// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Updated: DosX

// https://github.com/NIKJOO/PEP
meta("protector", "Private EXE Protector");

function detect() {
    if (PE.compareEP("558BEC83C4F4FC5357568B7424208B7C242466813E4A430F85A502000083C60A33DB")) {
        sVersion = "1.9.7";
        bDetected = true;
    } else if (PE.compareEP("B8........B9..9001..BE........68........6801......C3")) {
        sVersion = "1.X";
        bDetected = true;
    } else if (PE.compareEP("89....380000008B..0000000081..........89..0000000081..0400000081..0400000081..000000000F85D6FFFFFF")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (PE.compareEP("52ba........c702########....50....53....51....52....56..57....55....81ee")) {
        sVersion = "3.04";
        bDetected = true;
    } else if (PE.compareEP("EB08....0000000000007.009C")) {
        sVersion = "4.0-4.12";
        bDetected = true;
    } else if (PE.compareEP("EB08....0000000000007.0068")) {
        sVersion = "4.0-4.12";
        bDetected = true;
    } else if (PE.compareEP("6064ff35........b9........89ce81c6........ba........bd........8b0683c6..8b1e89dffcf829c333dd31c3891e")) {
        sVersion = "4.X";
        bDetected = true;
    } else if (PE.compareEP("51b9........c701........59ff35........c3")) {
        sVersion = "3.4.0";
        bDetected = true;
    } else if (PE.compareEP("53bb........c703........5bff35........c3")) {
        sVersion = "3.4.0";
        bDetected = true;
    } else if (PE.findSignature(PE.getEntryPointOffset(), 0xB00, "b900000000f3ae") != -1) {
        sVersion = "3.0.0-3.3.5";
        bDetected = true;
    } else if (PE.findSignature(PE.getEntryPointOffset(), 0xB00, "b900000000f366") != -1) {
        sVersion = "3.0.0-3.3.5";
        bDetected = true;
    } else if (PE.getNumberOfImports() == 1 &&
        PE.getImportLibraryName(0) == "KERNEL32.DLL" && PE.getNumberOfImportThunks(0) == 1 &&
        (PE.section[0].Characteristics == 0xc0000020 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xe0000020 && PE.getEntryPointOffset() == 0x200 ||
            PE.section[0].Characteristics == 0xe0000020 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0x60000020 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xe0000080 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xc0000040 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xe0000060 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xe0000040 && PE.getEntryPointOffset() == 0x400 ||
            PE.section[0].Characteristics == 0xf0000040 && PE.getEntryPointOffset() == 0x400)) {
        sVersion = "2.00-2.25";
        bDetected = true;
    } else if (PE.section.length >= 3) {
        if (PE.getNumberOfImports() == 1 &&
            PE.getImportLibraryName(0) == "KERNEL32.DLL" &&
            PE.getImportFunctionName(0, 0) == "ExitProcess") {
            if (PE.getAddressOfEntryPoint() == 0x1000 &&
                PE.section[0].FileSize != 0x200 &&
                PE.section[0].FileSize != 0x400 &&
                PE.section[0].Characteristics == 0xe0000020) {
                bDetected = true;
                sVersion = "1.X";
            } else if (PE.section[0].Characteristics == 0xe4000000 &&
                PE.section[1].Characteristics == 0xC0000000 &&
                PE.section[2].Characteristics == 0x50000040) {
                bDetected = true;
                sVersion = "1.7";
            }
        } else if (PE.getNumberOfImports() == 1 || PE.getNumberOfImports() == 2) {
            if (PE.getImportLibraryName(0) == "KERNEL32.DLL") {
                if (PE.getNumberOfImportThunks(0) == 1) {
                    var nSection = PE.nLastSection;
                    if (PE.section[nSection].Name == ".rsrc") {
                        nSection--;
                    }
                    if (PE.section[nSection].Characteristics == 0xE0000000 &&
                        PE.section[nSection - 1].Characteristics == 0xE0000000) {
                        bDetected = true;
                        sVersion = "2.X";
                    }
                }
            }
        }
    }

    if (!bDetected) {
        if (PE.isImportPositionHashPresent(0, 0xd89af68d)) {
            if (PE.isSectionNamePresent(".TRIAL!")) {
                sOptions = "demo";
                bDetected = true;
            } else if (PE.isSectionNamePresent(".-PEP-")) {
                bDetected = true;
            }
        }
    }

    return result();
}