// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// 27.12.2023 @DosX_dev add strings
// 29.06.2025 @DosX_dev rule logic optimized

// TODO: Rewrite this script

meta("compiler", "DMD");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    if (PE.isSectionNamePresent(".minfo") && PE.isSectionNamePresent("._deh")) {
        bDetected = true;
    }

    var rdataSection = PE.section[".rdata"],
        rdataSectionOffset = -1,
        rdataSectionSize = -1;

    if (rdataSection) {
        rdataSectionOffset = rdataSection.FileOffset;
        rdataSectionSize = rdataSection.FileSize;
    }

    if (!bDetected) {
        if (rdataSection && PE.isDeepScan()) {
            if (PE.findSignature(rdataSectionOffset, rdataSectionSize, "'core.sys.windows.dll'") != -1 &&
                PE.findSignature(rdataSectionOffset, rdataSectionSize, "'string.d'") != -1) {
                bDetected = true;
            }
        }
    }

    if (bDetected && rdataSection) {
        var strOffset = PE.findString(rdataSectionOffset, rdataSectionSize, "This program will continue, but will not operate when using DMD ");

        if (strOffset != -1) {
            sVersion = PE.getString(strOffset - 7, 5);

            if (sVersion.indexOf(".") == -1 || sVersion.split(".")[0].length != 1) {
                sVersion = String();
            }
        }
    }

    sLang = "D";

    return result();
}