// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Enhanced: DosX

meta("packer", ".netshrink");

function detect() {
    if (PE.isNet() && PE.isNetObjectPresent("\u0002\u2001")) {
        if (PE.isSignatureInSectionPresent(0, "20fe2b136028........13..203b28136028........13..11..11..161f4028........26")) {
            sVersion = "2.01 Demo";
            sOptions = "Encrypted/Password mode";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "20ad65133228........13..206866133228........13..11..11..161f4028........26")) {
            sVersion = "2.01 Demo";
            sOptions = "Encrypted/Password mode";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "20b9059f0728........13..2066059f0728........13..11..11..161f4028........26")) {
            sVersion = "2.01 Demo";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "20e6ea19be28........13..2039ea19be28........13..11..11..161f4028........26")) {
            sVersion = "2.01 Demo";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'stub_2.netrsrc.resources'")) {
            sVersion = "2.9+";
            bDetected = true;
        }
    }

    return result();
}