// Detect It Easy: detection rule file
// Author: Hand Mill
/*
If errors pls contact HandMill on exelab.ru
*/

meta("protector", "HASP");

function detect() {
    if (ELF.getNumberOfSections() == 2) {
        if (ELF.isSectionNamePresent("protect") && (ELF.getSectionFileSize(0) == 0)) {
            var nOffset = ELF.getProgramFileOffset(3);
            var nSize = ELF.getProgramFileSize(3);
            if (ELF.findString(nOffset, nSize, "hasp") != -1) {
                bDetected = true;
            } else {
                var nOffset = ELF.getProgramFileOffset(1);
                var nSize = ELF.getProgramFileSize(1);
                if (ELF.findString(nOffset, nSize, "hasp") != -1) {
                    bDetected = true;
                }
            }

        }
    }

    return result();
}