// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "StarForce");

function detect() {
    if (PE.compareEP("68........FF25....63")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (PE.compareEP("68........FF25....57")) {
        sVersion = "1.1";
        sOptions = "ProActive";
        bDetected = true;
    } else if (PE.compareEP("5768..0D01006800....00E850..FFFF68......0068......0068......0068......0068......00")) {
        sOptions = "Protection Driver";
        bDetected = true;
    } else if (PE.compareEP("E8........000000000000")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (PE.compareEP("60e8000000005883c008") && PE.isSectionNamePresent(".brick")) {
        sVersion = "3.4";
        bDetected = true;
    } else if (PE.compareEP("68........FF25........0000000000")) {
        sVersion = "3.X";
        bDetected = true;
    } else if (PE.isLibraryPresent("protect.dll")) {
        sVersion = PE.getPEFileVersion(PE.getFileDirectory() + "/protect.dll");
        if (!sVersion) {
            if (PE.isSectionNamePresent(".ps4")) {
                sVersion = "4.X-5.X";
                bDetected = true;
            } else if (PE.isSectionNamePresent(".sforce3")) {
                sVersion = "3.X";
                bDetected = true;
            }
        }
    } else {
        if (PE.isSectionNamePresent(".ps4")) {
            for (var i = 0; i < PE.getNumberOfImports(); i++) {
                if (PE.getNumberOfImportThunks(i) == 1 &&
                    (!PE.getImportFunctionName(i, 0) || PE.getImportFunctionName(i, 0) == "1")) {
                    var sLibraryName = PE.getImportLibraryName(i);

                    sVersion = PE.getPEFileVersion(PE.getFileDirectory() + "/" + sLibraryName);

                    if (!sVersion) {
                        sVersion = "4.X-5.X";
                    }

                    sOptions = sLibraryName;
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}