// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>
// Updated: DosX

meta("protector", "PE-SHiELD");

function detect() {
    if (PE.compareEP("E9$$$$$$$$60E8$$$$$$$$5D83ED..EB$$8DB5........BA........8A3C1632FA80....80....88....4AEB")) {
        sVersion = "0.25";
        bDetected = true;
    } else if (PE.compareEP("60E8$$$$$$$$5D83ED..EB$$8D....................8A....32..80....80....88......EB")) {
        sVersion = "0.25-0.26";
        bDetected = true;
    } else if (PE.compareEP("60E8$$$$$$$$414e414b494e5d83ed..eb$$8d....................8a....32")) {
        sVersion = "0.2";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$4e86ed38ca47475a524333f681c2")) {
        sVersion = "0.1d";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$4f465951f52bf9d1e638c281c1")) {
        sVersion = "0.1d";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$4e86c94f5951424784f686e4d1ca81c1")) {
        sVersion = "0.1d";
        bDetected = true;
    }

    var peShieldSection = PE.section["PESHiELD"],
        anakin98Section = PE.section["ANAKiN98"];

    if (!bDetected) {
        if (PE.isImportPositionHashPresent(0, 0x3651f68d) && (peShieldSection || anakin98Section)) {
            bDetected = true;
        }
    } else if (!peShieldSection && !anakin98Section) {
        sOptions = "modified";
    }

    return result();
}