mirrors/Detect-It-Easy
2
0
Fork 0
mirror of https://github.com/horsicq/Detect-It-Easy.git synced 2026-06-24 01:54:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

dbs_min update

Browse source
This commit is contained in:
DosX 2025-10-05 21:55:23 +03:00
commit 5dbebaedd5
5 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
dbs_min/db/PE/Confuser.2.sg
View file

@ -1,3 +1,3 @@
function getConfuserVersion(){var e=String(),t=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Confuser v")
return e=-1!==t?PE.getString(t+10):e}function detect(){var e
return PE.isNetObjectPresent("ConfusedByAttribute")?(e=getConfuserVersion(),sVersion=e||"1.X",bDetected=!0):PE.isNet()&&2<=PE.section.length&&-1!=(e=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"ConfuserEx v"))&&(sVersion=PE.getString(e+12,7),sName="ConfuserEx",bDetected=!0),0==PE.getNetAssemblyName().indexOf("вє∂ѕ ρяσтє¢тσя")&&(sName="ConfuserEx",sVersion="Bed's mod",bDetected=!0),result()}meta("protector","Confuser")
return PE.isNetObjectPresent("ConfusedByAttribute")?(e=getConfuserVersion(),sVersion=e||"1.X",bDetected=!0):PE.isNet()&&2<=PE.section.length&&-1!=(e=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"ConfuserEx v"))&&(sVersion=PE.getString(e+12,7),sName="ConfuserEx",bDetected=!0),0==PE.getNetAssemblyName().indexOf("вє∂ѕ ρяσтє¢тσя")?(sName="ConfuserEx",sVersion="Bed's mod",bDetected=!0):bDetected&&PE.isNetObjectPresent("DotNetPatcherPackerAttribute")&&(sName="ConfuserEx",sVersion="DotNetPatcher mod",bDetected=!0),result()}meta("protector","Confuser")

2
dbs_min/db/PE/Jar2exe.1.sg
View file

@ -1 +1 @@
function detect(){return PE.compareOverlay("efbbbf")?-1!=PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"504B0304")&&(PE.compareEP("558BEC6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d28ad48915........8bc881e1........890d")?(sOptions="x86",bDetected=!0):PE.compareEP("4883ec..48895c24..48897c24..ff15........488bc833d241b8........ff15........488bd84885c075..b8........e9")?(sOptions="x64",bDetected=!0):PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8........6a..e8........5968........6a")&&(bDetected=!0)):PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8........6a..e8........5968........6a")&&PE.compareOverlay("504b0304")&&(bDetected=!0),result()}meta("protector","Jar2Exe")
function detect(){return PE.compareOverlay("efbbbf")?-1!=PE.findSignature(PE.getOverlayOffset(),Math.min(255,PE.getOverlaySize()),"504B0304")&&(PE.compareEP("558BEC6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d28ad48915........8bc881e1........890d")?(sOptions="x86",bDetected=!0):PE.compareEP("4883ec..48895c24..48897c24..ff15........488bc833d241b8........ff15........488bd84885c075..b8........e9")?(sOptions="x64",bDetected=!0):PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8........6a..e8........5968........6a")&&(bDetected=!0)):PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8........6a..e8........5968........6a")&&PE.compareOverlay("504b0304")&&(bDetected=!0),sLang="Java",result()}meta("protector","Jar2Exe")

6
dbs_min/db/PE/MinGW.6.sg
View file

@ -1,3 +1,3 @@
function getMinGWVersion(){var e,t,i="",n=PE.section[".rdata"]
return!n||(e=n.FileOffset,n=n.FileSize,i=-1!=(t=PE.findString(e,n,"GCC: "))?PE.getString(t,128):i)||-1!=(t=PE.findString(e,n,"gcc-"))&&(i=(i=PE.getString(t)).substring(0,i.indexOf("/"))),i}function detect(){var e,t
return 2==PE.getMajorLinkerVersion()&&(e=PE.getMinorLinkerVersion(),bFPC||!(e<=30||36==e||41==e||44==e||56==e)||!PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000000000'PE'0000")||PE.isSectionNamePresent(".rsrc")&&(e=PE.section[".rsrc"],PE.isSignaturePresent(e.FileOffset+e.FileOffset-512,512,"'Microsoft Corp.'"))||(bDetected=!0)),!bDetected&&PE.compareEP("5589e583ec..e8$$$$$$$$5589e583ec..5383c4..68........e8........83c4..e8........e8........e8........83c4")&&(sVersion="2.9X",bDetected=!0),bDetected?sVersion=getMinGWVersion():(e=PE.section[".buildid"],t=PE.section[".rdata"],!(bDetected=t?PE.isSignaturePresent(t.FileOffset,256,"'mingw'"):bDetected)&&e&&t&&(bDetected=PE.isSignaturePresent(t.FileOffset,t.FileSize,"'Mingw'"))),bDetected&&!PE.isOverlayPresent()&&(sOptions="stripped"),sLang="C/C++",result()}meta("compiler","MinGW"),includeScript("FPC")
function getMinGWVersion(){var e,t,i="",r=PE.section[".rdata"]
return!r||(e=r.FileOffset,r=r.FileSize,i=-1!=(t=PE.findString(e,r,"GCC: "))?PE.getString(t,128):i)||-1!=(t=PE.findString(e,r,"gcc-"))&&(i=(i=PE.getString(t)).substring(0,i.indexOf("/"))),i}function detect(){var e,t
return!(bDetected=2==PE.getMajorLinkerVersion()&&(e=PE.getMinorLinkerVersion(),!bFPC)&&(e<=30||36==e||41==e||44==e||56==e)&&PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000000000'PE'0000")&&(!PE.isSectionNamePresent(".rsrc")||(e=PE.section[".rsrc"])&&!PE.isSignaturePresent(e.FileOffset+e.FileOffset-512,512,"'Microsoft Corp.'"))?!0:bDetected)&&PE.compareEP("5589e583ec..e8$$$$$$$$5589e583ec..5383c4..68........e8........83c4..e8........e8........e8........83c4")&&(sVersion="2.9X",bDetected=!0),bDetected?sVersion=getMinGWVersion():(e=PE.section[".buildid"],t=PE.section[".rdata"],!(bDetected=t?PE.isSignaturePresent(t.FileOffset,256,"'mingw'"):bDetected)&&e&&t&&(bDetected=PE.isSignaturePresent(t.FileOffset,t.FileSize,"'Mingw'"))),bDetected&&!PE.isOverlayPresent()?sOptions="stripped":!bDetected&&PE.isOverlayPresent()&&PE.compareOverlay("'.file' 00 00 00")&&(bDetected=!0),sLang="C/C++",result()}meta("compiler","MinGW"),includeScript("FPC")

4
dbs_min/db/PE/__GenericHeuristicAnalysis_By_DosX.7.sg
View file

File diff suppressed because one or more lines are too long

1
dbs_min/db/PE/czs108.2.sg Normal file
View file

@ -0,0 +1 @@
function detect(){return bDetected=1===PE.getNumberOfImports()&&"Kernel32.dll"===PE.getImportLibraryName(0)&&PE.isSectionNamePresent(".shell"),result()}meta("packer","czs108's Windows PE Packer")