
Granny_3D = (?:^|/)granny2(?:_x64)?\.dll$
Greenworks = (?:^|/)greenworks-(?:win|osx|linux)(?:32|64)?\.node$
iCue[] = cgsdk
iCue[] = cuesdk
Intel_OID = (?:^|/)OpenImageDenoise\.dll$
Intel_oneTBB = (?:^|/)tbb(?:[0-9]{2}|malloc)?\.dll$
Intel_XeSS = (?:^|/)(?:ig|lib)xess\.dll$
irrKlang = (?:^|/)irrKlang(?:\.NET4|-32bit)?\.dll$
iZotope = (?:^|/)iZotope\.dll$
JVM = (?:^|/)bin/java(?:\.exe|\.dll)?$
Lua[] = (?:^|/)(?:lib)?lua5\.?[01234]\.(?:dll|so)$
Lua[] = \.lua$
LWJGL = (?:^|/)lwjgl(?:64)?\.(?:dll|jar)$
Miles_Sound_System = (?:^|/)mss(?:16|32|64)\.dll$
Modio = (?:^|/)mod\.?io
NodeJS = (?:^|/)(?:lib)?node\.(?:dll|dylib)$
NvCloth = (?:^|/)NvCloth(?:profile)?_x(?:64|86)\.dll$
NVIDIA_Ansel = (?:^|/)AnselSDK(?:32|64)\.dll$
NVIDIA_APEX = (?:^|/)apex(?:framework|_framework|_loader|_release)
NVIDIA_CUDA = (?:^|/)(?:lib)?cudart
NVIDIA_DLSS = (?:^|/)(?:sl\.|nvngx_)dlss\.dll$
NVIDIA_DLSS_FrameGen = (?:^|/)(?:sl\.dlss_g|nvngx_dlssg)\.dll$
NVIDIA_FleX = (?:^|/)flexRelease_x(?:64|86)\.dll$
NVIDIA_GeForce_Now = (?:^|/)GfnRuntimeSdk\.dll$
NVIDIA_HairWorks = (?:^|/)(?:GFSDK_|Nv)HairWorks
NVIDIA_Highlights = (?:^|/)GFeSDK\.dll$
NVIDIA_Nsight_Aftermath = (?:^|/)GFSDK_Aftermath_Lib(?:\.x86|\.x64)?\.dll$
NVIDIA_PhysX = (?:^|/)PhysX(?:_64|_32|3_x64|3_x86|Core|Core64|Loader|3PROFILE_x64)\.dll$
NVIDIA_Real-Time_Denoisers = (?:^|/)(?:sl\.)?NRD\.dll$
NVIDIA_Reflex[] = (?:^|/)nvlowlatencyvk\.dll$
NVIDIA_Reflex[] = (?:^|/)GfxPluginNVIDIAReflex\.dll$
NVIDIA_Reflex[] = (?:^|/)sl\.reflex\.dll$
NVIDIA_Streamline = (?:^|/)sl\.common\.dll$
NVIDIA_Texture_Tools = (?:^|/)nvtt(?:_64)?\.dll$
NVIDIA_TXAA = (?:^|/)GFSDK_TXAA
NWJS = (?:^|/)nw\.(?:dll|pak)$
OculusXRPlugin = (?:^|/)OVRPlugin\.dll$
ODIN = (?:^|/)(?:lib)?odin\.(?:dll|so)$
Ogg = (?:^|/)(?:lib)?ogg(?:_64)?\.(?:dll|so\.0|0\.dylib)$
Oodle = (?:^|/)oo2(?:core|net|ext)\_[3-9]\_win(?:32|64)\.dll$
OpenAL = (?:^|/)OpenAL(?:32|64)(?:_bundled)?\.dll$
OpenSSL = (?:^|/)(?:lib|ssl)eay32\.dll$
OpenTK = (?:^|/)OpenTK\.(?:Core\.)?dll$
OpenVR = (?:^|/)(?:lib)?openvr_api\.(?:dll|so|bundle)$
OpenXR = (?:^|/)(?:lib)?openxr_loader\.(?:dll|so)$
Opus = (?:^|/)opus\.dll$
PathEngine = (?:^|/)PathEngine\.dll$
Photon = (?:^|/)Photon(?:3Unity3D|3DotNet|EncryptorPlugin)\.dll$
Protocol_Buffers = protobuf
Python = (?:^|/)python[0-9]{0,3}\.dll$
Qt = (?:^|/)Qt(?:Core4|[0-9]Core)\.dll$
Razer_CChromaEditor = (?:^|/)CChromaEditorLibrary(?:64)?\.dll$
SDL = (?:^|/)sdl[23]?\.(?:framework/|dll$|txt$)
Sentry = (?:^|/)(?:(?:lib)?sentry\.dll)$
SFML = (?:^|/)(?:lib)?sfml-
SharpDX = (?:^|/)SharpDX\.dll$
SlimDX = (?:^|/)slimdx\.dll$
Smacker_Video = (?:^|/)smackw32\.dll$
Sodium = (?:^|/)libsodium\.dll$
Squall = (?:^|/)Squall\.dll$
SteamworksNET = (?:^|/)(?:Steamworks\.NET\.dll|com\.rlabrecque\.steamworks\.net\.dll)$
Steam_Audio = (?:^|/)(?:lib)?(?:steamaudio|phonon)\.(?:dylib|dll|so)$
Steam_Networking = (?:^|/)(?:lib)?steamnetworkingsockets\.(?:dylib|dll|so)$
TeamSpeak = (?:^|/)ts3client(?:_win32|_win64)?\.dll$
Tencent_GME = (?:^|/)gmesdk\.dll$
Tiled = \.t[ms]x$
Tobii = (?:^|/)Tobii
trueSKY = (?:^|/)TrueSky(?:PluginRender_MT|PluginRender_MD|UI_MD)\.dll$
Ultraleap = (?:^|/)LeapC?\.dll$
UnityBurst = (?:^|/)lib_burst_generated\.(?:dll|so|bundle)$
UnityEntities[] = (?:^|/)Unity\.Entities\.dll$
UnityEntities[] = (?:^|/)StreamingAssets/SubScenes/
UnityEntities[] = (?:^|/)StreamingAssets/EntityScenes/
UnityHDRP = (?:^|/)Unity\.RenderPipelines\.HighDefinition\.(?:Config\.Runtime|Runtime)\.dll$
UnityHybridRenderer = (?:^|/)Unity\.Rendering\.Hybrid\.dll$
UnityIL2CPP = (?:^|/)il2cpp_data/Metadata/global-metadata\.dat$
UnityMultiplay = (?:^|/)Unity\.Services\.Multiplay\.dll$
UnityURP = (?:^|/)Unity\.RenderPipelines\.Universal\.Runtime\.dll$
V8 = (?:^|/)v8\.dll$
Vivox[] = (?:^|/)ortp\.dll$
Vivox[] = vivox
Vorbis = vorbis
Wwise = (?:^|/)AkSoundEngine(?:dll)?\.(?:bundle|dll)$
XAudio2 = (?:^|/)xaudio2_9redist\.dll$
Yarn_Spinner = (?:^|/)YarnSpinner\.dll$
ZStandard = (?:^|/)zstd\.dll$



GAME ENGINES

Regex About Games
EA_App = (?:^|/)EAappInstaller\.exe$
Gaijin = (?:^|/)gaijin_downloader\.exe$
Glyph = ^GlyphClient\.cfg$
MyGames = ^(?:GameCenter)?_chromeresources
Netmarble = ^MarbleStation/MarbleStation\.exe$
Paradox_Launcher = (?:^|/)dowser\.exe$
Rockstar = (?:^|/)Rockstar-Games-Launcher\.exe$
Ubisoft[] = (?:^|/)UbisoftConnectInstaller\.exe$
Ubisoft[] = (?:^|/)UplayInstaller\.exe$
Wargaming = (?:^|/)wgcs_api\.exe$
001GameCreator = (?:^|/)data\.1rc$
3D_GameStudio = (?:^|/)acknex\.(?:dll|wdf)$
4A*Engine = ^(?:oaremote_plugin|bchmark)\.dll$
Adobe_AIR = (?:^|/)Adobe AIR(?:$|/)
AdventureGameStudio = (?:^|/)(?:AGSteam\.dll|acsetup\.cfg)$
AGI = (?:^|/)AGIDATA\.OVL$
Alpha_Engine = ^Alpha_Engine\.dll$
Amazon_Lumberyard = ^bootstrap\.cfg$
AppGameKit = (?:^|/)bytecode\.byc$
Argon = ^ar\.cfg$
Asura = \.asr$
BabylonJS = (?:^|/)(?:babylon\.js|lib/babylon)$
Bitsquid[] = (?:^|/)[a-f0-9]{16}\.stream$
Bitsquid[] = (?:^|/)job_animation_player_win32_release\.dll$
BKEngine = \.bkarc$
BlenderGameEngine[] = (?:^|/)BlendThumb(?:64)?\.dll$
BlenderGameEngine[] = (?:^|/)blenderplayer\.exe$
Blitz3D = \.b3d$
Buddha = ^Data/Config/User\.(?:cfg|lua)$
Build = (?:^|/)buildlic\.txt$
C4_Engine = (?:^|/)Data/C4(?:\.pak)?$
CatSystem2 = ^cs2confx?\.dll$
ChoiceScript = (?:^|/)SteamChoiceScript-Info\.plist$
ChromeEngine[] = (?:^|/)ChromEd\.exe$
ChromeEngine[] = (?:^|/)ChromeEngine[0-9]\.dll$
ChromeEngine[] = (?:^|/)engine(?:_pc)?\.rpack$
Clausewitz[] = (?:^|/)common/defines\.(?:lua|txt)$
Clausewitz[] = ^(?:game/)?common/defines/00_defines\.txt$
ClickTeamFusion = (?:^|/)mmfs2\.dll$
Cobra = (?:common|init)\.ovl$
Cocos = cocos(?:2d|-js)
Construct = (?:^|/)c[23]runtime\.js$
CopperCube = \.ccb$
CryEngine[] = (?:^|/)cry3dengine\.dll$
CryEngine[] = (?:^|/)CryD3DCompilerStub\.dll$
CryEngine[] = (?:^|/)CryRenderD3D1[12]\.dll$
CryEngine[] = (?:^|/)CryRenderVulkan\.dll$
CryEngine[] = (?:^|/)Localization/English_xml(?:\_patch)?\.pak$
CTG_OR_Geo-Mod[] = (?:^|/)music\.vpp$
CTG_OR_Geo-Mod[] = \.vpp_pc$
Danmakufu = (?:^|/)th_dnh\.def$
Defold = (?:^|/)game\.dmanifest$
Diesel = ^dieselx\.cfg$
Divinity_Engine = ^Data/Localization/language\.lsx$
Eclipse_Engine[] = ^data\.pie$
Eclipse_Engine[] = ^Bundle/bundleMain\.mbundle$
EngineX = ^(?:_bin_PC/BuildData|data)/FILELIST.BIN$
Essence_Engine = \.sga$
FalcoEngine = (?:^|/)FalcoEngine\.dll$
Fase = ^faseEngine\.dll$
FBN = (?:^|/)fbnEngine\.dll$
FlatRedBall = (?:^|/)FlatRedBall\.
Flexi = (?:^|/)fx_core\.dll$
FNA = (?:^|/)fna\.dll$
FPS_Creator = (?:^|/)Files/languagebank/english/textfiles/fpsc-050\.ini$
Frostbite = (?:^|/)(?:Engine\.BuildInfo(?:_Win(?:64|32)_retail(?:_dll)?)?)\.dll$
GameBox = ^Nadeo\.ini$
GameGuru = ^files/gamecore/projectiletypes/.+\.dds$
GameMaker[] = (?:^|/)game\.(?:unx|ios)$
GameMaker[] = (?:^|/)libYoYoGamepad\.dylib$
GameMaker[] = (?:^|/)audiogroup1\.dat$
GameMaker[] = (?:^|/)Steamworks\.gm(?:k|l)\.dll$
GameMaker[] = (?:^|/)display_mouse_lock\.dll$
GameMaker[] = (?:^|/)rousrDissonance\.dll$
GameMaker[] = (?:^|/)CleanMem\.dll$
GameMaker[] = (?:^|/)window_set_cursor\.dll$
GameMaker[] = (?:^|/)joydll\.dll$
GameMaker[] = (?:^|/)gm7zip\.dll$
GameMaker[] = (?:^|/)GMXInput\.dll$
GameMaker[] = \.gm(?:spr|bck)$
GameMaker[] = (?:^|/)gmsched\.dll$
GDevelop[] = (?:^|/)LICENSE\.GDevelop\.txt$
GDevelop[] = (?:^|/)gdjs-evtsext\_\_
GDevelop[] = (?:^|/)GDCpp\.dll$
Gideros = gideros
Glacier = \.rpkg$
GlyphX = ^ClientLauncherG(?:64)?\.exe$
Godot[] = (?:^|/)project\.godot$ ; Extra detections are in IsEngineGodot
Godot[] = (?:^|/)(?:lib)?godotsteam
Godot[] = (?:^|/)(?:lib)?steamsdk-godot
GoldSource = (?:^|Bin/)vgui\.dll$
GZDoom[] = (?:^|/)zmusic\.dll$
GZDoom[] = (?:^|/)gzdoom\.pk3$
GZDoom[] = (?:^|/)gzdoom\.sf2$
HaemimontSol = ^Local/English\.hpk$
HashLink = (?:^|/)libhl\.(?:dll|so)$
idTech[] = (?:^|/)gl(?:quake|hexen)(?:$|/)
idTech[] = (?:^|/)baseq2(?:$|/)
idTech[] = \.pk4$
idTech[] = \.streamed$
idTech[] = \.mega2$
idTech[] = \.texdb$
idTech[] = \.streamdb$
iFAction = (?:^|/)iFCon$
Infernal_Engine = (?:^|/)(?:COMMON|STARTUP)\.POD$
IRISZOOM = (?:^|/)ZZ*(?:1|Win)\.dat$
Irrlicht = (?:^|/)Irrlicht\.dll$
IW_Engine[] = \.iwd$
IW_Engine[] = (?:common(?:_zm|_mp)?|code_post_gfx)\.ff$
jMonkeyEngine = (?:^|/)jme3-core
Katana = \.ktsl2(?:as|st)bin$
Kex = \.kpf$
KiriKiri[] = (?:^|/)data\.xp3$
KiriKiri[] = (?:^|/)krflash\.dll$
KMY = (?:^|/)kmyCore\.dll$
Lightvn = \.vndat$
Lime_OR_OpenFL = (?:^|/)lime(?:-legacy)?\.[hn]dll$
Liquid = (?:^|/)PCTouchHelper\.dll$
LithTech = (?:^|/)default\.archcfg$
Love2D = (?:^|/)(?:lib)?love\.(?:dll|so|so\.0)$
Marmalade = (?:^|/)angle/lib(?:EGL|GLESv2)Marmalade\.dll
MonoGame = (?:^|/)monogame
NeoX = (?:^|/)neox\.xml$
Nitrous = \.MeshDesc$
NovaLogic_Engine[] = (?:^|/)resource\.pff$
NovaLogic_Engine[] = (?:^|/)Update\.wiz$
NScripter[] = ^arc\.nsa$
NScripter[] = ^nscript\.dat$
OGRE = (?:^|/)OgreMain(?:\_x64)?\.dll$
Panda3D = (?:^|/)libpanda\.
Phaser = (?:^|/)phaser(?:\.min)?\.js$
Phyre = \.phyre\.
Pico8 = (?:^|/)data\.pod$
PlayFirstPlayground = \.pfp$
Prism3D[] = (?:^|/)base\.scs$
Prism3D[] = (?:^|/)p3shared\.dll$
PyGame = (?:^|/)pygame
Rayne = (?:^|/)Rayne\.dll$
RealVirtuality[] = \.pbo$
RealVirtuality[] = \.bisign$
REDengine = \.(?:red|w2)scripts$
RenPy[] = (?:^|/)renpy(?:$|/)
RenPy[] = \.rpyb$
RE_Engine = (?:^|/)re_chunk_000\.pak$
RPGMaker[] = (?:^|/)config\.rpgsave$
RPGMaker[] = (?:^|/)js/(?:rpg|rmmz)\_core\.js$
RPGMaker[] = (?:^|/)rgss(?:104e|102j|102e|301|202e)\.dll$
RPGMaker[] = (?:^|/)rp[tg]\_rt\.exe$
RPGMaker[] = (?:^|/)RPG_RT\.ini$
RPGMaker[] = \.(?:rgssad|rvproj2|rgss3a|rgss2a)$
RPG_Developer_Bakin = (?:^|/)bakinengine\.dll$
S2_Engine_HD = (?:^|/)S2Core\.dll$
SakanaGL[] = (?:^|/)sakanagl\.dll$
SakanaGL[] = \.sxstorage$
Serious_Engine = (?:All|01|patch)\.gro$
ShiVa3D = \.stk$
Silk = ^packs/sli\.spk$
SmileGameBuilder = (?:^|/)data\.sgbpack$
Snowdrop = \.sdfdata$
Solar2D = (?:^|/)CoronaLabs\.Corona\.Native\.dll$
Source = (?:^|/)(?:vphysics|bsppack)\.(?:dylib|dll|so)$
Source2 = (?:^|/)gameinfo\.gi$
SRPG_Studio[] = (?:^|/)data\.dts$
SRPG_Studio[] = (?:^|/)runtime\.rts$
Stencyl = (?:^|/)assets/data/behaviors\.mbs$
Stride = (?:^|/)(?:Stride|Xenko)\.Core\.dll$
TelltaleTool = \.ttarch2?$
Torque = \.cs\.dso$
TyranoBuilder[] = (?:^|/)tyrano\.js$
TyranoBuilder[] = \_tyrano_data\.sav$
UbiArtFramework = pc(?:32)?\.ipk$
UbisoftAnvil = (?:^|/)(?:datapc(?:64)?|gamedatapc_00)\.forge$
Unigine[] = (?:^|/)Unigine_x(?:86|64)\.dll$
Unigine[] = (?:^|/)core\.ung$
Unity[] = (?:^|/)Unity(?:Engine|Player)\.(?:dylib|dll)$
Unity[] = (?:^|/)globalgamemanagers\.assets$
Unreal[] = (?:^|/)Binaries/Win(?:32|64)/
Unreal[] = (?:^|/)Engine/Binaries/ThirdParty/
Unreal[] = (?:^|/)UnrealEd\.
Virtools = (?:^|/)CKDX[7-9]Rasterizer\.dll$
Vision = (?:^|/)vision(?:71|80|90|100)?\.dll$
VisionaireStudio = (?:^|/)VisionaireConfigurationTool\.exe(?:$|/)
VisualNovelMaker = (?:^|/)data/summaries\.json\.js$
Warscape = /startpos\.esf$
Wintermute = (?:^|/)(?:wme_steam\.dll|data\.dcp)$
WolfRPGEditor = data\.wolf$
X-Ray = (?:^|/)xrGame\.dll$
XNA[] = (?:^|/)xnafx31_redist\.msi$
XNA[] = (?:^|/|\.)XN[AB](?:$|/|.)
Xors3D = (?:^|/)Xors3d\.dll$
YU-RIS = (?:^|/)yscfg\.dat$
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment