// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Phoenix");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("?0?") && PE.isSignatureInSectionPresent(0, "0000010b160c..........0208..........0d0906085961d21304091e630861d21305070811051e62110460d19d081758")) {
            sVersion = "1.7-1.8";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'?.resources'")) {
            sVersion = "1.X";
            bDetected = true;
        } else if (PE.compareEP_NET("1b3002001c00000000000000280100000a280200000add01000000dc28070000")) {
            bDetected = true;
        }
    }

    return result();
}