// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "NsPack");

function getNSPackVersion() {
    if (PE.section[0].FileSize > 0 && PE.section[0].FileOffset < 0x200) {
        sVersion = "2.X";
    } else if (PE.section[0].FileSize == 0 && PE.section[0].FileOffset >= 0x200) {
        sVersion = "3.X";
    }
}

function detect() {
    var nNumberOfFunctions = PE.getNumberOfImportThunks(0);
    if (nNumberOfFunctions == 6 && !PE.getSizeOfCode()) {
        if (PE.getImportFunctionName(0, 0) == "LoadLibraryA" &&
            PE.getImportFunctionName(0, 1) == "GetProcAddress" &&
            PE.getImportFunctionName(0, 2) == "VirtualProtect" &&
            PE.getImportFunctionName(0, 3) == "VirtualAlloc" &&
            PE.getImportFunctionName(0, 4) == "VirtualFree" &&
            PE.getImportFunctionName(0, 5) == "ExitProcess") {
            getNSPackVersion();
            bDetected = true;
        }
    }
    if (!bDetected) {
        if (PE.isLibraryPresent("mscoree.dll") &&
            PE.getImportLibraryName(0) == "KERNEL32.dll" &&
            PE.getImportFunctionName(0, nNumberOfFunctions - 1) == "GetSystemInfo") {
            getNSPackVersion();
            sOptions = ".NET";
            bDetected = true;
        } else if (PE.isImportPositionHashPresent(0, 0x86111e49) && PE.isNetObjectPresent("nsnet")) {
            sVersion = "3.X";
            bDetected = true;
        } else if (PE.compareEP("9c60e8..........83....8d8d........8039..0f..........c601..8bc5")) {
            sVersion = "3.7";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d9d........8a033c..74..8d9d........8a03")) {
            sVersion = "3.1";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8338..0f..........c700........8bd5")) {
            sVersion = "3.6";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8038..0f..........c600..8bd5")) {
            sVersion = "3.5";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5db8........2be88db5........8a063c..74..8bf5")) {
            sVersion = "2.9";
            bDetected = true;
        } else if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$e9$$$$$$$$9c60e8........5db8........2be88db5........8b06")) {
            sVersion = "2.3-2.9";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8038..74..8d85........8038..0f84........c600..8bd5")) {
            sVersion = "3.3";
            bDetected = true;
        }
    }

    return result();
}