// Detect It Easy: detection rule file
// Authors: hors, sendersu
// If errors pls contact sendersu on cracklab.team

meta("protector", "Safengine Shielden");

function detect() {
    if (PE.compareEP("E8........5361")) {
        if (PE.section[PE.nLastSection].FileSize == 0x1000 &&
            PE.section[PE.nLastSection].VirtualSize == 0x1000) {
            sVersion = "2.X";
            bDetected = true;
        } else if (PE.section[PE.nLastSection].FileSize == 0x2000 &&
            PE.section[PE.nLastSection].VirtualSize == 0x2000) {
            bDetected = true;
        }
    }

    if (PE.compareEP("EB$$E9$$$$$$$$E8........'Safengine Shielden'")) {
        sVersion = "2.X";
        bDetected = true;
    }

    if (PE.compareEP("E8........'Shielden'")) {
        var nOffset = PE.findString(PE.getEntryPointOffset(), 0x50, "Shielden v");
        if (nOffset != -1) {
            sName = "Shielden"
            sVersion = File.cleanString(PE.getString(nOffset + 10));
            bDetected = true;
        }
    }

    if (bDetected) {
        // try to deduce specific version from payload (if present)
        var nOffset = PE.findString(0, PE.getSize(), "Safengine Shielden v")
        if (nOffset != -1) {
            sVersion = File.cleanString(PE.getString(nOffset + 19));
        } else {
            nOffset = PE.findString(0, PE.getSize(), "Safengine NetLicensor v")
            if (nOffset != -1) {
                sVersion = File.cleanString(PE.getString(nOffset + 22));
            }
        }
    }

    return result();
}