// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "NTkrnl Protector");

function detect() {
    if (PE.compareEP("68........e8") && PE.nLastSection >= 1) {
        if (PE.getNumberOfImports() == 1 && PE.getNumberOfImportThunks(0) == 2) {
            if (PE.getImportFunctionName(0, 0) == "LoadLibraryA" && PE.getImportFunctionName(0, 1) == "GetProcAddress") {
                if (PE.isSignatureInSectionPresent(1, "'http://www.ntcore.com  '")) {
                    sVersion = "0.1";
                    bDetected = true;
                } else if (PE.isSignatureInSectionPresent(1, "'http://www.ntkrnl.com'")) {
                    sVersion = "0.15";
                    bDetected = true;
                }
                /* if (bDetected) {
                    var nFind = PE.findString(PE.section[1].FileOffset, PE.section[1].FileSize, "Version ");
                    if (nFind !== -1) {
                        sVersion = PE.getString(nFind, 20);
                        sVersion = sVersion.match(/Version ?(.*?) /)[1];
                    }
                } */
            }
        }
    }

    if (PE.compareEP("68........e8........c3") && PE.compareEP("68########60e8$$$$$$$$5d4555c3")) {
        bDetected = true;
    }

    return result();
}