mirrors/Detect-It-Easy
2
0
Fork 0
mirror of https://github.com/horsicq/Detect-It-Easy.git synced 2026-06-24 01:54:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

Rename protector rule to packer and tighten detection

Browse source 
Rename db/PE/protector_Sixxpack.2.sg to db/PE/packer_Sixxpack.2.sg and change meta tag from "protector" to "packer". Add an additional guard so detection only runs when PE.isNet() and PE.isNetUStringPresent("Data Error") is present, preserving existing signature checks for versions 2.2, 2.4 and 2.X.
This commit is contained in:
DosX 2026-04-24 00:08:08 +03:00
commit 3320b2098f
1 changed files with 21 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

42
db/PE/protector_Sixxpack.2.sg → db/PE/packer_Sixxpack.2.sg Executable file → Normal file
View file

@ -1,21 +1,21 @@
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
meta("protector", "Sixxpack");
function detect() {
if (PE.isNet()) {
if (PE.isSignatureInSectionPresent(0, "00'actmp.dll'00'stub'00'Sixxpack'00")) {
sVersion = "2.2";
bDetected = true;
} else if (PE.isSignatureInSectionPresent(0, "0021......'xpack!'00................'xpack'00")) {
sVersion = "2.4";
bDetected = true;
} else if (PE.isNetObjectPresent("Sixxpack")) {
sVersion = "2.X";
bDetected = true;
}
}
return result();
}
// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
meta("packer", "Sixxpack");
function detect() {
if (PE.isNet() && PE.isNetUStringPresent("Data Error")) {
if (PE.isSignatureInSectionPresent(0, "00'actmp.dll'00'stub'00'Sixxpack'00")) {
sVersion = "2.2";
bDetected = true;
} else if (PE.isSignatureInSectionPresent(0, "0021......'xpack!'00................'xpack'00")) {
sVersion = "2.4";
bDetected = true;
} else if (PE.isNetObjectPresent("Sixxpack")) {
sVersion = "2.X";
bDetected = true;
}
}
return result();
}