// Detect It Easy: detection rule file
// Author: ajax
// History:
// 21:54 17.01.2013 add 1.X and 2.x
//       20.09.2013 add 2.X for x64

meta("protector", "Themida/Winlicense");

function detectThemida() {
    var sResult = "";

    if (PE.section.length >= 4) {
        var nEntryPointSection = PE.getEntryPointSection();

        if (PE.getResourceSection() == 1 && PE.getImportSection() == 2) {
            if (PE.getAddressOfEntryPoint() == PE.section[nEntryPointSection].VirtualAddress) {
                if (PE.calculateEntropy(PE.section[0].FileOffset, PE.section[0].FileSize) >= 7.5) {
                    if (nEntryPointSection == 3) {
                        sResult = "1.X";
                    } else if (nEntryPointSection > 3) {
                        sResult = "2.X";
                    }
                }
            }
        }
    }

    return sResult;
}

function detect() {
    if (PE.is64() && PE.compareEP("4883EC085053E801000000CC584889C348FFC0482D........482D........4805........803BCC75..C60300")) {
        sVersion = "2.X";
    } else if (PE.isNet()) {
        if (PE.isSignatureInSectionPresent(0, "b8000000006011c0")) {
            sVersion = "1.9";
        } else if (PE.isSignatureInSectionPresent(0, "83ec048053e80100")) {
            sVersion = "2.X";
        }
    } else if (PE.compareEP("B8........600BC074..E8000000005805..0000008038E975")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 9)) {
            case 0x58: sVersion = "1.0.X.X-1.8.0.0"; break;
            case 0x68: sVersion = "1.8.X-1.9.X"; break;
        }
        sOptions = "Compressed";
    } else if (PE.compareEP("558BEC83C4D860E8000000005A81EA........8BDAC745D8000000008B45D8408945D8817DD880000000")) {
        sVersion = "1.0.X.X-1.8.X.X";
        sOptions = "NoCompression";
    } else if (PE.compareEP("8BC58BD460E8000000005D81ED........8995........89B5........8985........83BD")) {
        sVersion = "1.X";
        sOptions = "NoCompression SecureEngine";
    } else if (PE.compareEP("83EC045053E801000000CC588BD840")) {
        sVersion = "2.0.1.0-2.1.8.0";
    } else if (PE.compareEP("51b9........85c974$$59e9$$$$$$$$83ec..5053............5889c3402d........2d........05........803b..75..c603..bb........68........68........5350")) {
        sVersion = "2.0.1.0-2.1.8.0";
    } else if (PE.compareEP("83EC045053E801000000CC5889C3402D........2D........05........803BCC75..C60300")) {
        sVersion = "2.X";
    } else if (PE.compareEP("E9$$$$$$$$8bc58bd460e8")) {
        sVersion = "1.1.X-1.2.X";
    } else if (PE.compareEP("eb$$e9$$$$$$$$e9$$$$$$$$565053e8$$$$$$$$5889c3402d")) {
        bDetected = true;
    } else if (PE.isImportPositionHashPresent(0, 0x3ffccc8a) && PE.isImportPositionHashPresent(1, 0x4b2fc056)) {
        sVersion = "1.XX-2.XX";
    } else if (PE.isSectionNamePresent(".themida")) {
        sVersion = "3.XX";
    } else if (PE.isSectionNamePresent(".winlice")) {
        sVersion = "3.XX, Winlicense";
    } else if (PE.section[0].Name == "   " && PE.isImportPositionHashPresent(0, 0x3ffccc8a)) {
        sVersion = "~2.XX";
    } else if (PE.section[0].Name == "        " && PE.isImportPositionHashPresent(0, 0x3651f68d)) {
        bDetected = true;
    } else {
        var sThemidaVersion = detectThemida();
        if (sThemidaVersion) {
            sVersion = sThemidaVersion;
        }
    }


    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    if (bDetected && PE.isFunctionPresent("_CorExeMain")) sOptions = "DotNET";

    return result();
}