// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Armadillo");

function detect() {
    if (PE.compareEP("60E8000000005D50510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE99D0FC98BCAF7D1595850510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08")) {
        sVersion = "3.X-9.X";
        bDetected = true;
    } else if (PE.compareEP("558BEC83EC0C5356578B450850FF15........83C4048945FC8B45FC51B900080000B906000000")) {
        sVersion = "4.44a public build";
        bDetected = true;
    } else if (PE.compareEP("E8E3400000E916FEFFFF6A0C68........E8441500008B4D0833FF3BCF762E6AE05833D2F7F13B")) {
        sVersion = "5.00";
        bDetected = true;
    } else if (PE.compareEP("837C2408017505E8DE4B0000FF7424048B4C24108B54240CE8EDFEFFFF59C20C006A0C68")) {
        sVersion = "5.00";
        sOptions = "DLL";
        bDetected = true;
    } else if (PE.compareEP("6A..8BB5........C1E6048B85........2507....8079054883C8F84033C98A88........8B95........81E207....8079054A83CAF84233C08A82")) {
        sVersion = "2.XX";
        sOptions = "CopyMem II";
        bDetected = true;
    } else if (PE.compareEP("60E8........5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959586033C9")) {
        sVersion = "3.00";
        bDetected = true;
    } else if (PE.compareEP("60E8........5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB")) {
        sVersion = "3.00a-3.70a";
        bDetected = true;
    } else {
        if (PE.getMajorLinkerVersion() == 0x53 && PE.getMinorLinkerVersion() == 0x52) {
            for (var i = 0; i <= PE.nLastSection; i++) {
                if (PE.compare("'PDATA000'", PE.section[i].FileOffset)) {
                    sVersion = "6.X-9.X";
                    break;
                }
            }
            if (!sVersion) {
                if (PE.section.length > 7) {
                    sVersion = "6.X-9.X";
                }
            }
            bDetected = true;
        }
    }

    return result();
}