mirrors/Detect-It-Easy
2
0
Fork 0
mirror of https://github.com/horsicq/Detect-It-Easy.git synced 2026-06-24 01:54:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

Improve North Star PE Shrinker detection logic

Browse source 
Detection now checks for the absence of the 'nsp0' section name in addition to the existing entry point pattern. This enhances accuracy for version 1.3 identification.
This commit is contained in:
DosX 2025-09-27 19:29:27 +03:00
commit 820dec4cce
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
db/PE/North_Star_PE_Shrinker.2.sg
View file

@ -3,7 +3,7 @@
meta("protector", "North Star PE Shrinker");
function detect() {
if (PE.compareEP("9C60E8000000005DB8........2D........2BE88DB5")) {
if (PE.compareEP("9C60E8000000005DB8........2D........2BE88DB5") && !PE.isSectionNamePresent("nsp0")) {
sVersion = "1.3";
bDetected = true;
}