mirrors/Detect-It-Easy
2
0
Fork 0
mirror of https://github.com/horsicq/Detect-It-Easy.git synced 2026-06-24 01:54:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix

Browse source
This commit is contained in:
horsicq 2019-02-01 21:32:22 +01:00
commit 1e84597bff
112 changed files with 5538 additions and 4905 deletions
Download patch file Download diff file Expand all files Collapse all files

94
README.md
View file

@ -1,47 +1,47 @@
Detect-It-Easy
==============
Detect it Easy
Detect It Easy, or abbreviated "DIE" is a program for determining types of files.
"DIE" is a cross-platform application, apart from Windows version there are also
available versions for Linux and Mac OS.
Many programs of the kind (PEID, PE tools) allow to use third-party signatures.
Unfortunately, those signatures scan only bytes by the pre-set mask, and it is
not possible to specify additional parameters. As the result, false triggering
often occur. More complicated algorithms are usually strictly set in the program
itself. Hence, to add a new complex detect one needs to recompile the entire
project. No one, except the authors themselves, can change the algorithm of
a detect. As time passes, such programs lose relevance without the constant support.
Detect It Easy has totally open architecture of signatures. You can easily
add your own algorithms of detects or modify those that already exist. This
is achieved by using scripts. The script language is very similar to JavaScript
and any person, who understands the basics of programming, will understand easily
how it works. Possibly, someone may decide the scripts are working very slow.
Indeed, scripts run slower than compiled code, but, thanks to the good optimization
of Script Engine, this doesn't cause any special inconvenience. The possibilities
of open architecture compensate these limitations.
DIE exists in three versions. Basic version ("DIE"), Lite version ("DIEL") and
console version ("DIEC"). All the three use the same signatures, which are located
in the folder "db". If you open this folder, nested sub-folders will be found
("Binary", "PE" and others). The names of sub-folders correspond to the types of files.
First, DIE determines the type of file, and then sequentially loads all the signatures,
which lie in the corresponding folder. Currently the program defines the following types:
• MSDOS executable files MS-DOS
• PE executable files Windows
• ELF executable files Linux
• MACH executable files Mac OS
• Text files
• Binary all other files
You could download DIE here: http://ntinfo.biz/
Detect-It-Easy
==============
Detect it Easy
Detect It Easy, or abbreviated "DIE" is a program for determining types of files.
"DIE" is a cross-platform application, apart from Windows version there are also
available versions for Linux and Mac OS.
Many programs of the kind (PEID, PE tools) allow to use third-party signatures.
Unfortunately, those signatures scan only bytes by the pre-set mask, and it is
not possible to specify additional parameters. As the result, false triggering
often occur. More complicated algorithms are usually strictly set in the program
itself. Hence, to add a new complex detect one needs to recompile the entire
project. No one, except the authors themselves, can change the algorithm of
a detect. As time passes, such programs lose relevance without the constant support.
Detect It Easy has totally open architecture of signatures. You can easily
add your own algorithms of detects or modify those that already exist. This
is achieved by using scripts. The script language is very similar to JavaScript
and any person, who understands the basics of programming, will understand easily
how it works. Possibly, someone may decide the scripts are working very slow.
Indeed, scripts run slower than compiled code, but, thanks to the good optimization
of Script Engine, this doesn't cause any special inconvenience. The possibilities
of open architecture compensate these limitations.
DIE exists in three versions. Basic version ("DIE"), Lite version ("DIEL") and
console version ("DIEC"). All the three use the same signatures, which are located
in the folder "db". If you open this folder, nested sub-folders will be found
("Binary", "PE" and others). The names of sub-folders correspond to the types of files.
First, DIE determines the type of file, and then sequentially loads all the signatures,
which lie in the corresponding folder. Currently the program defines the following types:
• MSDOS executable files MS-DOS
• PE executable files Windows
• ELF executable files Linux
• MACH executable files Mac OS
• Text files
• Binary all other files
You could download DIE here: http://ntinfo.biz/

21
db/Binary/Universal Binary.1.sg Normal file
View file

@ -0,0 +1,21 @@
// DIE's signature file
init("format","Universal Binary");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.getSize()>=8)
{
if(Binary.compare("CAFEBABE"))
{
var nMinor=Binary.readBEWord(4);
var nMajor=Binary.readBEWord(6);
if(nMinor)
{
bDetected=1;
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

624
db/Binary/archives.1.sg
View file

@ -1,312 +1,312 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("archive","");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("a596fdff"))
{
bDetected=1;
sName="FTCOMP";
}
else if(Binary.compare("aced00057704"))
{
bDetected=1;
sName="IzPack";
}
else if(Binary.compare("'SIT!'"))
{
bDetected=1;
sName="SIT";
}
else if(Binary.compare("06'SKF3.0'"))
{
bDetected=1;
sName="SKF";
}
else if(Binary.compare("789c"))
{
bDetected=1;
sName="ZLib";
}
else if(Binary.compare("'!<arch>'0a'debian-binary'"))
{
bDetected=1;
sName="DEB";
}
else if(Binary.compare("'Archive'00................2800000064"))
{
bDetected=1;
sName="ArcFS";
}
else if(Binary.compare("'ARCV'0002"))
{
bDetected=1;
sName="ARCV 2";
}
else if(Binary.compare("09006bea"))
{
bDetected=1;
sName="BFF";
}
else if(Binary.compare("00069a68"))
{
bDetected=1;
sName="DCL";
}
else if(Binary.compare("....'-lh'..2d")||Binary.compare("....'-lz'..2d"))
{
sName="LHA";
switch(Binary.readByte(0x5))
{
case 0x30: bDetected=1; break;
case 0x31: bDetected=1; break;
case 0x32: bDetected=1; break;
case 0x33: bDetected=1; break;
case 0x34: bDetected=1; break;
case 0x35: bDetected=1; break;
case 0x36: bDetected=1; break;
case 0x64: bDetected=1; break;
case 0x73: bDetected=1; break;
}
}
else if(Binary.compare("'mflh'0100"))
{
bDetected=1;
sName="MVA";
}
else if(Binary.compare("'ViG'....1a"))
{
bDetected=1;
sName="PaperPort";
}
else if(Binary.compare("'sqsh'0000"))
{
bDetected=1;
sName="SquashFS";
sOptions="big endian";
}
else if(Binary.compare("'hsqs'0300"))
{
bDetected=1;
sName="SquashFS";
sOptions="little endian";
}
else if(Binary.compare("'im001V'......50....0000"))
{
sName="SW";
bDetected=1;
var arch_offset=Binary.readByte(0x0e)+15;
if(Binary.compare("1f9d", arch_offset))
{
sOptions="Z archive";
}
else if(Binary.compare("1f1e", arch_offset))
{
sOptions="PACK 2 archive";
}
}
else if(Binary.compare("0001000401000100010000000000000000000000000000000000000000000000010101"))
{
bDetected=1;
sName="VMS SaveSet";
}
else if(Binary.compare("'ZOO'............'Archive'"))
{
bDetected=1;
sName="ZOO";
}
else if(Binary.compare("602213636c00"))
{
bDetected=1;
sName="Asymetrix";
}
else if(Binary.compare("453dcd28........................'Compressed ROMFS'"))
{
bDetected=1;
sName="CRAMFS";
}
else if(Binary.compare("'IsZ!@'01"))
{
bDetected=1;
sName="ISZ";
sOptions="Iso Zipped";
}
else if(Binary.compare("aa59f0000002"))
{
bDetected=1;
sName="SaveDskF";
}
else if(Binary.compare("'AlB'1a"))
{
bDetected=1;
sName="BeOS package";
}
else if(Binary.compare("'BIGF'00"))
{
bDetected=1;
sName="BIGF";
}
else if(Binary.compare("01ca'Copyright (c) Genus Microprogramming, Inc.'"))
{
bDetected=1;
sName="GXL";
}
else if(Binary.compare("0100......00ecf9"))
{
bDetected=1;
sName="INSA";
}
else if(Binary.compare("..0fd28ccc1f..3c0d8e830dd88f25ac"))
{
bDetected=1;
sName="InstallShield ISN";
}
else if(Binary.compare("135d658c3a010200"))
{
bDetected=1;
sName="InstallShield";
sVersion="3.x"
}
else if(Binary.compare("2aab79d800010000"))
{
bDetected=1;
sName="InstallShield INST";
sVersion="3.x"
}
else if(Binary.compare("'SZDD'88"))
{
bDetected=1;
sName="SZDD";
sOptions="by Microsoft";
}
else if(Binary.compare("'KWAJ'88"))
{
bDetected=1;
sName="KWAJ";
sOptions="by Microsoft";
}
else if(Binary.compare("'MDmd'"))
{
bDetected=1;
sName="MDCD";
}
else if(Binary.compare("'MPQ'1a"))
{
bDetected=1;
sName="MPQ";
sOptions="by Blizzard";
}
else if(Binary.compare("'_MCT'00'KSLZ'789c"))
{
bDetected=1;
sName="MSKN 2";
sOptions="zlib";
}
else if(Binary.compare("'PACK'............0000"))
{
bDetected=1;
sName="PACK";
}
else if(Binary.compare("00000000000000000000000000007400010074000500"))
{
bDetected=1;
sName="PCInstall";
}
else if(Binary.compare("'PP20'09"))
{
bDetected=1;
sName="PP20";
}
else if(Binary.compare("edabeedb0300"))
{
bDetected=1;
sName="RPM package";
}
else if(Binary.compare("bd01..00..00..000000"))
{
bDetected=1;
sName="HUFF";
}
else if(Binary.compare("'SZ '88"))
{
bDetected=1;
sName="SZ";
sOptions="by Microsoft";
}
else if(Binary.compare("'BAGF'02"))
{
bDetected=1;
sName="BAGF";
}
else if(Binary.compare("'PAC - 'a9' BVRP Software 1990-2000'"))
{
bDetected=1;
sName="PAC";
sOptions="1990-2000 by BVRP Software";
}
else if(Binary.compare("'Cr24'02"))
{
bDetected=1;
sName="CRX";
}
else if(Binary.compare("74c42c84e1e5d428"))
{
bDetected=1;
sName="InstallShield INX";
sVersion="7.x"
}
else if(Binary.compare("5d0000....ffffffffffffffff00180ddd04"))
{
bDetected=1;
sName="LZMA";
}
else if(Binary.compare("1fa0"))
{
bDetected=1;
sName="SCO";
}
else if(Binary.compare("'# PaCkAgE DaTaStReAm'"))
{
bDetected=1;
sName="Solaris Package";
}
else if(Binary.compare("'SQZE'010000"))
{
bDetected=1;
sName="SQZE";
}
else if(Binary.compare("'xar!'001c00010000"))
{
bDetected=1;
sName="XAR";
}
else if(Binary.compare("fd'7zXZ'0000"))
{
bDetected=1;
sName="XZ";
}
else if(Binary.compare("1f9d"))
{
bDetected=1;
sName="Z";
}
else if(Binary.compare("'LZK00'000000"))
{
bDetected=1;
sName="LZK00";
}
else if(Binary.compare("032401010100"))
{
bDetected=1;
sName="WPK";
}
else if(Binary.compare("'TPWM'"))
{
bDetected=1;
sName="TPWM (BlueByte)";
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("archive","");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("a596fdff"))
{
bDetected=1;
sName="FTCOMP";
}
else if(Binary.compare("aced00057704"))
{
bDetected=1;
sName="IzPack";
}
else if(Binary.compare("'SIT!'"))
{
bDetected=1;
sName="SIT";
}
else if(Binary.compare("06'SKF3.0'"))
{
bDetected=1;
sName="SKF";
}
else if(Binary.compare("789c"))
{
bDetected=1;
sName="ZLib";
}
else if(Binary.compare("'!<arch>'0a'debian-binary'"))
{
bDetected=1;
sName="DEB";
}
else if(Binary.compare("'Archive'00................2800000064"))
{
bDetected=1;
sName="ArcFS";
}
else if(Binary.compare("'ARCV'0002"))
{
bDetected=1;
sName="ARCV 2";
}
else if(Binary.compare("09006bea"))
{
bDetected=1;
sName="BFF";
}
else if(Binary.compare("00069a68"))
{
bDetected=1;
sName="DCL";
}
else if(Binary.compare("....'-lh'..2d")||Binary.compare("....'-lz'..2d"))
{
sName="LHA";
switch(Binary.readByte(0x5))
{
case 0x30: bDetected=1; break;
case 0x31: bDetected=1; break;
case 0x32: bDetected=1; break;
case 0x33: bDetected=1; break;
case 0x34: bDetected=1; break;
case 0x35: bDetected=1; break;
case 0x36: bDetected=1; break;
case 0x64: bDetected=1; break;
case 0x73: bDetected=1; break;
}
}
else if(Binary.compare("'mflh'0100"))
{
bDetected=1;
sName="MVA";
}
else if(Binary.compare("'ViG'....1a"))
{
bDetected=1;
sName="PaperPort";
}
else if(Binary.compare("'sqsh'0000"))
{
bDetected=1;
sName="SquashFS";
sOptions="big endian";
}
else if(Binary.compare("'hsqs'0300"))
{
bDetected=1;
sName="SquashFS";
sOptions="little endian";
}
else if(Binary.compare("'im001V'......50....0000"))
{
sName="SW";
bDetected=1;
var arch_offset=Binary.readByte(0x0e)+15;
if(Binary.compare("1f9d", arch_offset))
{
sOptions="Z archive";
}
else if(Binary.compare("1f1e", arch_offset))
{
sOptions="PACK 2 archive";
}
}
else if(Binary.compare("0001000401000100010000000000000000000000000000000000000000000000010101"))
{
bDetected=1;
sName="VMS SaveSet";
}
else if(Binary.compare("'ZOO'............'Archive'"))
{
bDetected=1;
sName="ZOO";
}
else if(Binary.compare("602213636c00"))
{
bDetected=1;
sName="Asymetrix";
}
else if(Binary.compare("453dcd28........................'Compressed ROMFS'"))
{
bDetected=1;
sName="CRAMFS";
}
else if(Binary.compare("'IsZ!@'01"))
{
bDetected=1;
sName="ISZ";
sOptions="Iso Zipped";
}
else if(Binary.compare("aa59f0000002"))
{
bDetected=1;
sName="SaveDskF";
}
else if(Binary.compare("'AlB'1a"))
{
bDetected=1;
sName="BeOS package";
}
else if(Binary.compare("'BIGF'00"))
{
bDetected=1;
sName="BIGF";
}
else if(Binary.compare("01ca'Copyright (c) Genus Microprogramming, Inc.'"))
{
bDetected=1;
sName="GXL";
}
else if(Binary.compare("0100......00ecf9"))
{
bDetected=1;
sName="INSA";
}
else if(Binary.compare("..0fd28ccc1f..3c0d8e830dd88f25ac"))
{
bDetected=1;
sName="InstallShield ISN";
}
else if(Binary.compare("135d658c3a010200"))
{
bDetected=1;
sName="InstallShield";
sVersion="3.x"
}
else if(Binary.compare("2aab79d800010000"))
{
bDetected=1;
sName="InstallShield INST";
sVersion="3.x"
}
else if(Binary.compare("'SZDD'88"))
{
bDetected=1;
sName="SZDD";
sOptions="by Microsoft";
}
else if(Binary.compare("'KWAJ'88"))
{
bDetected=1;
sName="KWAJ";
sOptions="by Microsoft";
}
else if(Binary.compare("'MDmd'"))
{
bDetected=1;
sName="MDCD";
}
else if(Binary.compare("'MPQ'1a"))
{
bDetected=1;
sName="MPQ";
sOptions="by Blizzard";
}
else if(Binary.compare("'_MCT'00'KSLZ'789c"))
{
bDetected=1;
sName="MSKN 2";
sOptions="zlib";
}
else if(Binary.compare("'PACK'............0000"))
{
bDetected=1;
sName="PACK";
}
else if(Binary.compare("00000000000000000000000000007400010074000500"))
{
bDetected=1;
sName="PCInstall";
}
else if(Binary.compare("'PP20'09"))
{
bDetected=1;
sName="PP20";
}
else if(Binary.compare("edabeedb0300"))
{
bDetected=1;
sName="RPM package";
}
else if(Binary.compare("bd01..00..00..000000"))
{
bDetected=1;
sName="HUFF";
}
else if(Binary.compare("'SZ '88"))
{
bDetected=1;
sName="SZ";
sOptions="by Microsoft";
}
else if(Binary.compare("'BAGF'02"))
{
bDetected=1;
sName="BAGF";
}
else if(Binary.compare("'PAC - 'a9' BVRP Software 1990-2000'"))
{
bDetected=1;
sName="PAC";
sOptions="1990-2000 by BVRP Software";
}
else if(Binary.compare("'Cr24'02"))
{
bDetected=1;
sName="CRX";
}
else if(Binary.compare("74c42c84e1e5d428"))
{
bDetected=1;
sName="InstallShield INX";
sVersion="7.x"
}
else if(Binary.compare("5d0000....ffffffffffffffff00180ddd04"))
{
bDetected=1;
sName="LZMA";
}
else if(Binary.compare("1fa0"))
{
bDetected=1;
sName="SCO";
}
else if(Binary.compare("'# PaCkAgE DaTaStReAm'"))
{
bDetected=1;
sName="Solaris Package";
}
else if(Binary.compare("'SQZE'010000"))
{
bDetected=1;
sName="SQZE";
}
else if(Binary.compare("'xar!'001c00010000"))
{
bDetected=1;
sName="XAR";
}
else if(Binary.compare("fd'7zXZ'0000"))
{
bDetected=1;
sName="XZ";
}
else if(Binary.compare("1f9d"))
{
bDetected=1;
sName="Z";
}
else if(Binary.compare("'LZK00'000000"))
{
bDetected=1;
sName="LZK00";
}
else if(Binary.compare("032401010100"))
{
bDetected=1;
sName="WPK";
}
else if(Binary.compare("'TPWM'"))
{
bDetected=1;
sName="TPWM (BlueByte)";
}
return result(bShowType,bShowVersion,bShowOptions);
}

60
db/Binary/com.$pirit.2.sg
View file

@ -1,30 +1,30 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","$pirit");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("e9$$$$b430cd21f6d12ea6e8....b462cd21e8....3636fb969034..c3"))
{
sVersion="1.x";
bDetected=1;
}
else if(Binary.compare("e9$$$$aee8$$$$e4210c..fbe62190b8....fb5026509087c1"))
{
sVersion="1.5";
bDetected=1;
}
else if(Binary.compare("e9$$$$369f9f1c..e9$$$$e8$$$$e421f80c..e6218d06....fc505089c1fb"))
{
sVersion="1.5";
bDetected=1;
}
else if(Binary.compare("e9$$$$f8d72606b435cd2107e8$$$$1c..1c..33d226f6da12ddfcf905....f8f5f6ea"))
{
sVersion="1.5";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","$pirit");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("e9$$$$b430cd21f6d12ea6e8....b462cd21e8....3636fb969034..c3"))
{
sVersion="1.x";
bDetected=1;
}
else if(Binary.compare("e9$$$$aee8$$$$e4210c..fbe62190b8....fb5026509087c1"))
{
sVersion="1.5";
bDetected=1;
}
else if(Binary.compare("e9$$$$369f9f1c..e9$$$$e8$$$$e421f80c..e6218d06....fc505089c1fb"))
{
sVersion="1.5";
bDetected=1;
}
else if(Binary.compare("e9$$$$f8d72606b435cd2107e8$$$$1c..1c..33d226f6da12ddfcf905....f8f5f6ea"))
{
sVersion="1.5";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

40
db/Binary/com.Best Protection Kit-B.2.sg
View file

@ -1,20 +1,20 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Best Protection Kit-B");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("eb$$fc8c06....e421a2....b0..e621fb33c08ed08be0be....8d3e....b9"))
{
sOptions="1993 by Eric Zmiro";
bDetected=1;
}
else if(Binary.compare("eb$$fc8c06....e421a2....b0..e621fbf433c08ed08be0be....8d3e....b9"))
{
sOptions="1992 by Eric Zmiro";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Best Protection Kit-B");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("eb$$fc8c06....e421a2....b0..e621fb33c08ed08be0be....8d3e....b9"))
{
sOptions="1993 by Eric Zmiro";
bDetected=1;
}
else if(Binary.compare("eb$$fc8c06....e421a2....b0..e621fbf433c08ed08be0be....8d3e....b9"))
{
sOptions="1992 by Eric Zmiro";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

30
db/Binary/com.Budokan.1.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Budokan");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("bf....b9....8bc1fd3305abe2..e9"))
{
sOptions="by Electronic Arts, Inc.";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Budokan");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("bf....b9....8bc1fd3305abe2..e9"))
{
sOptions="by Electronic Arts, Inc.";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

30
db/Binary/com.COM-Protect.2.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","COM-Protect");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("e9$$$$8b1e....83eb..b8....5053b430cd215b9ceb"))
{
sOptions="1995 by Mr.Wicked";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","COM-Protect");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("e9$$$$8b1e....83eb..b8....5053b430cd215b9ceb"))
{
sOptions="1995 by Mr.Wicked";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

30
db/Binary/com.ICE.1.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","ICE");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("eb$$be....8bfe8b0e....8b16....b8....50fcad33c2ab8bd0e2"))
{
sVersion="1.0";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","ICE");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("eb$$be....8bfe8b0e....8b16....b8....50fcad33c2ab8bd0e2"))
{
sVersion="1.0";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

206
db/Binary/com.PROTECT.2.sg
View file

@ -1,103 +1,103 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","PROTECT! COM");
function detect(bShowType,bShowVersion,bShowOptions)
{
var nLimit=Math.min(65536,Binary.getSize());
if(Binary.findSignature(0,nLimit,"0c02e9......e421e9......88e0..........eb....e621e9......88c4........e9......e621eb")!=-1)
{
sVersion="5.5";
bDetected=1;
}
else if(Binary.findSignature(0,nLimit,"e42150e9......e621e9......58e621e9......b0ffeb")!=-1)
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....81f2"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bb....81c3....eb"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$be....81ee....bb....d1cb8b04"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bf....81ef....eb"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$be....81ee....bb....d1cb8b04"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bf....81f7"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....81c2....eb"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bd....81f5....eb"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bd....d1cd"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bb....81f3"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$1efd2efe"))
{
sVersion="5.5";
bDetected=1;
}
else if(Binary.compare("e9$$$$e800005d81ed....33c08ed88bf0bf....b9....fcf3a5fd87fe8cc08ed833c08ec04f4f"))
{
sVersion="4.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$1eb430cd213c..73..cd20be....e8....e8....1f8cd88ec0"))
{
sVersion="6.0";
bDetected=1;
}
else if(Binary.compare("e8$$$$501e060e550e1f33c08ec0fafc26a1....5026a1....50"))
{
sVersion="3.0/3.1";
bDetected=1;
}
else if(Binary.compare("b8....50b8....50e9$$$$c606......eb$$8cc6060b01c3"))
{
sVersion="2.0";
sOptions="1993";
bDetected=1;
}
else if(Binary.compare("b8....50e9$$$$c606......eb$$8cc6060701c3eb"))
{
sVersion="1.0";
sOptions="1993";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","PROTECT! COM");
function detect(bShowType,bShowVersion,bShowOptions)
{
var nLimit=Math.min(65536,Binary.getSize());
if(Binary.findSignature(0,nLimit,"0c02e9......e421e9......88e0..........eb....e621e9......88c4........e9......e621eb")!=-1)
{
sVersion="5.5";
bDetected=1;
}
else if(Binary.findSignature(0,nLimit,"e42150e9......e621e9......58e621e9......b0ffeb")!=-1)
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....81f2"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bb....81c3....eb"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$be....81ee....bb....d1cb8b04"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bf....81ef....eb"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$be....81ee....bb....d1cb8b04"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bf....81f7"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....81c2....eb"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bd....81f5....eb"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bd....d1cd"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$bb....81f3"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$1efd2efe"))
{
sVersion="5.5";
bDetected=1;
}
else if(Binary.compare("e9$$$$e800005d81ed....33c08ed88bf0bf....b9....fcf3a5fd87fe8cc08ed833c08ec04f4f"))
{
sVersion="4.0";
bDetected=1;
}
else if(Binary.compare("e9$$$$1eb430cd213c..73..cd20be....e8....e8....1f8cd88ec0"))
{
sVersion="6.0";
bDetected=1;
}
else if(Binary.compare("e8$$$$501e060e550e1f33c08ec0fafc26a1....5026a1....50"))
{
sVersion="3.0/3.1";
bDetected=1;
}
else if(Binary.compare("b8....50b8....50e9$$$$c606......eb$$8cc6060b01c3"))
{
sVersion="2.0";
sOptions="1993";
bDetected=1;
}
else if(Binary.compare("b8....50e9$$$$c606......eb$$8cc6060701c3eb"))
{
sVersion="1.0";
sOptions="1993";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

40
db/Binary/com.PTP.2.sg
View file

@ -1,20 +1,20 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","PTP");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("'PTP50'fafafcb430cd21fb585c582bc05257502ec606"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("'PTP40'fafafcb430cd21fb585c582bc05257502ec606"))
{
sVersion="4.0";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","PTP");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("'PTP50'fafafcb430cd21fb585c582bc05257502ec606"))
{
sVersion="5.0";
bDetected=1;
}
else if(Binary.compare("'PTP40'fafafcb430cd21fb585c582bc05257502ec606"))
{
sVersion="4.0";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

198
db/Binary/com.RSCC.2.sg
View file

@ -1,99 +1,99 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","RSCC");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("b1..32ff82c7..b2..b5..b3..81c2....d0c203d133d1f7d232d13097"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("....82........81......32..80....2b..81"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("....80........81......30..80....30..80"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("32ed80c5..b2..b6..29ff81cf....32c980"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("29ff81f7....33d281f2....31c981c9....f81015a64975..fa53f889ea8944"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("2aed80cd..28c982c1..2ad282ca..bb....81c2....f7da03d102d128174383"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("28ed82cd..2aff82cf..32db80f3..b1..33c081c0....05....d0c033c1f7d002c1f83187"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("30c982f1..29d281ca....be....32ed82f5..81c2....d0c2f7da33d1"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("32ff82c7..b3..30ed80c5..b1..f88197........4343e2"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("f5bb....b8....bf....2e8037..81ff....4374..4875..90b5..1f9b"))
{
sVersion="1.20";
bDetected=1;
}
else if(Binary.compare("33d281f2....2bdb81f3....b9....3197....83c3..497f..2a142cca3aca"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("2bc981c1....29d281f2....33db81c3....81c2....291783c3..497f..ab"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("b9....2bdb81cb....f880b7......434975..55fc532245..ef57f9"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("bf....8bf7b9....b4..8a0532c480c4..aae2"))
{
sVersion="1.0x";
sOptions="mutated COM like RSCC";
bDetected=1;
}
else if(Binary.compare("b9....be....8bfeadd1c034..86c42ae003c7abe2"))
{
sVersion="1.0x";
sOptions="mutated COM like RSCC";
bDetected=1;
}
else if(Binary.compare("fc50be....bf....57b9....f3a4c3"))
{
sVersion="1.0x";
sOptions="mutated COM like RSCC";
bDetected=1;
}
else if(Binary.compare("eb$$fcbe....bf....57b9....f3a4bf....be....b9....c3"))
{
sVersion="1.0x";
sOptions="mutated COM like RSCC";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","RSCC");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("b1..32ff82c7..b2..b5..b3..81c2....d0c203d133d1f7d232d13097"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("....82........81......32..80....2b..81"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("....80........81......30..80....30..80"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("32ed80c5..b2..b6..29ff81cf....32c980"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("29ff81f7....33d281f2....31c981c9....f81015a64975..fa53f889ea8944"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("2aed80cd..28c982c1..2ad282ca..bb....81c2....f7da03d102d128174383"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("28ed82cd..2aff82cf..32db80f3..b1..33c081c0....05....d0c033c1f7d002c1f83187"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("30c982f1..29d281ca....be....32ed82f5..81c2....d0c2f7da33d1"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("32ff82c7..b3..30ed80c5..b1..f88197........4343e2"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("f5bb....b8....bf....2e8037..81ff....4374..4875..90b5..1f9b"))
{
sVersion="1.20";
bDetected=1;
}
else if(Binary.compare("33d281f2....2bdb81f3....b9....3197....83c3..497f..2a142cca3aca"))
{
sVersion="1.04";
bDetected=1;
}
else if(Binary.compare("2bc981c1....29d281f2....33db81c3....81c2....291783c3..497f..ab"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("b9....2bdb81cb....f880b7......434975..55fc532245..ef57f9"))
{
sVersion="1.03";
bDetected=1;
}
else if(Binary.compare("bf....8bf7b9....b4..8a0532c480c4..aae2"))
{
sVersion="1.0x";
sOptions="mutated COM like RSCC";
bDetected=1;
}
else if(Binary.compare("b9....be....8bfeadd1c034..86c42ae003c7abe2"))
{
sVersion="1.0x";
sOptions="mutated COM like RSCC";
bDetected=1;
}
else if(Binary.compare("fc50be....bf....57b9....f3a4c3"))
{
sVersion="1.0x";
sOptions="mutated COM like RSCC";
bDetected=1;
}
else if(Binary.compare("eb$$fcbe....bf....57b9....f3a4bf....be....b9....c3"))
{
sVersion="1.0x";
sOptions="mutated COM like RSCC";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

186
db/Binary/com.Unknown cryptors.2.sg
View file

@ -1,93 +1,93 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Unknown cryptor");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("fa8cde8ccf8edf8ec783c7..bb....8b1f83c3..b1..d3eb2bfbe8"))
{
sVersion="#01";
bDetected=1;
}
else if(Binary.compare("e9$$$$b9....b3..be....bf....acfec332c3aae2"))
{
sVersion="#02";
sOptions="exe 0-relocs crypt";
bDetected=1;
}
else if(Binary.compare("'GENERATED'00'FILE'bc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2"))
{
sVersion="#03";
sOptions="GENERATED FILE";
bDetected=1;
}
else if(Binary.compare("3ec606......90eb$$2e8a36....8ec08cd8be....bf....2e033e....26a3....26893e....26a3....26c706........0e07"))
{
sVersion="#04";
bDetected=1;
}
else if(Binary.compare("e8$$$$fc8bec8b4e..2bc08bf9f2aebb....03d9875e..fec58bf1ac8ad0ad8bc88bfeac32c2aae2"))
{
sVersion="#05";
bDetected=1;
}
else if(Binary.compare("fc525756ba....b9....be....bf....52f3a52ec606......c3"))
{
sVersion="#06";
bDetected=1;
}
else if(Binary.compare("b4..be....bf....b9....68....68....68....57f3a4c3"))
{
sVersion="#07";
bDetected=1;
}
else if(Binary.compare("b8....05....50c3"))
{
var nOffset=Binary.readWord(1)+Binary.readWord(4)-256;
if(Binary.compare("90902ea1....8bc85005....9083e9..bf....2e8035..47495083f9..74..c3",nOffset))
{
sVersion="#08";
sOptions="xorer";
bDetected=1;
}
}
else if(Binary.compare("e9$$$$fd1e2efe0e....81ce....39f63bf6b1..0e0e071f1e1fb9....bd....80c1..20c9bf....d1c7124e..80d1..124d..b1"))
{
sVersion="#09";
bDetected=1;
}
else if(Binary.compare("e9$$$$fd1e2a0980e9..80dd..0e80c6..32f780d2..0e10c5071f28cd26fe06....be....d1c6323780e2..02ae....2288"))
{
sVersion="#10";
bDetected=1;
}
else if(Binary.compare("e9$$$$e8$$$$5e83ee..2e8984....06562e8c9c....0e070e1fb430cd213c..7d..bb....03dee8....b0..b44ccd21"))
{
sVersion="#11";
bDetected=1;
}
else if(Binary.compare("e9$$$$3bfd81e7....fc81ef....33fc1e842b0e23fb13fc85c733ff1f0e31c70723fe26fe0e....81ef....bf....31ff"))
{
sVersion="#12";
bDetected=1;
}
else if(Binary.compare("e9$$$$1efc0e1f81df....2bfb0e81df....19d781df....89e72af4b2..072efe06....0681f7....23ff2274..02b0"))
{
sVersion="#13";
bDetected=1;
}
else if(Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....2ec706........31c0ada3....3136....8bc18bdef7e33106....3116....a1....abe2"))
{
sVersion="#14";
bDetected=1;
}
else if(Binary.compare("e9$$$$b9....be....bf....bb....5357ad3d....74..c1c8..bb....03d933c3abe2"))
{
sVersion="#15";
sOptions="xorer";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Unknown cryptor");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("fa8cde8ccf8edf8ec783c7..bb....8b1f83c3..b1..d3eb2bfbe8"))
{
sVersion="#01";
bDetected=1;
}
else if(Binary.compare("e9$$$$b9....b3..be....bf....acfec332c3aae2"))
{
sVersion="#02";
sOptions="exe 0-relocs crypt";
bDetected=1;
}
else if(Binary.compare("'GENERATED'00'FILE'bc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2"))
{
sVersion="#03";
sOptions="GENERATED FILE";
bDetected=1;
}
else if(Binary.compare("3ec606......90eb$$2e8a36....8ec08cd8be....bf....2e033e....26a3....26893e....26a3....26c706........0e07"))
{
sVersion="#04";
bDetected=1;
}
else if(Binary.compare("e8$$$$fc8bec8b4e..2bc08bf9f2aebb....03d9875e..fec58bf1ac8ad0ad8bc88bfeac32c2aae2"))
{
sVersion="#05";
bDetected=1;
}
else if(Binary.compare("fc525756ba....b9....be....bf....52f3a52ec606......c3"))
{
sVersion="#06";
bDetected=1;
}
else if(Binary.compare("b4..be....bf....b9....68....68....68....57f3a4c3"))
{
sVersion="#07";
bDetected=1;
}
else if(Binary.compare("b8....05....50c3"))
{
var nOffset=Binary.readWord(1)+Binary.readWord(4)-256;
if(Binary.compare("90902ea1....8bc85005....9083e9..bf....2e8035..47495083f9..74..c3",nOffset))
{
sVersion="#08";
sOptions="xorer";
bDetected=1;
}
}
else if(Binary.compare("e9$$$$fd1e2efe0e....81ce....39f63bf6b1..0e0e071f1e1fb9....bd....80c1..20c9bf....d1c7124e..80d1..124d..b1"))
{
sVersion="#09";
bDetected=1;
}
else if(Binary.compare("e9$$$$fd1e2a0980e9..80dd..0e80c6..32f780d2..0e10c5071f28cd26fe06....be....d1c6323780e2..02ae....2288"))
{
sVersion="#10";
bDetected=1;
}
else if(Binary.compare("e9$$$$e8$$$$5e83ee..2e8984....06562e8c9c....0e070e1fb430cd213c..7d..bb....03dee8....b0..b44ccd21"))
{
sVersion="#11";
bDetected=1;
}
else if(Binary.compare("e9$$$$3bfd81e7....fc81ef....33fc1e842b0e23fb13fc85c733ff1f0e31c70723fe26fe0e....81ef....bf....31ff"))
{
sVersion="#12";
bDetected=1;
}
else if(Binary.compare("e9$$$$1efc0e1f81df....2bfb0e81df....19d781df....89e72af4b2..072efe06....0681f7....23ff2274..02b0"))
{
sVersion="#13";
bDetected=1;
}
else if(Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....2ec706........31c0ada3....3136....8bc18bdef7e33106....3116....a1....abe2"))
{
sVersion="#14";
bDetected=1;
}
else if(Binary.compare("e9$$$$b9....be....bf....bb....5357ad3d....74..c1c8..bb....03d933c3abe2"))
{
sVersion="#15";
sOptions="xorer";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

30
db/Binary/com.VGA font loader.1.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("other","VGA font loader");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("e9$$$$b8....8ed8fafcbf....8b36....8e1e....b9....f3a5b8....8ed8c706........8c0e....8cc88ed8"))
{
sOptions="by Pete I. Kvitek";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("other","VGA font loader");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("e9$$$$b8....8ed8fafcbf....8b36....8e1e....b9....f3a5b8....8ed8c706........8c0e....8cc88ed8"))
{
sOptions="by Pete I. Kvitek";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

72
db/Binary/com.packers.2.sg
View file

@ -1,36 +1,36 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","Packer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("bf....be....b9....fdf3a5fceb$$8bf7bf....adad8be8b2..e9"))
{
sOptions="by B. Vorontsov";
bDetected=1;
}
else if(Binary.compare("565056fd8bfc83ef..b9....be....f3a447ffe7"))
{
sOptions="1997 by CyberWare";
bDetected=1;
}
else if(Binary.compare("be....bd....558bce8d72..bf....d1e9fd57f3a58d75..fcf9bf....c3"))
{
sOptions="1997 by JES //CORE";
bDetected=1;
}
else if(Binary.compare("be....bd....558bce8d72..bf....d1e9fd57f3a58d75..fcf98bfdc3"))
{
sVersion="1.2b";
sOptions="1997 by JES //CORE";
bDetected=1;
}
else if(Binary.compare("508cc890ba....05....3b06....72..b4..ba....cd21b8....cd21"))
{
sOptions="1996 by LostSoul";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","Packer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("bf....be....b9....fdf3a5fceb$$8bf7bf....adad8be8b2..e9"))
{
sOptions="by B. Vorontsov";
bDetected=1;
}
else if(Binary.compare("565056fd8bfc83ef..b9....be....f3a447ffe7"))
{
sOptions="1997 by CyberWare";
bDetected=1;
}
else if(Binary.compare("be....bd....558bce8d72..bf....d1e9fd57f3a58d75..fcf9bf....c3"))
{
sOptions="1997 by JES //CORE";
bDetected=1;
}
else if(Binary.compare("be....bd....558bce8d72..bf....d1e9fd57f3a58d75..fcf98bfdc3"))
{
sVersion="1.2b";
sOptions="1997 by JES //CORE";
bDetected=1;
}
else if(Binary.compare("508cc890ba....05....3b06....72..b4..ba....cd21b8....cd21"))
{
sOptions="1996 by LostSoul";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

274
db/Binary/com.patchers.1.sg
View file

@ -1,137 +1,137 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("patcher","Patcher");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("bc....8cc88ec08ed8fcbe....b9....8ae180e4..ac32c48844..e2"))
{
sName="Patch engine";
sOptions="by SoNiC //UTG";
bDetected=1;
}
else if(Binary.compare("e9$$$$b80300cd10b409ba....cd21e8$$$$1eb8....8ed833c98a0e....fec95133d2fec68916....b4..b2..cd21"))
{
sName="ByteHunter patch engine";
sOptions="by nOP & THE_q //Phrozen Crew";
bDetected=1;
}
else if(Binary.compare("e9$$$$0e588ec08ed88d16....68....9d9c582d....72..33dbb9"))
{
sName="GPatch";
sVersion="1.2b"
sOptions="by JES //C.O.R.E. team";
bDetected=1;
}
else if(Binary.compare("e9$$$$0e588ec08ed8e8$$$$68....9d9c582d....73..8d3e....fbc3"))
{
sName="GPatch";
sVersion="1.0c"
sOptions="by JES //C.O.R.E. team";
bDetected=1;
}
else if(Binary.compare("e9$$$$e8$$$$50558becc746......5d0733ffb9....fcb8....f3abc3"))
{
sName="Cracker";
sOptions="by NightIce //ByTe Enf0rcerZ";
bDetected=1;
}
else if(Binary.compare("eb$$c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99e8....f7d0f7d2b9"))
{
sName="AutoCRK";
sVersion="1.2x (uncrypted)";
sOptions="1995 by MACHiNE GUNgsTeR //BANG!";
bDetected=1;
}
else if(Binary.compare("eb$$8bfc83ef..83ec..be....b9....57f3a45fffe7"))
{
sName="AutoCRK";
sVersion="1.2x (crypted)";
sOptions="1995 by MACHiNE GUNgsTeR //BANG!";
bDetected=1;
}
else if(Binary.compare("c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99"))
{
sName="AutoCRK";
sVersion="1.15";
sOptions="1995 by MACHiNE GUNgsTeR //BANG!";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....8bda438a2780fc..75..e8....3c..74..2e8b1e....83fb..75..e9"))
{
sName="CRK2COM";
sVersion="1.10b";
sOptions="1993";
bDetected=1;
}
else if(Binary.compare("'/MG/'eb$$c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99"))
{
sName="AutoCRK";
sVersion="1.20";
sOptions="by MACHiNE GUNgsTeR //BANG!";
bDetected=1;
}
else if(Binary.compare("e9$$$$e8$$$$bb....b9....8a0734..880743e2..c3"))
{
sName="Crack Engine";
sVersion="0.2";
sOptions="by Prizna //PSP";
bDetected=1;
}
else if(Binary.compare("'SNT'1af8b409ba....cd2133f6bd....b8....ba....cd21a3....72..33c933d28bd8"))
{
sName="SNT patch";
sOptions="//SNT";
bDetected=1;
}
else if(Binary.compare("eb$$0e1fb409ba....cd21be....e8....803e......74..b4..ba....cd21eb..b4..ba....cd21b8....cd21"))
{
sOptions="by WOLVERiNE";
bDetected=1;
}
else if(Binary.compare("bc....5406b8....cd21891e....8c06....b8....ba....cd21b8....ba....cd21071eb9....ba....b7..b8....cd10"))
{
sOptions="by Randall Flagg of Razor 1911";
bDetected=1;
}
else if(Binary.compare("e9$$$$b8....cd10ba....e8....ba....b8....cd2173..ba....e8....ba....e8....b44ccd2193ba....e8"))
{
sOptions="by Nostromo";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....b409cd21c706........c706........c706........c706........be....33c98a0e....80f9..74..5651"))
{
sName+=" #1";
sOptions="by Drink Or Die (Dark Knight)";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....b409cd2133c0cd16b4..33dbcd10feccb2..cd10c706........c706........c706........c706"))
{
sName+=" #2";
sOptions="by Dark Knight";
bDetected=1;
}
else if(Binary.compare("b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb"))
{
sOptions="by Mr. KIM";
bDetected=1;
}
else if(Binary.compare("9090ba....8bfab409cd21c606......ba....b8....cd2172..93b8....33c933d2cd2172"))
{
sOptions="by SkorpyoN Team";
bDetected=1;
}
else if(Binary.compare("9090ba....b409cd21b401cd1674..33c0cd1633c0cd163c..0f84"))
{
sOptions="by +DzA kRAker";
bDetected=1;
}
else if(Binary.compare("9090ba....8bfab409cd21b401cd1674..33c0cd1633c0cd163c..75"))
{
sOptions="by +DzA kRAker";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("patcher","Patcher");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("bc....8cc88ec08ed8fcbe....b9....8ae180e4..ac32c48844..e2"))
{
sName="Patch engine";
sOptions="by SoNiC //UTG";
bDetected=1;
}
else if(Binary.compare("e9$$$$b80300cd10b409ba....cd21e8$$$$1eb8....8ed833c98a0e....fec95133d2fec68916....b4..b2..cd21"))
{
sName="ByteHunter patch engine";
sOptions="by nOP & THE_q //Phrozen Crew";
bDetected=1;
}
else if(Binary.compare("e9$$$$0e588ec08ed88d16....68....9d9c582d....72..33dbb9"))
{
sName="GPatch";
sVersion="1.2b"
sOptions="by JES //C.O.R.E. team";
bDetected=1;
}
else if(Binary.compare("e9$$$$0e588ec08ed8e8$$$$68....9d9c582d....73..8d3e....fbc3"))
{
sName="GPatch";
sVersion="1.0c"
sOptions="by JES //C.O.R.E. team";
bDetected=1;
}
else if(Binary.compare("e9$$$$e8$$$$50558becc746......5d0733ffb9....fcb8....f3abc3"))
{
sName="Cracker";
sOptions="by NightIce //ByTe Enf0rcerZ";
bDetected=1;
}
else if(Binary.compare("eb$$c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99e8....f7d0f7d2b9"))
{
sName="AutoCRK";
sVersion="1.2x (uncrypted)";
sOptions="1995 by MACHiNE GUNgsTeR //BANG!";
bDetected=1;
}
else if(Binary.compare("eb$$8bfc83ef..83ec..be....b9....57f3a45fffe7"))
{
sName="AutoCRK";
sVersion="1.2x (crypted)";
sOptions="1995 by MACHiNE GUNgsTeR //BANG!";
bDetected=1;
}
else if(Binary.compare("c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99"))
{
sName="AutoCRK";
sVersion="1.15";
sOptions="1995 by MACHiNE GUNgsTeR //BANG!";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....8bda438a2780fc..75..e8....3c..74..2e8b1e....83fb..75..e9"))
{
sName="CRK2COM";
sVersion="1.10b";
sOptions="1993";
bDetected=1;
}
else if(Binary.compare("'/MG/'eb$$c8......e8$$$$6a..07bf....268a1d263a1d74..268a1db8....99"))
{
sName="AutoCRK";
sVersion="1.20";
sOptions="by MACHiNE GUNgsTeR //BANG!";
bDetected=1;
}
else if(Binary.compare("e9$$$$e8$$$$bb....b9....8a0734..880743e2..c3"))
{
sName="Crack Engine";
sVersion="0.2";
sOptions="by Prizna //PSP";
bDetected=1;
}
else if(Binary.compare("'SNT'1af8b409ba....cd2133f6bd....b8....ba....cd21a3....72..33c933d28bd8"))
{
sName="SNT patch";
sOptions="//SNT";
bDetected=1;
}
else if(Binary.compare("eb$$0e1fb409ba....cd21be....e8....803e......74..b4..ba....cd21eb..b4..ba....cd21b8....cd21"))
{
sOptions="by WOLVERiNE";
bDetected=1;
}
else if(Binary.compare("bc....5406b8....cd21891e....8c06....b8....ba....cd21b8....ba....cd21071eb9....ba....b7..b8....cd10"))
{
sOptions="by Randall Flagg of Razor 1911";
bDetected=1;
}
else if(Binary.compare("e9$$$$b8....cd10ba....e8....ba....b8....cd2173..ba....e8....ba....e8....b44ccd2193ba....e8"))
{
sOptions="by Nostromo";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....b409cd21c706........c706........c706........c706........be....33c98a0e....80f9..74..5651"))
{
sName+=" #1";
sOptions="by Drink Or Die (Dark Knight)";
bDetected=1;
}
else if(Binary.compare("e9$$$$ba....b409cd2133c0cd16b4..33dbcd10feccb2..cd10c706........c706........c706........c706"))
{
sName+=" #2";
sOptions="by Dark Knight";
bDetected=1;
}
else if(Binary.compare("b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb$$cd21b409ba....eb"))
{
sOptions="by Mr. KIM";
bDetected=1;
}
else if(Binary.compare("9090ba....8bfab409cd21c606......ba....b8....cd2172..93b8....33c933d2cd2172"))
{
sOptions="by SkorpyoN Team";
bDetected=1;
}
else if(Binary.compare("9090ba....b409cd21b401cd1674..33c0cd1633c0cd163c..0f84"))
{
sOptions="by +DzA kRAker";
bDetected=1;
}
else if(Binary.compare("9090ba....8bfab409cd21b401cd1674..33c0cd1633c0cd163c..75"))
{
sOptions="by +DzA kRAker";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

28
db/Binary/com.readme.com.1.sg
View file

@ -1,14 +1,14 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","README.COM");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("bb....b8....cd21be....fcbf....f6c2..74..f6c2..74..bf....ac3c..74..b4"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","README.COM");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("bb....b8....cd21be....fcbf....f6c2..74..f6c2..74..bf....ac3c..74..b4"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

28
db/Binary/com.simple ansi viewer.1.sg
View file

@ -1,14 +1,14 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","simple ANSI viewer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("b8....bb....b9....0e1fba....cd21b8004ccd21"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","simple ANSI viewer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("b8....bb....b9....0e1fba....cd21b8004ccd21"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

28
db/Binary/com.simple self-displayer.1.sg
View file

@ -1,14 +1,14 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","simple self-displayer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("b8....8ec0b4..b9....cd102bc92bffb8....51b9....f3ab59be....2bdb2bed2bd28bfdac"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","simple self-displayer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("b8....8ec0b4..b9....cd102bc92bffb8....51b9....f3ab59be....2bdb2bed2bd28bfdac"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

28
db/Binary/java.1.sg
View file

@ -9,8 +9,32 @@ function detect(bShowType,bShowVersion,bShowOptions)
{
if(Binary.compare("CAFEBABE"))
{
sVersion=Binary.readBEWord(6)+"."+Binary.readBEWord(4);
bDetected=1;
var nMinor=Binary.readBEWord(4);
var nMajor=Binary.readBEWord(6);
if(nMajor)
{
switch(nMajor)
{
case 0x2D: sVersion="JDK 1.1"; break;
case 0x2E: sVersion="JDK 1.2"; break;
case 0x2F: sVersion="JDK 1.3"; break;
case 0x30: sVersion="JDK 1.4"; break;
case 0x31: sVersion="Java SE 5.0"; break;
case 0x32: sVersion="Java SE 6.0"; break;
case 0x33: sVersion="Java SE 7"; break;
case 0x34: sVersion="Java SE 8"; break;
case 0x35: sVersion="Java SE 9"; break;
case 0x36: sVersion="Java SE 10"; break;
case 0x37: sVersion="Java SE 11"; break;
case 0x38: sVersion="Java SE 12"; break;
default: sVersion=nMajor+"."+nMinor;
}
if((nMajor>=0x2D)&&(nMajor<=0x38))
{
bDetected=1;
}
}
}
}

246
db/MSDOS/Borland C.4.sg
View file

@ -1,123 +1,123 @@
// DIE's signature file
// Author: Jason Hood <jadoxa@yahoo.com.au>
init("compiler","Borland C/C++");
function detect(bShowType,bShowVersion,bShowOptions)
{
var nOffset=0;
if(MSDOS.compareEP("FB"))
{
nOffset=1;
}
if(MSDOS.compareEP("BA....2E8916....B430CD218B2E02008B1E2C008EDA",nOffset))
{
var nDataSeg=MSDOS.readWord(MSDOS.getEntryPointOffset(nOffset+1));
nOffset=MSDOS.AddressToOffset(nDataSeg);
bDetected=1;
}
else if(MSDOS.compareEP("8CCA2E8916....B430CD218B2E02008B1E2C008EDAA3"))
{
var nDataOfs=MSDOS.readWord(MSDOS.getEntryPointOffset(22));
nOffset=MSDOS.AddressToOffset(0,nDataOfs-120);
bDetected=1;
}
nOffset=MSDOS.findString(nOffset,64," - Copyright ");
if(nOffset!=-1)
{
sVersion=MSDOS.getString(nOffset+13,4);
if(MSDOS.compare("43",nOffset-1))
{
sName="Turbo C";
if(sVersion=="(c) ")
{
sVersion=MSDOS.getString(nOffset+17,4);
}
}
else if(MSDOS.compare("'Turbo'",nOffset-9))
{
sName="Turbo C/C++";
}
else if(sVersion=="1991")
{
sVersion="3.1";
}
else if(sVersion=="1994")
{
sVersion="4.X";
}
bDetected=1;
}
if(MSDOS.compareEP("b4..cd103c..74..b8....cd10ba....2e8916....8b2e....8b1e....8eda8c06....891e....892e....a1"))
{
sVersion="1991";
bDetected=1;
}
else if(MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8"))
{
sVersion="1991";
bDetected=1;
}
else if(MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....c43e....8bc78bd8"))
{
sVersion="1988";
bDetected=1;
}
//moved from Turbo C.sg
else if(MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......89......C7..........E8....C4......8bc78bd8b9....26........75"))
{
sName="Turbo C";
sVersion="1988";
bDetected=1;
}
else if(MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......89......8cd22bea8b3e....81ff....73..bf....893e....b1"))
{
sName="Turbo C";
sVersion="1988";
bDetected=1;
}
else if(MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......53E8....0733FF2BDB8BC3B9....FCF2AEE3..4326......75..80"))
{
sName="Turbo C";
sVersion="1990";
bDetected=1;
}
else if(MSDOS.compareEP("FBBA....2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........E8....C4......8BC78BD8B9....2681"))
{
sName="Turbo C";
sVersion="1987";
bDetected=1;
}
else if(MSDOS.compareEP("FB8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........E8....C4......8BC78BD8B9....2681"))
{
sName="Turbo C";
sVersion="1987";
bDetected=1;
}
else if(MSDOS.compareEP("BA....2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........8ec333c0b9....8bf88bd82681......75"))
{
sName="Turbo C";
sVersion="1987";
bDetected=1;
}
else if(MSDOS.compareEP("8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706"))
{
sName="Turbo C";
sVersion="1988";
bDetected=1;
}
else if(MSDOS.compareEP("8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......E8"))
{
sName="Turbo C";
sVersion="1990";
bDetected=1;
}
else if(MSDOS.compareEP("8cd8bb....8edb8cd38bccfa8e16....bc....fbe8....fa8ed38be1fbea"))
{
sName="Turbo C";
sVersion="1988";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: Jason Hood <jadoxa@yahoo.com.au>
init("compiler","Borland C/C++");
function detect(bShowType,bShowVersion,bShowOptions)
{
var nOffset=0;
if(MSDOS.compareEP("FB"))
{
nOffset=1;
}
if(MSDOS.compareEP("BA....2E8916....B430CD218B2E02008B1E2C008EDA",nOffset))
{
var nDataSeg=MSDOS.readWord(MSDOS.getEntryPointOffset(nOffset+1));
nOffset=MSDOS.AddressToOffset(nDataSeg);
bDetected=1;
}
else if(MSDOS.compareEP("8CCA2E8916....B430CD218B2E02008B1E2C008EDAA3"))
{
var nDataOfs=MSDOS.readWord(MSDOS.getEntryPointOffset(22));
nOffset=MSDOS.AddressToOffset(0,nDataOfs-120);
bDetected=1;
}
nOffset=MSDOS.findString(nOffset,64," - Copyright ");
if(nOffset!=-1)
{
sVersion=MSDOS.getString(nOffset+13,4);
if(MSDOS.compare("43",nOffset-1))
{
sName="Turbo C";
if(sVersion=="(c) ")
{
sVersion=MSDOS.getString(nOffset+17,4);
}
}
else if(MSDOS.compare("'Turbo'",nOffset-9))
{
sName="Turbo C/C++";
}
else if(sVersion=="1991")
{
sVersion="3.1";
}
else if(sVersion=="1994")
{
sVersion="4.X";
}
bDetected=1;
}
if(MSDOS.compareEP("b4..cd103c..74..b8....cd10ba....2e8916....8b2e....8b1e....8eda8c06....891e....892e....a1"))
{
sVersion="1991";
bDetected=1;
}
else if(MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....e8"))
{
sVersion="1991";
bDetected=1;
}
else if(MSDOS.compareEP("ba....2e8916....b430cd218b2e....8b1e....8edaa3....8c06....891e....892e....c43e....8bc78bd8"))
{
sVersion="1988";
bDetected=1;
}
//moved from Turbo C.sg
else if(MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......89......C7..........E8....C4......8bc78bd8b9....26........75"))
{
sName="Turbo C";
sVersion="1988";
bDetected=1;
}
else if(MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......89......8cd22bea8b3e....81ff....73..bf....893e....b1"))
{
sName="Turbo C";
sVersion="1988";
bDetected=1;
}
else if(MSDOS.compareEP("BA....2E89......B4..CD218B......8B......8EDAA3....8C......89......53E8....0733FF2BDB8BC3B9....FCF2AEE3..4326......75..80"))
{
sName="Turbo C";
sVersion="1990";
bDetected=1;
}
else if(MSDOS.compareEP("FBBA....2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........E8....C4......8BC78BD8B9....2681"))
{
sName="Turbo C";
sVersion="1987";
bDetected=1;
}
else if(MSDOS.compareEP("FB8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........E8....C4......8BC78BD8B9....2681"))
{
sName="Turbo C";
sVersion="1987";
bDetected=1;
}
else if(MSDOS.compareEP("BA....2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706........8ec333c0b9....8bf88bd82681......75"))
{
sName="Turbo C";
sVersion="1987";
bDetected=1;
}
else if(MSDOS.compareEP("8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......C706"))
{
sName="Turbo C";
sVersion="1988";
bDetected=1;
}
else if(MSDOS.compareEP("8cca2E89......B430CD218B......8B......8EDAA3....8C......89......89......E8"))
{
sName="Turbo C";
sVersion="1990";
bDetected=1;
}
else if(MSDOS.compareEP("8cd8bb....8edb8cd38bccfa8e16....bc....fbe8....fa8ed38be1fbea"))
{
sName="Turbo C";
sVersion="1988";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

56
db/MSDOS/CWSDPMI.0a.sg
View file

@ -1,28 +1,28 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("extender","CWSDPMI");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("8b2e....ba....8eda8c06....2bea8b3e....81c7....b1..d3ef473bef72..bf....3bef77..8bfd8bdfd3e7"))
{
sVersion="0.90+ (r4)";
sOptions="1997 by Charles W. Sandmann";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$8b2e....ba....8eda8c06....2bea8b3e....81c7....b1..d3ef473bef72..bf....3bef77..8bfd8bdfd3e7"))
{
sVersion="0.90+ (6b)";
sOptions="2001 by Charles W. Sandmann";
bDetected=1;
}
else if(MSDOS.compareEP("ba....8eda8cd32bdac1e3..8ed203e38c06....fcb430cd213c0373..b0..ba....e9"))
{
sName+=" (ELFstub)";
sVersion="1.00";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("extender","CWSDPMI");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("8b2e....ba....8eda8c06....2bea8b3e....81c7....b1..d3ef473bef72..bf....3bef77..8bfd8bdfd3e7"))
{
sVersion="0.90+ (r4)";
sOptions="1997 by Charles W. Sandmann";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$8b2e....ba....8eda8c06....2bea8b3e....81c7....b1..d3ef473bef72..bf....3bef77..8bfd8bdfd3e7"))
{
sVersion="0.90+ (6b)";
sOptions="2001 by Charles W. Sandmann";
bDetected=1;
}
else if(MSDOS.compareEP("ba....8eda8cd32bdac1e3..8ed203e38c06....fcb430cd213c0373..b0..ba....e9"))
{
sName+=" (ELFstub)";
sVersion="1.00";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

40
db/MSDOS/CauseWay DOS Extender.0a.sg
View file

@ -1,20 +1,20 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("extender","CauseWay DOS Extender");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("fa161f26a1....83e8..8ed0fb061607be....8bfeb9....f3a407368c......8bd88cca3603......368b......fd8bc53d....76"))
{
sVersion="3.1x-3.4x";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$8be88cc60e1f8cc005....0106....b8....cd213c..73..b8....cd21803e......74..8cc005....0306....268b16....3bc273..8ec0a1....33ff"))
{
sVersion="2.64, 3.25";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("extender","CauseWay DOS Extender");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("fa161f26a1....83e8..8ed0fb061607be....8bfeb9....f3a407368c......8bd88cca3603......368b......fd8bc53d....76"))
{
sVersion="3.1x-3.4x";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$8be88cc60e1f8cc005....0106....b8....cd213c..73..b8....cd21803e......74..8cc005....0306....268b16....3bc273..8ec0a1....33ff"))
{
sVersion="2.64, 3.25";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

30
db/MSDOS/Copylock PC.1.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Copylock PC");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("0e1fb9....bf....8135....83c7..e2"))
{
sOptions="1990 by Rob Northen Computing";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Copylock PC");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("0e1fb9....bf....8135....83c7..e2"))
{
sOptions="1990 by Rob Northen Computing";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

182
db/MSDOS/Cryptors.2.sg
View file

@ -1,91 +1,91 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Cryptor");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b2..33f6b9....2e30144649e3..eb..b8....ffe0"))
{
sOptions="by Rainor'99";
bDetected=1;
}
else if(MSDOS.compareEP("1e8ccb8edbbb....8177......8177......8177......8177......8177......1f0eeb"))
{
sOptions="by Papaev V.V., Moscow";
bDetected=1;
}
else if(MSDOS.compareEP("50e8$$$$5b9c5825....509d8ccb81c3....81eb....53bb....53cb"))
{
sOptions="1990-92 by Sergdesign";
bDetected=1;
}
else if(MSDOS.compareEP("81c3....eb$$85fa85e8eb$$81c3....eb$$bb....81eb....81c3....f981e9....39f5ba....81ea....85de"))
{
sOptions="by eGIS! //CORE";
bDetected=1;
}
else if(MSDOS.compareEP("bd....8cdb83c3..8cd805....8ed88ec033ffbe....b9....ba....0bc975..0bd274..4ae8....eb..561e"))
{
sOptions="1994 by FalCoN";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$e8$$$$bf....e9$$$$31d2eb$$eb$$e9$$$$8edae9$$$$e8$$$$8715e9$$$$52eb$$31f6e8$$bb....eb$$8737e9$$$$56e9$$$$e9$$$$e8$$$$bf....bb....2e8a1789d8"))
{
sOptions="by Matrix Technologies";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$eb$$bf....e9$$$$29f6e8$$$$e9$$$$8edee8$$$$8735e8$$$$56e9$$$$e9$$$$31ede9$$$$bb....e9$$$$e8$$$$e9$$$$e8$$$$e9$$$$e9$$$$e8$$$$e8$$$$e8$$$$872f"))
{
sOptions="by Matrix Technologies";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$33ed83ed..2ed0....5e0e8bfe81e7....f7df03fe2e893526a1....8ec0263b06....74..f92eff35"))
{
sOptions="by DREAMMASTER";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$e8$$$$eb$$e4210c..e62133c08ed80e50558becc746......5dfa8f06....8f06....fb9c580d....509d"))
{
sOptions="by RaZoR 1911";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$e80000fa9cfc505393584c4c3bc35b74..9de8....32e480c4..3065..47e2"))
{
sName+=' N1';
sOptions="by ZeroCoder //XG";
bDetected=1;
}
else if(MSDOS.compareEP("3beb81c5....fc23eb13ec85fd1e0e33e985ee01ed23ee1f0e81d1....84e931dd073efe0e....e9"))
{
sOptions="1996 by RAM Scanner //CiD";
bDetected=1;
}
else if(MSDOS.compareEP("b8....15....72..d4..8ac4..c3....8ed8b9....f7d32e871e....ff77..ff378becc747......8c0f"))
{
sOptions="by Thunderbyte";
bDetected=1;
}
else if(MSDOS.compareEP("b8....15....72..d4..8ac4..c3..8ed8b9....f7d32e871e....ff77..ff378becc747......8c0f"))
{
sOptions="by Thunderbyte";
bDetected=1;
}
else if(MSDOS.compareEP("2e8c1e....2e8e06....33ff33f6b9....0e1f030e....f3a406b8....500e07cb"))
{
sOptions="1994 by Paragon Technology Systems";
bDetected=1;
}
else if(MSDOS.compareEP("87dbb8....15....72$$8cd315....72..d4..8ac483c3..8ed8b9....f7d32e87"))
{
sOptions="1997 by Thunderbyte";
bDetected=1;
}
else if(MSDOS.compareEP("50e8$$$$5b83c3..1e06530e1f83c3..90b0..b9....2e3007fec043e2"))
{
sOptions="by Dr. Motorhead";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Cryptor");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b2..33f6b9....2e30144649e3..eb..b8....ffe0"))
{
sOptions="by Rainor'99";
bDetected=1;
}
else if(MSDOS.compareEP("1e8ccb8edbbb....8177......8177......8177......8177......8177......1f0eeb"))
{
sOptions="by Papaev V.V., Moscow";
bDetected=1;
}
else if(MSDOS.compareEP("50e8$$$$5b9c5825....509d8ccb81c3....81eb....53bb....53cb"))
{
sOptions="1990-92 by Sergdesign";
bDetected=1;
}
else if(MSDOS.compareEP("81c3....eb$$85fa85e8eb$$81c3....eb$$bb....81eb....81c3....f981e9....39f5ba....81ea....85de"))
{
sOptions="by eGIS! //CORE";
bDetected=1;
}
else if(MSDOS.compareEP("bd....8cdb83c3..8cd805....8ed88ec033ffbe....b9....ba....0bc975..0bd274..4ae8....eb..561e"))
{
sOptions="1994 by FalCoN";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$e8$$$$bf....e9$$$$31d2eb$$eb$$e9$$$$8edae9$$$$e8$$$$8715e9$$$$52eb$$31f6e8$$bb....eb$$8737e9$$$$56e9$$$$e9$$$$e8$$$$bf....bb....2e8a1789d8"))
{
sOptions="by Matrix Technologies";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$eb$$bf....e9$$$$29f6e8$$$$e9$$$$8edee8$$$$8735e8$$$$56e9$$$$e9$$$$31ede9$$$$bb....e9$$$$e8$$$$e9$$$$e8$$$$e9$$$$e9$$$$e8$$$$e8$$$$e8$$$$872f"))
{
sOptions="by Matrix Technologies";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$33ed83ed..2ed0....5e0e8bfe81e7....f7df03fe2e893526a1....8ec0263b06....74..f92eff35"))
{
sOptions="by DREAMMASTER";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$e8$$$$eb$$e4210c..e62133c08ed80e50558becc746......5dfa8f06....8f06....fb9c580d....509d"))
{
sOptions="by RaZoR 1911";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$e80000fa9cfc505393584c4c3bc35b74..9de8....32e480c4..3065..47e2"))
{
sName+=' N1';
sOptions="by ZeroCoder //XG";
bDetected=1;
}
else if(MSDOS.compareEP("3beb81c5....fc23eb13ec85fd1e0e33e985ee01ed23ee1f0e81d1....84e931dd073efe0e....e9"))
{
sOptions="1996 by RAM Scanner //CiD";
bDetected=1;
}
else if(MSDOS.compareEP("b8....15....72..d4..8ac4..c3....8ed8b9....f7d32e871e....ff77..ff378becc747......8c0f"))
{
sOptions="by Thunderbyte";
bDetected=1;
}
else if(MSDOS.compareEP("b8....15....72..d4..8ac4..c3..8ed8b9....f7d32e871e....ff77..ff378becc747......8c0f"))
{
sOptions="by Thunderbyte";
bDetected=1;
}
else if(MSDOS.compareEP("2e8c1e....2e8e06....33ff33f6b9....0e1f030e....f3a406b8....500e07cb"))
{
sOptions="1994 by Paragon Technology Systems";
bDetected=1;
}
else if(MSDOS.compareEP("87dbb8....15....72$$8cd315....72..d4..8ac483c3..8ed8b9....f7d32e87"))
{
sOptions="1997 by Thunderbyte";
bDetected=1;
}
else if(MSDOS.compareEP("50e8$$$$5b83c3..1e06530e1f83c3..90b0..b9....2e3007fec043e2"))
{
sOptions="by Dr. Motorhead";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

74
db/MSDOS/DOSX16.0a.sg
View file

@ -1,37 +1,37 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("extender","DOSX16");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("eb$$b430cd213c0372..b8....ba....2bc2268b1e....2bd8b1..d3e08bc881fb....72..1e068eda8ec333f6"))
{
bDetected=1;
}
else if(MSDOS.compareEP("eb$$b430cd213c0372..b8....ba....2bc2268b1e....81eb....2bd8b1..d3e08bc881fb....72..1e068eda8ec333f6"))
{
sVersion="type 1";
sOptions="CodeView";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$b430cd213c0372..e8$$$$56571e060e1fb8....cd213c0372..77..80fc..72..b452cd2126a1....3d"))
{
sVersion="type 2";
sOptions="CodeView";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$8cc8fa8ed0bc....fb0e1f8c06....c406....a3....8c06....e8....b8....b1..d3e805....a3....e8"))
{
sVersion="type 3";
sOptions="CodeView";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$b8....8ed88c06....8ed0bc....50bb....b44acd21588ec0"))
{
sVersion="type 4";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("extender","DOSX16");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("eb$$b430cd213c0372..b8....ba....2bc2268b1e....2bd8b1..d3e08bc881fb....72..1e068eda8ec333f6"))
{
bDetected=1;
}
else if(MSDOS.compareEP("eb$$b430cd213c0372..b8....ba....2bc2268b1e....81eb....2bd8b1..d3e08bc881fb....72..1e068eda8ec333f6"))
{
sVersion="type 1";
sOptions="CodeView";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$b430cd213c0372..e8$$$$56571e060e1fb8....cd213c0372..77..80fc..72..b452cd2126a1....3d"))
{
sVersion="type 2";
sOptions="CodeView";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$8cc8fa8ed0bc....fb0e1f8c06....c406....a3....8c06....e8....b8....b1..d3e805....a3....e8"))
{
sVersion="type 3";
sOptions="CodeView";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$b8....8ed88c06....8ed0bc....50bb....b44acd21588ec0"))
{
sVersion="type 4";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

32
db/MSDOS/DemoMaker.2.sg
View file

@ -1,16 +1,16 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("other","DemoMaker");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("be....ad8ed833f6b8....8ec0bf....b9....ac3c..75..3a0474..e2..b8....8ed8b409ba....cd21b8....cd21"))
{
sVersion="1.55";
sOptions="1993-94 by R.Janorkar";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("other","DemoMaker");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("be....ad8ed833f6b8....8ec0bf....b9....ac3c..75..3a0474..e2..b8....8ed8b409ba....cd21b8....cd21"))
{
sVersion="1.55";
sOptions="1993-94 by R.Janorkar";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

114
db/MSDOS/LZEXE.2.sg
View file

@ -1,57 +1,57 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","LZEXE");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb03......8ec3fdf3a453b8....50cb"))
{
sVersion="0.91, 1.0";
bDetected=1;
}
else if(MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb03......8ec3b4..31edfdac01c5aae2"))
{
sVersion="0.90";
bDetected=1;
}
else if(MSDOS.compareEP("50060e1f8b0e....8bf14e89f78cdb03......8ec3fdf3a453b8....50cb"))
{
sVersion="0.91c";
bDetected=1;
}
else if(MSDOS.compareEP("50060e1f8b36....83e6..8bfe8bced1e9418cdb031e....8ec3fdf3a553b8....50cb"))
{
sVersion="0.91c";
bDetected=1;
}
else if(MSDOS.compareEP("50060e1f8b0e....8bf14e8cdb89f703......8ec3fdf3a4b8....5350cb"))
{
sVersion="0.91";
sOptions="1990";
bDetected=1;
}
else if(MSDOS.compareEP("0e1f068b0e....8bf14e89f78cdb031e....8ec3fdf3a453b8....50cb"))
{
sVersion="1.0";
bDetected=1;
}
else if(MSDOS.compareEP("0e1f8b0e....89ce504e8cdb0689f7031e....fd8ec3f3a453b8....50cb"))
{
sVersion="?.?";
bDetected=1;
}
else if(MSDOS.compareEP("060e1f8b0e....8bf14e8bfe8cdb031e....8ec3fdf3a453b8....50cb"))
{
sVersion="1.0a";
bDetected=1;
}
else if(MSDOS.compareEP("8cd805....2e0106....2eff2e"))
{
sVersion="1.00a";
sOptions="suspicious, look like a trick";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","LZEXE");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb03......8ec3fdf3a453b8....50cb"))
{
sVersion="0.91, 1.0";
bDetected=1;
}
else if(MSDOS.compareEP("060e1f8b0e....8bf14e89f78cdb03......8ec3b4..31edfdac01c5aae2"))
{
sVersion="0.90";
bDetected=1;
}
else if(MSDOS.compareEP("50060e1f8b0e....8bf14e89f78cdb03......8ec3fdf3a453b8....50cb"))
{
sVersion="0.91c";
bDetected=1;
}
else if(MSDOS.compareEP("50060e1f8b36....83e6..8bfe8bced1e9418cdb031e....8ec3fdf3a553b8....50cb"))
{
sVersion="0.91c";
bDetected=1;
}
else if(MSDOS.compareEP("50060e1f8b0e....8bf14e8cdb89f703......8ec3fdf3a4b8....5350cb"))
{
sVersion="0.91";
sOptions="1990";
bDetected=1;
}
else if(MSDOS.compareEP("0e1f068b0e....8bf14e89f78cdb031e....8ec3fdf3a453b8....50cb"))
{
sVersion="1.0";
bDetected=1;
}
else if(MSDOS.compareEP("0e1f8b0e....89ce504e8cdb0689f7031e....fd8ec3f3a453b8....50cb"))
{
sVersion="?.?";
bDetected=1;
}
else if(MSDOS.compareEP("060e1f8b0e....8bf14e8bfe8cdb031e....8ec3fdf3a453b8....50cb"))
{
sVersion="1.0a";
bDetected=1;
}
else if(MSDOS.compareEP("8cd805....2e0106....2eff2e"))
{
sVersion="1.00a";
sOptions="suspicious, look like a trick";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

256
db/MSDOS/Lattice C.4.sg
View file

@ -1,128 +1,128 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","Lattice C");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....90fb"))
{
sVersion="3.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed02e8b26....fbb8....a3....8c06....26a1....a3....be"))
{
sVersion="3.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be02e8c06....fbbb....b4..cd2173..e9"))
{
sVersion="3.00";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fb8cd88cc92bc1b1..d3c0a3....8126........25....a3....33c0"))
{
sVersion="3.00";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fbb8....a3....8c06....26a1....a3....be....268a0c32ede3"))
{
sVersion="2.00";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fbb430cd210ac075..b8....a3....8c06"))
{
sVersion="2.1";
bDetected=1;
}
else if(MSDOS.compareEP("fa8cc78cd68bccba....8ec2268e16....bc....fb8ec75651501e06"))
{
sVersion="2.1";
bDetected=1;
}
else if(MSDOS.compareEP("fcb8....8ed88926....8306......06fa8ed081c4....fbc706........c606......33c0a2....a2....b8....2d....a3....03c4"))
{
sVersion="6.0";
bDetected=1;
}
else if(MSDOS.compareEP("fcb8....8ed88926....8306......fa8ed081c4....fbc706........b8....a3....a3....bb....2bd8"))
{
sVersion="6.0";
if(MSDOS.compareEP("891e....03dc",43))
{
sOptions="overlay";
}
bDetected=1;
}
else if(MSDOS.compareEP("8cc88ed8ba....b409cd21b8....8ed8ba....b409cd21bb....8b178b4f..8ed9b409cd21b8....cd21cb"))
{
sVersion="3.30";
sOptions="driver";
bDetected=1;
}
else if(MSDOS.compareEP("fa8cdeb9....8ed98926....8c16....8936....8bec8b46..a3....8b46..a3....fbfca1....0bc075..40a3....8cd8"))
{
sVersion="3.00";
sOptions="overlay";
bDetected=1;
}
else if(MSDOS.compareEP("8bec8b5e..8b46..2ea3....2e891e....c746......8b46..8b5e..8cc78cd68bccba....8ec2268e16....bc....8bd0"))
{
sVersion="3.00";
sOptions="overlay";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3891e....b8....a3....0633c0508bec"))
{
sVersion="1.00";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed88ed08c06....268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec"))
{
sVersion="1.02";
bDetected=1;
}
else if(MSDOS.compareEP("fc508cc00bc05874..b8....8ed88cc0a3....2906....8b1e....b4..cd2126a1....a3....8cc0a3....c706........268a1e"))
{
sVersion="3.30";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$fafcb8....8ed88cc0a3....2906....a3....c706........8b1e....b4..cd2126a1....a3....268a1e....26c606"))
{
sVersion="3.30";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$fc268b36....bf....2e8c06....8ec732c0b430cd21fc8cd93c..73..b0..26a2....33ed33db8edb8b07d1e8"))
{
sVersion="2.00";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$8cc78cd68bcc83c1..2e8c06....ba....8ec2268e16....bc....5651501e57b8....8ed833ff26f685......75"))
{
sVersion="2.00";
bDetected=1;
}
else if(MSDOS.compareEP("fabe....8b14b8....8ed8b8....8ed0bc....8916....fbb430cd210ac075..b8....a3....8c06....803e......7c"))
{
sVersion="2.1";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed88f06....8f06....8becc446..a3....8c06....8b46..2b46..a3....8b46..a3....8e46..8b5e..b8....8ed0"))
{
sVersion="2.1";
sOptions="overlay";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be0fbbb....b44acd21ba....73..e9"))
{
sVersion="2.1-3.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fb8c06....268e06....8c06....c706........b8....a3"))
{
sVersion="2.1-3.0";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","Lattice C");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....90fb"))
{
sVersion="3.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed02e8b26....fbb8....a3....8c06....26a1....a3....be"))
{
sVersion="3.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be02e8c06....fbbb....b4..cd2173..e9"))
{
sVersion="3.00";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fb8cd88cc92bc1b1..d3c0a3....8126........25....a3....33c0"))
{
sVersion="3.00";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fbb8....a3....8c06....26a1....a3....be....268a0c32ede3"))
{
sVersion="2.00";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fbb430cd210ac075..b8....a3....8c06"))
{
sVersion="2.1";
bDetected=1;
}
else if(MSDOS.compareEP("fa8cc78cd68bccba....8ec2268e16....bc....fb8ec75651501e06"))
{
sVersion="2.1";
bDetected=1;
}
else if(MSDOS.compareEP("fcb8....8ed88926....8306......06fa8ed081c4....fbc706........c606......33c0a2....a2....b8....2d....a3....03c4"))
{
sVersion="6.0";
bDetected=1;
}
else if(MSDOS.compareEP("fcb8....8ed88926....8306......fa8ed081c4....fbc706........b8....a3....a3....bb....2bd8"))
{
sVersion="6.0";
if(MSDOS.compareEP("891e....03dc",43))
{
sOptions="overlay";
}
bDetected=1;
}
else if(MSDOS.compareEP("8cc88ed8ba....b409cd21b8....8ed8ba....b409cd21bb....8b178b4f..8ed9b409cd21b8....cd21cb"))
{
sVersion="3.30";
sOptions="driver";
bDetected=1;
}
else if(MSDOS.compareEP("fa8cdeb9....8ed98926....8c16....8936....8bec8b46..a3....8b46..a3....fbfca1....0bc075..40a3....8cd8"))
{
sVersion="3.00";
sOptions="overlay";
bDetected=1;
}
else if(MSDOS.compareEP("8bec8b5e..8b46..2ea3....2e891e....c746......8b46..8b5e..8cc78cd68bccba....8ec2268e16....bc....8bd0"))
{
sVersion="3.00";
sOptions="overlay";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3891e....b8....a3....0633c0508bec"))
{
sVersion="1.00";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed88ed08c06....268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec"))
{
sVersion="1.02";
bDetected=1;
}
else if(MSDOS.compareEP("fc508cc00bc05874..b8....8ed88cc0a3....2906....8b1e....b4..cd2126a1....a3....8cc0a3....c706........268a1e"))
{
sVersion="3.30";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$fafcb8....8ed88cc0a3....2906....a3....c706........8b1e....b4..cd2126a1....a3....268a1e....26c606"))
{
sVersion="3.30";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$fc268b36....bf....2e8c06....8ec732c0b430cd21fc8cd93c..73..b0..26a2....33ed33db8edb8b07d1e8"))
{
sVersion="2.00";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$8cc78cd68bcc83c1..2e8c06....ba....8ec2268e16....bc....5651501e57b8....8ed833ff26f685......75"))
{
sVersion="2.00";
bDetected=1;
}
else if(MSDOS.compareEP("fabe....8b14b8....8ed8b8....8ed0bc....8916....fbb430cd210ac075..b8....a3....8c06....803e......7c"))
{
sVersion="2.1";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed88f06....8f06....8becc446..a3....8c06....8b46..2b46..a3....8b46..a3....8e46..8b5e..b8....8ed0"))
{
sVersion="2.1";
sOptions="overlay";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0b8....8be0fbbb....b44acd21ba....73..e9"))
{
sVersion="2.1-3.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8b8....8ed0bc....fb8c06....268e06....8c06....c706........b8....a3"))
{
sVersion="2.1-3.0";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

30
db/MSDOS/Mandrake.2.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Mandrake");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b8....8ed8b8....8ec0e8$$$$bb....b9....b8....2bc1568bf0268a3488305ee2..b4..b7..cd10"))
{
sOptions="by H.P.G. Soft";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","Mandrake");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b8....8ed8b8....8ec0e8$$$$bb....b9....b8....2bc1568bf0268a3488305ee2..b4..b7..cd10"))
{
sOptions="by H.P.G. Soft";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

160
db/MSDOS/Microsoft C.4.sg
View file

@ -1,80 +1,80 @@
// DIE's signature file
// Author: Jason Hood <jadoxa@yahoo.com.au>
init("compiler","Microsoft");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b430cd213c..73..33c00650cbbf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f"))
{
sName+=" Quick C";
sVersion="2.5x";
sOptions="1990";
bDetected=1;
}
else if(MSDOS.compareEP("fc8cc02ea3....8ed8a1....2ea3....2ea3....be....ac32e403f0c6....b8....8ec02680........75"))
{
sName+=" Quick C";
sVersion="2.51a";
sOptions="1990";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..b8....50e8....92b409cd21cd20bf"))
{
sName+=" C/C++";
sVersion="1986";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..b8....50900ee8....92b409cd21cd20bf"))
{
sName+=" C/C++";
sVersion="1986";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..b8....509a........92b409cd21cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..33c050"))
{
sName+=" C/C++";
sVersion="1986";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf776..8bc405....d1d8b1..d3e83bf072..8bf0fa8ed781c4....fb73"))
{
sName+=" Quick C";
sVersion="1987-89";
bDetected=1;
}
else if(MSDOS.compareEP("bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..e9....81e4....3689......3689......8bc6b1"))
{
sName+=" C/C++";
sVersion="1985";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec"))
{
sName+=" C/C++";
sVersion="1.04";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73"))
{
sName+=" Quick C";
if(MSDOS.compareEP("81",54))
{
sVersion="1.0";
sOptions="1987";
}
else if(MSDOS.compareEP("83",54))
{
sVersion="2.00";
sOptions="1989";
}
else if(MSDOS.compareEP("8b",54))
{
sVersion="2.x";
sOptions="1989";
}
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: Jason Hood <jadoxa@yahoo.com.au>
init("compiler","Microsoft");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b430cd213c..73..33c00650cbbf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f"))
{
sName+=" Quick C";
sVersion="2.5x";
sOptions="1990";
bDetected=1;
}
else if(MSDOS.compareEP("fc8cc02ea3....8ed8a1....2ea3....2ea3....be....ac32e403f0c6....b8....8ec02680........75"))
{
sName+=" Quick C";
sVersion="2.51a";
sOptions="1990";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..b8....50e8....92b409cd21cd20bf"))
{
sName+=" C/C++";
sVersion="1986";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..b8....50900ee8....92b409cd21cd20bf"))
{
sName+=" C/C++";
sVersion="1986";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..b8....509a........92b409cd21cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..33c050"))
{
sName+=" C/C++";
sVersion="1986";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf776..8bc405....d1d8b1..d3e83bf072..8bf0fa8ed781c4....fb73"))
{
sName+=" Quick C";
sVersion="1987-89";
bDetected=1;
}
else if(MSDOS.compareEP("bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..e9....81e4....3689......3689......8bc6b1"))
{
sName+=" C/C++";
sVersion="1985";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec"))
{
sName+=" C/C++";
sVersion="1.04";
bDetected=1;
}
else if(MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73"))
{
sName+=" Quick C";
if(MSDOS.compareEP("81",54))
{
sVersion="1.0";
sOptions="1987";
}
else if(MSDOS.compareEP("83",54))
{
sVersion="2.00";
sOptions="1989";
}
else if(MSDOS.compareEP("8b",54))
{
sVersion="2.x";
sOptions="1989";
}
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

30
db/MSDOS/Microsoft Fortran.4.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","Microsoft Fortran");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b430cd213c..73..9a########558becb8....501eb8....50b8....509a"))
{
sVersion="1987";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","Microsoft Fortran");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b430cd213c..73..9a########558becb8....501eb8....50b8....509a"))
{
sVersion="1987";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

32
db/MSDOS/PRO32.0a.sg
View file

@ -1,16 +1,16 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("extender","PRO32 Protected Mode DOS Extender");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("e8$$$$8cc82ea3....fa6633f68eeeb8....8ed8b9....66658b0466890483c6..e2..6633c0bb"))
{
sVersion="1.7";
sOptions="1996-99 by Dieter Pawelczak";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("extender","PRO32 Protected Mode DOS Extender");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("e8$$$$8cc82ea3....fa6633f68eeeb8....8ed8b9....66658b0466890483c6..e2..6633c0bb"))
{
sVersion="1.7";
sOptions="1996-99 by Dieter Pawelczak";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

322
db/MSDOS/PROTECT.2.sg
View file

@ -1,161 +1,161 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","PROTECT! EXE");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.findSignature(0,MSDOS.getSize(),"0c02e9......e421e9......88e0..........eb....e621e9......88c4........e9......e621eb")!=-1)
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.findSignature(0,MSDOS.getSize(),"e42150e9......e621e9......58e621e9......b0ffeb")!=-1)
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07bd"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e071fbb"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07ba"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07bb"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07bf"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07be"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07e8"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fbf"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fba"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fbd"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fbe"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fbb"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("fd1e2efe......81c5"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("fd8a....80....1E80"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("fd1e........0e07"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("1efd2efe"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("fd1e0e070e1f26fe"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ec0fafc26a1....2ea3....26a1"))
{
sVersion="3.0";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$1e068cc88ed88ec02ec606"))
{
sVersion="1.0";
bDetected=1;
}
else if(MSDOS.compareEP("8cd805....50b8....501e068cda83c2..b9....be....0e1fad8bd8ad03c28ec0260117e2"))
{
sOptions="relocpacker";
sVersion="1.0";
bDetected=1;
}
else if(MSDOS.compareEP("1eb430cd213c..73..cd20be....e8....e8"))
{
sVersion="6.0";
bDetected=1;
}
else if(MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ed8fafcbe....0e07"))
{
sVersion="3.1";
bDetected=1;
}
else if(MSDOS.compareEP("8cdb0e0e1f07b9....e800005e81c6....89f7ac34..aae2"))
{
sVersion="4.0";
bDetected=1;
}
else if(MSDOS.compareEP("80ed..80e9..80c5..31c5fd1e2efe0e....0e0a2b3a0f80d9"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("1e124d..fd32c901cf0e33ff13fe85cf0e"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("19da22b1....19ea22b7....3af33af780ea..30de23f933f91290....b6..fc1e"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("00d6fc1e2efe0e....2ad70e1f80f2..80ce..3a8f....0e2a08"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$1e068cc88ed88ec0be....8bfeb9....ac"))
{
sVersion="2.0";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("protector","PROTECT! EXE");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.findSignature(0,MSDOS.getSize(),"0c02e9......e421e9......88e0..........eb....e621e9......88c4........e9......e621eb")!=-1)
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.findSignature(0,MSDOS.getSize(),"e42150e9......e621e9......58e621e9......b0ffeb")!=-1)
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07bd"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e071fbb"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07ba"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07bb"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07bf"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07be"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("1e0e0e1f07e8"))
{
sVersion="5.0";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fbf"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fba"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fbd"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fbe"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("0e071e0e1fbb"))
{
sVersion="4.1";
bDetected=1;
}
else if(MSDOS.compareEP("fd1e2efe......81c5"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("fd8a....80....1E80"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("fd1e........0e07"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("1efd2efe"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("fd1e0e070e1f26fe"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ec0fafc26a1....2ea3....26a1"))
{
sVersion="3.0";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$1e068cc88ed88ec02ec606"))
{
sVersion="1.0";
bDetected=1;
}
else if(MSDOS.compareEP("8cd805....50b8....501e068cda83c2..b9....be....0e1fad8bd8ad03c28ec0260117e2"))
{
sOptions="relocpacker";
sVersion="1.0";
bDetected=1;
}
else if(MSDOS.compareEP("1eb430cd213c..73..cd20be....e8....e8"))
{
sVersion="6.0";
bDetected=1;
}
else if(MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ed8fafcbe....0e07"))
{
sVersion="3.1";
bDetected=1;
}
else if(MSDOS.compareEP("8cdb0e0e1f07b9....e800005e81c6....89f7ac34..aae2"))
{
sVersion="4.0";
bDetected=1;
}
else if(MSDOS.compareEP("80ed..80e9..80c5..31c5fd1e2efe0e....0e0a2b3a0f80d9"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("1e124d..fd32c901cf0e33ff13fe85cf0e"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("19da22b1....19ea22b7....3af33af780ea..30de23f933f91290....b6..fc1e"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("00d6fc1e2efe0e....2ad70e1f80f2..80ce..3a8f....0e2a08"))
{
sVersion="5.5";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$1e068cc88ed88ec0be....8bfeb9....ac"))
{
sVersion="2.0";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

54
db/MSDOS/SimplyWare.1.sg
View file

@ -1,27 +1,27 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b8....8ed88c06....fa8ed0bc....fbb430cd21a3....0650b434cd218c06....8bc3485b86df81fb"))
{
var nOffset=MSDOS.getOverlayOffset();
if(MSDOS.findSignature(nOffset-0x1000, 0x1000, "'Simply Docs Viewer'")!=-1)
{
sName="Simply Docs Viewer";
sVersion="3.0";
sOptions="1990-94 by SimpleWare";
bDetected=1;
}
else if(MSDOS.compareOverlay("'Simply Help!'"))
{
sName="Simply Help! TSR Viewer"
sOptions="1990-94 by SimpleWare";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b8....8ed88c06....fa8ed0bc....fbb430cd21a3....0650b434cd218c06....8bc3485b86df81fb"))
{
var nOffset=MSDOS.getOverlayOffset();
if(MSDOS.findSignature(nOffset-0x1000, 0x1000, "'Simply Docs Viewer'")!=-1)
{
sName="Simply Docs Viewer";
sVersion="3.0";
sOptions="1990-94 by SimpleWare";
bDetected=1;
}
else if(MSDOS.compareOverlay("'Simply Help!'"))
{
sName="Simply Help! TSR Viewer"
sOptions="1990-94 by SimpleWare";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

68
db/MSDOS/StonyBrook Pascal.4.sg
View file

@ -1,34 +1,34 @@
// DIE's signature file
init("compiler","StonyBrook Pascal+");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("31ED9A........5589E581EC....B8....0E509A........BE....1E0EBF....1E071FFC"))
{
sVersion="7.0";
bDetected=1;
}
else if(MSDOS.compareEP("31ed9a........5589e5b8....50ff1e"))
{
sVersion="6.13";
bDetected=1;
}
else if(MSDOS.compareEP("31ed9a........5589e581ec....16078dbe....b9....31c0fcf3ab1e07"))
{
sVersion="6.12";
bDetected=1;
}
else if(MSDOS.compareEP("31ed9a........5589e59a........c706........c706........e8"))
{
sVersion="6.1G";
bDetected=1;
}
else if(MSDOS.compareEP("31ed9a........5589e583ec..9a........9a"))
{
sVersion="6.14";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("compiler","StonyBrook Pascal+");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("31ED9A........5589E581EC....B8....0E509A........BE....1E0EBF....1E071FFC"))
{
sVersion="7.0";
bDetected=1;
}
else if(MSDOS.compareEP("31ed9a........5589e5b8....50ff1e"))
{
sVersion="6.13";
bDetected=1;
}
else if(MSDOS.compareEP("31ed9a........5589e581ec....16078dbe....b9....31c0fcf3ab1e07"))
{
sVersion="6.12";
bDetected=1;
}
else if(MSDOS.compareEP("31ed9a........5589e59a........c706........c706........e8"))
{
sVersion="6.1G";
bDetected=1;
}
else if(MSDOS.compareEP("31ed9a........5589e583ec..9a........9a"))
{
sVersion="6.14";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

30
db/MSDOS/TSCRUNCH.2.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","TSCRUNCH");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("e9$$$$061e55575652515350161f0e078bf4bf....b9....fcf3a4b430cd213c0373..be....e9"))
{
sOptions="by Clarion software";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","TSCRUNCH");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("e9$$$$061e55575652515350161f0e078bf4bf....b9....fcf3a4b430cd213c0373..be....e9"))
{
sOptions="by Clarion software";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

44
db/MSDOS/TXT2COM.1.sg
View file

@ -1,22 +1,22 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","TXT2COM + generic com2exe");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("e8$$$$c706........803e......75..8d36....e8....e8....e8....e8....e8....ffa7"))
{
sVersion="1.1";
sOptions="1987 by Keith P. Graham";
bDetected=1;
}
else if(MSDOS.compareEP("8d26....e8$$$$b4..cd103c..74..c706........c706........3c..74..3c..74..8d16....b409cd21cd20c706"))
{
sVersion="2.06";
sOptions="1989 by Keith P. Graham";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("self-displayer","TXT2COM + generic com2exe");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("e8$$$$c706........803e......75..8d36....e8....e8....e8....e8....e8....ffa7"))
{
sVersion="1.1";
sOptions="1987 by Keith P. Graham";
bDetected=1;
}
else if(MSDOS.compareEP("8d26....e8$$$$b4..cd103c..74..c706........c706........3c..74..3c..74..8d16....b409cd21cd20c706"))
{
sVersion="2.06";
sOptions="1989 by Keith P. Graham";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

64
db/MSDOS/TinyProg.2.sg
View file

@ -1,32 +1,32 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","TinyProg");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("e9$$$$eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff"))
{
sVersion="3.x";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff"))
{
sVersion="3.x";
sOptions="modified";
bDetected=1;
}
else if(MSDOS.compareEP("83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff"))
{
sVersion="3.x";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$2ec606......e9$$$$83ec..83e4..8bec50be............8cd28cd803....33c275..fc8ec233ff"))
{
sVersion="3.x";
sOptions="modified";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","TinyProg");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("e9$$$$eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff"))
{
sVersion="3.x";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff"))
{
sVersion="3.x";
sOptions="modified";
bDetected=1;
}
else if(MSDOS.compareEP("83ec..83e4..8bec50be....0336....8cd28cd803....33c275..fc8ec233ff"))
{
sVersion="3.x";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$2ec606......e9$$$$83ec..83e4..8bec50be............8cd28cd803....33c275..fc8ec233ff"))
{
sVersion="3.x";
sOptions="modified";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

44
db/MSDOS/Topspeed C.4.sg
View file

@ -1,22 +1,22 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","Topspeed C");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("8cc1e3$$1eba....8eda8b0e....8b36....ff36....50a1....ba....8eda890e....8936....a3....58"))
{
sVersion="2.0";
sOptions="1989 by JPI";
bDetected=1;
}
else if(MSDOS.compareEP("8cc1e3$$1eba....8eda8b0e....8b36....ff36....50a1....48ba....8eda890e....8936....a3....c706........58"))
{
sVersion="2.0";
sOptions="1989 by JPI";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","Topspeed C");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("8cc1e3$$1eba....8eda8b0e....8b36....ff36....50a1....ba....8eda890e....8936....a3....58"))
{
sVersion="2.0";
sOptions="1989 by JPI";
bDetected=1;
}
else if(MSDOS.compareEP("8cc1e3$$1eba....8eda8b0e....8b36....ff36....50a1....48ba....8eda890e....8936....a3....c706........58"))
{
sVersion="2.0";
sOptions="1989 by JPI";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

156
db/MSDOS/WATCOM.4.sg
View file

@ -1,78 +1,78 @@
// DIE's signature file
// Author: Jason Hood <jadoxa@yahoo.com.au>
init("compiler","WATCOM C");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("E9....'WATCOM C'"))
{
bDetected=1;
}
else if(MSDOS.isSignaturePresent(0,Math.min(2048,MSDOS.getSize()),"'WATCOM C'"))
{
bDetected=1;
}
else if(MSDOS.isLE())
{
var nLE=MSDOS.getNEOffset();
var nDataPage=MSDOS.readDword(nLE+0x80);
var nOffset=MSDOS.readDword(nLE+0x1C);
if(MSDOS.compare("EB..'WATCOM C'",nDataPage+nOffset))
{
bDetected=1;
}
}
else if(MSDOS.compareEP("e9$$$$fbb9....8ec126bb....83c3..80e3..26891e....268c1e....01e383c3..80e3..8ed189dc26891e....89dad1ea"))
{
sName="Open Watcom C/C++16";
sVersion="2002 by Sybase, Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$fbb9....8ec1bb....83c3..80e3..26891e....268c1e....01e383c3..80e3..8ed189dc26891e....89dad1ea"))
{
sName="Open Watcom C/C++16";
sVersion="2002 by Sybase, Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("8cd8bb....8edb8b1e....0bdb74..8cd18bd4fa8ed3bc....fb50535152a3....e8....5a595b580bdb74..fa8ed18be2fb"))
{
sName+="/C++";
sVersion="1990 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....fa8cc88ed0bc....fb2ec706........b8....cd213c..72..2e830e......e8....8bd8"))
{
sName+="/C++";
sVersion="1991 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea1....2e0306....fa8ed0bc....fbb8....b1..d3e874..33c054593bcc75..9cb9"))
{
sVersion="1992 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....8d06....a3....8d06....a3....8d06....a3....8cd88d1e....8ed08be3bb....26891e"))
{
sName+=" 386";
sVersion="1990 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea3....2e8916....2e891e....fa8cc88ed0bc....fbe8....8bd8e8....2ea2....fa"))
{
sVersion="1990 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("faba....8eda8916....8c06....8c0e....b8....a3....b8....a3....8ed28be0fb0633c9518becbe....268b04a3....8ec28e1e"))
{
sVersion="1988 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea3....2e8916....2e891e....2e8c1e....fa8cc88ed0bc....fbe8....8bd8fa2e8e16"))
{
sVersion="1992 by WATCOM Systems Inc.";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: Jason Hood <jadoxa@yahoo.com.au>
init("compiler","WATCOM C");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("E9....'WATCOM C'"))
{
bDetected=1;
}
else if(MSDOS.isSignaturePresent(0,Math.min(2048,MSDOS.getSize()),"'WATCOM C'"))
{
bDetected=1;
}
else if(MSDOS.isLE())
{
var nLE=MSDOS.getNEOffset();
var nDataPage=MSDOS.readDword(nLE+0x80);
var nOffset=MSDOS.readDword(nLE+0x1C);
if(MSDOS.compare("EB..'WATCOM C'",nDataPage+nOffset))
{
bDetected=1;
}
}
else if(MSDOS.compareEP("e9$$$$fbb9....8ec126bb....83c3..80e3..26891e....268c1e....01e383c3..80e3..8ed189dc26891e....89dad1ea"))
{
sName="Open Watcom C/C++16";
sVersion="2002 by Sybase, Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("e9$$$$fbb9....8ec1bb....83c3..80e3..26891e....268c1e....01e383c3..80e3..8ed189dc26891e....89dad1ea"))
{
sName="Open Watcom C/C++16";
sVersion="2002 by Sybase, Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("8cd8bb....8edb8b1e....0bdb74..8cd18bd4fa8ed3bc....fb50535152a3....e8....5a595b580bdb74..fa8ed18be2fb"))
{
sName+="/C++";
sVersion="1990 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....fa8cc88ed0bc....fb2ec706........b8....cd213c..72..2e830e......e8....8bd8"))
{
sName+="/C++";
sVersion="1991 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea1....2e0306....fa8ed0bc....fbb8....b1..d3e874..33c054593bcc75..9cb9"))
{
sVersion="1992 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$33ed2e8e1e....26a1....a3....8d06....a3....8d06....a3....8d06....a3....8cd88d1e....8ed08be3bb....26891e"))
{
sName+=" 386";
sVersion="1990 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea3....2e8916....2e891e....fa8cc88ed0bc....fbe8....8bd8e8....2ea2....fa"))
{
sVersion="1990 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("faba....8eda8916....8c06....8c0e....b8....a3....b8....a3....8ed28be0fb0633c9518becbe....268b04a3....8ec28e1e"))
{
sVersion="1988 by WATCOM Systems Inc.";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$2e8c06....2e8c16....2e8926....2ea3....2e8916....2e891e....2e8c1e....fa8cc88ed0bc....fbe8....8bd8fa2e8e16"))
{
sVersion="1992 by WATCOM Systems Inc.";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

266
db/MSDOS/WWPACK.2.sg
View file

@ -1,133 +1,133 @@
// DIE's signature file
init("packer","WWPACK");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compare("'WWP'",0x1c))
{
if(MSDOS.compareEP("B8....8CCA03D08CC981C1....51"))
{
if(MSDOS.compareEP("6A..06068CD383....536A..FC",14))
{
sVersion="3.00";
sOptions="Extractable";
}
else if(MSDOS.compareEP("33C9B1..510606BB....538CD3",14))
{
sVersion="3.02";
sOptions="Extractable";
}
else if(MSDOS.compareEP("BB....53",20))
{
sVersion="3.03";
}
else if(MSDOS.compareEP("B1..518CD3",20))
{
sVersion="3.05c4";
sOptions="Modified";
}
}
else if(MSDOS.compareEP("BE....BA....BF....B9....8CCD8EDD81ED....06068BDD2BDA8BD3FC"))
{
sVersion="3.00";
sOptions="Relocations pack";
}
else if(MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA1E8EDB011533C02EAC"))
{
sVersion="3.02";
sOptions="Relocations pack";
}
else if(MSDOS.compareEP("0305....B8....8CCA03D08CC981C1....51B9....510606B1..518CD3"))
{
sVersion="3.05c4";
if(MSDOS.compareEP("1A",3))
{
sOptions="Extractable";
}
else if(MSDOS.compareEP("1B",3))
{
sOptions="Unextractable";
}
if(MSDOS.compareEP("C0",2))
{
sOptions=sOptions.append("Password check","Virus shield");
}
else if(MSDOS.compareEP("80",2))
{
sOptions=sOptions.append("Password check");
}
else if(MSDOS.compareEP("40",2))
{
sOptions=sOptions.append("Virus shield");
}
}
bDetected=1;
}
else if(MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA"))
{
sVersion="3.04/3.05";
sOptions="Relocations pack";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606b1..518cd383eb..53b1"))
{
sVersion="3.05beta P";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606fc8cd5b1..51b1..8cd3"))
{
sVersion="3.0x P";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606b1..51fc8cd5b1..8cd3"))
{
sVersion="3.0x P";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606bb....538cd383eb..53b1"))
{
sVersion="3.03 PU";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....5133c9b1..510606bb....538cd383eb..53b1"))
{
sVersion="3.02, 3.02a P";
bDetected=1;
}
else if(MSDOS.compareEP("fa1e8ed8b8....cd218ed98bd3b8....cd211fe800005a83c2..87d4ffe4"))
{
sVersion="3.05 PU";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....516a..06068cd383eb..536a..fc8cd5be....33ff"))
{
sVersion="3.0 P";
bDetected=1;
}
else if(MSDOS.compareEP("be....ba....bf....b9....8ccd8edd81ed....06068bdd2bda8bd3fc8ec3"))
{
sVersion="3.0";
sOptions="Relocations pack";
bDetected=1;
}
else if(MSDOS.compareEP("ba....faf9............72..0633c98ec1bf....ab8bc6ab07e8....5a"))
{
sVersion="3.03 PU";
sOptions="Relocations pack modified";
bDetected=1;
}
else if(MSDOS.compareEP("faba....f8bb....b9....73..0633c98ec1bf....ab8bc6ab07e8....5a"))
{
sVersion="3.03 PU";
sOptions="Relocations pack";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08ccd81c5....55b9....510606b1..518cd383eb..53b1..51fc8cd5be....33ff"))
{
sVersion="3.05c PU";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("packer","WWPACK");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compare("'WWP'",0x1c))
{
if(MSDOS.compareEP("B8....8CCA03D08CC981C1....51"))
{
if(MSDOS.compareEP("6A..06068CD383....536A..FC",14))
{
sVersion="3.00";
sOptions="Extractable";
}
else if(MSDOS.compareEP("33C9B1..510606BB....538CD3",14))
{
sVersion="3.02";
sOptions="Extractable";
}
else if(MSDOS.compareEP("BB....53",20))
{
sVersion="3.03";
}
else if(MSDOS.compareEP("B1..518CD3",20))
{
sVersion="3.05c4";
sOptions="Modified";
}
}
else if(MSDOS.compareEP("BE....BA....BF....B9....8CCD8EDD81ED....06068BDD2BDA8BD3FC"))
{
sVersion="3.00";
sOptions="Relocations pack";
}
else if(MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA1E8EDB011533C02EAC"))
{
sVersion="3.02";
sOptions="Relocations pack";
}
else if(MSDOS.compareEP("0305....B8....8CCA03D08CC981C1....51B9....510606B1..518CD3"))
{
sVersion="3.05c4";
if(MSDOS.compareEP("1A",3))
{
sOptions="Extractable";
}
else if(MSDOS.compareEP("1B",3))
{
sOptions="Unextractable";
}
if(MSDOS.compareEP("C0",2))
{
sOptions=sOptions.append("Password check","Virus shield");
}
else if(MSDOS.compareEP("80",2))
{
sOptions=sOptions.append("Password check");
}
else if(MSDOS.compareEP("40",2))
{
sOptions=sOptions.append("Virus shield");
}
}
bDetected=1;
}
else if(MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA"))
{
sVersion="3.04/3.05";
sOptions="Relocations pack";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606b1..518cd383eb..53b1"))
{
sVersion="3.05beta P";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606fc8cd5b1..51b1..8cd3"))
{
sVersion="3.0x P";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606b1..51fc8cd5b1..8cd3"))
{
sVersion="3.0x P";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....51b9....510606bb....538cd383eb..53b1"))
{
sVersion="3.03 PU";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....5133c9b1..510606bb....538cd383eb..53b1"))
{
sVersion="3.02, 3.02a P";
bDetected=1;
}
else if(MSDOS.compareEP("fa1e8ed8b8....cd218ed98bd3b8....cd211fe800005a83c2..87d4ffe4"))
{
sVersion="3.05 PU";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08cc981c1....516a..06068cd383eb..536a..fc8cd5be....33ff"))
{
sVersion="3.0 P";
bDetected=1;
}
else if(MSDOS.compareEP("be....ba....bf....b9....8ccd8edd81ed....06068bdd2bda8bd3fc8ec3"))
{
sVersion="3.0";
sOptions="Relocations pack";
bDetected=1;
}
else if(MSDOS.compareEP("ba....faf9............72..0633c98ec1bf....ab8bc6ab07e8....5a"))
{
sVersion="3.03 PU";
sOptions="Relocations pack modified";
bDetected=1;
}
else if(MSDOS.compareEP("faba....f8bb....b9....73..0633c98ec1bf....ab8bc6ab07e8....5a"))
{
sVersion="3.03 PU";
sOptions="Relocations pack";
bDetected=1;
}
else if(MSDOS.compareEP("b8....8cca03d08ccd81c5....55b9....510606b1..518cd383eb..53b1..51fc8cd5be....33ff"))
{
sVersion="3.05c PU";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

136
db/MSDOS/Zortech(Symantec) C.4.sg
View file

@ -1,68 +1,68 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","Zortech/Symantec C");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("fafcb8....8ed88c......268b......891e....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....80ff..73..ba....e9....fbb430cd21a3"))
{
sVersion="2.10 - 3.0r1*, 4.0";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed88ed08ec0bc....33c050e8....eb"))
{
sVersion="2.10 - 3.0r1, 4.0";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed0bc....b8....8ed88c06....660fb7c066c1e0..ba"))
{
sVersion="3.0";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed88ed0bc....b4..cd214b891e....8cc0a3....b8....cd21"))
{
sVersion="2.10 - 3.0r1, 4.0";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed833c08ed88bf8bb....b9....b8....8905"))
{
sVersion="2.10 - 3.0r1, 4.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8a3....8c06....268b......891e....8bd82b1e....891e....268b......891e....2bd881fb....72..bb....8bd003d34289"))
{
sVersion="2.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd0"))
{
sVersion="2.00";
sOptions="1989 by Walter Bright";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....dbe38ed88c06....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....81fb....77"))
{
sVersion="4.0";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$fab8....05....b9....d3e88cc903c18ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd8"))
{
sVersion="4.0";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$fc06b8....cd21bf....8cc98ed9be....b9....f3"))
{
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed8bb....81c3....8ed08be38becfb8cc0a3....be....268b04a3....8b36"))
{
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed88c06....8ed0bc....fbba....e8....b8....cd2186c4"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","Zortech/Symantec C");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("fafcb8....8ed88c......268b......891e....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....80ff..73..ba....e9....fbb430cd21a3"))
{
sVersion="2.10 - 3.0r1*, 4.0";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed88ed08ec0bc....33c050e8....eb"))
{
sVersion="2.10 - 3.0r1, 4.0";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed0bc....b8....8ed88c06....660fb7c066c1e0..ba"))
{
sVersion="3.0";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed88ed0bc....b4..cd214b891e....8cc0a3....b8....cd21"))
{
sVersion="2.10 - 3.0r1, 4.0";
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed833c08ed88bf8bb....b9....b8....8905"))
{
sVersion="2.10 - 3.0r1, 4.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed8a3....8c06....268b......891e....8bd82b1e....891e....268b......891e....2bd881fb....72..bb....8bd003d34289"))
{
sVersion="2.0";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....8ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd0"))
{
sVersion="2.00";
sOptions="1989 by Walter Bright";
bDetected=1;
}
else if(MSDOS.compareEP("fab8....dbe38ed88c06....8bd82b1e....891e....268b1e....2bd881fb....72..bb....8bd003d342b1..d3e38ed08be381eb....81fb....77"))
{
sVersion="4.0";
bDetected=1;
}
else if(MSDOS.compareEP("eb$$fab8....05....b9....d3e88cc903c18ed88c06....268b1e....891e....8bd82b1e....891e....268b1e....2bd8"))
{
sVersion="4.0";
bDetected=1;
}
else if(MSDOS.compareEP("e8$$$$fc06b8....cd21bf....8cc98ed9be....b9....f3"))
{
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed8bb....81c3....8ed08be38becfb8cc0a3....be....268b04a3....8b36"))
{
bDetected=1;
}
else if(MSDOS.compareEP("fafcb8....8ed88c06....8ed0bc....fbba....e8....b8....cd2186c4"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

54
db/MSDOS/com2exe.2.sg
View file

@ -1,27 +1,27 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("converter","com2exe");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b8....50c3"))
{
sVersion="9.50";
bDetected=1;
}
else if(MSDOS.compareEP("16179c58f6c4..74..faeb"))
{
sName="COM -> EXE";
sOptions="1993 by R.Roth";
bDetected=1;
}
else if(MSDOS.compareEP("fcbe....bf....b9....f3a568....c3"))
{
sVersion="2.1";
sOptions="1997 by X-HACKS Group";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("converter","com2exe");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareEP("b8....50c3"))
{
sVersion="9.50";
bDetected=1;
}
else if(MSDOS.compareEP("16179c58f6c4..74..faeb"))
{
sName="COM -> EXE";
sOptions="1993 by R.Roth";
bDetected=1;
}
else if(MSDOS.compareEP("fcbe....bf....b9....f3a568....c3"))
{
sVersion="2.1";
sOptions="1997 by X-HACKS Group";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

116
db/MSDOS/overlays.6.sg
View file

@ -1,58 +1,58 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("overlay","");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareOverlay("....'-lh'..2d")||MSDOS.compareOverlay("....'-lz'..2d"))
{
sName="LHA archive";
switch(MSDOS.readByte(MSDOS.getOverlayOffset()+0x5))
{
case 0x30: bDetected=1; break;
case 0x31: bDetected=1; break;
case 0x32: bDetected=1; break;
case 0x33: bDetected=1; break;
case 0x34: bDetected=1; break;
case 0x35: bDetected=1; break;
case 0x36: bDetected=1; break;
case 0x64: bDetected=1; break;
case 0x73: bDetected=1; break;
}
}
else if(MSDOS.compareOverlay("60ea"))
{
sName="ARJ archive";
bDetected=1;
}
else if(MSDOS.compareOverlay("'ZOO'............'Archive'"))
{
bDetected=1;
sName="ZOO archive";
}
else if(MSDOS.compareOverlay("4c0103"))
{
bDetected=1;
sName="COFF executable";
}
else if(MSDOS.compareOverlay("0101'Aladdin'"))
{
sName="Self UnStuffit data";
sVersion="1.1";
sOptions="by Aladdin Systems, Inc.";
bDetected=1;
}
else if(MSDOS.compareOverlay("7f'ELF'010101"))
{
sName="ELF executable";
bDetected=1;
}
else if(MSDOS.compareOverlay("................'BSA'"))
{
sName="BSN archive";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("overlay","");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(MSDOS.compareOverlay("....'-lh'..2d")||MSDOS.compareOverlay("....'-lz'..2d"))
{
sName="LHA archive";
switch(MSDOS.readByte(MSDOS.getOverlayOffset()+0x5))
{
case 0x30: bDetected=1; break;
case 0x31: bDetected=1; break;
case 0x32: bDetected=1; break;
case 0x33: bDetected=1; break;
case 0x34: bDetected=1; break;
case 0x35: bDetected=1; break;
case 0x36: bDetected=1; break;
case 0x64: bDetected=1; break;
case 0x73: bDetected=1; break;
}
}
else if(MSDOS.compareOverlay("60ea"))
{
sName="ARJ archive";
bDetected=1;
}
else if(MSDOS.compareOverlay("'ZOO'............'Archive'"))
{
bDetected=1;
sName="ZOO archive";
}
else if(MSDOS.compareOverlay("4c0103"))
{
bDetected=1;
sName="COFF executable";
}
else if(MSDOS.compareOverlay("0101'Aladdin'"))
{
sName="Self UnStuffit data";
sVersion="1.1";
sOptions="by Aladdin Systems, Inc.";
bDetected=1;
}
else if(MSDOS.compareOverlay("7f'ELF'010101"))
{
sName="ELF executable";
bDetected=1;
}
else if(MSDOS.compareOverlay("................'BSA'"))
{
sName="BSN archive";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

116
db/PE/7z.1.sg
View file

@ -1,58 +1,58 @@
// DIE's signature file
init("sfx","7-Zip");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("';!@Install@!UTF-8!'"))
{
sType="installer";
var sManifest=PE.getManifest();
var aVersion=sManifest.match(/(\n?)version="(.*?)"/);
if(aVersion)
{
sVersion=aVersion[2];
if(aVersion[1])
{
sOptions="new";
}
}
else if(aVersion=sManifest.match(/Archive v(\d.*?)<\/desc/))
{
sVersion=aVersion[1];
}
bDetected=1;
}
else if(PE.compareOverlay("'7z'BCAF271C"))
{
bDetected=1;
}
else if(PE.compareOverlay("efbbbf';!@Install@!UTF-8!'"))
{
sType="installer";
bDetected=1;
}
if(bDetected)
{
if((PE.getVersionStringInfo("InternalName")=="7z.sfx")||(PE.getVersionStringInfo("InternalName")=="7zS2.sfx"))
{
sVersion=PE.getVersionStringInfo("FileVersion");
if(sVersion=="")
{
sVersion=PE.getFileVersion().replace(/\.0\.0$/,"");
}
}
if(sVersion==""&&PE.section[".rdata"])
{
var nVersionOffset=PE.findString(PE.section[".rdata"].FileOffset,PE.section[".rdata"].FileSize,"7-Zip version:");
if(nVersionOffset!=-1)
{
sVersion=PE.getString(nVersionOffset+16,4);
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("sfx","7-Zip");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("';!@Install@!UTF-8!'"))
{
sType="installer";
var sManifest=PE.getManifest();
var aVersion=sManifest.match(/(\n?)version="(.*?)"/);
if(aVersion)
{
sVersion=aVersion[2];
if(aVersion[1])
{
sOptions="new";
}
}
else if(aVersion=sManifest.match(/Archive v(\d.*?)<\/desc/))
{
sVersion=aVersion[1];
}
bDetected=1;
}
else if(PE.compareOverlay("'7z'BCAF271C"))
{
bDetected=1;
}
else if(PE.compareOverlay("efbbbf';!@Install@!UTF-8!'"))
{
sType="installer";
bDetected=1;
}
if(bDetected)
{
if((PE.getVersionStringInfo("InternalName")=="7z.sfx")||(PE.getVersionStringInfo("InternalName")=="7zS2.sfx"))
{
sVersion=PE.getVersionStringInfo("FileVersion");
if(sVersion=="")
{
sVersion=PE.getFileVersion().replace(/\.0\.0$/,"");
}
}
if(sVersion==""&&PE.section[".rdata"])
{
var nVersionOffset=PE.findString(PE.section[".rdata"].FileOffset,PE.section[".rdata"].FileSize,"7-Zip version:");
if(nVersionOffset!=-1)
{
sVersion=PE.getString(nVersionOffset+16,4);
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

48
db/PE/ACCAStore.1.sg
View file

@ -1,24 +1,24 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","ACCAStore");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1"))
{
if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("METRO_INFO");
{
if(nOffset!=-1)
{
sVersion="1.9.4.0";
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","ACCAStore");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1"))
{
if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("METRO_INFO");
{
if(nOffset!=-1)
{
sVersion="1.9.4.0";
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

298
db/PE/ASPack.2.sg
View file

@ -1,149 +1,149 @@
// DIE's signature file
init("packer","ASPack");
function getASPackVersion(nOffset)
{
if(PE.compare("60E8000000005D81ED........B8........03C5",nOffset))
{
sVersion="1.00b-1.07b";
}
else if(PE.compare("60EB..5DEB..FF..........E9",nOffset))
{
sVersion="1.08.01-1.08.02";
}
else if(PE.compare("60E8000000005D............BB........03DD",nOffset))
{
sVersion="1.08.03";
}
else if(PE.compare("60E8000000005D81ed........BB........01eb",nOffset))
{
sVersion="1.08.x";
sOptions="possibly";
}
else if(PE.compare("60E841060000EB41",nOffset))
{
sVersion="1.08.04";
}
else if(PE.compare("60EB..5DFFE5E8........81ED........BB........03DD2B9D",nOffset))
{
sVersion="1.08.x";
}
else if(PE.compare("60E870050000EB4C",nOffset))
{
sVersion="2.000";
}
else if(PE.compare("60E872050000EB4C",nOffset))
{
sVersion="2.001";
}
else if(PE.compare("60E872050000EB3387DB9000",nOffset))
{
sVersion="2.1";
}
else if(PE.compare("60E93D040000",nOffset))
{
sVersion="2.11";
}
else if(PE.compare("60E802000000EB095D5581ED39394400C3E93D040000",nOffset))
{
sVersion="2.11b";
}
else if(PE.compare("60E802000000EB095D5581ED39394400C3E959040000",nOffset))
{
sVersion="2.11c-2.11d";
}
else if(PE.compare("60E802000000EB095D55",nOffset))
{
sVersion="2.11d";
}
else if(PE.compare("60E803000000E9EB045D4555C3E801",nOffset))
{
sVersion="2.12-2.42";
}
else if(PE.compare("9060E8$$$$$$$$5D4555C3",nOffset))
{
sVersion="2.12b";
}
else if(PE.compare("60e8$$$$$$$$8b2c2481ed........c3",nOffset))
{
sVersion="2.1x-2.39";
}
else if(PE.compare("9060e8$$$$$$$$8b2c2481ed........c3",nOffset))
{
sVersion="2.1x-2.39";
}
else
{
return 0;
}
return 1;
}
function detect(bShowType,bShowVersion,bShowOptions)
{
var nOffset=PE.nEP;
if(nOffset!=-1)
{
if(!getASPackVersion(nOffset))
{
if(PE.compareEP("7500E9"))
{
nOffset+=3;
bDetected=1;
}
else if(PE.compareEP("907500E9"))
{
nOffset+=4;
bDetected=1;
}
else if(PE.compareEP("90907500E9"))
{
nOffset+=5;
bDetected=1;
}
else if(PE.compareEP("90750190E9"))
{
nOffset+=5;
bDetected=1;
}
else if(PE.compareEP("9090907500E9"))
{
nOffset+=6;
bDetected=1;
}
else if(PE.compareEP("9090750190E9"))
{
nOffset+=6;
bDetected=1;
}
else if(PE.compareEP("909090750190E9"))
{
nOffset+=7;
bDetected=1;
}
if(bDetected)
{
// Can't simply adjust the offset, as the destination may be in a different section.
nOffset=PE.RVAToOffset(PE.OffsetToRVA(nOffset)+4+~~PE.readDword(nOffset));
bDetected=getASPackVersion(nOffset);
}
}
else
{
bDetected=1;
}
}
if(!bDetected)
{
if(PE.section[".aspack"]&&PE.section[".adata"])
{
bDetected=1;
sVersion="2.12-2.XX";
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("packer","ASPack");
function getASPackVersion(nOffset)
{
if(PE.compare("60E8000000005D81ED........B8........03C5",nOffset))
{
sVersion="1.00b-1.07b";
}
else if(PE.compare("60EB..5DEB..FF..........E9",nOffset))
{
sVersion="1.08.01-1.08.02";
}
else if(PE.compare("60E8000000005D............BB........03DD",nOffset))
{
sVersion="1.08.03";
}
else if(PE.compare("60E8000000005D81ed........BB........01eb",nOffset))
{
sVersion="1.08.x";
sOptions="possibly";
}
else if(PE.compare("60E841060000EB41",nOffset))
{
sVersion="1.08.04";
}
else if(PE.compare("60EB..5DFFE5E8........81ED........BB........03DD2B9D",nOffset))
{
sVersion="1.08.x";
}
else if(PE.compare("60E870050000EB4C",nOffset))
{
sVersion="2.000";
}
else if(PE.compare("60E872050000EB4C",nOffset))
{
sVersion="2.001";
}
else if(PE.compare("60E872050000EB3387DB9000",nOffset))
{
sVersion="2.1";
}
else if(PE.compare("60E93D040000",nOffset))
{
sVersion="2.11";
}
else if(PE.compare("60E802000000EB095D5581ED39394400C3E93D040000",nOffset))
{
sVersion="2.11b";
}
else if(PE.compare("60E802000000EB095D5581ED39394400C3E959040000",nOffset))
{
sVersion="2.11c-2.11d";
}
else if(PE.compare("60E802000000EB095D55",nOffset))
{
sVersion="2.11d";
}
else if(PE.compare("60E803000000E9EB045D4555C3E801",nOffset))
{
sVersion="2.12-2.42";
}
else if(PE.compare("9060E8$$$$$$$$5D4555C3",nOffset))
{
sVersion="2.12b";
}
else if(PE.compare("60e8$$$$$$$$8b2c2481ed........c3",nOffset))
{
sVersion="2.1x-2.39";
}
else if(PE.compare("9060e8$$$$$$$$8b2c2481ed........c3",nOffset))
{
sVersion="2.1x-2.39";
}
else
{
return 0;
}
return 1;
}
function detect(bShowType,bShowVersion,bShowOptions)
{
var nOffset=PE.nEP;
if(nOffset!=-1)
{
if(!getASPackVersion(nOffset))
{
if(PE.compareEP("7500E9"))
{
nOffset+=3;
bDetected=1;
}
else if(PE.compareEP("907500E9"))
{
nOffset+=4;
bDetected=1;
}
else if(PE.compareEP("90907500E9"))
{
nOffset+=5;
bDetected=1;
}
else if(PE.compareEP("90750190E9"))
{
nOffset+=5;
bDetected=1;
}
else if(PE.compareEP("9090907500E9"))
{
nOffset+=6;
bDetected=1;
}
else if(PE.compareEP("9090750190E9"))
{
nOffset+=6;
bDetected=1;
}
else if(PE.compareEP("909090750190E9"))
{
nOffset+=7;
bDetected=1;
}
if(bDetected)
{
// Can't simply adjust the offset, as the destination may be in a different section.
nOffset=PE.RVAToOffset(PE.OffsetToRVA(nOffset)+4+~~PE.readDword(nOffset));
bDetected=getASPackVersion(nOffset);
}
}
else
{
bDetected=1;
}
}
if(!bDetected)
{
if(PE.section[".aspack"]&&PE.section[".adata"])
{
bDetected=1;
sVersion="2.12-2.XX";
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

76
db/PE/Acronis installer.1.sg
View file

@ -1,38 +1,38 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Acronis installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'PK'0304"))
{
if(PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15"))
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74"))
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareEP("558bec8b45..8b4d..8b55..83f8..75..8915........894d..8945..8955..5de9"))
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareEP("8b4424..83f8..8b4c24..8b5424..75..8915........894c24..894424..895424..e9"))
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
sOptions="ZIP";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Acronis installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'PK'0304"))
{
if(PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15"))
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74"))
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareEP("558bec8b45..8b4d..8b55..83f8..75..8915........894d..8945..8955..5de9"))
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareEP("8b4424..83f8..8b4c24..8b5424..75..8915........894c24..894424..895424..e9"))
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
sOptions="ZIP";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

48
db/PE/Adobe Flash Player installer.1.sg
View file

@ -1,24 +1,24 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Adobe Flash Player installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7"))
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type=="RT_RCDATA")
{
if(PE.compare("02010000",PE.resource[i].Offset))
{
bDetected=1;
break;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Adobe Flash Player installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7"))
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type=="RT_RCDATA")
{
if(PE.compare("02010000",PE.resource[i].Offset))
{
bDetected=1;
break;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

15
db/PE/Advanced BAT to EXE converter.2.sg Normal file
View file

@ -0,0 +1,15 @@
// DIE's signature file
// Author: A.S.L. <asl@onet.eu> 2018
init("protector","Advanced BAT to EXE Converter");
function detect(bShowType,bShowVersion,bShowOptions)
{
if ( (PE.compareEP("558BEC6AFF68")) && (PE.compareOverlay("..02020202363A38393a")))
{
sVersion="2X-4.X";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

94
db/PE/Advanced installer.1.sg
View file

@ -1,47 +1,47 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Advanced Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("2f30ee1f5e4ee51e"))
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0"))
{
bDetected=1;
}
else if(PE.compareEP("558bec83ec..5657ff15........8bf085f675..6a..eb..e8........8a063c..8b3d........75..56ffd7"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc83bcf75..b9........eb"))
{
bDetected=1;
}
}
else if(PE.compareOverlay("d0cf11e0a1b11ae1"))
{
if(PE.compareEP("558bec83ec..5657ff15........8bf085f675..6a..eb..e8........8a063c..8b3d........75..56ffd7"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0"))
{
bDetected=1;
}
}
else if(PE.findSignature(PE.getSize()-0x50, 0x50, "'ADVINSTSFX'")!=-1)
{
if(PE.compareEP("558bec837d....75..e8$$$$$$$$8b0d........5657bf........be........3bcf74"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Advanced Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("2f30ee1f5e4ee51e"))
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0"))
{
bDetected=1;
}
else if(PE.compareEP("558bec83ec..5657ff15........8bf085f675..6a..eb..e8........8a063c..8b3d........75..56ffd7"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc83bcf75..b9........eb"))
{
bDetected=1;
}
}
else if(PE.compareOverlay("d0cf11e0a1b11ae1"))
{
if(PE.compareEP("558bec83ec..5657ff15........8bf085f675..6a..eb..e8........8a063c..8b3d........75..56ffd7"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0"))
{
bDetected=1;
}
}
else if(PE.findSignature(PE.getSize()-0x50, 0x50, "'ADVINSTSFX'")!=-1)
{
if(PE.compareEP("558bec837d....75..e8$$$$$$$$8b0d........5657bf........be........3bcf74"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

54
db/PE/Astrum.1.sg
View file

@ -1,27 +1,27 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Astrum");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15"))
{
if(PE.isOverlayPresent()!=-1)
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type==77)
{
if(PE.findSignature(PE.resource[i].Offset, 0x140,"'AstrumInstallWizard'")!=-1)
{
bDetected=1;
break;
}
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Astrum");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15"))
{
if(PE.isOverlayPresent()!=-1)
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type==77)
{
if(PE.findSignature(PE.resource[i].Offset, 0x140,"'AstrumInstallWizard'")!=-1)
{
bDetected=1;
break;
}
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

48
db/PE/Bat to exe.1.sg
View file

@ -1,24 +1,24 @@
// DIE's signature file
init("converter","Bat to Exe");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("68........68........68........e8........83c4..68........e8........a3........68........68........68........e8........a3"))
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type=="RT_RCDATA")
{
if(PE.compare("789c636018052319000002000001",PE.resource[i].Offset))
{
sOptions="by Fatih Kodak";
bDetected=1;
break;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("converter","Bat to Exe");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("68........68........68........e8........83c4..68........e8........a3........68........68........68........e8........a3"))
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type=="RT_RCDATA")
{
if(PE.compare("789c636018052319000002000001",PE.resource[i].Offset))
{
sOptions="by Fatih Kodak";
bDetected=1;
break;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

42
db/PE/BitRock Installer.1.sg
View file

@ -1,21 +1,21 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","BitRock Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("........'.eh_frame'00"))
{
if(PE.compareEP("60be........8dbe........c787................5789e58d9c24........31c05039dc75..46465368"))
{
bDetected=1;
}
else if(PE.compareEP("83ec..c70424........ff15........e8........8d7426..8dbc27........a1........ffe0"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","BitRock Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("........'.eh_frame'00"))
{
if(PE.compareEP("60be........8dbe........c787................5789e58d9c24........31c05039dc75..46465368"))
{
bDetected=1;
}
else if(PE.compareEP("83ec..c70424........ff15........e8........8d7426..8dbc27........a1........ffe0"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

34
db/PE/Box Stub.1.sg
View file

@ -1,17 +1,17 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Box Stub");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7"))
{
if(PE.compareOverlay("000000000000000038e8020000000000"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Box Stub");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7"))
{
if(PE.compareOverlay("000000000000000038e8020000000000"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

36
db/PE/Bytessence Install Maker.1.sg
View file

@ -1,18 +1,18 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Bytessence Install Maker");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("68........68........68........e8........83c4..68........e8........a3........68........68........68"))
{
if(PE.compareOverlay("'$_BIM_CONFIG_START_$'"))
{
sVersion="5.40";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Bytessence Install Maker");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("68........68........68........e8........83c4..68........e8........a3........68........68........68"))
{
if(PE.compareOverlay("'$_BIM_CONFIG_START_$'"))
{
sVersion="5.40";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

46
db/PE/CZ installer.1.sg
View file

@ -1,23 +1,23 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","CZ installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3"))
{
if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("CZ_STORAGE");
{
if(nOffset!=-1)
{
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","CZ installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3"))
{
if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("CZ_STORAGE");
{
if(nOffset!=-1)
{
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

164
db/PE/Cab.1.sg
View file

@ -1,82 +1,82 @@
// DIE's signature file
// Author: Jason Hood <jadoxa@yahoo.com.au>
init("sfx","Microsoft Cabinet");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'wextract'",16))
{
// The version is probably for what's being installed, not what's doing
// the installing; it does seem, though, the raw product version is for
// the installer itself. Take a punt, anyway.
var nOffset=PE.getOverlayOffset();
nOffset=PE.findSignature(nOffset-0xE00,0xE00,"BD04EFFE00000100");
if(nOffset!=-1)
{
nOffset+=16;
sVersion=PE.readWord(nOffset+2)+"."+PE.readWord(nOffset)+"."
+PE.readWord(nOffset+6)+"."+PE.readWord(nOffset+4);
}
bDetected=1;
}
else if(/sfxcab/.test(PE.getManifest()))
{
// There's two version resources, locate the second.
if(PE.section[".rsrc"])
{
var nVirtSize=PE.section[".rsrc"].VirtualSize;
var nOffset=PE.section[".rsrc"].FileOffset+nVirtSize;
nOffset=PE.findSignature(nOffset-0x600,0x600,"BD04EFFE00000100");
if(nOffset!=-1)
{
nOffset+=8;
sVersion=PE.readWord(nOffset+2)+"."+PE.readWord(nOffset)+"."
+PE.readWord(nOffset+6)+"."+PE.readWord(nOffset+4);
}
}
bDetected=1;
}
else if(/wextract/i.test(PE.getVersionStringInfo("InternalName")))
{
sVersion=PE.getFileVersion();
bDetected=1;
}
else if(PE.compareEP("558bec81ec........535657ff15........a3........ff15........a1........6625....3d"))
{
if(PE.compare("'MSCF'00000000", 0x5000))
{
bDetected=1;
}
}
else if(PE.compareEP("6a..68........e8........66813d............75..a1........81b8................75.."))
{
if(PE.compareOverlay("'MSCF'00000000"))
{
bDetected=1;
}
}
else if(PE.compareEP("e9$$$$$$$$558bec81ec........830d..........5356576a..33dbbf........68........895d..881d"))
{
bDetected=1;
}
if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("CABINET");
{
if(PE.compare("'MSCF'00000000", nOffset))
{
bDetected=1;
}
}
nOffset=PE.getResourceNameOffset("IDR_CABFILE");
{
if(PE.compare("'MSCF'00000000", nOffset))
{
bDetected=1;
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: Jason Hood <jadoxa@yahoo.com.au>
init("sfx","Microsoft Cabinet");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'wextract'",16))
{
// The version is probably for what's being installed, not what's doing
// the installing; it does seem, though, the raw product version is for
// the installer itself. Take a punt, anyway.
var nOffset=PE.getOverlayOffset();
nOffset=PE.findSignature(nOffset-0xE00,0xE00,"BD04EFFE00000100");
if(nOffset!=-1)
{
nOffset+=16;
sVersion=PE.readWord(nOffset+2)+"."+PE.readWord(nOffset)+"."
+PE.readWord(nOffset+6)+"."+PE.readWord(nOffset+4);
}
bDetected=1;
}
else if(/sfxcab/.test(PE.getManifest()))
{
// There's two version resources, locate the second.
if(PE.section[".rsrc"])
{
var nVirtSize=PE.section[".rsrc"].VirtualSize;
var nOffset=PE.section[".rsrc"].FileOffset+nVirtSize;
nOffset=PE.findSignature(nOffset-0x600,0x600,"BD04EFFE00000100");
if(nOffset!=-1)
{
nOffset+=8;
sVersion=PE.readWord(nOffset+2)+"."+PE.readWord(nOffset)+"."
+PE.readWord(nOffset+6)+"."+PE.readWord(nOffset+4);
}
}
bDetected=1;
}
else if(/wextract/i.test(PE.getVersionStringInfo("InternalName")))
{
sVersion=PE.getFileVersion();
bDetected=1;
}
else if(PE.compareEP("558bec81ec........535657ff15........a3........ff15........a1........6625....3d"))
{
if(PE.compare("'MSCF'00000000", 0x5000))
{
bDetected=1;
}
}
else if(PE.compareEP("6a..68........e8........66813d............75..a1........81b8................75.."))
{
if(PE.compareOverlay("'MSCF'00000000"))
{
bDetected=1;
}
}
else if(PE.compareEP("e9$$$$$$$$558bec81ec........830d..........5356576a..33dbbf........68........895d..881d"))
{
bDetected=1;
}
if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("CABINET");
{
if(PE.compare("'MSCF'00000000", nOffset))
{
bDetected=1;
}
}
nOffset=PE.getResourceNameOffset("IDR_CABFILE");
{
if(PE.compare("'MSCF'00000000", nOffset))
{
bDetected=1;
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

36
db/PE/DS.Flexlm.4.sg
View file

@ -1,18 +1,18 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("library","");
function detect(bShowType,bShowVersion,bShowOptions)
{
var nSize=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize();
var nOffset=PE.findSignature(0, nSize, "'@(#) F'");
if(nOffset!=-1)
{
sName=PE.getString(nOffset, 200).match(/\w\S*/i);
sVersion=PE.getString(nOffset, 200).match(/\d\S*/i);
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("library","");
function detect(bShowType,bShowVersion,bShowOptions)
{
var nSize=PE.isOverlayPresent()?PE.getOverlayOffset():PE.getSize();
var nOffset=PE.findSignature(0, nSize, "'@(#) F'");
if(nOffset!=-1)
{
sName=PE.getString(nOffset, 200).match(/\w\S*/i);
sVersion=PE.getString(nOffset, 200).match(/\d\S*/i);
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

106
db/PE/EP.MPRESS.2.sg
View file

@ -1,53 +1,53 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","EP:MPRESS");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("575653515255e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb"))
{
sVersion="0.71-0.75";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb"))
{
sVersion="0.77";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc857498a4439..74..880431eb"))
{
sVersion="0.85-0.97";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..74..880431eb"))
{
sVersion="1.27";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..88043175"))
{
sVersion="2.01-2.12";
bDetected=1;
}
if(PE.isPEPlus())
{
if(PE.compareEP("57565351524150e8$$$$$$$$488d05........488b304803f0482bc0488bfe66adc1e0..488bc8ad2bc84803f18bc8ffc98a4439..74..880431eb"))
{
sVersion="0.71-0.92";
bDetected=1;
}
else if(PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857ffc98a4439..74..880431eb"))
{
sVersion="0.97";
bDetected=1;
}
else if(PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857448bc1ffc98a4439..88043175"))
{
sVersion="1.27-2.12";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("packer","EP:MPRESS");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("575653515255e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb"))
{
sVersion="0.71-0.75";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb"))
{
sVersion="0.77";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc857498a4439..74..880431eb"))
{
sVersion="0.85-0.97";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..74..880431eb"))
{
sVersion="1.27";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..88043175"))
{
sVersion="2.01-2.12";
bDetected=1;
}
if(PE.isPEPlus())
{
if(PE.compareEP("57565351524150e8$$$$$$$$488d05........488b304803f0482bc0488bfe66adc1e0..488bc8ad2bc84803f18bc8ffc98a4439..74..880431eb"))
{
sVersion="0.71-0.92";
bDetected=1;
}
else if(PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857ffc98a4439..74..880431eb"))
{
sVersion="0.97";
bDetected=1;
}
else if(PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857448bc1ffc98a4439..88043175"))
{
sVersion="1.27-2.12";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

90
db/PE/Gentee Installer.1.sg
View file

@ -1,45 +1,45 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Gentee Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec81ec........538d85........5633db578d8d........68........895d..518945..53ff15"))
{
if(PE.findSignature(PE.getOverlayOffset(),0x80,"'GEA'")!=-1)
{
bDetected=1;
}
else if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("SETUP_TEMP");
{
if(PE.compare("'GEA'", nOffset))
{
bDetected=1;
}
}
}
}
else if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15"))
{
if(PE.findSignature(PE.getOverlayOffset(),0x80,"'GEA'")!=-1)
{
bDetected=1;
}
}
else if(PE.compareEP("81ec........5356575568........6a..6a..ff15........8bf0ff15........3d........75..56"))
{
if(PE.compareOverlay("'OWS9G1'", 0xb)!=-1)
{
bDetected=1;
}
}
if(PE.compareEP("558bec81ec........5356576a..ff15........68........ff15........85c074..6a..a1........50ff15........8bf06a..56ff15"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Gentee Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec81ec........538d85........5633db578d8d........68........895d..518945..53ff15"))
{
if(PE.findSignature(PE.getOverlayOffset(),0x80,"'GEA'")!=-1)
{
bDetected=1;
}
else if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("SETUP_TEMP");
{
if(PE.compare("'GEA'", nOffset))
{
bDetected=1;
}
}
}
}
else if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15"))
{
if(PE.findSignature(PE.getOverlayOffset(),0x80,"'GEA'")!=-1)
{
bDetected=1;
}
}
else if(PE.compareEP("81ec........5356575568........6a..6a..ff15........8bf0ff15........3d........75..56"))
{
if(PE.compareOverlay("'OWS9G1'", 0xb)!=-1)
{
bDetected=1;
}
}
if(PE.compareEP("558bec81ec........5356576a..ff15........68........ff15........85c074..6a..a1........50ff15........8bf06a..56ff15"))
{
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

42
db/PE/Hamrick_Software_installer.1.sg
View file

@ -1,21 +1,21 @@
// DIE's signature file
// Author: A.S.L <asl@onet.eu>
init("installer","Hamrick Software - VueScan Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("BDA6EEE9F9EDEFEDE5ED"))
{
if(PE.compareEP("E8....0000"))
{
bDetected=1;
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc375..33c0"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: A.S.L <asl@onet.eu>
init("installer","Hamrick Software - VueScan Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("BDA6EEE9F9EDEFEDE5ED"))
{
if(PE.compareEP("E8....0000"))
{
bDetected=1;
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc375..33c0"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

42
db/PE/Install4j installer.1.sg
View file

@ -1,21 +1,21 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Install4j Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("d513e4e801000000"))
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774"))
{
bDetected=1;
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Install4j Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("d513e4e801000000"))
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774"))
{
bDetected=1;
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

100
db/PE/InstallAnywhere.1.sg
View file

@ -1,50 +1,50 @@
// DIE's signature file
init("installer","InstallAnywhere");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("60BE........8DBE0070FDFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB7507"))
{
sVersion="6.1";
bDetected=1;
}
else if(PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15........8b4e..890d"))
{
if(PE.compareOverlay("5b3e"))
{
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x500, "'PK'0304");
if(ArcOffset!=-1)
{
sOptions="zip";
bDetected=1;
}
}
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b..........488365....48bb................483bc375"))
{
if(PE.compareOverlay("5b3e"))
{
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x500, "'PK'0304");
if(ArcOffset!=-1)
{
sOptions="zip";
bDetected=1;
}
}
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7"))
{
if(PE.compareOverlay("5b3e"))
{
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x500, "'PK'0304");
if(ArcOffset!=-1)
{
sOptions="zip";
bDetected=1;
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("installer","InstallAnywhere");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("60BE........8DBE0070FDFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB7507"))
{
sVersion="6.1";
bDetected=1;
}
else if(PE.compareEP("6a..68........e8........bf........8bc7e8........8965..8bf4893e56ff15........8b4e..890d"))
{
if(PE.compareOverlay("5b3e"))
{
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x500, "'PK'0304");
if(ArcOffset!=-1)
{
sOptions="zip";
bDetected=1;
}
}
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488b..........488365....48bb................483bc375"))
{
if(PE.compareOverlay("5b3e"))
{
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x500, "'PK'0304");
if(ArcOffset!=-1)
{
sOptions="zip";
bDetected=1;
}
}
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7"))
{
if(PE.compareOverlay("5b3e"))
{
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x500, "'PK'0304");
if(ArcOffset!=-1)
{
sOptions="zip";
bDetected=1;
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

236
db/PE/InstallShield.1.sg
View file

@ -1,118 +1,118 @@
// DIE's signature file
init("installer","InstallShield");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))
{
if(PE.isOverlayPresent())
{
nOffset=PE.readByte(PE.getOverlayOffset())+PE.getOverlayOffset()+12;
if(PE.compare("135d658c", nOffset))
{
sVersion="3.x";
bDetected=1;
}
else if(PE.compare("'PK'0304", nOffset))
{
sVersion="3.x";
sOptions="zip";
bDetected=1;
}
}
else
{
for(var i=0;i<PE.resource.length;i++)
{
if(PE.resource[i].Type==3000) //IS2
{
if(PE.compare("'SZDD'",PE.resource[i].Offset))
{
sVersion="2.x"
bDetected=1;
break;
}
}
}
}
if(PE.isSectionNamePresent("_cabinet"))
{
bDetected=1;
}
}
else if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15"))
{
if(PE.findSignature(PE.getOverlayOffset(), 0x100, "'InstallShield Native Installer'")!=-1)
{
sName+=" Java Edition";
bDetected=1;
}
else if(PE.findSignature(PE.getOverlayOffset(), 0x100, "'setup.class'")!=-1)
{
sName+=" Java Edition";
sVersion="3.x";
bDetected=1;
}
}
else if((PE.getVersionStringInfo("ProductName").substr(0,13)=="InstallShield")||(PE.getVersionStringInfo("CompanyName")=="InstallShield Software Corporation"))
{
sVersion=PE.getVersionStringInfo("FileVersion").replace(/, /g,".").trim();
bDetected=1;
}
else if(PE.compareEP("558BEC83EC4456FF15........8BF085F675086AFFFF15........8A06578B3D"))
{
bDetected=1;
}
else if(/InstallShield/.test(PE.getManifest()))
{
bDetected=1;
}
/*else if(PE.isOverlayPresent()&&
(searchSection(".rsrc",0x10000)||searchSection(".data",0x1000))) // Too slow on some files :(
{
bDetected=1;
} */
else if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d2"))
{
if(PE.findSignature(PE.getOverlayOffset(),Math.min(0x2000,PE.getOverlaySize()),"'ISc('")!=-1)
{
sVersion="19.x";
bDetected=1;
}
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7"))
{
if(PE.findSignature(PE.getOverlayOffset(),Math.min(0x2000,PE.getOverlaySize()),"'ISSetupStream'")!=-1)
{
sVersion="18.x";
bDetected=1;
}
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7"))
{
if(PE.compareOverlay("'ISSetupStream'"))
{
sVersion="19.x";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
function searchSection(sSection,nLimit)
{
if(PE.section[sSection])
{
var nOffset=PE.section[sSection].FileOffset;
var nSize=PE.section[sSection].FileSize;
if(PE.findString(nOffset,Math.min(nLimit,nSize),"InstallShield")!=-1)
{
return 1;
}
}
return 0;
}
// DIE's signature file
init("installer","InstallShield");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))
{
if(PE.isOverlayPresent())
{
nOffset=PE.readByte(PE.getOverlayOffset())+PE.getOverlayOffset()+12;
if(PE.compare("135d658c", nOffset))
{
sVersion="3.x";
bDetected=1;
}
else if(PE.compare("'PK'0304", nOffset))
{
sVersion="3.x";
sOptions="zip";
bDetected=1;
}
}
else
{
for(var i=0;i<PE.resource.length;i++)
{
if(PE.resource[i].Type==3000) //IS2
{
if(PE.compare("'SZDD'",PE.resource[i].Offset))
{
sVersion="2.x"
bDetected=1;
break;
}
}
}
}
if(PE.isSectionNamePresent("_cabinet"))
{
bDetected=1;
}
}
else if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15"))
{
if(PE.findSignature(PE.getOverlayOffset(), 0x100, "'InstallShield Native Installer'")!=-1)
{
sName+=" Java Edition";
bDetected=1;
}
else if(PE.findSignature(PE.getOverlayOffset(), 0x100, "'setup.class'")!=-1)
{
sName+=" Java Edition";
sVersion="3.x";
bDetected=1;
}
}
else if((PE.getVersionStringInfo("ProductName").substr(0,13)=="InstallShield")||(PE.getVersionStringInfo("CompanyName")=="InstallShield Software Corporation"))
{
sVersion=PE.getVersionStringInfo("FileVersion").replace(/, /g,".").trim();
bDetected=1;
}
else if(PE.compareEP("558BEC83EC4456FF15........8BF085F675086AFFFF15........8A06578B3D"))
{
bDetected=1;
}
else if(/InstallShield/.test(PE.getManifest()))
{
bDetected=1;
}
/*else if(PE.isOverlayPresent()&&
(searchSection(".rsrc",0x10000)||searchSection(".data",0x1000))) // Too slow on some files :(
{
bDetected=1;
} */
else if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d2"))
{
if(PE.findSignature(PE.getOverlayOffset(),Math.min(0x2000,PE.getOverlaySize()),"'ISc('")!=-1)
{
sVersion="19.x";
bDetected=1;
}
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7"))
{
if(PE.findSignature(PE.getOverlayOffset(),Math.min(0x2000,PE.getOverlaySize()),"'ISSetupStream'")!=-1)
{
sVersion="18.x";
bDetected=1;
}
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7"))
{
if(PE.compareOverlay("'ISSetupStream'"))
{
sVersion="19.x";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
function searchSection(sSection,nLimit)
{
if(PE.section[sSection])
{
var nOffset=PE.section[sSection].FileOffset;
var nSize=PE.section[sSection].FileSize;
if(PE.findString(nOffset,Math.min(nLimit,nSize),"InstallShield")!=-1)
{
return 1;
}
}
return 0;
}

78
db/PE/MoleBox.2.sg
View file

@ -1,39 +1,39 @@
// DIE's signature file
init("protector","MoleBox");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15"))
{
sVersion="2.3.3-2.6.4";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15"))
{
sVersion="2.0.0-2.3.0";
bDetected=1;
}
else if(PE.compareEP("eb$$b8........8338..74..50ff70..ff3050830424..e8$$$$$$$$558beca1........53568b75..85c0578bde75..6a..68........68........ff15"))
{
sVersion="2.36";
bDetected=1;
}
else if(PE.compareEP("5589E583EC08C7042401000000FF15........E8B8FEFFFF908DB426000000005589E583EC08C7042402000000FF15"))
{
if(PE.isOverlayPresent()&&(PE.section.length>=6))
{
var nNumbersOfImports=PE.getNumberOfImports();
if((nNumbersOfImports==4)||(nNumbersOfImports==3))
{
if(PE.isLibraryPresent("KERNEL32.dll")&&PE.isLibraryPresent("msvcrt.dll")&&PE.isLibraryPresent("USER32.dll"))
{
sVersion="4.X";
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("protector","MoleBox");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15"))
{
sVersion="2.3.3-2.6.4";
bDetected=1;
}
else if(PE.compareEP("60e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15"))
{
sVersion="2.0.0-2.3.0";
bDetected=1;
}
else if(PE.compareEP("eb$$b8........8338..74..50ff70..ff3050830424..e8$$$$$$$$558beca1........53568b75..85c0578bde75..6a..68........68........ff15"))
{
sVersion="2.36";
bDetected=1;
}
else if(PE.compareEP("5589E583EC08C7042401000000FF15........E8B8FEFFFF908DB426000000005589E583EC08C7042402000000FF15"))
{
if(PE.isOverlayPresent()&&(PE.section.length>=6))
{
var nNumbersOfImports=PE.getNumberOfImports();
if((nNumbersOfImports==4)||(nNumbersOfImports==3))
{
if(PE.isLibraryPresent("KERNEL32.dll")&&PE.isLibraryPresent("msvcrt.dll")&&PE.isLibraryPresent("USER32.dll"))
{
sVersion="4.X";
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

51
db/PE/NsPacK.2.sg Normal file
View file

@ -0,0 +1,51 @@
// DIE's signature file
init("packer","NsPacK");
function getNSPackVersion()
{
if((PE.section[0].FileSize>0)&&(PE.section[0].FileOffset<0x200))
{
sVersion="2.x";
}
else if((PE.section[0].FileSize==0)&&(PE.section[0].FileOffset>=0x200))
{
sVersion="3.x";
}
}
function detect(bShowType,bShowVersion,bShowOptions)
{
var nNumberOfFunctions=PE.getNumberOfImportThunks(0);
if((nNumberOfFunctions==6)&&(!PE.getSizeOfCode()))
{
if(PE.getImportFunctionName(0,0)=="LoadLibraryA"
&&PE.getImportFunctionName(0,1)=="GetProcAddress"
&&PE.getImportFunctionName(0,2)=="VirtualProtect"
&&PE.getImportFunctionName(0,3)=="VirtualAlloc"
&&PE.getImportFunctionName(0,4)=="VirtualFree"
&&PE.getImportFunctionName(0,5)=="ExitProcess")
{
getNSPackVersion();
bDetected=1;
}
}
if(!bDetected)
{
if(PE.isLibraryPresent("mscoree.dll")
&&PE.getImportLibraryName(0)=="KERNEL32.dll"
&&PE.getImportFunctionName(0,nNumberOfFunctions-1)=="GetSystemInfo")
{
getNSPackVersion();
sOptions=".NET";
bDetected=1;
}
else if(PE.isNETStringPresent("nsnet"))
{
sVersion="3.X";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

360
db/PE/Obsidium.2.sg
View file

@ -1,180 +1,180 @@
// DIE's signature file
// Author: ajax
// History:
// 22:54 17.01.2013 add generic
// 22:30 14.07.2013 improved generic
init("protector","Obsidium");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("E8AB1C"))
{
sVersion="1.0.0.59";
bDetected=1;
}
else if(PE.compareEP("E8AF1C0000"))
{
sVersion="1.0.0.61";
bDetected=1;
}
else if(PE.compareEP("EB02....E8E71C0000"))
{
sVersion="1.1.1.1";
bDetected=1;
}
else if(PE.compareEP("EB02....E8771E0000"))
{
sVersion="1.2";
bDetected=1;
}
else if(PE.compareEP("EB02....E83F1E0000"))
{
sVersion="1.2.0.0";
bDetected=1;
}
else if(PE.compareEP("E80E0000008B54240C8382B8000000"))
{
sVersion="1.2.5.0";
bDetected=1;
}
else if(PE.compareEP("EB01..E829000000EB02....EB01..8B54240CEB04"))
{
sVersion="1.2.5.8";
bDetected=1;
}
else if(PE.compareEP("E80E00000033C08B54240C8382B80000000DC36467FF36"))
{
sVersion="1.2.X";
bDetected=1;
}
else if(PE.compareEP("EB04........E829000000EB02....EB01..8B54240CEB02"))
{
sVersion="1.3.0.0";
bDetected=1;
}
else if(PE.compareEP("EB02....E825000000EB04........EB01..8B54240CEB01"))
{
sVersion="1.3.0.4";
bDetected=1;
}
else if(PE.compareEP("EB01..E826000000EB02....EB02....8B54240CEB01"))
{
sVersion="1.3.0.13";
bDetected=1;
}
else if(PE.compareEP("EB02....E828000000EB04........EB01..8B54240CEB"))
{
sVersion="1.3.0.17";
bDetected=1;
}
else if(PE.compareEP("EB03......E82E000000EB04........EB04........8B"))
{
sVersion="1.3.0.21";
bDetected=1;
}
else if(PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB04"))
{
sVersion="1.3.0.37";
bDetected=1;
}
else if(PE.compareEP("EB02....E827000000EB02....EB03......8B54240CEB01"))
{
sVersion="1.3.1.1";
bDetected=1;
}
else if(PE.compareEP("EB04........E82A000000EB03......EB04........8B54"))
{
sVersion="1.3.2.2";
bDetected=1;
}
else if(PE.compareEP("EB01..E829000000EB02....EB03......8B54240CEB02"))
{
sVersion="1.3.3.1";
bDetected=1;
}
else if(PE.compareEP("EB01..E82B000000EB02....EB02....8B54240CEB03"))
{
sVersion="1.3.3.2";
bDetected=1;
}
else if(PE.compareEP("EB02....E829000000EB03......EB03......8B..240CEB"))
{
sVersion="1.3.3.3";
bDetected=1;
}
else if(PE.compareEP("EB02....E829000000EB03......EB02....8B54240CEB03"))
{
sVersion="1.3.3.4";
bDetected=1;
}
else if(PE.compareEP("EB04........E828000000EB01..............8B54240"))
{
sVersion="1.3.3.6";
bDetected=1;
}
else if(PE.compareEP("EB02....E827000000EB03......EB01..8B54240CEB03"))
{
sVersion="1.3.3.7";
bDetected=1;
}
else if(PE.compareEP("EB02....E82C000000EB04........EB04........8B5424"))
{
sVersion="1.3.3.7";
bDetected=1;
}
else if(PE.compareEP("EB04........E828000000EB01..EB01..8B54240CEB04"))
{
sVersion="1.3.3.8";
bDetected=1;
}
else if(PE.compareEP("EB02....E829000000EB03......EB01..8B54240CEB04"))
{
sVersion="1.3.3.9";
bDetected=1;
}
else if(PE.compareEP("EB01..E82A000000EB04........EB02....8B54240CEB03"))
{
sVersion="1.3.4.1";
bDetected=1;
}
else if(PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB02"))
{
sVersion="1.3.4.2";
bDetected=1;
}
else if(PE.compareEP("EB03......E8........EB02....EB04........8B54240C"))
{
sVersion="1.3.5.0";
bDetected=1;
}
else if(PE.compareEP("eb08................eb03......50eb02"))
{
sVersion="1.6b43";
bDetected=1;
}
else if(PE.compareEP("E84719"))
{
bDetected=1;
}
else if(PE.compareEP("EB$$E8....0000EB$$EB$$8B54240CEB"))
{
bDetected=1;
}
// Generic
else if(PE.getEntryPointSection()==PE.nLastSection)
{
if(PE.compareEP("EB"))
{
if(PE.getImportSection()>=0&&PE.getImportSection()<=2)
{
if(PE.isOverlayPresent())
{
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: ajax
// History:
// 22:54 17.01.2013 add generic
// 22:30 14.07.2013 improved generic
init("protector","Obsidium");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("E8AB1C"))
{
sVersion="1.0.0.59";
bDetected=1;
}
else if(PE.compareEP("E8AF1C0000"))
{
sVersion="1.0.0.61";
bDetected=1;
}
else if(PE.compareEP("EB02....E8E71C0000"))
{
sVersion="1.1.1.1";
bDetected=1;
}
else if(PE.compareEP("EB02....E8771E0000"))
{
sVersion="1.2";
bDetected=1;
}
else if(PE.compareEP("EB02....E83F1E0000"))
{
sVersion="1.2.0.0";
bDetected=1;
}
else if(PE.compareEP("E80E0000008B54240C8382B8000000"))
{
sVersion="1.2.5.0";
bDetected=1;
}
else if(PE.compareEP("EB01..E829000000EB02....EB01..8B54240CEB04"))
{
sVersion="1.2.5.8";
bDetected=1;
}
else if(PE.compareEP("E80E00000033C08B54240C8382B80000000DC36467FF36"))
{
sVersion="1.2.X";
bDetected=1;
}
else if(PE.compareEP("EB04........E829000000EB02....EB01..8B54240CEB02"))
{
sVersion="1.3.0.0";
bDetected=1;
}
else if(PE.compareEP("EB02....E825000000EB04........EB01..8B54240CEB01"))
{
sVersion="1.3.0.4";
bDetected=1;
}
else if(PE.compareEP("EB01..E826000000EB02....EB02....8B54240CEB01"))
{
sVersion="1.3.0.13";
bDetected=1;
}
else if(PE.compareEP("EB02....E828000000EB04........EB01..8B54240CEB"))
{
sVersion="1.3.0.17";
bDetected=1;
}
else if(PE.compareEP("EB03......E82E000000EB04........EB04........8B"))
{
sVersion="1.3.0.21";
bDetected=1;
}
else if(PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB04"))
{
sVersion="1.3.0.37";
bDetected=1;
}
else if(PE.compareEP("EB02....E827000000EB02....EB03......8B54240CEB01"))
{
sVersion="1.3.1.1";
bDetected=1;
}
else if(PE.compareEP("EB04........E82A000000EB03......EB04........8B54"))
{
sVersion="1.3.2.2";
bDetected=1;
}
else if(PE.compareEP("EB01..E829000000EB02....EB03......8B54240CEB02"))
{
sVersion="1.3.3.1";
bDetected=1;
}
else if(PE.compareEP("EB01..E82B000000EB02....EB02....8B54240CEB03"))
{
sVersion="1.3.3.2";
bDetected=1;
}
else if(PE.compareEP("EB02....E829000000EB03......EB03......8B..240CEB"))
{
sVersion="1.3.3.3";
bDetected=1;
}
else if(PE.compareEP("EB02....E829000000EB03......EB02....8B54240CEB03"))
{
sVersion="1.3.3.4";
bDetected=1;
}
else if(PE.compareEP("EB04........E828000000EB01..............8B54240"))
{
sVersion="1.3.3.6";
bDetected=1;
}
else if(PE.compareEP("EB02....E827000000EB03......EB01..8B54240CEB03"))
{
sVersion="1.3.3.7";
bDetected=1;
}
else if(PE.compareEP("EB02....E82C000000EB04........EB04........8B5424"))
{
sVersion="1.3.3.7";
bDetected=1;
}
else if(PE.compareEP("EB04........E828000000EB01..EB01..8B54240CEB04"))
{
sVersion="1.3.3.8";
bDetected=1;
}
else if(PE.compareEP("EB02....E829000000EB03......EB01..8B54240CEB04"))
{
sVersion="1.3.3.9";
bDetected=1;
}
else if(PE.compareEP("EB01..E82A000000EB04........EB02....8B54240CEB03"))
{
sVersion="1.3.4.1";
bDetected=1;
}
else if(PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB02"))
{
sVersion="1.3.4.2";
bDetected=1;
}
else if(PE.compareEP("EB03......E8........EB02....EB04........8B54240C"))
{
sVersion="1.3.5.0";
bDetected=1;
}
else if(PE.compareEP("eb08................eb03......50eb02"))
{
sVersion="1.6b43";
bDetected=1;
}
else if(PE.compareEP("E84719"))
{
bDetected=1;
}
else if(PE.compareEP("EB$$E8....0000EB$$EB$$8B54240CEB"))
{
bDetected=1;
}
// Generic
else if(PE.getEntryPointSection()==PE.nLastSection)
{
if(PE.compareEP("EB"))
{
if(PE.getImportSection()>=0&&PE.getImportSection()<=2)
{
if(PE.isOverlayPresent())
{
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

72
db/PE/Pantaray QSetup.1.sg
View file

@ -1,36 +1,36 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Pantaray QSetup");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3........33c0a3........e8........ba........8bc3e8........5bc3"))
{
if(PE.compareOverlay("970300000201"))
{
sVersion="10.0.0.x";
bDetected=1;
}
else if(PE.compareOverlay("370700000201"))
{
sVersion="11.0.0.x";
bDetected=1;
}
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x400, "'|http:'");
if(ArcOffset!=-1)
{
sVersion="6.0.0.0";
bDetected=1;
}
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x400, "'|www.'");
if(ArcOffset!=-1)
{
sVersion="8.0.0.0";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Pantaray QSetup");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3........33c0a3........e8........ba........8bc3e8........5bc3"))
{
if(PE.compareOverlay("970300000201"))
{
sVersion="10.0.0.x";
bDetected=1;
}
else if(PE.compareOverlay("370700000201"))
{
sVersion="11.0.0.x";
bDetected=1;
}
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x400, "'|http:'");
if(ArcOffset!=-1)
{
sVersion="6.0.0.0";
bDetected=1;
}
var ArcOffset=PE.findSignature(PE.getOverlayOffset(),0x400, "'|www.'");
if(ArcOffset!=-1)
{
sVersion="8.0.0.0";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

36
db/PE/Paquet Builder.1.sg
View file

@ -1,18 +1,18 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Paquet Builder");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("5589e56a..68........68........64ff35........648925........83ec..83ec..5356578965..68"))
{
if(PE.compareOverlay("'PB'................................'7z'"))
{
sOptions="7zip";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Paquet Builder");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("5589e56a..68........68........64ff35........648925........83ec..83ec..5356578965..68"))
{
if(PE.compareOverlay("'PB'................................'7z'"))
{
sOptions="7zip";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

48
db/PE/PerlApp.1.sg
View file

@ -1,24 +1,24 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","PerlApp");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..8365....6a..ff15"))
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type=="232") //BFS
{
if(PE.compare("ff'BFS'01",PE.resource[i].Offset))
{
bDetected=1;
break;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("compiler","PerlApp");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..8365....6a..ff15"))
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type=="232") //BFS
{
if(PE.compare("ff'BFS'01",PE.resource[i].Offset))
{
bDetected=1;
break;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

38
db/PE/Power Screen Recorder.1.sg
View file

@ -1,19 +1,19 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("player","Power Screen Recorder");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8"))
{
if(PE.findSignature(PE.getSize()-0x500, 0x500, "'xzjtlx'")!=-1)
{
sVersion="6.x-7.x";
sOptions="by www.tlxsoft.com";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("player","Power Screen Recorder");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8"))
{
if(PE.findSignature(PE.getSize()-0x500, 0x500, "'xzjtlx'")!=-1)
{
sVersion="6.x-7.x";
sOptions="by www.tlxsoft.com";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

124
db/PE/Setup Factory.1.sg
View file

@ -1,62 +1,62 @@
// DIE's signature file
init("installer","Setup Factory");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558BEC6AFF68..61400068..43400064A1000000005064892500000000"))
{
if(PE.compareEP("90614000",6))
{
sVersion="6.0.0.3";
}
else
{
sVersion="6.x";
}
bDetected=1;
}
else if(PE.compareOverlay("e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7"))
{
if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0a3........eb"))
{
sVersion="8.0";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0a3........eb"))
{
sVersion="9.0";
bDetected=1;
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0488905........eb"))
{
sVersion="9.5";
bDetected=1;
}
}
else if(PE.compareOverlay("e0e1e2e3e4e5e6"))
{
if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15"))
{
sVersion="5.0";
bDetected=1;
}
else if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))
{
sVersion="4.02";
bDetected=1;
}
}
if(bDetected)
{
var sInfoString=PE.getVersionStringInfo("Comments");
if(sInfoString.indexOf("Trial")>=0)
{
sOptions="trial";
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("installer","Setup Factory");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558BEC6AFF68..61400068..43400064A1000000005064892500000000"))
{
if(PE.compareEP("90614000",6))
{
sVersion="6.0.0.3";
}
else
{
sVersion="6.x";
}
bDetected=1;
}
else if(PE.compareOverlay("e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7"))
{
if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0a3........eb"))
{
sVersion="8.0";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0a3........eb"))
{
sVersion="9.0";
bDetected=1;
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0488905........eb"))
{
sVersion="9.5";
bDetected=1;
}
}
else if(PE.compareOverlay("e0e1e2e3e4e5e6"))
{
if(PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15"))
{
sVersion="5.0";
bDetected=1;
}
else if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))
{
sVersion="4.02";
bDetected=1;
}
}
if(bDetected)
{
var sInfoString=PE.getVersionStringInfo("Comments");
if(sInfoString.indexOf("Trial")>=0)
{
sOptions="trial";
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

50
db/PE/SfxCA.1.sg
View file

@ -1,25 +1,25 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Sfx Custom Action");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'MSCF'00000000"))
{
if(PE.compareEP("48895c24..48897424..574883ec..498bf88bda488bf183fa..75..e8........4c8bc7"))
{
sVersion="3.8";
sOptions="by Outercurve Foundation";
bDetected=1;
}
else if(PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
sVersion="3.10";
sOptions="by Outercurve Foundation";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Sfx Custom Action");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'MSCF'00000000"))
{
if(PE.compareEP("48895c24..48897424..574883ec..498bf88bda488bf183fa..75..e8........4c8bc7"))
{
sVersion="3.8";
sOptions="by Outercurve Foundation";
bDetected=1;
}
else if(PE.compareEP("558bec837d....75..e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
sVersion="3.10";
sOptions="by Outercurve Foundation";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

40
db/PE/Spices .Net.2.sg
View file

@ -1,18 +1,44 @@
// DIE's signature file
// DIE's signature file
// 25.11.2018 added 5.X Version - A.S.L - asl@onet.eu
init("protector","Spices.Net");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.isNETStringPresent("NineRays.Obfuscator"))
if(PE.isNET())
{
if(PE.isSignaturePresent(PE.section[1].FileOffset-512,512,
"'Built using an evaluation version of 9Rays.Net Spices.Obfuscator.'"))
if(PE.isNETStringPresent("NineRays.Obfuscator"))
{
sOptions="Evaluation";
if(PE.isSignaturePresent(PE.section[1].FileOffset-512,512,
"'Built using an evaluation version of 9Rays.Net Spices.Obfuscator.'"))
{
sOptions="Evaluation";
}
bDetected=1;
}
bDetected=1;
}
if(!bDetected)
{
var Spices="'9Rays.Net Spices.Net Obfuscator'";
if(PE.isDll())
{
if((PE.isSignatureInSectionPresent(1,Spices))||(PE.isSignatureInSectionPresent(0,Spices)))
{
sVersion="5.X";
sOptions="DLL";
bDetected=1;
}
}
}
else
{
if(PE.isSignatureInSectionPresent(0,Spices))
{
sVersion="5.X";
bDetected=1;
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

192
db/PE/Thinstall.2.sg
View file

@ -1,96 +1,96 @@
// DIE's signature file
init("protector","Thinstall(VMware ThinApp)");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("6A00FF1520504000E8D4F8FFFFE9E9ADFFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C741"))
{
sVersion="2.403";
bDetected=1;
}
else if(PE.compareEP("558BECB8........BB........50E800000000582D..1A0000B9..1A0000BA..1B0000BE00100000BF..530000BD..1A000003E8817500..........7504........817508........81750C........817510"))
{
sVersion="2.5xx";
bDetected=1;
}
else if(PE.compareEP("558BEC515356576A006A00FF15........50E887FCFFFF5959A1........8B40100305........8945FC8B45FCFFE05F5E5BC9C3000000"))
{
sVersion="1.9X";
bDetected=1;
}
else if(PE.compareEP("B8EFBEADDE506A00FF15........E9..FFFFFF"))
{
switch(PE.readByte(PE.nEP+15))
{
case 0xAD: sVersion="2.0X"; break;
case 0xB9: sVersion="2.2X-2.308"; break;
}
bDetected=1;
}
else if(PE.compareEP("E8F2FFFFFF5068........68401B0000E842FFFFFFE99DFFFFFF000000000000"))
{
sVersion="2.545";
bDetected=1;
}
else if(PE.compareEP("E80000000058BB....00002BC35068........68....000068"))
{
switch(PE.readWord(PE.nEP+7))
{
case 0x80C1: sVersion="2.547-2.600"; break;
case 0x19AD: sVersion="2.609"; break;
case 0x1EAC: sVersion="2.620-2.623"; break;
case 0x1D34: sVersion="2.628"; break;
default: sVersion="2.6XX";
}
bDetected=1;
}
else if(PE.compareEP("9C60E80000000058BB........2BC35068........68........68........E8........E9"))
{
sVersion="2.7XX";
bDetected=1;
}
else if(PE.compareEP("9C6068'StAl'68'ThIn'E80000000058BB371F00002BC35068"))
{
if(PE.compareEP("0028",32))
{
sVersion="3.035-3.043";
}
else if(PE.compareEP("002C",32))
{
sVersion="3.049-3.080";
}
else if(PE.compareEP("BAFE",42))
{
sVersion="3.0XX";
}
else if(PE.compareEP("2CFF",42))
{
sVersion="3.10X";
}
bDetected=1;
}
else if(PE.compareEP("b8........e8........482be08d50..4533c033c9e8........85c075..b9........ff15"))
{
sVersion="5.0";
bDetected=1;
}
else if(PE.isOverlayPresent())
{
if(PE.nLastSection>=1&&PE.section[1].Name==".res")
{
sVersion="4.7.X";
bDetected=1;
}
}
if(PE.compareEP("6a..6a..6a..e8$$$$$$$$8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..a1........8365"))
{
if(PE.compareOverlay("09050000"))
{
sVersion="5.2.2";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("protector","Thinstall(VMware ThinApp)");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("6A00FF1520504000E8D4F8FFFFE9E9ADFFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C741"))
{
sVersion="2.403";
bDetected=1;
}
else if(PE.compareEP("558BECB8........BB........50E800000000582D..1A0000B9..1A0000BA..1B0000BE00100000BF..530000BD..1A000003E8817500..........7504........817508........81750C........817510"))
{
sVersion="2.5xx";
bDetected=1;
}
else if(PE.compareEP("558BEC515356576A006A00FF15........50E887FCFFFF5959A1........8B40100305........8945FC8B45FCFFE05F5E5BC9C3000000"))
{
sVersion="1.9X";
bDetected=1;
}
else if(PE.compareEP("B8EFBEADDE506A00FF15........E9..FFFFFF"))
{
switch(PE.readByte(PE.nEP+15))
{
case 0xAD: sVersion="2.0X"; break;
case 0xB9: sVersion="2.2X-2.308"; break;
}
bDetected=1;
}
else if(PE.compareEP("E8F2FFFFFF5068........68401B0000E842FFFFFFE99DFFFFFF000000000000"))
{
sVersion="2.545";
bDetected=1;
}
else if(PE.compareEP("E80000000058BB....00002BC35068........68....000068"))
{
switch(PE.readWord(PE.nEP+7))
{
case 0x80C1: sVersion="2.547-2.600"; break;
case 0x19AD: sVersion="2.609"; break;
case 0x1EAC: sVersion="2.620-2.623"; break;
case 0x1D34: sVersion="2.628"; break;
default: sVersion="2.6XX";
}
bDetected=1;
}
else if(PE.compareEP("9C60E80000000058BB........2BC35068........68........68........E8........E9"))
{
sVersion="2.7XX";
bDetected=1;
}
else if(PE.compareEP("9C6068'StAl'68'ThIn'E80000000058BB371F00002BC35068"))
{
if(PE.compareEP("0028",32))
{
sVersion="3.035-3.043";
}
else if(PE.compareEP("002C",32))
{
sVersion="3.049-3.080";
}
else if(PE.compareEP("BAFE",42))
{
sVersion="3.0XX";
}
else if(PE.compareEP("2CFF",42))
{
sVersion="3.10X";
}
bDetected=1;
}
else if(PE.compareEP("b8........e8........482be08d50..4533c033c9e8........85c075..b9........ff15"))
{
sVersion="5.0";
bDetected=1;
}
else if(PE.isOverlayPresent())
{
if(PE.nLastSection>=1&&PE.section[1].Name==".res")
{
sVersion="4.7.X";
bDetected=1;
}
}
if(PE.compareEP("6a..6a..6a..e8$$$$$$$$8bff558bec837d....75..e8$$$$$$$$8bff558bec83ec..a1........8365"))
{
if(PE.compareOverlay("09050000"))
{
sVersion="5.2.2";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

390
db/PE/VMProtect.2.sg
View file

@ -1,195 +1,195 @@
// DIE's signature file
// 16:27 26.01.2013 detect improved //ajax
// 2:30 27.01.2013 bugfixes
// 14:14 27.01.2013 bugfixes
init("protector","VMProtect");
function detectVMP(sSectionName)
{
if(PE.section[sSectionName])
{
nCharacteristics=PE.section[sSectionName].Characteristics;
if((nCharacteristics==0x60000060)||(nCharacteristics==0xE0000060)||(nCharacteristics==0xE0000040))
{
return 1;
}
}
return 0;
}
function detectVMP2()
{
if(PE.section.length>7)
{
var nCount=5;
var nResource=PE.getResourceSection();
var nRelocs=PE.getRelocsSection();
if(nResource>PE.section.length-nCount)
{
nCount++;
}
if(nRelocs>PE.section.length-nCount)
{
nCount++;
}
var nDetectCount=0;
var nLastVMPSection=0;
for(var nSection=PE.section.length-nCount;nSection<PE.section.length;nSection++)
{
if((nSection==nResource)||(nSection==nRelocs))
{
continue;
}
if((PE.section[nSection].FileSize==0)&&(PE.section[nSection].FileOffset==0))
{
nDetectCount++;
}
if((PE.section[nSection].FileSize!=0)&&(PE.section[nSection].FileOffset!=0))
{
nLastVMPSection=nSection;
}
}
if(nDetectCount>=3)
{
if(PE.getEntryPointSection()==nLastVMPSection)
{
if(PE.section[nLastVMPSection].Characteristics==0xE0000060)
{
if(PE.calculateEntropy(PE.section[nLastVMPSection].FileOffset,PE.section[nLastVMPSection].FileSize)>7.6)
{
return 1;
}
}
else if(PE.section[nLastVMPSection].Characteristics&0x20000000) // Fix sent Deniskore
{
var nSectionOffset=PE.section[nLastVMPSection].FileOffset;
var nSectionSize=PE.section[nLastVMPSection].FileSize;
var nOffset=nSectionOffset;
var nSize=nSectionSize;
var nCount=0;
var nSignatureOffset;
while(nSize>0)
{
nSignatureOffset=PE.findSignature(nOffset,nSize,"9c8d64");
if(nSignatureOffset==-1)
break;
nCount++;
nOffset=nSignatureOffset+3;
nSize=nSectionSize-(nSignatureOffset-nSectionOffset);
if(nCount>=2)
{
return 1;
}
}
}
}
}
}
return 0;
}
function detect(bShowType,bShowVersion,bShowOptions)
{
var nSectionNumber=0;
var nCharacteristics=0;
var collision="";
if(PE.section[".vmp0"]&&(PE.compareEP("68........E9")||PE.compareEP("68........E8")))
{
sVersion="1.60-2.05";
bDetected=1;
}
else if(detectVMP(".vmp0"))
{
bDetected=1;
}
else if(detectVMP(".vmp1"))
{
bDetected=1;
}
else if(detectVMP(".vmp2"))
{
bDetected=1;
}
else if(PE.compareEP("54c70424........9c60c74424..........c64424....887424..60"))
{
sVersion="2.06";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$e9$$$$$$$$880424881c24c70424........9ce8"))
{
sVersion="2.07";
bDetected=1;
}
else if(PE.compareEP("9ce8$$$$$$$$e8$$$$$$$$c74424..........e9$$$$$$$$e8$$$$$$$$c74424..........526068"))
{
sVersion="2.12-13";
bDetected=1;
}
else if(PE.compareEP("9c9cc74424..........9cc74424..........9c528d6424..e9"))
{
sVersion="2.12-13";
bDetected=1;
}
else if(PE.compareEP("68........e8$$$$$$$$41574150448ac350410f96c057415148c7c7"))
{
sVersion="3.0x";
bDetected=1;
}
else
{
collision=PE.getSectionNameCollision("0","1");
if(collision!="")
{
if((PE.compareEP("68........E9")||PE.compareEP("68........E8")))
{
sVersion="1.X";
bDetected=1;
}
else if((PE.compareEP("9cE9")||PE.compareEP("9cFF")))
{
sVersion="2.X";
bDetected=1;
}
else if(detectVMP(collision+"0")&&detectVMP(collision+"1"))
{
bDetected=1;
}
}
if(!bDetected)
{
if(detectVMP2())
{
sVersion="2.X";
bDetected=1;
}
}
}
if(bDetected)
{
if(PE.section.length<3)
{
bDetected=0;
}
else if(PE.section.length==3)
{
if(PE.section[0].FileSize==0)
{
bDetected=0;
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// 16:27 26.01.2013 detect improved //ajax
// 2:30 27.01.2013 bugfixes
// 14:14 27.01.2013 bugfixes
init("protector","VMProtect");
function detectVMP(sSectionName)
{
if(PE.section[sSectionName])
{
nCharacteristics=PE.section[sSectionName].Characteristics;
if((nCharacteristics==0x60000060)||(nCharacteristics==0xE0000060)||(nCharacteristics==0xE0000040))
{
return 1;
}
}
return 0;
}
function detectVMP2()
{
if(PE.section.length>7)
{
var nCount=5;
var nResource=PE.getResourceSection();
var nRelocs=PE.getRelocsSection();
if(nResource>PE.section.length-nCount)
{
nCount++;
}
if(nRelocs>PE.section.length-nCount)
{
nCount++;
}
var nDetectCount=0;
var nLastVMPSection=0;
for(var nSection=PE.section.length-nCount;nSection<PE.section.length;nSection++)
{
if((nSection==nResource)||(nSection==nRelocs))
{
continue;
}
if((PE.section[nSection].FileSize==0)&&(PE.section[nSection].FileOffset==0))
{
nDetectCount++;
}
if((PE.section[nSection].FileSize!=0)&&(PE.section[nSection].FileOffset!=0))
{
nLastVMPSection=nSection;
}
}
if(nDetectCount>=3)
{
if(PE.getEntryPointSection()==nLastVMPSection)
{
if(PE.section[nLastVMPSection].Characteristics==0xE0000060)
{
if(PE.calculateEntropy(PE.section[nLastVMPSection].FileOffset,PE.section[nLastVMPSection].FileSize)>7.6)
{
return 1;
}
}
else if(PE.section[nLastVMPSection].Characteristics&0x20000000) // Fix sent Deniskore
{
var nSectionOffset=PE.section[nLastVMPSection].FileOffset;
var nSectionSize=PE.section[nLastVMPSection].FileSize;
var nOffset=nSectionOffset;
var nSize=nSectionSize;
var nCount=0;
var nSignatureOffset;
while(nSize>0)
{
nSignatureOffset=PE.findSignature(nOffset,nSize,"9c8d64");
if(nSignatureOffset==-1)
break;
nCount++;
nOffset=nSignatureOffset+3;
nSize=nSectionSize-(nSignatureOffset-nSectionOffset);
if(nCount>=2)
{
return 1;
}
}
}
}
}
}
return 0;
}
function detect(bShowType,bShowVersion,bShowOptions)
{
var nSectionNumber=0;
var nCharacteristics=0;
var collision="";
if(PE.section[".vmp0"]&&(PE.compareEP("68........E9")||PE.compareEP("68........E8")))
{
sVersion="1.60-2.05";
bDetected=1;
}
else if(detectVMP(".vmp0"))
{
bDetected=1;
}
else if(detectVMP(".vmp1"))
{
bDetected=1;
}
else if(detectVMP(".vmp2"))
{
bDetected=1;
}
else if(PE.compareEP("54c70424........9c60c74424..........c64424....887424..60"))
{
sVersion="2.06";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$e9$$$$$$$$880424881c24c70424........9ce8"))
{
sVersion="2.07";
bDetected=1;
}
else if(PE.compareEP("9ce8$$$$$$$$e8$$$$$$$$c74424..........e9$$$$$$$$e8$$$$$$$$c74424..........526068"))
{
sVersion="2.12-13";
bDetected=1;
}
else if(PE.compareEP("9c9cc74424..........9cc74424..........9c528d6424..e9"))
{
sVersion="2.12-13";
bDetected=1;
}
else if(PE.compareEP("68........e8$$$$$$$$41574150448ac350410f96c057415148c7c7"))
{
sVersion="3.0x";
bDetected=1;
}
else
{
collision=PE.getSectionNameCollision("0","1");
if(collision!="")
{
if((PE.compareEP("68........E9")||PE.compareEP("68........E8")))
{
sVersion="1.X";
bDetected=1;
}
else if((PE.compareEP("9cE9")||PE.compareEP("9cFF")))
{
sVersion="2.X";
bDetected=1;
}
else if(detectVMP(collision+"0")&&detectVMP(collision+"1"))
{
bDetected=1;
}
}
if(!bDetected)
{
if(detectVMP2())
{
sVersion="2.X";
bDetected=1;
}
}
}
if(bDetected)
{
if(PE.section.length<3)
{
bDetected=0;
}
else if(PE.section.length==3)
{
if(PE.section[0].FileSize==0)
{
bDetected=0;
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

110
db/PE/VMWare.1.sg
View file

@ -1,55 +1,55 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","VMWare");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'RWMV'"))
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0"))
{
sName+=" Installation Launcher";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0"))
{
sName+=" Installation Launcher";
bDetected=1;
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0"))
{
sName+=" Installation Launcher";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
sName+=" Installation Launcher";
bDetected=1;
}
}
if(PE.isOverlayPresent()&&PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0"))
{
var nSize=Math.min(PE.getOverlaySize(), 0x100);
if(PE.findString(PE.getOverlayOffset(), nSize, "BZh91AY&")!=-1)
{
sName+=" Software Installer";
sOptions="bzip2";
bDetected=1;
}
else if(PE.findSignature(PE.getOverlayOffset(), nSize, "d0cf11e0a1b11ae1")!=-1)
{
sName+=" Software Installer";
sOptions="MS Compound";
bDetected=1;
}
}
if(bDetected)
{
sVersion=PE.getFileVersion();
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","VMWare");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'RWMV'"))
{
if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0"))
{
sName+=" Installation Launcher";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0"))
{
sName+=" Installation Launcher";
bDetected=1;
}
else if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0"))
{
sName+=" Installation Launcher";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
sName+=" Installation Launcher";
bDetected=1;
}
}
if(PE.isOverlayPresent()&&PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0"))
{
var nSize=Math.min(PE.getOverlaySize(), 0x100);
if(PE.findString(PE.getOverlayOffset(), nSize, "BZh91AY&")!=-1)
{
sName+=" Software Installer";
sOptions="bzip2";
bDetected=1;
}
else if(PE.findSignature(PE.getOverlayOffset(), nSize, "d0cf11e0a1b11ae1")!=-1)
{
sName+=" Software Installer";
sOptions="MS Compound";
bDetected=1;
}
}
if(bDetected)
{
sVersion=PE.getFileVersion();
}
return result(bShowType,bShowVersion,bShowOptions);
}

72
db/PE/VbsToExe.1.sg
View file

@ -1,36 +1,36 @@
// DIE's signature file
// sign by A.S.L - asl@onet.eu
// fixed by adoxa
init("protector","VbsToExe");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.resource["D"])
{
if(PE.compare("'2edecompile'", PE.resource["D"].Offset+2))
{
sVersion="v2.0.2.0";
bDetected=1;
}
else if(PE.resource["D"].Size==14 &&
PE.isResourceNamePresent("B") &&
PE.isResourceNamePresent("F") &&
PE.isResourceNamePresent("I") &&
PE.isResourceNamePresent("N") &&
PE.isResourceNamePresent("O"))
{
sVersion="v2.0.2.0";
bDetected=1;
}
if(bDetected)
{
if(PE.resource["P"])
{
sOptions="Protected";
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// sign by A.S.L - asl@onet.eu
// fixed by adoxa
init("protector","VbsToExe");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.resource["D"])
{
if(PE.compare("'2edecompile'", PE.resource["D"].Offset+2))
{
sVersion="v2.0.2.0";
bDetected=1;
}
else if(PE.resource["D"].Size==14 &&
PE.isResourceNamePresent("B") &&
PE.isResourceNamePresent("F") &&
PE.isResourceNamePresent("I") &&
PE.isResourceNamePresent("N") &&
PE.isResourceNamePresent("O"))
{
sVersion="v2.0.2.0";
bDetected=1;
}
if(bDetected)
{
if(PE.resource["P"])
{
sOptions="Protected";
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

13
db/PE/Visual Objects.4.sg Normal file
View file

@ -0,0 +1,13 @@
// DIE's signature file
init("compiler","Visual Objects");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compare("'This Visual Objects application cannot be run in DOS mode'",0x312))
{
sVersion="2.XX";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

48
db/PE/WiX Toolset installer.1.sg
View file

@ -1,24 +1,24 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","WiX Toolset installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'MSCF'00000000"))
{
if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc774..85c674..f7"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","WiX Toolset installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'MSCF'00000000"))
{
if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc774..85c674..f7"))
{
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7"))
{
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

76
db/PE/WinRAR Installer.1.sg
View file

@ -1,38 +1,38 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","WinRAR Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e8$$$$$$$$558bec83c4..b8........53"))
{
if(PE.compareOverlay("'***messages***'"))
{
bDetected=1;
}
}
else if(PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf76..2bcffcf3aa595f"))
{
if(PE.compareOverlay("'Rar!'1a"))
{
bDetected=1;
}
}
if(PE.compareOverlay("fffe2a002a002a006d0065007300730061006700650073002a002a002a00"))
{
sOptions="Unicode";
if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488365....48bb................488b05........483bc375"))
{
sVersion="5.x";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
sVersion="5.x";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","WinRAR Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e8$$$$$$$$558bec83c4..b8........53"))
{
if(PE.compareOverlay("'***messages***'"))
{
bDetected=1;
}
}
else if(PE.compareEP("a1........c1e0..a3........575133c0bf........b9........3bcf76..2bcffcf3aa595f"))
{
if(PE.compareOverlay("'Rar!'1a"))
{
bDetected=1;
}
}
if(PE.compareOverlay("fffe2a002a002a006d0065007300730061006700650073002a002a002a00"))
{
sOptions="Unicode";
if(PE.compareEP("4883ec..e8$$$$$$$$48895c24..55488bec4883ec..488365....48bb................488b05........483bc375"))
{
sVersion="5.x";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7"))
{
sVersion="5.x";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

122
db/PE/WinZip.1.sg
View file

@ -1,61 +1,61 @@
// DIE's signature file
init("sfx","WinZip");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("ff15........b1..380874..b1..4080....74..380874..4080....75..80....74..4033"))
{
sVersion="6.x";
bDetected=1;
}
else if(PE.compareEP("53ff15........b3..38..74..80c3..4033d28a083aca74..3acb74..408a083aca75"))
{
if(PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"504b0304")!=-1)
{
sVersion="2.2";
}
else if(PE.compareEP("8A48014033D23ACA740A3ACB74068A4801",16))
{
sVersion="8.x";
}
bDetected=1;
}
else if(PE.compareEP("53ff15........b3..38..74..80c3..8a48..4033d23aca74..3acb74..8a48..40"))
{
sVersion="8.x";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0"))
{
for(var i=0;i<PE.resource.length;i++)
{
if(PE.resource[i].Type!="RT_DIALOG")
{
var nSize=Math.min(PE.resource[i].Size, 0x1100);
var ArcOffset=PE.findSignature(PE.resource[i].Offset, nSize, "'PK'0304");
if(ArcOffset!=-1)
{
bDetected=1;
break;
}
}
}
if(PE.isSectionNamePresent("_winzip_"))
{
bDetected=1;
}
}
if(PE.isSectionNamePresent("_winzip_"))
{
var nOffset=PE.getSectionFileOffset(PE.getSectionNumber("_winzip_"));
var ArcOffset=PE.findSignature(nOffset, 0x1000, "'PK'0304");
if(ArcOffset!=-1)
{
sVersion="3.1";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("sfx","WinZip");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("ff15........b1..380874..b1..4080....74..380874..4080....75..80....74..4033"))
{
sVersion="6.x";
bDetected=1;
}
else if(PE.compareEP("53ff15........b3..38..74..80c3..4033d28a083aca74..3acb74..408a083aca75"))
{
if(PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"504b0304")!=-1)
{
sVersion="2.2";
}
else if(PE.compareEP("8A48014033D23ACA740A3ACB74068A4801",16))
{
sVersion="8.x";
}
bDetected=1;
}
else if(PE.compareEP("53ff15........b3..38..74..80c3..8a48..4033d23aca74..3acb74..8a48..40"))
{
sVersion="8.x";
bDetected=1;
}
else if(PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0"))
{
for(var i=0;i<PE.resource.length;i++)
{
if(PE.resource[i].Type!="RT_DIALOG")
{
var nSize=Math.min(PE.resource[i].Size, 0x1100);
var ArcOffset=PE.findSignature(PE.resource[i].Offset, nSize, "'PK'0304");
if(ArcOffset!=-1)
{
bDetected=1;
break;
}
}
}
if(PE.isSectionNamePresent("_winzip_"))
{
bDetected=1;
}
}
if(PE.isSectionNamePresent("_winzip_"))
{
var nOffset=PE.getSectionFileOffset(PE.getSectionNumber("_winzip_"));
var ArcOffset=PE.findSignature(nOffset, 0x1000, "'PK'0304");
if(ArcOffset!=-1)
{
sVersion="3.1";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

118
db/PE/Wise Installer.1.sg
View file

@ -1,59 +1,59 @@
// DIE's signature file
init("installer","Wise Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.getOverlaySize()>80)
{
var nOffset=PE.getOverlayOffset()+77;
if(PE.readDword(nOffset)==PE.getSize())
{
bDetected=1;
}
else if(PE.section[".WISE"])
{
bDetected=1;
}
else if(PE.compareEP("558bec81ec........5356576a..ff15........ff15........8bf08975..8a063c..0f85........8a46..46"))
{
bDetected=1;
}
else if(PE.compareEP("558bec81ec........5356576a..5e6a..8975..ff15........ff15........8bf8897d..8a073c..0f85........8a47..47"))
{
bDetected=1;
}
}
else if(PE.compareEP("81ec........535556576a..ff15........33db895c24..895c24..895c24..895c24..895c24..ff15........8a08894424"))
{
if(PE.isSectionNamePresent(".WISE"))
{
sOptions="CAB";
bDetected=1;
}
}
if(PE.isSectionNamePresent(".WISE"))
{
if(PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".WISE")), 0x1000, "'Wise Installation Wizard...'")!=-1)
{
bDetected=1;
}
}
if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))
{
var nOffset=PE.getOverlayOffset();
var nZipsig=PE.findSignature(nOffset,0x1000,"504b0304");
if(nZipsig!=-1)
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareOverlay("'MSCF'0000"))
{
sOptions="CAB";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
init("installer","Wise Installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.getOverlaySize()>80)
{
var nOffset=PE.getOverlayOffset()+77;
if(PE.readDword(nOffset)==PE.getSize())
{
bDetected=1;
}
else if(PE.section[".WISE"])
{
bDetected=1;
}
else if(PE.compareEP("558bec81ec........5356576a..ff15........ff15........8bf08975..8a063c..0f85........8a46..46"))
{
bDetected=1;
}
else if(PE.compareEP("558bec81ec........5356576a..5e6a..8975..ff15........ff15........8bf8897d..8a073c..0f85........8a47..47"))
{
bDetected=1;
}
}
else if(PE.compareEP("81ec........535556576a..ff15........33db895c24..895c24..895c24..895c24..895c24..ff15........8a08894424"))
{
if(PE.isSectionNamePresent(".WISE"))
{
sOptions="CAB";
bDetected=1;
}
}
if(PE.isSectionNamePresent(".WISE"))
{
if(PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".WISE")), 0x1000, "'Wise Installation Wizard...'")!=-1)
{
bDetected=1;
}
}
if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))
{
var nOffset=PE.getOverlayOffset();
var nZipsig=PE.findSignature(nOffset,0x1000,"504b0304");
if(nZipsig!=-1)
{
sOptions="ZIP";
bDetected=1;
}
else if(PE.compareOverlay("'MSCF'0000"))
{
sOptions="CAB";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

70
db/PE/Xojo.3.sg
View file

@ -1,35 +1,35 @@
// DIE's signature file
// Author: Jupiter
/*
Xojo GUI Framework
https://www.xojo.com
*/
init("framework","Xojo");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.section["xojoinit"])
{
// plugins
if(PE.section["xojoplgn"])
{
sOptions=sOptions.append("plugins");
}
// x64 | x86
if(PE.isLibraryPresent("XojoGUIFramework64.dll"))
{
sVersion="x64";
}
else if(PE.isLibraryPresent("XojoGUIFramework32.dll"))
{
sVersion="x86";
}
//sVersion="2018r2";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: Jupiter
/*
Xojo GUI Framework
https://www.xojo.com
*/
init("framework","Xojo");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.section["xojoinit"])
{
// plugins
if(PE.section["xojoplgn"])
{
sOptions=sOptions.append("plugins");
}
// x64 | x86
if(PE.isLibraryPresent("XojoGUIFramework64.dll"))
{
sVersion="x64";
}
else if(PE.isLibraryPresent("XojoGUIFramework32.dll"))
{
sVersion="x86";
}
//sVersion="2018r2";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

48
db/PE/Xoreax installer.1.sg
View file

@ -1,24 +1,24 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Xoreax installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c055"))
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type=="RT_RCDATA")
{
if(PE.compare("5d0000",PE.resource[i].Offset))
{
bDetected=1;
break;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("installer","Xoreax installer");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c055"))
{
for(var i=0;i<PE.getNumberOfResources();i++)
{
if(PE.resource[i].Type=="RT_RCDATA")
{
if(PE.compare("5d0000",PE.resource[i].Offset))
{
bDetected=1;
break;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

64
db/PE/Zip SFX.2.sg
View file

@ -1,32 +1,32 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("sfx","Zip SFX");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15"))
{
if(PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"'PK'0304")!=-1)
{
bDetected=1;
}
}
else if(PE.compareEP("558bec83c4..b8........e8........33c05568........64ff30648920e8"))
{
if(PE.resource[0].Type==784) //ZIP
{
bDetected=1;
}
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb"))
{
if(PE.compareOverlay("'PK'0304"))
{
sOptions="by Intel";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("sfx","Zip SFX");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15"))
{
if(PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"'PK'0304")!=-1)
{
bDetected=1;
}
}
else if(PE.compareEP("558bec83c4..b8........e8........33c05568........64ff30648920e8"))
{
if(PE.resource[0].Type==784) //ZIP
{
bDetected=1;
}
}
else if(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb"))
{
if(PE.compareOverlay("'PK'0304"))
{
sOptions="by Intel";
bDetected=1;
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

48
db/PE/dUP.1.sg
View file

@ -1,24 +1,24 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("patcher","dUP diablo2oo2's Universal Patcher");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e8$$$$$$$$558bec81c4........5657536a..e8........a3........c745..........6a..68"))
{
if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("DLL");
{
if(PE.compare("a2", nOffset))
{
sVersion="2.0";
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("patcher","dUP diablo2oo2's Universal Patcher");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareEP("e8$$$$$$$$558bec81c4........5657536a..e8........a3........c745..........6a..68"))
{
if (PE.getNumberOfResources()>0)
{
nOffset=PE.getResourceNameOffset("DLL");
{
if(PE.compare("a2", nOffset))
{
sVersion="2.0";
bDetected=1;
}
}
}
}
return result(bShowType,bShowVersion,bShowOptions);
}

1180
db/PE/overlays.6.sg
View file

File diff suppressed because it is too large Load diff

30
db/PE/temporary EXE SFX.1.sg
View file

@ -1,15 +1,15 @@
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("sfx","temporary EXE SFX");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'MZ'"))
{
sOptions="EXE files in overlays not supported now";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}
// DIE's signature file
// Author: hypn0 <hypn0@mail.ru>
init("sfx","temporary EXE SFX");
function detect(bShowType,bShowVersion,bShowOptions)
{
if(PE.compareOverlay("'MZ'"))
{
sOptions="EXE files in overlays not supported now";
bDetected=1;
}
return result(bShowType,bShowVersion,bShowOptions);
}

8
editor/autocomplete/PE.lst
View file

@ -69,6 +69,10 @@ isConsole;bool isConsole();
isDll;bool isDll();
isDosStubPresent;bool isDosStubPresent();
isDriver;bool isDriver();
isExportFunctionPresent;bool isExportFunctionPresent(QString sFunctionName);
isExportFunctionPresentExp;bool isExportFunctionPresentExp(QString sFunctionName);
isExportPresent;bool isExportPresent();
isImportPresent;bool isImportPresent();
isLibraryFunctionPresent;bool isLibraryFunctionPresent(QString sLibraryName, QString sFunctionName);
isLibraryPresent;bool isLibraryPresent(QString sLibraryName);
isNET;bool isNET();
@ -77,6 +81,7 @@ isNETUnicodeStringPresent;bool isNETUnicodeStringPresent(QString sString);
isOverlayPresent;bool isOverlayPresent();
isPEPlus;bool isPEPlus();
isResourceNamePresent;bool isResourceNamePresent(QString sName);
isResourcePresent;bool isResourcePresent();
isRichSignaturePresent;bool isRichSignaturePresent();
isRichVersionPresent;bool isRichVersionPresent(unsigned int nVersion);
isSectionNamePresent;bool isSectionNamePresent(QString sSectionName);
@ -84,6 +89,7 @@ isSectionNamePresentExp;bool isSectionNamePresentExp(QString sSectionName);
isSignatureInSectionPresent;bool isSignatureInSectionPresent(unsigned int nSection,QString sSignature);
isSignaturePresent;bool isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature);
isSignedFile;bool isSignedFile();
isTLSPresent;bool isTLSPresent();
OffsetToRVA;int64 OffsetToRVA(unsigned int64 nOffset);
OffsetToVA;int64 OffsetToVA(unsigned int64 nOffset);
readByte;unsigned char readByte(unsigned int nOffset);
@ -91,4 +97,4 @@ readDword;unsigned int readDword(unsigned int nOffset);
readWord;unsigned short readWord(unsigned int nOffset);
RVAToOffset;int64 RVAToOffset(unsigned int64 nRVA);
swapBytes;unsigned int swapBytes(unsigned int nValue);
VAToOffset;int64 VAToOffset(unsigned int64 nVA);
VAToOffset;int64 VAToOffset(unsigned int64 nVA);

34
help/PE.js
View file

@ -659,4 +659,36 @@ PE.getFileSuffix=function(){}
/**
* @see Binary.getFileCompleteSuffix
*/
PE.getFileCompleteSuffix=function(){}
PE.getFileCompleteSuffix=function(){}
/**
* Check if Export presents.
* @returns {Bool}
*/
PE.isExportPresent=function(){}
/**
* Check if TLS presents.
* @returns {Bool}
*/
PE.isTLSPresent=function(){}
/**
* Check if Import presents.
* @returns {Bool}
*/
PE.isImportPresent=function(){}
/**
* Check if Resource presents.
* @returns {Bool}
*/
PE.isResourcePresent=function(){}
/**
* Check if Export function exists with a specific name.
* @param {String} sFunctionName - Function name
* @returns {Bool}
*/
PE.isExportFunctionPresent=function(){}
/**
* Check if Export function matches a regular expression.
* @param {String} sFunctionName - Function pattern
* @returns {Bool}
*/
PE.isExportFunctionPresentExp=function(){}

10
info/Xojo.html
View file

@ -1,5 +1,5 @@
Xojo is an integrated software developer tool and programming language that is the easiest way to make desktop, web and iOS apps. With Xojo you can create desktop apps for Windows, Mac and Linux (including Raspberry Pi), web apps for all popular web browsers and iOS apps for iPhones, iPads and other iOS devices.
Xojo is a rapid application development (RAD) tool with a user interface (UI) builder that lets you create your app's user interface with little to no programming required. If you know how to drag and drop, you can build the UI using the wide variety of built-in controls, making it easy to create powerful, multi-platform desktop, web and iOS applications faster than you ever thought possible.
https://www.xojo.com
Xojo is an integrated software developer tool and programming language that is the easiest way to make desktop, web and iOS apps. With Xojo you can create desktop apps for Windows, Mac and Linux (including Raspberry Pi), web apps for all popular web browsers and iOS apps for iPhones, iPads and other iOS devices.
Xojo is a rapid application development (RAD) tool with a user interface (UI) builder that lets you create your app's user interface with little to no programming required. If you know how to drag and drop, you can build the UI using the wide variety of built-in controls, making it easy to create powerful, multi-platform desktop, web and iOS applications faster than you ever thought possible.
https://www.xojo.com

6
info/_NET Reactor.html
View file

@ -1,3 +1,3 @@
.NET Reactor is a powerful code protection and software licensing system for software written for the .NET Framework, and supports all languages that generate .NET assemblies.
Site: http://www.eziriz.de/dotnet_reactor.htm
.NET Reactor is a powerful code protection and software licensing system for software written for the .NET Framework, and supports all languages that generate .NET assemblies.
Site: http://www.eziriz.de/dotnet_reactor.htm

6
info/_NET.html
View file

@ -1,3 +1,3 @@
.NET Framework (pronounced dot net) is a software framework developed by Microsoft that runs primarily on Microsoft Windows. It includes a large class library known as Framework Class Library (FCL) and provides language interoperability (each language can use code written in other languages) across several programming languages. Programs written for .NET Framework execute in a software environment (as contrasted to hardware environment), known as Common Language Runtime (CLR), an application virtual machine that provides services such as security, memory management, and exception handling. FCL and CLR together constitute .NET Framework.
Site: http://microsoft.com/net
.NET Framework (pronounced dot net) is a software framework developed by Microsoft that runs primarily on Microsoft Windows. It includes a large class library known as Framework Class Library (FCL) and provides language interoperability (each language can use code written in other languages) across several programming languages. Programs written for .NET Framework execute in a software environment (as contrasted to hardware environment), known as Common Language Runtime (CLR), an application virtual machine that provides services such as security, memory management, and exception handling. FCL and CLR together constitute .NET Framework.
Site: http://microsoft.com/net

3
info/yara_info.html Normal file
View file

@ -0,0 +1,3 @@
YARA
https://github.com/VirusTotal/yara

439
qss/neo.qss Normal file
View file

@ -0,0 +1,439 @@
QWidget {
background-color: #444444;
selection-color: black;
selection-background-color: Silver;
color: #C8C8CA;
font-size: 14px;
}
QWidget:!enabled {
color: #888888;
}
QFrame
{
background-color: #444444;
color: #C8C8CA;
border: 1px solid black;
border-left-color: #373737;
border-top-color: #373737;
}
QMainWindow > .QWidget {
background-color: #444444;
}
QPushButton {
background-color: #444444;
color: #C8C8CA;
border: 1px solid black;
border-left-color: #373737;
border-top-color: #373737;
}
QPushButton:hover {
background-color: #444444;
color: #C8C8CA;
border: 1px solid black;
border-left-color: #373737;
border-right-width: 1px;
border-top-color: #373737;
border-bottom-width: 1px;
background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:1 #212121, stop:0.4 #343434, stop:0.2 #343434, stop:0.1 #343434);
}
QPushButton:!enabled {
background-color: #444444;
border: 1px solid black;
border-left-color: #373737;
border-right-width: 1px;
border-top-color: #373737;
border-bottom-width: 1px;
}
QLabel {
border: none;
}
QToolTip {
background-color: #C8C8CA;
color: #444444;
border: 1px solid #C8C8CA;
border-left-color: #A8A8AA;
border-top-color: #A8A8AA;
}
QMenu {
background-color: #C8C8CA;
color: #444444;
border: 1px solid #C8C8CA;
border-left-color: #A8A8AA;
border-top-color: #A8A8AA;
}
QMenu::item:enabled:selected {
background-color: #555555;
background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:1 #212121, stop:0.4 #343434, stop:0.2 #343434, stop:0.1 #343434);
color: #C8C8CA;
}
QComboBox, QLineEdit, QSpinBox, QTextEdit, QListView, QSpinBox, QDoubleSpinBox {
background-color: #444444;
color: #C8C8CA;
border: 1px solid black;
border-right-color: #373737;
border-bottom-color: #373737;
}
QCheckBox {
spacing: 8px;
margin-top: 5px;
color: #C8C8CA;
}
QCheckBox::indicator {
width: 15px;
height: 15px;
border: 1px solid #70685f;
border-radius: 0px;
}
QCheckBox::indicator:unchecked,
QCheckBox::indicator:unchecked:hover,
QCheckBox::indicator:unchecked:pressed {
background-color: transparent;
}
QCheckBox::indicator:checked,
QCheckBox::indicator:checked:hover,
QCheckBox::indicator:checked:pressed {
background-image:url('qss/neo/Dialog/checkbox.png');
background-position: center;
background-repeat:no-repeat;
}
QCheckBox::indicator:indeterminate:hover,
QCheckBox::indicator:indeterminate:pressed {
background: qlineargradient(x1: 0, y1: 0, x2: 0.5, y2: 0.5, stop: 0 #FB8E00, stop: 1 #FB8E00);
border: 1px solid #333333;
border-radius: 0px;
}
QTabWidget::pane {
border: 0px solid #373737;
}
QTabBar::tab {
color: #b1b1b1;
border: 1px solid #373737;
border-style: outset;
background-color: #323232;
padding-left: 10px;
padding-right: 10px;
padding-top: 3px;
padding-bottom: 2px;
}
QTabBar::tab:selected
{
background-color: qlineargradient(x1: 0, y1: 0, x2: 0, y2: 1, stop:0 #6b6865, stop:0.3 #6b6865, stop:1 #383635);
background-color: qlineargradient(x1: 0, y1: 0, x2: 0, y2: 1, stop:0 #6b6865, stop:0.3 #6b6865, stop:1 #444444);
border: 1px solid #373737;
border-style: outset;
color: #e5e2df;
margin-bottom: 0px;
border-bottom: none;
}
QTabBar::tab:hover
{
background-color: #666360;
color: #e5e2df;
margin-bottom: 3px;
}
QTabBar::tab:!selected:hover
{
/*border-top: 2px solid #ffaa00;
padding-bottom: 3px;*/
border-top-left-radius: 3px;
border-top-right-radius: 3px;
background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:1 #212121, stop:0.4 #343434, stop:0.2 #343434, stop:0.1 #0DBFBF);
}
QScrollBar:vertical { /* The area behind the scrollbar covering entire height. */
background-color: qlineargradient(x1:0, y1:0, x2:0, y2:1, stop:0 #4d4b48, stop:1 transparent);
width: 13px; /* set width to zero to hide scrollbar entirely. Can look quite clean and scrolling still works with mousewheel. */
margin: 18px px; /* Takes the height of the buttons + 3 extra pixels to leave some free space between handle and buttons */
border-radius: 0px;
border: 0px solid transparent;
}
QScrollBar::handle:vertical { /* The handle you scroll with */
image: url("qss/neo/Misc/Scrollbar/scroll-gripper.png");
image-position: center; /* image is used as a small gripper in the center of the scrollbar.. You can also use background-image to use two images */
background-color: #575552;
border: 0px solid transparent;
border-radius: 0px;
min-height: 18px;
}
QScrollBar::handle:vertical:hover { /* state when you hover over the handle */
background-color: #64615e;
}
QScrollBar::sub-line:vertical { /* button to scroll up */
border: 0px solid #575552;
border-radius: 0px;
background-color: #575552;
height: 18px;
subcontrol-position: top;
subcontrol-origin: margin;
}
QScrollBar::sub-line:vertical:hover { /* hover state of button to scroll up */
background-color: #64615e;
}
QScrollBar::up-arrow:vertical { /* arrow to scroll up with */
image: url("qss/neo/Misc/Scrollbar/up-arrow.png");
top: 2px;
}
QScrollBar::add-line:vertical { /* Button to scroll down */
border: 0px solid #575552;
border-radius: 0px;
background-color: #575552;
height: 18px;
padding-top: 2px;
subcontrol-position: bottom;
subcontrol-origin: margin;
}
QScrollBar::add-line:vertical:hover { /* hover state of button to scroll down */
background-color: #64615e;
}
QScrollBar::down-arrow:vertical { /* arrow to scroll down with */
image: url("qss/neo/Misc/Scrollbar/down-arrow.png");
bottom: 3px;
}
QScrollBar::add-page:vertical, /* area between the scroll down button and the handle */
QScrollBar::sub-page:vertical { /* area betwen the scroll up button and the handle */
background: none;
}
QScrollBar:horizontal { /* background of horizontal scrollbar. */
background-color: qlineargradient(x1:0, y1:0, x2:1, y2:0, stop:0 #4d4b48, stop:1 transparent);
height: 0px; /* set height to zero to hide scrollbar entirely */
margin: 0px 22px; /* Takes the width of the buttons + 3 extra pixels to leave some free space between handle and buttons */
border-radius: 0px;
border: 0px solid transparent;
}
QScrollBar::handle:horizontal { /* Same story but for horizontal */
image: url("qss/neo/Scrollbar/scroll-gripper.png");
image-position: center;
background-repeat: no-repeat;
background-color: #575552;
border: 0px solid transparent;
border-radius: 0px;
min-width: 20px;
}
QScrollBar::handle:horizontal:hover {
background-color: #64615e;
}
QScrollBar::add-line:horizontal {
border: 0px solid #575552;
border-radius: 0px;
background-color: #575552;
width: 20px;
subcontrol-position: right;
subcontrol-origin: margin;
}
QScrollBar::sub-line:horizontal {
border: 0px solid #575552;
border-radius: 0px;
background-color: #575552;
width: 20px;
subcontrol-position: left;
subcontrol-origin: margin;
}
QScrollBar::add-line:horizontal:hover {
border: 0px solid #64615e;
border-radius: 0px;
background-color: #64615e;
width: 20px;
subcontrol-position: right;
subcontrol-origin: margin;
}
QScrollBar::sub-line:horizontal:hover {
border: 0px solid #64615e;
border-radius: 0px;
background-color: #64615e;
width: 20px;
subcontrol-position: left;
subcontrol-origin: margin;
}
QScrollBar::left-arrow:horizontal {
background: url("qss/neo/Scrollbar/left-arrow.png");
background-repeat: none;
}
QScrollBar::right-arrow:horizontal {
background: url("qss/neo/Scrollbar/right-arrow.png");
background-repeat: none;
}
QScrollBar::add-page:horizontal, QScrollBar::sub-page:horizontal {
background: none;
}
QProgressBar:horizontal {
color: #C8C8CA;
border: 1px solid black;
border-left-color: #373737;
border-top-color: #373737;
}
QProgressBar::chunk:horizontal {
background: qlineargradient(x1: 0, y1: 0.5, x2: 1, y2: 0.5, stop: 0 #373737, stop: 1 #a7a7a7);
}
QComboBox
{
background-color: qlineargradient(x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #5c5956, stop:1 #4a4846);
color: #d1cfcd;
border: 1px solid #706d69;
border-radius: 0px;
min-width: 30px;
height: 20px;
text-align: left;
padding: 0px 5px 0px 5px;
}
QComboBox:disabled { /* State of combobox that is currently disabled */
background-color: #4a4846;
border: 1px solid #706d69;
color: #888888;
}
QComboBox:!editable:on { } /* State of combobox that is open and not editable */
QComboBox:editable:on { } /* State of comboxo that is open and editable */
QComboBox:on { /* State of open combobox. Use QComboBox::drop-down:on to skin the arrow part when it's open */
background: qlineargradient(x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #5c5956, stop:1 #4a4846);
}
QComboBox QAbstractItemView /* Use this to skin the dropdown menu of a combobox. Transparency is not supported */
{
background: qlineargradient(x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #666666, stop: 1 #333333);
border: 1px solid #4d4b48;
border-radius: 0px;
border-image: none;
color: #d1cfcd;
outline: none;
}
QComboBox QListView { /* Use this for the selection in the dropdown menu */
selection-color: #ffffff;
selection-background-color: #A1A1A1;
}
QComboBox::drop-down { /* Part of the combobox that has the drop down arrow in it. Use this if you want to have a clickable image for the dropdown menu */
color: #d1cfcd;
subcontrol-origin: padding;
subcontrol-position: right; /* Use subcontrol position to set the side of the arrow. In this case the arrow at the right side of the box */
width: 15px;
border: 0px solid transparent;
background-color: transparent;
}
QComboBox::down-arrow {
image: url('qss/neo/Misc/Scrollbar/Down-arrow.png');
}
QListView {
show-decoration-selected: 1;
}
QListView::item:selected {
background-color: #A1A1A1;
}
QListView::item:hover {
background-color: #A1A1A1;
}
/* 1st version
QGroupBox {
color: #C8C8CA;
border: 1px solid black;
border-left-color: #373737;
border-top-color: #373737;
margin: 10px;
padding: 3px;
padding-top: 8px;
}
*/
QGroupBox {
color: #C8C8CA;
border: 1px solid black;
border-left-color: #373737;
border-top-color: #373737;
margin: 1px;
margin-top: 10px;
padding: 1px;
padding-top: 3px;
font-size: 12px;
}
QGroupBox QRadioButton {
font-size: 11px;
}
QGroupBox QComboBox {
font-size: 12px;
}
QGroupBox::title {
subcontrol-origin: margin;
subcontrol-position: top left;
padding: 0px;
padding-top: 0px;
left: 20px;
}
QHeaderView::section
{
background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:0 #616161, stop: 0.5 #505050, stop: 0.6 #434343, stop:1 #656565);
color: white;
padding-left: 4px;
border: 1px solid #6c6c6c;
}

BIN
qss/neo/Dialog/checkbox.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 3 KiB

BIN
qss/neo/Dialog/listview.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 2.9 KiB

BIN
qss/neo/Misc/Scrollbar/down-arrow.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 2.8 KiB

Some files were not shown because too many files have changed in this diff Show more