// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("image", "Windows Animated Cursor");

function detect() {
    if (Binary.getSize() >= 48) {
        if (Binary.compare("'RIFF'........'ACON'")) {
            var nOffset = Binary.findString(12, Binary.getSize() - 12, "framicon");
            if (nOffset != -1) {
                sOptions = Binary.readByte(nOffset + 18) + "x" + Binary.readByte(nOffset + 19);
                // Read the BPP from the first icon, as the header is unreliable.
                nOffset += 12 + Binary.readDword(nOffset + 30);
                sOptions = sOptions.append(Binary.readWord(nOffset + 14) + "bpp");
            }
            nOffset = Binary.findSignature(12, Binary.getSize() - 12, "'anih'24000000");
            if (nOffset != -1) {
                var nCount = Binary.readDword(nOffset + 12);
                sOptions = sOptions.append(nCount + (nCount == 1 ? " icon" : " icons"));
            }
            bDetected = true;
        }
    }

    return result();
}