mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
dbs_min update
This commit is contained in:
DosX
parent
bef5e6eb7d
commit
dfda510cb0
172 changed files with 231 additions and 237 deletions
File diff suppressed because one or more lines are too long
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("'CVMH'")&&(sVersion="CRI ROFS",bDetected=!0),result()}init("archive","CVM")
|
||||
function detect(){return Binary.compare("'CVMH'")&&(sName="CRI ROFS",bDetected=!0),result()}init("archive","CVM")
|
||||
|
|
|
|||
1
dbs_min/db/Binary/archive.EDP.1.sg
Normal file
1
dbs_min/db/Binary/archive.EDP.1.sg
Normal file
|
|
@ -0,0 +1 @@
|
|||
function detect(){return Binary.compare("'.EDP'")&&(sName="EdgeDataPak",bDetected=!0),result()}init("archive","EDP")
|
||||
|
|
@ -1 +0,0 @@
|
|||
function detect(){return Binary.compare("'.EDP'")&&(sVersion="EdgeDataPak",bDetected=!0),result()}init("archive","EDP")
|
||||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("'STK2.1'")&&(sVersion="STK21",bDetected=!0),result()}init("archive","STK")
|
||||
function detect(){return Binary.compare("'STK2.0'")?(sVersion="STK20",bDetected=!0):Binary.compare("'STK2.1'")&&(sVersion="STK21",bDetected=!0),result()}init("archive","STK")
|
||||
|
|
|
|||
1
dbs_min/db/Binary/bin.LGX.1.sg
Normal file
1
dbs_min/db/Binary/bin.LGX.1.sg
Normal file
|
|
@ -0,0 +1 @@
|
|||
function detect(){return Binary.compare("'LGX'")&&(sVersion="4.1.0.0.0",bDetected=!0),result()}init("format","Logox4 Speechengine")
|
||||
|
|
@ -1,9 +1,9 @@
|
|||
function detect(){if(Binary.compare("'SQLite format 3'00")){sName="SQLite 3 database (.SQLITE)",bDetected=!0
|
||||
var e=Binary.read_uint32(56,_BE),a=Binary.read_uint32(68,_BE),i=Binary.read_uint32(96,_BE),t=Binary.read_uint32(24,_BE),r=i/1e6>>0,n=(i-1e6*r)/1e3>>0
|
||||
switch(sVersion=r+"."+n+"."+(i-1e6*r-1e3*n>>0),e){case 1:sOption("UTF-8")
|
||||
var e=Binary.read_uint32(68,_BE),a=Binary.read_uint32(96,_BE),i=Binary.read_uint32(24,_BE),t=a/1e6>>0,r=(a-1e6*t)/1e3>>0
|
||||
switch(sVersion=t+"."+r+"."+(a-1e6*t-1e3*r>>0),Binary.read_uint32(56,_BE)){case 1:sOption("UTF-8")
|
||||
break
|
||||
case 2:sOption("UTF-16LE")
|
||||
break
|
||||
case 3:sOption("UTF-16BE")
|
||||
break
|
||||
default:bDetected=!1}a&&Binary.isVerbose()&&sOption("AppID:"+a),t&&Binary.isVerbose()&&sOption("Changes:"+t)}return result()}init("format","")
|
||||
default:bDetected=!1}e&&Binary.isVerbose()&&sOption("AppID:"+e),i&&Binary.isVerbose()&&sOption("Changes:"+i)}return result()}init("format","")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("'FNTF'")&&(sVersion="Font",bDetected=!0),result()}init("font","FFN")
|
||||
function detect(){return Binary.compare("'FNTF'")&&(sName="Font",bDetected=!0),result()}init("font","FFN")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("'SHPI'")&&(sVersion="Image",bDetected=!0),result()}init("image","FSH")
|
||||
function detect(){return Binary.compare("'SHPI'")&&(sName="Image",bDetected=!0),result()}init("image","FSH")
|
||||
|
|
|
|||
1
dbs_min/db/Binary/image.IMG.1.sg
Normal file
1
dbs_min/db/Binary/image.IMG.1.sg
Normal file
|
|
@ -0,0 +1 @@
|
|||
function detect(){return Binary.compare("'IMG10'")?(sVersion="v1.0",bDetected=!0):Binary.compare("'IMG1.0.1'")&&(sVersion="v1.0.1",bDetected=!0),result()}init("image","Image (DEV7)")
|
||||
1
dbs_min/db/Binary/text.OBC.1.sg
Normal file
1
dbs_min/db/Binary/text.OBC.1.sg
Normal file
|
|
@ -0,0 +1 @@
|
|||
function detect(){return Binary.compare("'OBC Copyright MDO'")&&(sName="Compiled DEV7 object",bDetected=!0),result()}init("source","OBC")
|
||||
|
|
@ -1 +0,0 @@
|
|||
function detect(){return bDetected=!!Binary.compare("'OBC Copyright MDO'")&&(sVersion="Compiled DEV7 object",!0),result()}init("source","OBC")
|
||||
1
dbs_min/db/Binary/text.XCS.1.sg
Normal file
1
dbs_min/db/Binary/text.XCS.1.sg
Normal file
|
|
@ -0,0 +1 @@
|
|||
function detect(){return Binary.compare("58 43 53")&&(sName="XPAT Compiled Script",bDetected=!0),result()}init("source","XCS")
|
||||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("'BIKi'")&&(sVersion="Bink Video",bDetected=!0),result()}init("format","BIK")
|
||||
function detect(){return Binary.compare("'BIKi'")&&(sName="Bink Video",bDetected=!0),result()}init("format","BIK")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....be....8bc82e300446ffc0e2")||Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....be....8bcb2e300446fec0e2")?(sVersion="0.10",bDetected=!0):Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....8bcbbe....2e3004fec046e2")&&(sVersion="0.1x",bDetected=!0),result()}init("protector","Comlock by Trouble Makers")
|
||||
function detect(){return Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....be....8bc82e300446ffc0e2")||Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....be....8bcb2e300446fec0e2")?(sVersion="0.10",bDetected=!0):Binary.compare("e9$$$$eb$$bb....be....81c6....03f3bf....b9....f3a42e8a87....8bcbbe....2e3004fec046e2")&&(sVersion="0.1X",bDetected=!0),result()}init("protector","Comlock by Trouble Makers")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("'EXOM'fabd....ffe5")&&(sVersion="0.0x",sOptions="by Abdelaziz BELBACHiR",bDetected=!0),result()}init("protector","ExOM")
|
||||
function detect(){return Binary.compare("'EXOM'fabd....ffe5")&&(sVersion="0.0X",sOptions="by Abdelaziz BELBACHiR",bDetected=!0),result()}init("protector","ExOM")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.12, 1.20",bDetected=!0):Binary.compare("B8....BA....3bc473..8bc42d....9025....8bf8b9....90be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.15",bDetected=!0):Binary.compare("50B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.50",bDetected=!0):Binary.compare("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..8ec353b9....33ff57be....fcf3a5cb")?(sVersion="1.00, 1.03",sOptions="exe2com",bDetected=!0):Binary.compare("ba....a1....2d....8ccb81c3....3bc377..05....3bc377..b4..ba....cd21cd20")?(sVersion="1.00c",bDetected=!0):Binary.compare("ba....b8....05....3b06....73..2d....fa8ed0fb2d....8ec050b9....33ff57be....fcf3a5cb")?(sVersion="1.1x",bDetected=!0):Binary.compare("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1")&&(sVersion="1.12, 1.15, 1.20",bDetected=!0),result()}init("packer","PKLITE")
|
||||
function detect(){return Binary.compare("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.12, 1.20",bDetected=!0):Binary.compare("B8....BA....3bc473..8bc42d....9025....8bf8b9....90be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.15",bDetected=!0):Binary.compare("50B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.50",bDetected=!0):Binary.compare("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..8ec353b9....33ff57be....fcf3a5cb")?(sVersion="1.00, 1.03",sOptions="exe2com",bDetected=!0):Binary.compare("ba....a1....2d....8ccb81c3....3bc377..05....3bc377..b4..ba....cd21cd20")?(sVersion="1.00c",bDetected=!0):Binary.compare("ba....b8....05....3b06....73..2d....fa8ed0fb2d....8ec050b9....33ff57be....fcf3a5cb")?(sVersion="1.1X",bDetected=!0):Binary.compare("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1")&&(sVersion="1.12, 1.15, 1.20",bDetected=!0),result()}init("packer","PKLITE")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("b1..32ff82c7..b2..b5..b3..81c2....d0c203d133d1f7d232d13097")?(sVersion="1.03",bDetected=!0):Binary.compare("....82........81......32..80....2b..81")||Binary.compare("....80........81......30..80....30..80")||Binary.compare("32ed80c5..b2..b6..29ff81cf....32c980")||Binary.compare("29ff81f7....33d281f2....31c981c9....f81015a64975..fa53f889ea8944")||Binary.compare("2aed80cd..28c982c1..2ad282ca..bb....81c2....f7da03d102d128174383")||Binary.compare("28ed82cd..2aff82cf..32db80f3..b1..33c081c0....05....d0c033c1f7d002c1f83187")?(sVersion="1.04",bDetected=!0):Binary.compare("30c982f1..29d281ca....be....32ed82f5..81c2....d0c2f7da33d1")||Binary.compare("32ff82c7..b3..30ed80c5..b1..f88197........4343e2")?(sVersion="1.03",bDetected=!0):Binary.compare("f5bb....b8....bf....2e8037..81ff....4374..4875..90b5..1f9b")?(sVersion="1.20",bDetected=!0):Binary.compare("33d281f2....2bdb81f3....b9....3197....83c3..497f..2a142cca3aca")?(sVersion="1.04",bDetected=!0):Binary.compare("2bc981c1....29d281f2....33db81c3....81c2....291783c3..497f..ab")||Binary.compare("b9....2bdb81cb....f880b7......434975..55fc532245..ef57f9")?(sVersion="1.03",bDetected=!0):(Binary.compare("bf....8bf7b9....b4..8a0532c480c4..aae2")||Binary.compare("b9....be....8bfeadd1c034..86c42ae003c7abe2")||Binary.compare("fc50be....bf....57b9....f3a4c3")||Binary.compare("eb$$fcbe....bf....57b9....f3a4bf....be....b9....c3"))&&(sVersion="1.0x",sOptions="mutated COM like RSCC",bDetected=!0),result()}init("protector","RSCC")
|
||||
function detect(){return Binary.compare("b1..32ff82c7..b2..b5..b3..81c2....d0c203d133d1f7d232d13097")?(sVersion="1.03",bDetected=!0):Binary.compare("....82........81......32..80....2b..81")||Binary.compare("....80........81......30..80....30..80")||Binary.compare("32ed80c5..b2..b6..29ff81cf....32c980")||Binary.compare("29ff81f7....33d281f2....31c981c9....f81015a64975..fa53f889ea8944")||Binary.compare("2aed80cd..28c982c1..2ad282ca..bb....81c2....f7da03d102d128174383")||Binary.compare("28ed82cd..2aff82cf..32db80f3..b1..33c081c0....05....d0c033c1f7d002c1f83187")?(sVersion="1.04",bDetected=!0):Binary.compare("30c982f1..29d281ca....be....32ed82f5..81c2....d0c2f7da33d1")||Binary.compare("32ff82c7..b3..30ed80c5..b1..f88197........4343e2")?(sVersion="1.03",bDetected=!0):Binary.compare("f5bb....b8....bf....2e8037..81ff....4374..4875..90b5..1f9b")?(sVersion="1.20",bDetected=!0):Binary.compare("33d281f2....2bdb81f3....b9....3197....83c3..497f..2a142cca3aca")?(sVersion="1.04",bDetected=!0):Binary.compare("2bc981c1....29d281f2....33db81c3....81c2....291783c3..497f..ab")||Binary.compare("b9....2bdb81cb....f880b7......434975..55fc532245..ef57f9")?(sVersion="1.03",bDetected=!0):(Binary.compare("bf....8bf7b9....b4..8a0532c480c4..aae2")||Binary.compare("b9....be....8bfeadd1c034..86c42ae003c7abe2")||Binary.compare("fc50be....bf....57b9....f3a4c3")||Binary.compare("eb$$fcbe....bf....57b9....f3a4bf....be....b9....c3"))&&(sVersion="1.0X",sOptions="mutated COM like RSCC",bDetected=!0),result()}init("protector","RSCC")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("e9$$$$545b3bdc75..eb$$9c5b81cb....539d9c5825....75..e8")?(sVersion="1.7x",sOptions="by MANtiC0RE",bDetected=!0):Binary.compare("e9$$$$545b3bdc75..eb$$9c5b81cb....539d9c5825....74..50584c4c5b33c3")?(sVersion="1.78",sOptions="by MANtiC0RE",bDetected=!0):Binary.compare("e9$$$$ac2d....04..89c5e8....f514..f9362633f6")?(sVersion="1.79",sOptions="by MANtiC0RE",bDetected=!0):Binary.compare("e9$$$$e9$$$$e4..e8....e4..e9$$$$26fb78")?(sVersion="1.7",sOptions="by MANtiC0RE",bDetected=!0):(Binary.compare("b8....bd....2e8a76..80f6..80ee..2e8876..83c5..4874..eb")||Binary.compare("be....31d281c2....2e8034..83ee..83c2..74..31c005....50c3"))&&(sVersion="1.80",sOptions="by MANtiC0RE",bDetected=!0),result()}init("cryptor","Shadow Com Cryptor (SDW)")
|
||||
function detect(){return Binary.compare("e9$$$$545b3bdc75..eb$$9c5b81cb....539d9c5825....75..e8")?(sVersion="1.7X",sOptions="by MANtiC0RE",bDetected=!0):Binary.compare("e9$$$$545b3bdc75..eb$$9c5b81cb....539d9c5825....74..50584c4c5b33c3")?(sVersion="1.78",sOptions="by MANtiC0RE",bDetected=!0):Binary.compare("e9$$$$ac2d....04..89c5e8....f514..f9362633f6")?(sVersion="1.79",sOptions="by MANtiC0RE",bDetected=!0):Binary.compare("e9$$$$e9$$$$e4..e8....e4..e9$$$$26fb78")?(sVersion="1.7",sOptions="by MANtiC0RE",bDetected=!0):(Binary.compare("b8....bd....2e8a76..80f6..80ee..2e8876..83c5..4874..eb")||Binary.compare("be....31d281c2....2e8034..83ee..83c2..74..31c005....50c3"))&&(sVersion="1.80",sOptions="by MANtiC0RE",bDetected=!0),result()}init("cryptor","Shadow Com Cryptor (SDW)")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return Binary.compare("'MMX'e8$$$$83c5..8306......b8....5050ffe0")?(sVersion="0.xx",bDetected=!0):Binary.compare("'MMX'668136............eb$$668136............eb")?(sVersion="0.99i, 0.99h",bDetected=!0):Binary.compare("'MMX'b409ba....cd21e8$$$$1e6a..1f8136........8136........8b1e....a1....501f813f....75")?bDetected=!0:Binary.compare("'MMX'b8....ba....87ecbc....eb$$50b409cd2187e533edeb$$4f030de8")?(sName="XcomOR/486 by madmax",bDetected=!0):Binary.compare("'MMX'b8....ba....87ecbc....eb$$50b409cd2187e533ede8$$$$1e6a..1f")?(sVersion="0.99f",bDetected=!0):Binary.compare("e8$$$$8006......b4..5050c3bf....57bb....8b4d..81")?(sVersion="0.99a",bDetected=!0):Binary.compare("'MMX'eb$$4feb$$8b0dba....83c2..90eb")&&(bDetected=!0),result()}init("protector","XcomOR by madmax")
|
||||
function detect(){return Binary.compare("'MMX'e8$$$$83c5..8306......b8....5050ffe0")?(sVersion="0.XX",bDetected=!0):Binary.compare("'MMX'668136............eb$$668136............eb")?(sVersion="0.99i, 0.99h",bDetected=!0):Binary.compare("'MMX'b409ba....cd21e8$$$$1e6a..1f8136........8136........8b1e....a1....501f813f....75")?bDetected=!0:Binary.compare("'MMX'b8....ba....87ecbc....eb$$50b409cd2187e533edeb$$4f030de8")?(sName="XcomOR/486 by madmax",bDetected=!0):Binary.compare("'MMX'b8....ba....87ecbc....eb$$50b409cd2187e533ede8$$$$1e6a..1f")?(sVersion="0.99f",bDetected=!0):Binary.compare("e8$$$$8006......b4..5050c3bf....57bb....8b4d..81")?(sVersion="0.99a",bDetected=!0):Binary.compare("'MMX'eb$$4feb$$8b0dba....83c2..90eb")&&(bDetected=!0),result()}init("protector","XcomOR by madmax")
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -1 +1 @@
|
|||
function detect(){return MSDOS.compareEP("bd....85ed75..8cdd2e8c1e....8b1e....2bdd81fb....76..8d9e....8cc02bd8b4..cd21bb....8ec5")?(sVersion="3.40",sOptions="1988",bDetected=!0):MSDOS.compareEP("bd....85ed75..b8....e9....2e8c1e....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc2")?(sVersion="3.40b",sOptions="1986",bDetected=!0):MSDOS.compareEP("bd....85ed75..8cdd8b1e....2bdd81fb....76..8d9e....8cc02bd8b4..cd21bb....8ec5268c1e....b1..d3e3")||MSDOS.compareEP("bd....85ed75..b8....50e8....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")||MSDOS.compareEP("bd....85ed75..b8....509a........8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")||MSDOS.compareEP("bd....85ed75..b0..e9....2e8c1e....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")?(sVersion="5.2a",sOptions="1992",bDetected=!0):(MSDOS.compareEP("b8....8ed82e80........ba....75..e8....3d....75..e9$$$$8cc38edb2e891e....be....8a0c80f9..74..80f9..7e")||MSDOS.compareEP("eb$$3d....74..eb$$2ec606......502e891e....2e890e....2e8916....8cd82ea3....8cc02ea3....2e8936"))&&(sVersion="3.20x",bDetected=!0),result()}init("compiler","Aztec C-86")
|
||||
function detect(){return MSDOS.compareEP("bd....85ed75..8cdd2e8c1e....8b1e....2bdd81fb....76..8d9e....8cc02bd8b4..cd21bb....8ec5")?(sVersion="3.40",sOptions="1988",bDetected=!0):MSDOS.compareEP("bd....85ed75..b8....e9....2e8c1e....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc2")?(sVersion="3.40b",sOptions="1986",bDetected=!0):MSDOS.compareEP("bd....85ed75..8cdd8b1e....2bdd81fb....76..8d9e....8cc02bd8b4..cd21bb....8ec5268c1e....b1..d3e3")||MSDOS.compareEP("bd....85ed75..b8....50e8....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")||MSDOS.compareEP("bd....85ed75..b8....509a........8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")||MSDOS.compareEP("bd....85ed75..b0..e9....2e8c1e....8ec5268c1e....bd....83c5..d1ddb1..d3ed81e5....8cc203ea268b1e....d3eb")?(sVersion="5.2a",sOptions="1992",bDetected=!0):(MSDOS.compareEP("b8....8ed82e80........ba....75..e8....3d....75..e9$$$$8cc38edb2e891e....be....8a0c80f9..74..80f9..7e")||MSDOS.compareEP("eb$$3d....74..eb$$2ec606......502e891e....2e890e....2e8916....8cd82ea3....8cc02ea3....2e8936"))&&(sVersion="3.20X",bDetected=!0),result()}init("compiler","Aztec C-86")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return MSDOS.compareEP("fa161f26a1....83e8..8ed0fb061607be....8bfeb9....f3a407368c......8bd88cca3603......368b......fd8bc53d....76")?(sVersion="3.1x-3.4x",bDetected=!0):MSDOS.compareEP("eb$$8be88cc60e1f8cc005....0106....b8....cd213c..73..b8....cd21803e......74..8cc005....0306....268b16....3bc273..8ec0a1....33ff")&&(sVersion="2.64, 3.25",bDetected=!0),result()}init("extender","CauseWay DOS Extender")
|
||||
function detect(){return MSDOS.compareEP("fa161f26a1....83e8..8ed0fb061607be....8bfeb9....f3a407368c......8bd88cca3603......368b......fd8bc53d....76")?(sVersion="3.1X-3.4X",bDetected=!0):MSDOS.compareEP("eb$$8be88cc60e1f8cc005....0106....b8....cd213c..73..b8....cd21803e......74..8cc005....0306....268b16....3bc273..8ec0a1....33ff")&&(sVersion="2.64, 3.25",bDetected=!0),result()}init("extender","CauseWay DOS Extender")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return MSDOS.compareEP("068CC88EC0BE....26....34..26....4681......75..40B3..B3..F3")?(sVersion="1.0",bDetected=!0):MSDOS.compareEP("ba....bf....eb$$e8$$$$53bb....eb$$eb$$5beb$$0633c08ec0b8....26a3....268c0e....075052faba....b0..ee")&&(sVersion="1.0x",sOptions="by ST!LLS0N",bDetected=!0),result()}init("protector","EXELock666")
|
||||
function detect(){return MSDOS.compareEP("068CC88EC0BE....26....34..26....4681......75..40B3..B3..F3")?(sVersion="1.0",bDetected=!0):MSDOS.compareEP("ba....bf....eb$$e8$$$$53bb....eb$$eb$$5beb$$0633c08ec0b8....26a3....268c0e....075052faba....b0..ee")&&(sVersion="1.0X",sOptions="by ST!LLS0N",bDetected=!0),result()}init("protector","EXELock666")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return MSDOS.compareEP("b430cd213c..73..33c00650cbbf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f")?(sName+=" Quick C",sVersion="2.5x",sOptions="1990",bDetected=!0):MSDOS.compareEP("fc8cc02ea3....8ed8a1....2ea3....2ea3....be....ac32e403f0c6....b8....8ec02680........75")?(sName+=" Quick C",sVersion="2.51a",sOptions="1990",bDetected=!0):MSDOS.compareEP("b430cd213c..73..b8....50e8....92b409cd21cd20bf")||MSDOS.compareEP("b430cd213c..73..b8....50900ee8....92b409cd21cd20bf")||MSDOS.compareEP("b430cd213c..73..b8....509a........92b409cd21cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..33c050")?(sName+=" C/C++",sVersion="1986",bDetected=!0):MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf776..8bc405....d1d8b1..d3e83bf072..8bf0fa8ed781c4....fb73")?(sName+=" Quick C",sVersion="1987-89",bDetected=!0):MSDOS.compareEP("bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..e9....81e4....3689......3689......8bc6b1")?(sName+=" C/C++",sVersion="1985",bDetected=!0):MSDOS.compareEP("fab8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec")?(sName+=" C/C++",sVersion="1.04",bDetected=!0):MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73")&&(sName+=" Quick C",MSDOS.compareEP("81",54)?(sVersion="1.0",sOptions="1987"):MSDOS.compareEP("83",54)?(sVersion="2.00",sOptions="1989"):MSDOS.compareEP("8b",54)&&(sVersion="2.X",sOptions="1989"),bDetected=!0),result()}init("compiler","Microsoft")
|
||||
function detect(){return MSDOS.compareEP("b430cd213c..73..33c00650cbbf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..161f")?(sName+=" Quick C",sVersion="2.5X",sOptions="1990",bDetected=!0):MSDOS.compareEP("fc8cc02ea3....8ed8a1....2ea3....2ea3....be....ac32e403f0c6....b8....8ec02680........75")?(sName+=" Quick C",sVersion="2.51a",sOptions="1990",bDetected=!0):MSDOS.compareEP("b430cd213c..73..b8....50e8....92b409cd21cd20bf")||MSDOS.compareEP("b430cd213c..73..b8....50900ee8....92b409cd21cd20bf")||MSDOS.compareEP("b430cd213c..73..b8....509a........92b409cd21cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..33c050")?(sName+=" C/C++",sVersion="1986",bDetected=!0):MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf776..8bc405....d1d8b1..d3e83bf072..8bf0fa8ed781c4....fb73")?(sName+=" Quick C",sVersion="1987-89",bDetected=!0):MSDOS.compareEP("bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73..e9....81e4....3689......3689......8bc6b1")?(sName+=" C/C++",sVersion="1985",bDetected=!0):MSDOS.compareEP("fab8....8ed88ed0268b1e....2bd8f7c3....75..b1..d3e3eb..bb....8be3fb891e....b8....a3....0633c0508bec")?(sName+=" C/C++",sVersion="1.04",bDetected=!0):MSDOS.compareEP("b430cd213c..73..cd20bf....8b36....2bf781fe....72..be....fa8ed781c4....fb73")&&(sName+=" Quick C",MSDOS.compareEP("81",54)?(sVersion="1.0",sOptions="1987"):MSDOS.compareEP("83",54)?(sVersion="2.00",sOptions="1989"):MSDOS.compareEP("8b",54)&&(sVersion="2.X",sOptions="1989"),bDetected=!0),result()}init("compiler","Microsoft")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return MSDOS.compareEP("b8....fcfdb9....be....f82e180cf5fcfc74..fccc")?(sVersion="3.05 PRO",sOptions="1994/97 by Ceklic Blagoje //COMSEC",bDetected=!0):MSDOS.compareEP("2bdb81cb....f8fdbf....2bd281ca....f52e291dfcf7d3fdfccc")?(sVersion="3.05",sOptions="1994/97 by Ceklic Blagoje //COMSEC",bDetected=!0):(MSDOS.compareEP("bb....f5b9....fcfdbe....fdfc2e190cfcfdf8f7d9d1d9f8f8")||MSDOS.compareEP("be....fcb9....fdf5f5ba....fc2e102cf8d1d1d1c9f7d9")||MSDOS.compareEP("33db81c3....f8fdbe....f8f5fcba....f52e111cfcfd72"))&&(sVersion="3.xx",sOptions="by Ceklic Blagoje //COMSEC",bDetected=!0),result()}init("protector","PC-Guard")
|
||||
function detect(){return MSDOS.compareEP("b8....fcfdb9....be....f82e180cf5fcfc74..fccc")?(sVersion="3.05 PRO",sOptions="1994/97 by Ceklic Blagoje //COMSEC",bDetected=!0):MSDOS.compareEP("2bdb81cb....f8fdbf....2bd281ca....f52e291dfcf7d3fdfccc")?(sVersion="3.05",sOptions="1994/97 by Ceklic Blagoje //COMSEC",bDetected=!0):(MSDOS.compareEP("bb....f5b9....fcfdbe....fdfc2e190cfcfdf8f7d9d1d9f8f8")||MSDOS.compareEP("be....fcb9....fdf5f5ba....fc2e102cf8d1d1d1c9f7d9")||MSDOS.compareEP("33db81c3....f8fdbe....f8f5fcba....f52e111cfcfd72"))&&(sVersion="3.XX",sOptions="by Ceklic Blagoje //COMSEC",bDetected=!0),result()}init("protector","PC-Guard")
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
function detect(){var e
|
||||
return MSDOS.compare("'PKLITE'",30)||MSDOS.compare("'PKlite'",30)?(e=MSDOS.readByte(29),sVersion=(7&e)+"."+("0"+MSDOS.readByte(28)).slice(-2),8&e&&(sOptions="Extra compression"),16&e&&(sOptions=sOptions.append("Multi-segment file")),bDetected=!0):MSDOS.compareEP("1FB409BA....CD21B8....CD21")?(sVersion="1.50",sOptions="CRC check",bDetected=!0):MSDOS.compareEP("50B8....BA....05....3B060200")?(sVersion="1.50",bDetected=!0):MSDOS.compareEP("B8....BA....05....3B060200")?(sVersion="1.12-1.13",bDetected=!0):MSDOS.compareEP("b8....ba....05....2d....fa8ed0fb2d....8ec050b9....33ff57be....fc565706518cc88ec0")?(sVersion="1.12",sOptions="extra compression",bDetected=!0):MSDOS.compareEP("ba....b8....05....3B06....73..2d....fa8ed0fb2d....8ec050b9....33ff57be....fcf3a5cb")||MSDOS.compareEP("b8....05....3B06....72..cd20b9....2d....8ed02d....8ec006ba....be....33ff571e571feb")?(sVersion="1.1x",bDetected=!0):MSDOS.compareEP("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.12, 1.20",bDetected=!0):MSDOS.compareEP("50532b06....0a06....8b1e....5b58b8....ba....8cdb03d83b1e....73..83eb..fa8ed3bc....fb")?(sVersion="1.05",bDetected=!0):MSDOS.compareEP("8cd805....ba....903b06....72..b409ba....cd21cd20")?(sVersion="1.15",bDetected=!0):MSDOS.compareEP("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..8ec353b9....33ff57be....fcf3a5cb")?(sVersion="1.03-1.05",bDetected=!0):MSDOS.compareEP("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..908ec353b9....33ff57be....90fcf3a5cb")?(sVersion="1.03",sOptions="type 2",bDetected=!0):MSDOS.compareEP("2e8c1e....8b1e....8cda81c2....3bda72..81eb....83eb..fa8ed3bc....fbfdbe....8bfe8ccab9....03d1")?(sVersion="1.00c",bDetected=!0):MSDOS.compareEP("b8....ba....3b06....73..2d....8ed02d....518ec050b9....33ff57be....fcf3a5")&&(sName+=" [hacked] by Shay Lev Ary",bDetected=!0),result()}init("packer","PKLITE")
|
||||
return MSDOS.compare("'PKLITE'",30)||MSDOS.compare("'PKlite'",30)?(e=MSDOS.readByte(29),sVersion=(7&e)+"."+("0"+MSDOS.readByte(28)).slice(-2),8&e&&(sOptions="Extra compression"),16&e&&(sOptions=sOptions.append("Multi-segment file")),bDetected=!0):MSDOS.compareEP("1FB409BA....CD21B8....CD21")?(sVersion="1.50",sOptions="CRC check",bDetected=!0):MSDOS.compareEP("50B8....BA....05....3B060200")?(sVersion="1.50",bDetected=!0):MSDOS.compareEP("B8....BA....05....3B060200")?(sVersion="1.12-1.13",bDetected=!0):MSDOS.compareEP("b8....ba....05....2d....fa8ed0fb2d....8ec050b9....33ff57be....fc565706518cc88ec0")?(sVersion="1.12",sOptions="extra compression",bDetected=!0):MSDOS.compareEP("ba....b8....05....3B06....73..2d....fa8ed0fb2d....8ec050b9....33ff57be....fcf3a5cb")||MSDOS.compareEP("b8....05....3B06....72..cd20b9....2d....8ed02d....8ec006ba....be....33ff571e571feb")?(sVersion="1.1X",bDetected=!0):MSDOS.compareEP("B8....BA....3bc473..8bc42d....25....8bf8b9....be....fcf3a58bd8b1..d3eb8cd903d95333db53cb")?(sVersion="1.12, 1.20",bDetected=!0):MSDOS.compareEP("50532b06....0a06....8b1e....5b58b8....ba....8cdb03d83b1e....73..83eb..fa8ed3bc....fb")?(sVersion="1.05",bDetected=!0):MSDOS.compareEP("8cd805....ba....903b06....72..b409ba....cd21cd20")?(sVersion="1.15",bDetected=!0):MSDOS.compareEP("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..8ec353b9....33ff57be....fcf3a5cb")?(sVersion="1.03-1.05",bDetected=!0):MSDOS.compareEP("B8....BA....8cdb03d83b1e....73..83eb..fa8ed3bc....fb83eb..908ec353b9....33ff57be....90fcf3a5cb")?(sVersion="1.03",sOptions="type 2",bDetected=!0):MSDOS.compareEP("2e8c1e....8b1e....8cda81c2....3bda72..81eb....83eb..fa8ed3bc....fbfdbe....8bfe8ccab9....03d1")?(sVersion="1.00c",bDetected=!0):MSDOS.compareEP("b8....ba....3b06....73..2d....8ed02d....518ec050b9....33ff57be....fcf3a5")&&(sName+=" [hacked] by Shay Lev Ary",bDetected=!0),result()}init("packer","PKLITE")
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
function detect(){var e
|
||||
return MSDOS.compareEP("3670..b8....81c0....bb....43e8....5f83c7..0e570656cbbe....eb")?(sVersion="0.9x",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0):MSDOS.compareEP("68....c3")?(e=MSDOS.readWord(MSDOS.getEntryPointOffset()+1)-32,MSDOS.compare("bf....e2..a541b9....2e31154747e2",e)?(sVersion="0.95",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0):MSDOS.compare("b9....39fe2e31154747eb",e)&&(sVersion="0.95 freeware",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0)):MSDOS.compareEP("4e46555dbb....70..b8....81c0....4c44cd213efc268b2e....8ec5")||MSDOS.compareEP("b8....40bb....4be8$$$$be....eb$$5f83c7..0e570656cb")?(sVersion="0.94",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0):MSDOS.compareEP("424a5159bb....4bb8....404a42cd2190fc")&&(sVersion="0.96",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0),result()}init("protector","UnPackStop")
|
||||
return MSDOS.compareEP("3670..b8....81c0....bb....43e8....5f83c7..0e570656cbbe....eb")?(sVersion="0.9X",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0):MSDOS.compareEP("68....c3")?(e=MSDOS.readWord(MSDOS.getEntryPointOffset()+1)-32,MSDOS.compare("bf....e2..a541b9....2e31154747e2",e)?(sVersion="0.95",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0):MSDOS.compare("b9....39fe2e31154747eb",e)&&(sVersion="0.95 freeware",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0)):MSDOS.compareEP("4e46555dbb....70..b8....81c0....4c44cd213efc268b2e....8ec5")||MSDOS.compareEP("b8....40bb....4be8$$$$be....eb$$5f83c7..0e570656cb")?(sVersion="0.94",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0):MSDOS.compareEP("424a5159bb....4bb8....404a42cd2190fc")&&(sVersion="0.96",sOptions="by Szaszi (Szabo Laszlo)",bDetected=!0),result()}init("protector","UnPackStop")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return MSDOS.compareEP("8becfac746......4c4cc3fbbf....b8....2e3105d1c84f")?(sVersion="4.01x",sOptions="by Christian Schwarz",bDetected=!0):MSDOS.compareEP("bf....b8....2e3105d1c84f81ff....73..b7..df53..961e")&&(sVersion="4.017",sOptions="by Christian Schwarz",bDetected=!0),result()}init("protector","iLUCRYPT")
|
||||
function detect(){return MSDOS.compareEP("8becfac746......4c4cc3fbbf....b8....2e3105d1c84f")?(sVersion="4.01X",sOptions="by Christian Schwarz",bDetected=!0):MSDOS.compareEP("bf....b8....2e3105d1c84f81ff....73..b7..df53..961e")&&(sVersion="4.017",sOptions="by Christian Schwarz",bDetected=!0),result()}init("protector","iLUCRYPT")
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
function detect(){var e,t
|
||||
return PE.compareOverlay("';!@Install@!UTF-8!'")?(sType="installer",(e=(t=PE.getManifest()).match(/(\n?)version="(.*?)"/))?(sVersion=e[2],e[1]&&(sOptions="new")):(e=t.match(/Archive v(\d.*?)<\/desc/))&&(sVersion=e[1]),bDetected=!0):PE.compareOverlay("'7z'BCAF271C")?bDetected=!0:PE.compareOverlay("efbbbf';!@Install@!UTF-8!'")&&(sType="installer",bDetected=!0),bDetected&&("7z.sfx"!=PE.getVersionStringInfo("InternalName")&&"7zS2.sfx"!=PE.getVersionStringInfo("InternalName")||""==(sVersion=PE.getVersionStringInfo("FileVersion"))&&(sVersion=PE.getFileVersion().replace(/\.0\.0$/,"")),""==sVersion)&&PE.section[".rdata"]&&-1!=(t=PE.findString(PE.section[".rdata"].FileOffset,PE.section[".rdata"].FileSize,"7-Zip version:"))&&(sVersion=PE.getString(t+16,4)),result()}init("sfx","7-Zip")
|
||||
return PE.compareOverlay("';!@Install@!UTF-8!'")?(sType="installer",(e=(t=PE.getManifest()).match(/(\n?)version="(.*?)"/))?(sVersion=e[2],e[1]&&(sOptions="new")):(e=t.match(/Archive v(\d.*?)<\/desc/))&&(sVersion=e[1]),bDetected=!0):PE.compareOverlay("'7z'BCAF271C")?bDetected=!0:PE.compareOverlay("efbbbf';!@Install@!UTF-8!'")&&(sType="installer",bDetected=!0),bDetected&&!(sVersion="7z.sfx"!=PE.getVersionStringInfo("InternalName")&&"7zS2.sfx"!=PE.getVersionStringInfo("InternalName")?sVersion:(sVersion=PE.getVersionStringInfo("FileVersion"))||PE.getFileVersion().replace(/\.0\.0$/,""))&&PE.section[".rdata"]&&-1!=(t=PE.findString(PE.section[".rdata"].FileOffset,PE.section[".rdata"].FileSize,"7-Zip version:"))&&(sVersion=PE.getString(t+16,4)),result()}init("sfx","7-Zip")
|
||||
|
|
|
|||
1
dbs_min/db/PE/AMD_PowerXpress.4.sg
Normal file
1
dbs_min/db/PE/AMD_PowerXpress.4.sg
Normal file
|
|
@ -0,0 +1 @@
|
|||
function detect(){return PE.isExportFunctionPresent("AmdPowerXpressRequestHighPerformance")?bDetected=!0:PE.isExportFunctionPresent("NoAmdPwrXpressRequestHighPerformance")&&(sOptions="Disabled",bDetected=!0),result()}init("library","AMD PowerXpress")
|
||||
|
|
@ -1 +0,0 @@
|
|||
function detect(){return PE.isExportFunctionPresent("AmdPowerXpressRequestHighPerformance")&&(bDetected=!0),result()}init("library","AMD PowerXpress")
|
||||
|
|
@ -14,5 +14,5 @@ else if(PE.compare("60E802000000EB095D55",e))sVersion="2.11d"
|
|||
else if(PE.compare("60E803000000E9EB045D4555C3E801",e))sVersion="2.12-2.42"
|
||||
else if(PE.compare("9060E8$$$$$$$$5D4555C3",e))sVersion="2.12b"
|
||||
else{if(!PE.compare("60e8$$$$$$$$8b2c2481ed........c3",e)&&!PE.compare("9060e8$$$$$$$$8b2c2481ed........c3",e))return 0
|
||||
sVersion="2.1X-2.39"}return 1}function detect(){var e=PE.nEP
|
||||
sVersion="2.1X-2.39"}return 1}function detect(){var e=PE.getEntryPointOffset()
|
||||
return-1!=e&&(getASPackVersion(e)?bDetected=!0:(PE.compareEP("7500E9")?(e+=3,bDetected=!0):PE.compareEP("907500E9")?(e+=4,bDetected=!0):PE.compareEP("90907500E9")||PE.compareEP("90750190E9")||PE.compareEP("907501FFE9")?(e+=5,bDetected=!0):PE.compareEP("9090907500E9")||PE.compareEP("9090750190E9")?(e+=6,bDetected=!0):PE.compareEP("909090750190E9")&&(e+=7,bDetected=!0),bDetected&&(e=PE.RVAToOffset(PE.OffsetToRVA(e)+4+~~PE.readDword(e)),bDetected=getASPackVersion(e)))),bDetected||PE.section[".aspack"]&&PE.section[".adata"]&&(bDetected=!0,sVersion="2.12-2.XX"),result()}init("packer","ASPack")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&PE.isSignatureInSectionPresent(0,"20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. ..")&&PE.isSignatureInSectionPresent(0,"20 .. .. .. .. FE 0C .. .. 3F .. .. 00 00 20 .. .. .. .. FE 0C .. .. 3D .. .. 00 00")&&(bDetected=!0),result()}init("protector","ArmDot")
|
||||
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. .. 8D .. .. .. .. FE 0E .. .. 20 .. .. .. ..")&&PE.isSignatureInSectionPresent(0,"20 .. .. .. .. FE 0C .. .. 3F .. .. 00 00 20 .. .. .. .. FE 0C .. .. 3D .. .. 00 00")&&(bDetected=!0),result()}init("protector","ArmDot")
|
||||
|
|
|
|||
|
|
@ -7,4 +7,4 @@ else if(PE.compareEP("60E8........5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5
|
|||
else if(PE.compareEP("60E8........5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB"))sVersion="3.00a-3.70a",bDetected=!0
|
||||
else if(83==PE.getMajorLinkerVersion()&&82==PE.getMinorLinkerVersion()){for(var E=0;E<=PE.nLastSection;E++){var e=PE.section[E].FileOffset
|
||||
if(PE.compare("'PDATA000'",e)){sVersion="6.X-9.X"
|
||||
break}}""==sVersion&&7<PE.section.length&&(sVersion="6.X-9.X"),bDetected=!0}return result()}init("protector","Armadillo")
|
||||
break}}sVersion||7<PE.section.length&&(sVersion="6.X-9.X"),bDetected=!0}return result()}init("protector","Armadillo")
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
function detect(){if(PE.is64()&&!PE.isNET())if(PE.compareEP("40 50 40 51 40 52 40 53 55 56 57 9C 48 83 EC 38 FC B8 01 00 00 00 B9 FF FF 00 00 E0 FE"))bDetected=!0,sVersion="GuardIT ~2013"
|
||||
function detect(){if(PE.is64()&&!PE.isNet())if(PE.compareEP("40 50 40 51 40 52 40 53 55 56 57 9C 48 83 EC 38 FC B8 01 00 00 00 B9 FF FF 00 00 E0 FE"))bDetected=!0,sVersion="GuardIT ~2013"
|
||||
else{var e=skipJumpsAndNops(PE.getEntryPointOffset()),e=PE.compare("48 83 EC 28 E8",e)?PE.OffsetToRVA(e)+PE.readSDword(e+5)+9:PE.OffsetToRVA(e)
|
||||
if(-1!=e){for(var s=PE.OffsetToVA(PE.RVAToOffset(e)),t=0,r=0;r<32&&0===PE.getDisasmString(s).indexOf("PUSH");r++)t++,s=PE.getDisasmNextAddress(s)
|
||||
if(3<t&&0===PE.getDisasmString(s).indexOf("LEA RSP,")){for(var s=PE.getDisasmNextAddress(s),E=0,r=0;r<32&&0===PE.getDisasmString(s).indexOf("MOVUPD");r++)E++,s=PE.getDisasmNextAddress(s)
|
||||
0<E&&"PUSH 0X10"===PE.getDisasmString(s)&&"TEST RSP, 0XF"===PE.getDisasmString(PE.getDisasmNextAddress(s))&&(bDetected=!0,sVersion="GuardIT ",sVersion+=t<14||E<16?"12.0+":"2014-2021")}}}return result()}function skipJumpsAndNops(e){for(var s=PE.OffsetToRVA(e);;){var t=PE.readByte(PE.RVAToOffset(s))
|
||||
if(3<t&&0===PE.getDisasmString(s).indexOf("LEA RSP,")){for(var s=PE.getDisasmNextAddress(s),i=0,r=0;r<32&&0===PE.getDisasmString(s).indexOf("MOVUPD");r++)i++,s=PE.getDisasmNextAddress(s)
|
||||
0<i&&"PUSH 0X10"===PE.getDisasmString(s)&&"TEST RSP, 0XF"===PE.getDisasmString(PE.getDisasmNextAddress(s))&&(bDetected=!0,sVersion="GuardIT ",sVersion+=t<14||i<16?"12.0+":"2014-2021")}}}return result()}function skipJumpsAndNops(e){for(var s=PE.OffsetToRVA(e);;){var t=PE.readByte(PE.RVAToOffset(s))
|
||||
if(233===t)s+=PE.readSDword(PE.RVAToOffset(s+1))+5
|
||||
else if(235===t)s+=PE.readSByte(PE.RVAToOffset(s+1))+2
|
||||
else{if(144!==t)break
|
||||
|
|
|
|||
|
|
@ -1,2 +0,0 @@
|
|||
function detect(){var t=PE.section[0]
|
||||
return""===t.Name&&3758096416===t.Characteristics&&(bDetected=!0,"."!==PE.getImportLibraryName(0)[0])&&(sOptions="Legacy-compat-mode"),result()}init("protector","Astral-PE")
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
function detect(){var e
|
||||
return PE.compareOverlay("0b0bafaf0b0ba4")&&(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0a3........eb")&&(sVersion="8.X",bDetected=!0),PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d28ad48915........8bc8"))&&(sVersion="7.5.X",bDetected=!0),bDetected&&""!=(e=PE.getFileVersion().replace(/\.0\.0$/,""))&&(sVersion=e),result()}init("installer","AutoPlay Media Studio")
|
||||
return PE.compareOverlay("0b0bafaf0b0ba4")&&(PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0a3........eb")&&(sVersion="8.X",bDetected=!0),PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d28ad48915........8bc8"))&&(sVersion="7.5.X",bDetected=!0),bDetected&&(e=PE.getFileVersion().replace(/\.0\.0$/,""))&&(sVersion=e),result()}init("installer","AutoPlay Media Studio")
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
function detect(){if(PE.isSectionNamePresent(".avc")&&PE.compareEP("60E8000000005D81ED........8BBD........8B8D........B8")){switch(PE.readByte(PE.nEP+65)){case 250:sVersion="1.0"
|
||||
function detect(){if(PE.isSectionNamePresent(".avc")&&PE.compareEP("60E8000000005D81ED........8BBD........8B8D........B8")){switch(PE.readByte(PE.getEntryPointOffset()+65)){case 250:sVersion="1.0"
|
||||
break
|
||||
case 247:sVersion="1.02"}bDetected=!0}return result()}init("cryptor","AverCryptor")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&(PE.isNetObjectPresent("BabelAttribute")?(sVersion="3.X",bDetected=!0):PE.isNetObjectPresent("BabelObfuscatorAttribute")&&(sVersion="1.0-2.X",bDetected=!0),PE.isNetObjectPresent("BabelAttribute"))&&PE.isNetObjectPresent("BabelObfuscatorAttribute")&&(bDetected=!1),result()}init("protector","Babel .NET")
|
||||
function detect(){return PE.isNet()&&(PE.isNetObjectPresent("BabelAttribute")?(sVersion="3.X",bDetected=!0):PE.isNetObjectPresent("BabelObfuscatorAttribute")&&(sVersion="1.0-2.X",bDetected=!0),PE.isNetObjectPresent("BabelAttribute"))&&PE.isNetObjectPresent("BabelObfuscatorAttribute")&&(bDetected=!1),result()}init("protector","Babel .NET")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&PE.isNetUStringPresent("C# version only supports level 1 and 3")&&!PE.isNetObjectPresent("VMProtect")&&(bDetected=!0),result()}init("protector","ByteGuard")
|
||||
function detect(){return PE.isNet()&&PE.isNetUStringPresent("C# version only supports level 1 and 3")&&!PE.isNetObjectPresent("VMProtect")&&(bDetected=!0),result()}init("protector","ByteGuard")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()?PE.isNetObjectPresent("ObfuscatedByCliSecureAttribute")?(sVersion="4.0-5.X",bDetected=!0):(PE.isNetObjectPresent("CliSecureRd.dll")||PE.isNetObjectPresent("CliSecureRd64.dll")||PE.isSignatureInSectionPresent(0,"436c69005300650063007500720065"))&&(bDetected=!0):PE.compareEP("e9$$$$$$$$558bec81ec4c020000a1........33c58945f483")&&(sVersion="4.5",bDetected=!0),result()}init("protector","CliSecure")
|
||||
function detect(){return PE.isNet()?PE.isNetObjectPresent("ObfuscatedByCliSecureAttribute")?(sVersion="4.0-5.X",bDetected=!0):(PE.isNetObjectPresent("CliSecureRd.dll")||PE.isNetObjectPresent("CliSecureRd64.dll")||PE.isSignatureInSectionPresent(0,"436c69005300650063007500720065"))&&(bDetected=!0):PE.compareEP("e9$$$$$$$$558bec81ec4c020000a1........33c58945f483")&&(sVersion="4.5",bDetected=!0),result()}init("protector","CliSecure")
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
function detect(){if(PE.compareEP("E9........EB02833D58EB02FF1D5BEB020FC75F")){switch(PE.readDword(PE.nEP+1)){case 709:sVersion="0.14b"
|
||||
function detect(){if(PE.compareEP("E9........EB02833D58EB02FF1D5BEB020FC75F")){switch(PE.readDword(PE.getEntryPointOffset()+1)){case 709:sVersion="0.14b"
|
||||
break
|
||||
case 817:sVersion="0.15b"
|
||||
break
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.compareEP("e9$$$$$$$$e9$$$$$$$$8bff60e8$$$$$$$$5ee8")?(sVersion="1.2",bDetected=!0):PE.isNET()&&(PE.isNetObjectPresent("____KILL")?(sVersion="4.X",bDetected=!0):PE.isNetUStringPresent("E_TamperDetected")&&(sVersion="3.X-4.X",bDetected=!0)),result()}init("protector","CodeVeil")
|
||||
function detect(){return PE.compareEP("e9$$$$$$$$e9$$$$$$$$8bff60e8$$$$$$$$5ee8")?(sVersion="1.2",bDetected=!0):PE.isNet()&&(PE.isNetObjectPresent("____KILL")?(sVersion="4.X",bDetected=!0):PE.isNetUStringPresent("E_TamperDetected")&&(sVersion="3.X-4.X",bDetected=!0)),result()}init("protector","CodeVeil")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&(PE.isNetObjectPresent("CodeWallTrialVersion")||PE.isNetObjectPresent("CodeWallTrialVersion")?(sVersion="4.X",sOptions="Evaluation",bDetected=!0):PE.isSignatureInSectionPresent(0,"9161d281........11..175813..11..11..32..28........11..6f........13..7e........2d..73")&&(sVersion="4.X",bDetected=!0)),result()}init("protector","CodeWall")
|
||||
function detect(){return PE.isNet()&&(PE.isNetObjectPresent("CodeWallTrialVersion")||PE.isNetObjectPresent("CodeWallTrialVersion")?(sVersion="4.X",sOptions="Evaluation",bDetected=!0):PE.isSignatureInSectionPresent(0,"9161d281........11..175813..11..11..32..28........11..6f........13..7e........2d..73")&&(sVersion="4.X",bDetected=!0)),result()}init("protector","CodeWall")
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
function getConfuserVersion(){var e="",t=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Confuser v")
|
||||
return e=-1!=t?PE.getString(t+10):e}function detect(){var e
|
||||
return PE.isNetObjectPresent("ConfusedByAttribute")?(e=getConfuserVersion(),sVersion=""!=e?e:"1.X",bDetected=!0):PE.isNET()&&2<=PE.section.length&&-1!=(e=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"ConfuserEx v"))&&(sVersion=PE.getString(e+12,7),sName+="Ex",bDetected=!0),result()}init("protector","Confuser")
|
||||
return PE.isNetObjectPresent("ConfusedByAttribute")?(e=getConfuserVersion(),sVersion=e||"1.X",bDetected=!0):PE.isNet()&&2<=PE.section.length&&-1!=(e=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"ConfuserEx v"))&&(sVersion=PE.getString(e+12,7),sName+="Ex",bDetected=!0),result()}init("protector","Confuser")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&PE.isSignatureInSectionPresent(0,"43 72 6F 6E 6F 73 2D 43 72 79 70 74 65 72")&&(bDetected=!0),result()}init("cryptor","CronosCrypter")
|
||||
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"43 72 6F 6E 6F 73 2D 43 72 79 70 74 65 72")&&(bDetected=!0),result()}init("cryptor","CronosCrypter")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&(PE.isSignatureInSectionPresent(0,"000220....000a20ffffff0028........2a")||PE.isSignatureInSectionPresent(0,"0291203fffffff5f1f18620a067e........021758911f1062600a067e"))&&(sVersion="5.X",bDetected=!0),result()}init("protector","Crypto Obfuscator")
|
||||
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"000220....000a20ffffff0028........2a")||PE.isSignatureInSectionPresent(0,"0291203fffffff5f1f18620a067e........021758911f1062600a067e"))&&(sVersion="5.X",bDetected=!0),result()}init("protector","Crypto Obfuscator")
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
function detect(){if(PE.compareEP("9C5557565251539CFAE8........5D81ED5B5340..B0..E8........5E83C611B927......3006464975FA"))sVersion="1.53",bDetected=!0
|
||||
else if(PE.compareEP("9C6A10730BEB02C151E806......C41173F75BCD83C404EB0299EBFF0C247101E879E07A017583C4049DEB017568"))sVersion="2.10",bDetected=!0
|
||||
else if(PE.compareEP("EB$$9C5557565251539CE8........5D81ED")){switch(PE.readByte(PE.nEP+92)){case 235:sVersion="2.10"
|
||||
else if(PE.compareEP("EB$$9C5557565251539CE8........5D81ED")){switch(PE.readByte(PE.getEntryPointOffset()+92)){case 235:sVersion="2.10"
|
||||
break
|
||||
case 156:sVersion="2.33"}bDetected=!0}return result()}init("protector","DBPE")
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
function detect(){!PE.isNET()&&PE.isSectionNamePresent(".minfo")&&PE.isSectionNamePresent("._deh")&&(bDetected=!0)
|
||||
function detect(){!PE.isNet()&&PE.isSectionNamePresent(".minfo")&&PE.isSectionNamePresent("._deh")&&(bDetected=!0)
|
||||
var e=PE.section[".rdata"]
|
||||
return bDetected||e&&PE.isDeepScan()&&-1!=PE.findSignature(e.FileOffset,e.FileSize,"'core.sys.windows.dll'")&&-1!=PE.findSignature(e.FileOffset,e.FileSize,"'string.d'")&&(bDetected=!0),bDetected&&e&&(-1==(e=PE.findString(e.FileOffset,e.FileSize,"This program will continue, but will not operate when using DMD "))||-1!=(sVersion=PE.getString(e-7,5)).indexOf(".")&&1==sVersion.split(".")[0].length||(sVersion="")),sLang="D",result()}init("compiler","DMD")
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
function detect(){var e
|
||||
return PE.isNET()?(bDetected=_getNumberOfResults("protector")<=1&&(PE.isNetObjectPresent("ZYXDNGuarder")||PE.isNetObjectPresent("HVMRuntm.dll"))?!0:bDetected)||PE.isSignatureInSectionPresent(0,"'A newer version of DNGuard Runtime library is needed to run this application.'")&&(bDetected=!0):PE.is64()?(e=PE.section[".rdata"])&&PE.isSignaturePresent(e.FileOffset,e.FileSize,"'DNGuard'")&&PE.isImportPositionHashPresent(0,943924593)&&PE.compareEP("48 83 EC 28 E8 07 AD")&&(bDetected=!0,PE.section[".I:R"]||(sOptions="modified")):!PE.is64()&&PE.isImportPositionHashPresent(0,2583213454)&&(bDetected=!0,sVersion="4.9+"),result()}init("protector","DNGuard")
|
||||
return PE.isNet()?(bDetected=_getNumberOfResults("protector")<=1&&(PE.isNetObjectPresent("ZYXDNGuarder")||PE.isNetObjectPresent("HVMRuntm.dll"))?!0:bDetected)||PE.isSignatureInSectionPresent(0,"'A newer version of DNGuard Runtime library is needed to run this application.'")&&(bDetected=!0):PE.is64()?(e=PE.section[".rdata"])&&PE.isSignaturePresent(e.FileOffset,e.FileSize,"'DNGuard'")&&PE.isImportPositionHashPresent(0,943924593)&&PE.compareEP("48 83 EC 28 E8 07 AD")&&(bDetected=!0,PE.section[".I:R"]||(sOptions="modified")):!PE.is64()&&PE.isImportPositionHashPresent(0,2583213454)&&(bDetected=!0,sVersion="4.9+"),result()}init("protector","DNGuard")
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
function detect(){var e
|
||||
return PE.isNET()&&-1!==(e=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"DeepSeaObfuscator"))&&(PE.compare("'Evaluation'",e+18)&&(sVersion="4.X",sOptions="Evaluation"),bDetected=!0),result()}init("protector","DeepSea")
|
||||
return PE.isNet()&&-1!==(e=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"DeepSeaObfuscator"))&&(PE.compare("'Evaluation'",e+18)&&(sVersion="4.X",sOptions="Evaluation"),bDetected=!0),result()}init("protector","DeepSea")
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
function getVersion(){if(PE.isNET()){if(PE.isNetObjectPresent("Borland.Vcl.Types"))sVersion="8"
|
||||
function getVersion(){if(PE.isNet()){if(PE.isNetObjectPresent("Borland.Vcl.Types"))sVersion="8"
|
||||
else if(PE.isNetObjectPresent("Borland.Eco.Interfaces"))sVersion="8 Eco WinForm"
|
||||
else if(PE.isNetObjectPresent("Borland.Delphi.System")&&PE.isNetObjectPresent("WinForm"))sVersion="8 WinForm"
|
||||
else if(PE.isNetObjectPresent("Borland.Delphi.Units"))sVersion="2005 for .NET"
|
||||
else{if(!PE.isNetObjectPresent("Borland.Studio.Delphi"))return 0
|
||||
sName="Embarcadero Delphi",sVersion="XE*",sOptions=".NET"}return 1}for(var e,s,r,i,n,t,o=PE.section[0].FileOffset,a=PE.section[0].FileSize,E=o,c=a,P=0,l=PE.isPEPlus()?8:4;0<c&&-1!=(E=PE.findSignature(E,c,"0708'TControl'"));){if(s=PE.readDword(E+10),-1!=(e=PE.VAToOffset(s))&&o<=e&&e<o+a){switch(r=PE.readDword(e-10*l),i=PE.readDword(e-10*l-11*l),r){case 0:1953384711==i?sVersion="3":1330906996==i&&(sVersion="2")
|
||||
sName="Embarcadero Delphi",sVersion="XE*",sOptions=".NET"}return 1}for(var e,s,r,i,t,n,o=PE.section[0].FileOffset,a=PE.section[0].FileSize,E=o,c=a,P=0,l=PE.isPEPlus()?8:4;0<c&&-1!=(E=PE.findSignature(E,c,"0708'TControl'"));){if(s=PE.readDword(E+10),-1!=(e=PE.VAToOffset(s))&&o<=e&&e<o+a){switch(r=PE.readDword(e-10*l),i=PE.readDword(e-10*l-11*l),r){case 0:1953384711==i?sVersion="3":1330906996==i&&(sVersion="2")
|
||||
break
|
||||
case 180:sVersion="C++ Builder"
|
||||
break
|
||||
|
|
@ -24,4 +24,4 @@ break
|
|||
case 400:sVersion="2006"
|
||||
break
|
||||
default:420==(r=PE.readDword(e-13*l))?(sName="Embarcadero Delphi",sVersion="2009"):428==r?PE.resource.PACKAGEINFO&&(E=PE.resource.PACKAGEINFO.Offset,c=PE.resource.PACKAGEINFO.Size,sVersion=PE.isSignaturePresent(E,c,"'ExcUtils'")?(sName="Embarcadero Delphi","XE"):PE.isSignaturePresent(E,c,"'StrUtils'")?(sName="Embarcadero Delphi","2010"):(sName="Embarcadero Delphi","2010 or XE")):436==r?(sName="Embarcadero Delphi",sVersion="XE2-XE4"):752==r||760==r?(sName="Embarcadero Delphi",sVersion="XE2"):444==r?(sName="Embarcadero Delphi",sVersion="XE5-XE6",P=1):8==l&&(760==(r=PE.readDword(e-16*l))?(sName="Embarcadero Delphi",sVersion="XE3-X4"):776==r&&(sName="Embarcadero Delphi",sVersion="XE5-XE6",P=1))}if(!sVersion&&!P)return 1}c=a-(++E-o+1)}if(PE.resource.PACKAGEINFO){if(E=PE.resource.PACKAGEINFO.Offset,c=PE.resource.PACKAGEINFO.Size,PE.isSignaturePresent(E,c,"'System.SysUtils'")?(sName="Embarcadero Delphi",sVersion="XE2-XE6",P=1):PE.isSignaturePresent(E,c,"'ExcUtils'")?(sName="Embarcadero Delphi",sVersion="XE"):PE.isSignaturePresent(E,c,"'StrUtils'")?(sName="Embarcadero Delphi",sVersion="2009-2010"):PE.isSignaturePresent(E,c,"'ImageHlp'")?sVersion="2006":PE.isSignaturePresent(E,c,"'SysInit'")&&(sVersion="6-7 or 2005"),!sVersion&&!P)return 1}else if(-1!=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Borland\\Delphi"))return sVersion="2-3",1
|
||||
return P?(PE.section[".rdata"]&&(n=PE.section[".rdata"].FileOffset,t=PE.section[".rdata"].FileSize,-1!=(n=PE.findString(n,t,"Embarcadero Delphi for Win")))&&(t=PE.getString(n+46,4),sVersion="28.0"==t?"XE7":"29.0"==t?"XE8":"30.0"==t?"10 Seattle":"31.0"==t?"10.1 Berlin":"32.0"==t?"10.2 Tokyo":"33.0"==t?"10.3 Rio":"34.0"==t?"10.4 Sydney":"35.0"==t?"11.0 Alexandria":"36.0"==t?"12.0 Athens":"12.x Athens++"),1):0}function detect(){return bBorlandC?null:(PE.resource.PACKAGEINFO&&(bDetected=!0,getVersion()),PE.resource.DVCLAL?(bDetected=!0,getVersion(),nOffset=PE.getResourceNameOffset("DVCLAL"),PE.compare("A28CDF987B3C3A7926713F090F2A2517",nOffset)?sOptions="Professional":PE.compare("23785D23B6A5F31943F3400226D111C7",nOffset)?sOptions="Standard":PE.compare("263D4F38C28237B8F3244203179B3A83",nOffset)&&(sOptions="Enterprise")):PE.resource.TMAINFORM?(bDetected=!0,getVersion()):PE.isNET()?getVersion()&&(bDetected=!0):PE.compare("0A06'string'",PE.section[0].FileOffset)?(sVersion="2",bDetected=!0):-1!=PE.findSignature(PE.section[0].FileOffset,100,"07'Boolean'")||-1!=PE.findSignature(PE.section[0].FileOffset,100,"06'String'")?(bDetected=!0,getVersion()):PE.findSignature(PE.section[0].FileOffset,256,"FF25........8BC0FF25........8BC0")&&getVersion()&&(bDetected=!0),sLang="Object Pascal (Delphi)",result())}init("compiler","Borland Delphi"),includeScript("Borland")
|
||||
return P?(PE.section[".rdata"]&&(t=PE.section[".rdata"].FileOffset,n=PE.section[".rdata"].FileSize,-1!=(t=PE.findString(t,n,"Embarcadero Delphi for Win")))&&(n=PE.getString(t+46,4),sVersion="28.0"==n?"XE7":"29.0"==n?"XE8":"30.0"==n?"10 Seattle":"31.0"==n?"10.1 Berlin":"32.0"==n?"10.2 Tokyo":"33.0"==n?"10.3 Rio":"34.0"==n?"10.4 Sydney":"35.0"==n?"11.0 Alexandria":"36.0"==n?"12.0 Athens":"12.X Athens++"),1):0}function detect(){if(!bBorlandC)return PE.resource.PACKAGEINFO&&(bDetected=!0,getVersion()),PE.resource.DVCLAL?(bDetected=!0,getVersion(),nOffset=PE.getResourceNameOffset("DVCLAL"),PE.compare("A28CDF987B3C3A7926713F090F2A2517",nOffset)?sOptions="Professional":PE.compare("23785D23B6A5F31943F3400226D111C7",nOffset)?sOptions="Standard":PE.compare("263D4F38C28237B8F3244203179B3A83",nOffset)&&(sOptions="Enterprise")):PE.resource.TMAINFORM?(bDetected=!0,getVersion()):PE.isNet()?getVersion()&&(bDetected=!0):PE.compare("0A06'string'",PE.section[0].FileOffset)?(sVersion="2",bDetected=!0):-1!=PE.findSignature(PE.section[0].FileOffset,100,"07'Boolean'")||-1!=PE.findSignature(PE.section[0].FileOffset,100,"06'String'")?(bDetected=!0,getVersion()):PE.findSignature(PE.section[0].FileOffset,256,"FF25........8BC0FF25........8BC0")&&getVersion()&&(bDetected=!0),sLang="Object Pascal (Delphi)",result()}init("compiler","Borland Delphi"),includeScript("Borland")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return(PE.isSectionNamePresent(".arch")||PE.isSectionNamePresent(".edata")||PE.isSectionNamePresent(".srdata")||PE.isSectionNamePresent(".xpdata")||PE.isSectionNamePresent(".xdata")||PE.isSectionNamePresent(".xtls"))&&(PE.is64()?(PE.compareEP("51 52 41 50 41 51 4C 8D ?? ?? ?? ?? ?? 4C 8D ?? ?? ?? ?? ?? 4D 29 C1")?(sVersion="v1.0",bDetected=!0):PE.compareEP("48 8D 0D ?? ?? ?? ?? E9 ?? ?? ?? ??")?(sVersion="v2.0a",bDetected=!0):PE.compareEP("48 89 ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 48 83 FA 01")?(sVersion="v2.0b",bDetected=!0):PE.compareEP("?? ?? ?? ?? ?? ?? ?? ?? 4C 89 1C 24 49 89 E3")?(sVersion="v3.0a",bDetected=!0):PE.compareEP("48 8D 64 24 .. 50 51 52 80 3D .. .. .. .. .. 75 .. 48 8D 05 .. .. .. .. 48 8D 0D .. .. .. ..")?(sVersion="v17.0",bDetected=!0):PE.compareEP("4D 8D ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 48 8D ?? ?? 48 89 ?? 48 89 ?? 48 89")?(sVersion="v3.0b",bDetected=!0):-1!==PE.findSignature(0,PE.getSize(),"64 65 6E 75 76 6F 5F 61 74 64 00 00 00 00 00 00")&&(bDetected=!0),PE.isLibraryPresent("steam_api64.dll")&&(sOptions="Steam",bDetected=!0),PE.isLibraryPresent("eossdk-win64-shipping.dll")&&(sOptions="Epic Game Store",bDetected=!0),PE.isLibraryPresent("uplay_r1_loader64.dll")&&(sOptions="uPlay",bDetected=!0),PE.isLibraryPresent("Core/Activation64.dll")&&(sOptions="Origin",bDetected=!0)):(PE.compareEP("55 89 E5 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??")?(sVersion="v1.0",bDetected=!0):PE.compareEP("8D ?? ?? ?? ?? ?? ?? 89 7C 24 04 89 E7")?(sVersion="v2.0",bDetected=!0):sVersion="v?",PE.isLibraryPresent("steam_api.dll")&&(sOptions="Steam",bDetected=!0),PE.isLibraryPresent("eossdk-win32-shipping.dll")&&(sOptions="Epic Game Store",bDetected=!0),PE.isLibraryPresent("uplay_r1_loader.dll")&&(sOptions="uPlay",bDetected=!0),PE.isLibraryPresent("Core/Activation.dll")&&(sOptions="Origin",bDetected=!0))),bDetected||PE.isLibraryPresent("dbdata.dll")&&(sOptions="FIFA23 series",bDetected=!0),result()}init("protector","Denuvo")
|
||||
function detect(){if(!PE.isNet())return(PE.isSectionNamePresent(".arch")||PE.isSectionNamePresent(".edata")||PE.isSectionNamePresent(".srdata")||PE.isSectionNamePresent(".xpdata")||PE.isSectionNamePresent(".xdata")||PE.isSectionNamePresent(".xtls"))&&(PE.is64()?(PE.compareEP("51 52 41 50 41 51 4C 8D ?? ?? ?? ?? ?? 4C 8D ?? ?? ?? ?? ?? 4D 29 C1")?(sVersion="v1.0",bDetected=!0):PE.compareEP("48 8D 0D ?? ?? ?? ?? E9 ?? ?? ?? ??")?(sVersion="v2.0a",bDetected=!0):PE.compareEP("48 89 ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 48 83 FA 01")?(sVersion="v2.0b",bDetected=!0):PE.compareEP("?? ?? ?? ?? ?? ?? ?? ?? 4C 89 1C 24 49 89 E3")?(sVersion="v3.0a",bDetected=!0):PE.compareEP("48 8D 64 24 .. 50 51 52 80 3D .. .. .. .. .. 75 .. 48 8D 05 .. .. .. .. 48 8D 0D .. .. .. ..")?(sVersion="v17.0",bDetected=!0):PE.compareEP("4D 8D ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 48 8D ?? ?? 48 89 ?? 48 89 ?? 48 89")?(sVersion="v3.0b",bDetected=!0):-1!==PE.findSignature(0,PE.getSize(),"64 65 6E 75 76 6F 5F 61 74 64 00 00 00 00 00 00")&&(bDetected=!0),PE.isLibraryPresent("steam_api64.dll")&&(sOptions="Steam",bDetected=!0),PE.isLibraryPresent("eossdk-win64-shipping.dll")&&(sOptions="Epic Game Store",bDetected=!0),PE.isLibraryPresent("uplay_r1_loader64.dll")&&(sOptions="uPlay",bDetected=!0),PE.isLibraryPresent("Core/Activation64.dll")&&(sOptions="Origin",bDetected=!0)):(PE.compareEP("55 89 E5 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??")?(sVersion="v1.0",bDetected=!0):PE.compareEP("8D ?? ?? ?? ?? ?? ?? 89 7C 24 04 89 E7")?(sVersion="v2.0",bDetected=!0):sVersion="v?",PE.isLibraryPresent("steam_api.dll")&&(sOptions="Steam",bDetected=!0),PE.isLibraryPresent("eossdk-win32-shipping.dll")&&(sOptions="Epic Game Store",bDetected=!0),PE.isLibraryPresent("uplay_r1_loader.dll")&&(sOptions="uPlay",bDetected=!0),PE.isLibraryPresent("Core/Activation.dll")&&(sOptions="Origin",bDetected=!0))),bDetected||PE.isLibraryPresent("dbdata.dll")&&(sOptions="FIFA23 series",bDetected=!0),PE.isExportFunctionPresentExp(/^ANTICHEAT_OBFUSCATE_*_CODEMARKER/)&&_setResult("marker","Denuvo",String(),String()),result()}init("protector","Denuvo")
|
||||
|
|
|
|||
|
|
@ -1,6 +1,3 @@
|
|||
function detect(){var r
|
||||
return PE.isLibraryPresentExp(/^d3d*/i)||PE.isExportFunctionPresentExp(/^d3d/i)?(bDetected=!0,(r=PE.isLibraryPresentExp(/^d3d\d/i))&&(r=String(r).slice(3,5),sVersion=isNumber(r)?r:r[0]),(r=getVersionByExports())&&r!==sVersion&&(sVersion+=(sVersion?"/":String())+r)):(r=getVersionByExports())&&(sVersion=r,bDetected=!0),result()}function getVersionByExports(){var r=PE.isExportFunctionPresentExp(/D3D\d{1,2}/i)
|
||||
if(r){r=String(r).match(/D3D(\d{1,2})/i)
|
||||
if(r&&isNumber(r[1]))return r[1]}return null}function isNumber(r){if(0===r.length)return!1
|
||||
for(var e=0;e<r.length;e++)for(var i=0;i<10&&r[e]!=="0123456789"[i];i++)if(9===i)return!1
|
||||
return!0}init("library","Direct3D")
|
||||
function detect(){for(var t=0,e=/d3dx?(\d+)/i,r=0;r<PE.getNumberOfImports();r++)(i=PE.getImportLibraryName(r).match(e))&&/^\d+$/.test(i[1])&&Number(i[1])>t&&(t=Number(i[1]))
|
||||
for(var i,r=0;r<PE.getNumberOfExportFunctions();r++)(i=PE.getExportFunctionName(r).match(e))&&/^\d+$/.test(i[1])&&Number(i[1])>t&&(t=Number(i[1]))
|
||||
return 0<t?(bDetected=!0,sVersion=String(t)):PE.isLibraryPresentExp(/^d3d/i)&&(bDetected=!0),result()}init("library","Direct3D")
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
function detect(){if(PE.compareEP("558BEC81EC00050000E8000000005D81ED0E")){switch(PE.readWord(PE.nEP+18)){case 776:sVersion="1.0"
|
||||
function detect(){if(PE.compareEP("558BEC81EC00050000E8000000005D81ED0E")){switch(PE.readWord(PE.getEntryPointOffset()+18)){case 776:sVersion="1.0"
|
||||
break
|
||||
case 1082:sVersion="1.0b"}bDetected=!0}return result()}init("cryptor","Duals eXe Encryptor")
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
function detect(){if(PE.compareEP("60E8........5D8BFD81ED........2BB9........81EF........83BD..........0F84")){switch(PE.readByte(PE.nEP+32)){case 185:sVersion="1.0"
|
||||
function detect(){if(PE.compareEP("60E8........5D8BFD81ED........2BB9........81EF........83BD..........0F84")){switch(PE.readByte(PE.getEntryPointOffset()+32)){case 185:sVersion="1.0"
|
||||
break
|
||||
case 189:sVersion="0.86"}bDetected=!0}else PE.compareEP("EB03C20C00558BEC81EC00100000B80000....B900100000BA0000....89")&&(sVersion="1.0",bDetected=!0)
|
||||
return!bDetected&&PE.isSectionNamePresent("coderpub")&&(PE.compareEP("558BEC")||PE.compareEP("880D........CC"))&&(bDetected=!0),result()}init("packer","DxPack")
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
function getVersion(){var e,t,r,i,o,E,n,d=PE.nLastSection,P=PE.section[d].FileOffset,$=PE.section[d].FileSize,d=(0==$&&(P=PE.section[d-1].FileOffset,$=PE.section[d-1].FileSize),PE.findSignature(P,$,"000000'ENIGMA'"))
|
||||
return-1!=d?(e=PE.readByte(d+9),t=PE.readByte(d+10),r=PE.readWord(d+11),i=PE.readWord(d+13),o=PE.readWord(d+15),E=PE.readWord(d+17),n=PE.readWord(d+19),d=PE.readWord(d+21),sVersion=e+"."+t+" build "+r+"."+i+"."+o+" "+E+":"+n+":"+d,1):-1!=PE.findSignature(P,$,"'Enigma Protector'")?(sVersion="5.X",1):0}function getVersion4x(){var e,t,r,i,o,E,n=PE.nLastSection,d=PE.section[n-1].FileOffset,n=PE.section[n-1].FileSize,d=PE.findSignature(d,n,"000000'ENIGMA'")
|
||||
return-1!=d?(n=PE.readByte(d+9),e=PE.readByte(d+10),t=PE.readWord(d+11),r=PE.readWord(d+13),i=PE.readWord(d+15),o=PE.readWord(d+17),E=PE.readWord(d+19),d=PE.readWord(d+21),sVersion=n+"."+e+" build "+t+"."+r+"."+i+" "+o+":"+E+":"+d,1):0}function getVersion_old1x(){var e=PE.nLastSection
|
||||
function getVersion(){var e,t,r,i,o,n,E,d=PE.nLastSection,P=PE.section[d].FileOffset,$=PE.section[d].FileSize,d=(0==$&&(P=PE.section[d-1].FileOffset,$=PE.section[d-1].FileSize),PE.findSignature(P,$,"000000'ENIGMA'"))
|
||||
return-1!=d?(e=PE.readByte(d+9),t=PE.readByte(d+10),r=PE.readWord(d+11),i=PE.readWord(d+13),o=PE.readWord(d+15),n=PE.readWord(d+17),E=PE.readWord(d+19),d=PE.readWord(d+21),sVersion=e+"."+t+" build "+r+"."+i+"."+o+" "+n+":"+E+":"+d,1):-1!=PE.findSignature(P,$,"'Enigma Protector'")?(sVersion="5.X",1):0}function getVersion4x(){var e,t,r,i,o,n,E=PE.nLastSection,d=PE.section[E-1].FileOffset,E=PE.section[E-1].FileSize,d=PE.findSignature(d,E,"000000'ENIGMA'")
|
||||
return-1!=d?(E=PE.readByte(d+9),e=PE.readByte(d+10),t=PE.readWord(d+11),r=PE.readWord(d+13),i=PE.readWord(d+15),o=PE.readWord(d+17),n=PE.readWord(d+19),d=PE.readWord(d+21),sVersion=E+"."+e+" build "+t+"."+r+"."+i+" "+o+":"+n+":"+d,1):0}function getVersion_old1x(){var e=PE.nLastSection
|
||||
return-1!=PE.findSignature(PE.section[e].FileOffset,PE.section[e].FileSize,"'ENIGMA'07' PROT'")?(sVersion="1.14",1):0}function getVersion_old(){if(PE.section[".data"]){var e=PE.section[".data"].FileOffset
|
||||
if(-1!=(e=PE.findString(e,PE.section[".data"].FileSize,"Enigma protector v")))return sVersion=PE.getString(e+18,4),1}return 0}function detect(){return PE.isPEPlus()?(PE.compareEP("5051525355565741504151415241534154415541564157489C4881EC080000000FAE1C24E8000000005D")||PE.compareEP("eb$$60e8000000005d81ed........81ed........e9"))&&(getVersion(),bDetected=!0):PE.compareEP("558bec83c4..b8........e8........9a............e9$$$$$$$$60e8000000005d..ed")||PE.compareEP("60e8000000005d81ed........81ed........e9")||PE.compareEP("68........e8$$$$$$$$eb$$83c4..e9$$$$$$$$60e8000000005d81ed")||PE.compareEP("eb$$e9$$$$$$$$60e8000000005d81ed........81ed........e9")||PE.compareEP("e8$$$$$$$$83c4..e9$$$$$$$$60e8000000005d81ed........81ed........e9")?(getVersion(),bDetected=!0):PE.compareEP("60e8000000005d83....81ed")?(getVersion_old(),bDetected=!0):PE.compareEP("eb$$e9$$$$$$$$60e8000000005d83....81ed")&&(getVersion_old1x(),getVersion_old(),bDetected=!0),bDetected||(1<PE.getNumberOfImports()&&1==PE.getNumberOfImportThunks(1)&&"MessageBoxA"==PE.getImportFunctionName(1,0)&&3758096448==PE.getSectionCharacteristics(0)&&getVersion()||"enigma"==PE.getSectionNameCollision("1","2")||PE.isNET()&&PE.isSignatureInSectionPresent(0,"000000'ENIGMA'"))&&(bDetected=!0),PE.compareEP("60648b2d........3e8b6d..3e8b6d..e8........bb........c3")&&(getVersion4x(),bDetected=!0),result()}init("protector","Enigma")
|
||||
if(-1!=(e=PE.findString(e,PE.section[".data"].FileSize,"Enigma protector v")))return sVersion=PE.getString(e+18,4),1}return 0}function detect(){if(!PE.isNet())return PE.is64()?(PE.compareEP("5051525355565741504151415241534154415541564157489C4881EC080000000FAE1C24E8000000005D")||PE.compareEP("eb$$60e8000000005d81ed........81ed........e9"))&&(getVersion(),bDetected=!0):PE.compareEP("558bec83c4..b8........e8........9a............e9$$$$$$$$60e8000000005d..ed")||PE.compareEP("60e8000000005d81ed........81ed........e9")||PE.compareEP("68........e8$$$$$$$$eb$$83c4..e9$$$$$$$$60e8000000005d81ed")||PE.compareEP("eb$$e9$$$$$$$$60e8000000005d81ed........81ed........e9")||PE.compareEP("e8$$$$$$$$83c4..e9$$$$$$$$60e8000000005d81ed........81ed........e9")?(getVersion(),bDetected=!0):PE.compareEP("60e8000000005d83....81ed")?(getVersion_old(),bDetected=!0):PE.compareEP("eb$$e9$$$$$$$$60e8000000005d83....81ed")&&(getVersion_old1x(),getVersion_old(),bDetected=!0),bDetected||(1<PE.getNumberOfImports()&&1==PE.getNumberOfImportThunks(1)&&"MessageBoxA"==PE.getImportFunctionName(1,0)&&3758096448==PE.getSectionCharacteristics(0)&&getVersion()||"enigma"==PE.getSectionNameCollision("1","2")||PE.isNet()&&PE.isSignatureInSectionPresent(0,"000000'ENIGMA'"))&&(bDetected=!0),PE.compareEP("60648b2d........3e8b6d..3e8b6d..e8........bb........c3")&&(getVersion4x(),bDetected=!0),result()}init("protector","Enigma")
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
function detect(){if(PE.compareEP("A4......00000000FFFFFFFF3C......94......D8......00000000FFFFFFFFB8")?(sVersion="2.0/2.1",sOptions="protected IAT",bDetected=!0):PE.compareEP("558BEC83C4F4565753BE........B80000....8945FC89C28B460C09C00F84")?(sVersion="2.0/2.1",bDetected=!0):PE.compareEP("BE........B80000....8945FC89C28B460C09C00F84..00000001D089C350FF15")?(sVersion="2.1.17",bDetected=!0):PE.compareEP("E8$$$$$$$$E800000000............8B1C2481EB........B8........506A..68")?(sVersion="2.2.4",bDetected=!0):PE.compareEP("5068........5881E0........E9......00870C2459E8......008945F8E9")?(sVersion="2.2.6",sOptions="minimum protection",bDetected=!0):PE.compareEP("508BC687042468........5EE9........85C8E9........81C3........0F81")?(sVersion="2.2.6",sOptions="DLL/minimum protection",bDetected=!0):PE.compareEP("E80000000058..........8B1C2481EB........B8........506A046800100000506A00B8")?(sVersion="2.2/2.3",sOptions="compressed code",bDetected=!0):PE.compareEP("CC......00000000FFFFFFFF3C......B4......08......00000000FFFFFFFFE8")?(sVersion="2.2/2.3",sOptions="protected IAT",bDetected=!0):PE.compareEP("5168........5981F1123CCB98E9532C0000F7D7E9EB6000008345F802E9E3360000")?(sVersion="2.3.9",sOptions="compressed resources",bDetected=!0):PE.compareEP("68........E9......FF50C1C8188905........C3C1C01851E9......FF84C00F84")?(sVersion="2.3.9",sOptions="minimum protection",bDetected=!0):PE.compareEP("5068........58C1C00FE9......00870424588945FCE9......FFFF05........E9")?(sVersion="2.3.9",sOptions="DLL/compressed resources",bDetected=!0):PE.compareEP("5168........872C248BCD5D81E1........E9......008945F85168........5981F1")?(sVersion="2.3.9",sOptions="DLL/minimum protection",bDetected=!0):PE.compareEP("56575331DB89C689D70FB60689C283E01FC1EA05742D4A74158D5C130246C1E00889")?(sVersion="2.xx",sOptions="compressed resources",bDetected=!0):PE.compareEP("558BEC83C4ECFC5357568945FC8955F889C689D766813E4A430F852301000083C60A")?(sVersion="2.xx",sOptions="max. compressed resources",bDetected=!0):PE.compareEP("E824......8B4C240CC70117..01..C781..............31C089411489411880A1")?(sVersion="1.3.0.45",bDetected=!0):PE.compareEP("E8$$$$$$$$31c064ff30648920648f05........83c4..e9$$$$$$$$60e8$$$$$$$$83c4")?(sVersion="1.4X-1.5X",bDetected=!0):PE.compareEP("E8$$$$$$$$31C064FF30648920CCC3")?(sVersion="1.5X",bDetected=!0):PE.compareEP("83C6148B55FCE9..FFFFFF")||PE.compareEP("E9........669C60508D88........8D900416....8BDC8BE1")?(sVersion="2.1X",bDetected=!0):PE.compareEP("FFE0E804000000FFFFFFFF5EC300")?(sVersion="2.2X",bDetected=!0):PE.compareEP("E9$$$$$$$$E8$$$$$$$$0F")&&(bDetected=!0),!bDetected){var e=PE.section.length
|
||||
function detect(){if(!PE.isNet()){if(PE.compareEP("A4......00000000FFFFFFFF3C......94......D8......00000000FFFFFFFFB8")?(sVersion="2.0/2.1",sOptions="protected IAT",bDetected=!0):PE.compareEP("558BEC83C4F4565753BE........B80000....8945FC89C28B460C09C00F84")?(sVersion="2.0/2.1",bDetected=!0):PE.compareEP("BE........B80000....8945FC89C28B460C09C00F84..00000001D089C350FF15")?(sVersion="2.1.17",bDetected=!0):PE.compareEP("E8$$$$$$$$E800000000............8B1C2481EB........B8........506A..68")?(sVersion="2.2.4",bDetected=!0):PE.compareEP("5068........5881E0........E9......00870C2459E8......008945F8E9")?(sVersion="2.2.6",sOptions="minimum protection",bDetected=!0):PE.compareEP("508BC687042468........5EE9........85C8E9........81C3........0F81")?(sVersion="2.2.6",sOptions="DLL/minimum protection",bDetected=!0):PE.compareEP("E80000000058..........8B1C2481EB........B8........506A046800100000506A00B8")?(sVersion="2.2/2.3",sOptions="compressed code",bDetected=!0):PE.compareEP("CC......00000000FFFFFFFF3C......B4......08......00000000FFFFFFFFE8")?(sVersion="2.2/2.3",sOptions="protected IAT",bDetected=!0):PE.compareEP("5168........5981F1123CCB98E9532C0000F7D7E9EB6000008345F802E9E3360000")?(sVersion="2.3.9",sOptions="compressed resources",bDetected=!0):PE.compareEP("68........E9......FF50C1C8188905........C3C1C01851E9......FF84C00F84")?(sVersion="2.3.9",sOptions="minimum protection",bDetected=!0):PE.compareEP("5068........58C1C00FE9......00870424588945FCE9......FFFF05........E9")?(sVersion="2.3.9",sOptions="DLL/compressed resources",bDetected=!0):PE.compareEP("5168........872C248BCD5D81E1........E9......008945F85168........5981F1")?(sVersion="2.3.9",sOptions="DLL/minimum protection",bDetected=!0):PE.compareEP("56575331DB89C689D70FB60689C283E01FC1EA05742D4A74158D5C130246C1E00889")?(sVersion="2.XX",sOptions="compressed resources",bDetected=!0):PE.compareEP("558BEC83C4ECFC5357568945FC8955F889C689D766813E4A430F852301000083C60A")?(sVersion="2.XX",sOptions="max. compressed resources",bDetected=!0):PE.compareEP("E824......8B4C240CC70117..01..C781..............31C089411489411880A1")?(sVersion="1.3.0.45",bDetected=!0):PE.compareEP("E8$$$$$$$$31c064ff30648920648f05........83c4..e9$$$$$$$$60e8$$$$$$$$83c4")?(sVersion="1.4X-1.5X",bDetected=!0):PE.compareEP("E8$$$$$$$$31C064FF30648920CCC3")?(sVersion="1.5X",bDetected=!0):PE.compareEP("83C6148B55FCE9..FFFFFF")||PE.compareEP("E9........669C60508D88........8D900416....8BDC8BE1")?(sVersion="2.1X",bDetected=!0):PE.compareEP("FFE0E804000000FFFFFFFF5EC300")?(sVersion="2.2X",bDetected=!0):PE.compareEP("E9$$$$$$$$E8$$$$$$$$0F")&&(bDetected=!0),!bDetected){var e=PE.section.length
|
||||
if(3<e&&2==PE.getNumberOfImports()&&1==PE.getNumberOfImportThunks(1)&&"MessageBoxA"==PE.getImportFunctionName(1,0))for(var E=1;E<3;E++)if(PE.getImportSection()==e-E&&0==PE.section[e-E-1].FileSize){sVersion=4<e?"2.4X":"2.X",bDetected=!0
|
||||
break}}return result()}init("cryptor","EXECryptor")
|
||||
break}}return result()}}init("cryptor","EXECryptor")
|
||||
|
|
|
|||
|
|
@ -1,3 +1 @@
|
|||
function detect(){(PE.compareEP("56e8$$$$$$$$5e5ee9$$$$$$$$e8$$$$$$$$5d83c5..55c3")||PE.compareEP("52e8$$$$$$$$83c4..5a8be4510fb6c981e5"))&&(sVersion="1.1",bDetected=!0)
|
||||
var e=PE.getEntryPointOffset()
|
||||
return-1!=PE.findSignature(e,4096,"6545c2fb195bbd004040ebef9155f0401897db0024e8e80000008387202e87d17820fb1cb800b0ef0b000000848e")&&(sVersion="1.1",bDetected=!0),result()}init("protector","ExeFog")
|
||||
function detect(){return(PE.compareEP("56e8$$$$$$$$5e5ee9$$$$$$$$e8$$$$$$$$5d83c5..55c3")||PE.compareEP("52e8$$$$$$$$83c4..5a8be4510fb6c981e5"))&&(sVersion="1.1",bDetected=!0),-1!=PE.findSignature(PE.getEntryPointOffset(),4096,"6545c2fb195bbd004040ebef9155f0401897db0024e8e80000008387202e87d17820fb1cb800b0ef0b000000848e")&&(sVersion="1.1",bDetected=!0),result()}init("protector","ExeFog")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return bDetected=PE.isNET()&&PE.isSignaturePresent(PE.section[0].FileOffset,1024,"'fefef'")&&PE.isSignatureInSectionPresent(0,"00 E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 **"),result()}init("protector","EazFuscator")
|
||||
function detect(){return bDetected=PE.isNet()&&PE.isSignaturePresent(PE.section[0].FileOffset,1024,"'fefef'")&&PE.isSignatureInSectionPresent(0,"00 E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 **"),result()}init("protector","EazFuscator")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&(PE.isSignatureInSectionPresent(0,"83c42068........68........c744240800000000ff15........50ff15........85c0a3")?(sOptions="AnyCPU",bDetected=!0):PE.isSignatureInSectionPresent(0,"488b0dd2be01006641b83200488d917b070000ff15a040010033c9ff15b8400100488b")&&(sOptions="x64",bDetected=!0)),bDetected||(PE.isPEPlus()?PE.compareEP("41504151515257535556E8000000005B48B8................482BD8488BEB")&&(sVersion="2.00.X",bDetected=!0):PE.compareEP("515257535556E8000000005BB8........2BD8")&&(sVersion="2.00.X",bDetected=!0)),result()}init("protector","ElecKey")
|
||||
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"83c42068........68........c744240800000000ff15........50ff15........85c0a3")?(sOptions="AnyCPU",bDetected=!0):PE.isSignatureInSectionPresent(0,"488b0dd2be01006641b83200488d917b070000ff15a040010033c9ff15b8400100488b")&&(sOptions="x64",bDetected=!0)),bDetected||(PE.is64()?PE.compareEP("41504151515257535556E8000000005B48B8................482BD8488BEB")&&(sVersion="2.00.X",bDetected=!0):PE.compareEP("515257535556E8000000005BB8........2BD8")&&(sVersion="2.00.X",bDetected=!0)),result()}init("protector","ElecKey")
|
||||
|
|
|
|||
1
dbs_min/db/PE/EpicGames.4.sg
Normal file
1
dbs_min/db/PE/EpicGames.4.sg
Normal file
|
|
@ -0,0 +1 @@
|
|||
function detect(){return PE.isLibraryPresentExp(/^EOSSDK/)&&(bDetected=!0),result()}init("library","Epic Games Services")
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
function detect(){if(PE.compareEP("EB0668....0600C39C60E8020000")){switch(PE.readWord(PE.nEP+3)){case 8080:sVersion="1.7"
|
||||
function detect(){if(PE.compareEP("EB0668....0600C39C60E8020000")){switch(PE.readWord(PE.getEntryPointOffset()+3)){case 8080:sVersion="1.7"
|
||||
break
|
||||
case 34548:sVersion="2.7"
|
||||
break
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&(PE.isSignatureInSectionPresent(0,"0800'FISH_NET'")||PE.isSignatureInSectionPresent(0,"'FISH.NET'"))&&(sVersion="1.X",bDetected=!0),result()}init("protector","FISH .NET")
|
||||
function detect(){return PE.isNet()&&(PE.isSignatureInSectionPresent(0,"0800'FISH_NET'")||PE.isSignatureInSectionPresent(0,"'FISH.NET'"))&&(sVersion="1.X",bDetected=!0),result()}init("protector","FISH .NET")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.compareEP("BE........BF........BB........53BB........B280")?sVersion="1.31":PE.compareEP("BB........BF........BE........53E80A00000002D275058A164612D2")?sVersion="1.0":PE.compareEP("BB........BF........BE........FCB2808A064688074702D275058A16")?sVersion="1.1":PE.compareEP("EB02CD2003..8D..80....00..................EB02")?(sVersion="1.10",sOptions="Watcom C/C++ EXE"):PE.compareEP("80E9A1C1C11368E4167546C1C1055EEB019D6864863746EB028CE05FF7D0")||PE.compareEP("EB0102EB02CD20B8........EB0155BEF400000013DF13D80FB638D1F3F7")?(sVersion="1.10",sOptions="WinRAR-SFX"):PE.compareEP("EB02CD202BC868........EB021EBB5EEB02CD2068B12B6E37405B0FB6C9")?(sVersion="1.10",sOptions="Borland C++ 1999"):PE.compareEP("23CAEB025A0DE8020000006A3558C1C910BE........0FB6C9EB02CD20BB")?(sVersion="1.10",sOptions="Borland C++"):PE.compareEP("2BC2E802000000954A598D3D52F12AE8C1C81CBE2E....18EB02ABA003F7")||PE.compareEP("EB012EEB02A555BB........87FE8D05AACEE063EB0175BA5ECEE063EB02")?(sVersion="1.10",sOptions="Borland Delphi/Borland C++"):PE.compareEP("EB02CD20EB02CD20EB02CD20C1E618BB........EB0282B8EB01108D05F4")?(sVersion="1.10",sOptions="Borland Delphi/Microsoft Visual C++/ASM"):PE.compareEP("C1C810EB010FBF03746677C1E91D6883....77EB02CD205EEB02CD202BF7")||PE.compareEP("1BDBE8020000001A0D5B68........E801000000EA5A58EB02CD2068F400")?(sVersion="1.10",sOptions="Borland Delphi/Microsoft Visual C++"):PE.compareEP("EB0156E802000000B2D9596880..4100E8020000006532595EEB02CD20BB")?(sVersion="1.10",sOptions="Borland Delphi 2.0"):PE.compareEP("F7D80FBEC2BE........0FBEC9BF083B6507EB02D829BBECC59AF8EB0194")?(sVersion="1.10",sOptions="MASM32/TASM32/Microsoft Visual Basic"):PE.compareEP("03F723FE33FBEB02CD20BB........EB0186EB0190B8F400000083EE052B")?(sVersion="1.10",sOptions="MASM32/TASM32"):PE.compareEP("EB01DBE80200000086435E8D1DD075CF83C1EE1D6850..8F83EB023D0F5A")?(sVersion="1.10",sOptions="MASM32"):PE.compareEP("EB0209940FB7FF68........81F68E0000005BEB0211C28D05F400000047")?(sVersion="1.10",sOptions="Microsoft Visual Basic/MASM32"):PE.compareEP("C1CB10EB010FB90374F6EE0FB6D38D0583....EF80F3F62BC1EB01DE6877")?(sVersion="1.10",sOptions="Microsoft Visual Basic 5.0/6.0"):PE.compareEP("2C711BCAEB012AEB01658D3580....0080C98480C968BBF4000000EB01EB")?(sVersion="1.10",sOptions="Microsoft Visual C++ 4.x/LCC Win32 1.X"):PE.compareEP("33D20FBED2EB01C7EB01D88D0580......EB02CD20EB01F8BEF4000000EB")?(sVersion="1.10",sOptions="Microsoft Visual C++ 5.0/6.0"):PE.compareEP("E8010000005A5EE802000000BADD5E03F2EB0164BB........8BFAEB01A8")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/7.0/ASM"):PE.compareEP("0BD08BDAE80200000040A05AEB019DB8........EB02CD2003D38D35F400")||PE.compareEP("87FEE80200000098CC5FBB80....00EB02CD2068F4000000E801000000E3")||PE.compareEP("F7D84049EB02E00A8D3580......0FB6C2EB019C8D1DF4000000EB013C80")||PE.compareEP("F7DB80EABFB92F4067BAEB010168AF..A7BA80EA9D58C1C2092BC18BD768")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/7.0"):PE.compareEP("F7D0EB02CD20BEBB741CFBEB02CD20BF3B....FBC1C10333F7EB02CD2068")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/ASM"):PE.compareEP("03DEEB01F8B8........EB02CD206817A0B3ABEB01E8590FB6DB680BA1B3")||PE.compareEP("91EB02CD20BF50BC046F91BED0....6FEB02CD202BF7EB02F0468D1DF400")||PE.compareEP("C1CE10C1F60F68........2BFA5B23F98D15........E801000000B65E0B")||PE.compareEP("E8010000000E59E8010000005858BE........EB0261E968F4000000C1C8")||PE.compareEP("EB014D83F64C68........EB02CD205BEB012368481C2B3AE80200000038")||PE.compareEP("EB02AB35EB02B5C68D05........C1C211BEF4000000F7DBF7DB0FBE38E8")||PE.compareEP("EB02CD20..CF....80....00................00")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0"):PE.compareEP("C1F007EB02CD20BE........1BC68D1DF40000000FB606EB02CD208A160F")?(sVersion="1.20",sOptions="Borland C++"):PE.compareEP("0FBEC1EB010E8D35C3BEB622F7D16843....22EB02B5155FC1F11533F780")?(sVersion="1.20",sOptions="Borland Delphi/Borland C++"):PE.compareEP("0FB6D0E8010000000C5AB8........EB0200DE8D35F4000000F7D2EB020E")?(sVersion="1.20",sOptions="Borland Delphi/Microsoft Visual C++"):PE.compareEP("33C22CFB8D3D7E45B480E8020000008A45586802..8C7FEB02CD205E80C9")?(sVersion="1.20",sOptions="MASM32/TASM32"):PE.compareEP("EB02CD20EB01918D35........33C26883937E7D0CA45B23C36877937E7D")?(sVersion="1.20",sOptions="Microsoft Visual C++ 6.0/7.0"):PE.compareEP("C1E006EB02CD20EB0127EB0124BE........49EB01998D1DF4000000EB01")?(sVersion="1.20",sOptions="Microsoft Visual C++ 6.0"):PE.compareEP("BB........BF........BE........53BB........B280A4B680FFD373F9")?sVersion="1.31":PE.compareEP("BE........AD93AD97AD5696B280A4B680FF1373")?sVersion="1.33":PE.compareEP("BE........AD97AD569683CD..EB")?sVersion="1.3.3":PE.compareEP("8725........619455A4B6..FF13")&&(sVersion="2.0"),bDetected=Boolean(sVersion),result()}init("packer","FSG")
|
||||
function detect(){return PE.compareEP("BE........BF........BB........53BB........B280")?sVersion="1.31":PE.compareEP("BB........BF........BE........53E80A00000002D275058A164612D2")?sVersion="1.0":PE.compareEP("BB........BF........BE........FCB2808A064688074702D275058A16")?sVersion="1.1":PE.compareEP("EB02CD2003..8D..80....00..................EB02")?(sVersion="1.10",sOptions="Watcom C/C++ EXE"):PE.compareEP("80E9A1C1C11368E4167546C1C1055EEB019D6864863746EB028CE05FF7D0")||PE.compareEP("EB0102EB02CD20B8........EB0155BEF400000013DF13D80FB638D1F3F7")?(sVersion="1.10",sOptions="WinRAR-SFX"):PE.compareEP("EB02CD202BC868........EB021EBB5EEB02CD2068B12B6E37405B0FB6C9")?(sVersion="1.10",sOptions="Borland C++ 1999"):PE.compareEP("23CAEB025A0DE8020000006A3558C1C910BE........0FB6C9EB02CD20BB")?(sVersion="1.10",sOptions="Borland C++"):PE.compareEP("2BC2E802000000954A598D3D52F12AE8C1C81CBE2E....18EB02ABA003F7")||PE.compareEP("EB012EEB02A555BB........87FE8D05AACEE063EB0175BA5ECEE063EB02")?(sVersion="1.10",sOptions="Borland Delphi/Borland C++"):PE.compareEP("EB02CD20EB02CD20EB02CD20C1E618BB........EB0282B8EB01108D05F4")?(sVersion="1.10",sOptions="Borland Delphi/Microsoft Visual C++/ASM"):PE.compareEP("C1C810EB010FBF03746677C1E91D6883....77EB02CD205EEB02CD202BF7")||PE.compareEP("1BDBE8020000001A0D5B68........E801000000EA5A58EB02CD2068F400")?(sVersion="1.10",sOptions="Borland Delphi/Microsoft Visual C++"):PE.compareEP("EB0156E802000000B2D9596880..4100E8020000006532595EEB02CD20BB")?(sVersion="1.10",sOptions="Borland Delphi 2.0"):PE.compareEP("F7D80FBEC2BE........0FBEC9BF083B6507EB02D829BBECC59AF8EB0194")?(sVersion="1.10",sOptions="MASM32/TASM32/Microsoft Visual Basic"):PE.compareEP("03F723FE33FBEB02CD20BB........EB0186EB0190B8F400000083EE052B")?(sVersion="1.10",sOptions="MASM32/TASM32"):PE.compareEP("EB01DBE80200000086435E8D1DD075CF83C1EE1D6850..8F83EB023D0F5A")?(sVersion="1.10",sOptions="MASM32"):PE.compareEP("EB0209940FB7FF68........81F68E0000005BEB0211C28D05F400000047")?(sVersion="1.10",sOptions="Microsoft Visual Basic/MASM32"):PE.compareEP("C1CB10EB010FB90374F6EE0FB6D38D0583....EF80F3F62BC1EB01DE6877")?(sVersion="1.10",sOptions="Microsoft Visual Basic 5.0/6.0"):PE.compareEP("2C711BCAEB012AEB01658D3580....0080C98480C968BBF4000000EB01EB")?(sVersion="1.10",sOptions="Microsoft Visual C++ 4.X/LCC Win32 1.X"):PE.compareEP("33D20FBED2EB01C7EB01D88D0580......EB02CD20EB01F8BEF4000000EB")?(sVersion="1.10",sOptions="Microsoft Visual C++ 5.0/6.0"):PE.compareEP("E8010000005A5EE802000000BADD5E03F2EB0164BB........8BFAEB01A8")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/7.0/ASM"):PE.compareEP("0BD08BDAE80200000040A05AEB019DB8........EB02CD2003D38D35F400")||PE.compareEP("87FEE80200000098CC5FBB80....00EB02CD2068F4000000E801000000E3")||PE.compareEP("F7D84049EB02E00A8D3580......0FB6C2EB019C8D1DF4000000EB013C80")||PE.compareEP("F7DB80EABFB92F4067BAEB010168AF..A7BA80EA9D58C1C2092BC18BD768")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/7.0"):PE.compareEP("F7D0EB02CD20BEBB741CFBEB02CD20BF3B....FBC1C10333F7EB02CD2068")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0/ASM"):PE.compareEP("03DEEB01F8B8........EB02CD206817A0B3ABEB01E8590FB6DB680BA1B3")||PE.compareEP("91EB02CD20BF50BC046F91BED0....6FEB02CD202BF7EB02F0468D1DF400")||PE.compareEP("C1CE10C1F60F68........2BFA5B23F98D15........E801000000B65E0B")||PE.compareEP("E8010000000E59E8010000005858BE........EB0261E968F4000000C1C8")||PE.compareEP("EB014D83F64C68........EB02CD205BEB012368481C2B3AE80200000038")||PE.compareEP("EB02AB35EB02B5C68D05........C1C211BEF4000000F7DBF7DB0FBE38E8")||PE.compareEP("EB02CD20..CF....80....00................00")?(sVersion="1.10",sOptions="Microsoft Visual C++ 6.0"):PE.compareEP("C1F007EB02CD20BE........1BC68D1DF40000000FB606EB02CD208A160F")?(sVersion="1.20",sOptions="Borland C++"):PE.compareEP("0FBEC1EB010E8D35C3BEB622F7D16843....22EB02B5155FC1F11533F780")?(sVersion="1.20",sOptions="Borland Delphi/Borland C++"):PE.compareEP("0FB6D0E8010000000C5AB8........EB0200DE8D35F4000000F7D2EB020E")?(sVersion="1.20",sOptions="Borland Delphi/Microsoft Visual C++"):PE.compareEP("33C22CFB8D3D7E45B480E8020000008A45586802..8C7FEB02CD205E80C9")?(sVersion="1.20",sOptions="MASM32/TASM32"):PE.compareEP("EB02CD20EB01918D35........33C26883937E7D0CA45B23C36877937E7D")?(sVersion="1.20",sOptions="Microsoft Visual C++ 6.0/7.0"):PE.compareEP("C1E006EB02CD20EB0127EB0124BE........49EB01998D1DF4000000EB01")?(sVersion="1.20",sOptions="Microsoft Visual C++ 6.0"):PE.compareEP("BB........BF........BE........53BB........B280A4B680FFD373F9")?sVersion="1.31":PE.compareEP("BE........AD93AD97AD5696B280A4B680FF1373")?sVersion="1.33":PE.compareEP("BE........AD97AD569683CD..EB")?sVersion="1.3.3":PE.compareEP("8725........619455A4B6..FF13")&&(sVersion="2.0"),bDetected=Boolean(sVersion),result()}init("packer","FSG")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isSectionNamePresent(".CRT")&&PE.isLibraryPresent("msvcrt.dll")&&(sVersion="MinGW",bDetected=PE.is64()?PE.compareEP("48")&&PE.isSignatureInSectionPresent(0,"564889CE534889D34883EC28E8........4885C074..48893048895808488958104883C4285B5EC3"):PE.compareEP("83")&&PE.isSignatureInSectionPresent(0,"5383EC088B5C2414E8........85C074..8B542410895804895808891083C4085BC20800")),!bDetected&&PE.compareEP("E8....0000E801000000C35589E5")&&(sVersion="0.11+"),sLang="FreeBASIC",result()}init("compiler","FreeBASIC")
|
||||
function detect(){if(!PE.isNet())return PE.isSectionNamePresent(".CRT")&&PE.isLibraryPresent("msvcrt.dll")&&(sVersion="MinGW",bDetected=PE.is64()?PE.compareEP("48")&&PE.isSignatureInSectionPresent(0,"564889CE534889D34883EC28E8........4885C074..48893048895808488958104883C4285B5EC3"):PE.compareEP("83")&&PE.isSignatureInSectionPresent(0,"5383EC088B5C2414E8........85C074..8B542410895804895808891083C4085BC20800")),!bDetected&&PE.compareEP("E8....0000E801000000C35589E5")&&(sVersion="0.11+"),sLang="FreeBASIC",result()}init("compiler","FreeBASIC")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.compareEP("558bec81ec........538d85........5633db578d8d........68........895d..518945..53ff15")?(-1!=PE.findSignature(PE.getOverlayOffset(),128,"'GEA'")||0<PE.getNumberOfResources()&&(nOffset=PE.getResourceNameOffset("SETUP_TEMP"),PE.compare("'GEA'",nOffset)))&&(bDetected=!0):PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")?(-1!=PE.findSignature(PE.getOverlayOffset(),128,"'GEA'")&&(bDetected=!0),-1!=PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".data")),128,"'gentee'")&&(bDetected=!0)):PE.compareEP("81ec........5356575568........6a..6a..ff15........8bf0ff15........3d........75..56")&&-1!=PE.compareOverlay("'OWS9G1'",11)&&(bDetected=!0),PE.compareEP("558bec81ec........5356576a..ff15........68........ff15........85c074..6a..a1........50ff15........8bf06a..56ff15")&&(bDetected=!0),result()}init("installer","Gentee Installer")
|
||||
function detect(){return PE.compareEP("558bec81ec........538d85........5633db578d8d........68........895d..518945..53ff15")?(-1!=PE.findSignature(PE.getOverlayOffset(),128,"'GEA'")||0<PE.getNumberOfResources()&&PE.compare("'GEA'",PE.getResourceNameOffset("SETUP_TEMP")))&&(bDetected=!0):PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")?-1==PE.findSignature(PE.getOverlayOffset(),128,"'GEA'")&&-1==PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".data")),128,"'gentee'")||(bDetected=!0):(PE.compareEP("81ec........5356575568........6a..6a..ff15........8bf0ff15........3d........75..56")&&-1!=PE.compareOverlay("'OWS9G1'",11)||PE.compareEP("558bec81ec........5356576a..ff15........68........ff15........85c074..6a..a1........50ff15........8bf06a..56ff15"))&&(bDetected=!0),result()}init("installer","Gentee Installer")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&(PE.isNetObjectPresent("ObfuscatedByGoliath")||PE.isSignatureInSectionPresent(0,"'.Goliath.NET.CodeShield.'"))&&(bDetected=!0),result()}init("protector","Goliath")
|
||||
function detect(){return PE.isNet()&&(PE.isNetObjectPresent("ObfuscatedByGoliath")||PE.isSignatureInSectionPresent(0,"'.Goliath.NET.CodeShield.'"))&&(bDetected=!0),result()}init("protector","Goliath")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isPEPlus()?PE.compareEP("5750569C53515241504151488D05........488B304803F0482BC0488BFE66AD")&&(sVersion="1.X",sOptions="SRM",bDetected=!0):PE.compareEP("558bec535657608bc4a3........b8........2b05........a3........833d..........74..8b0d........51ff15")?(sVersion="4.X",sOptions="HL",bDetected=!0):PE.compareEP("57565351E801000000..5805........508B3003F02BC08BFE66AD")?(sVersion="1.X",sOptions="SRM",bDetected=!0):PE.compareEP("558bec535657608bc4a3........b8........2b05........a3........833d..........0f84........a1........50ff15")&&(sVersion="1.X",sOptions="HL",bDetected=!0),result()}init("protector","HASP HL/SRM Protection")
|
||||
function detect(){return PE.is64()?PE.compareEP("5750569C53515241504151488D05........488B304803F0482BC0488BFE66AD")&&(sVersion="1.X",sOptions="SRM",bDetected=!0):PE.compareEP("558bec535657608bc4a3........b8........2b05........a3........833d..........74..8b0d........51ff15")?(sVersion="4.X",sOptions="HL",bDetected=!0):PE.compareEP("57565351E801000000..5805........508B3003F02BC08BFE66AD")?(sVersion="1.X",sOptions="SRM",bDetected=!0):PE.compareEP("558bec535657608bc4a3........b8........2b05........a3........833d..........0f84........a1........50ff15")&&(sVersion="1.X",sOptions="HL",bDetected=!0),result()}init("protector","HASP HL/SRM Protection")
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -1 +1 @@
|
|||
function detect(){return bDetected=PE.isNET()&&PE.isNetGlobalCctorPresent()&&PE.isNetObjectPresent("Protect32.dll")&&PE.isNetObjectPresent("Protect64.dll"),result()}init("protector","ILProtector")
|
||||
function detect(){return bDetected=PE.isNet()&&PE.isNetGlobalCctorPresent()&&PE.isNetObjectPresent("Protect32.dll")&&PE.isNetObjectPresent("Protect64.dll"),result()}init("protector","ILProtector")
|
||||
|
|
|
|||
|
|
@ -3,4 +3,4 @@ sVersion=e.substring(0,e.indexOf(")")),/\(u\)/.test(e)?sOptions=sOptions.append(
|
|||
if(e<16384){var n=PE.findString(t,e,"Inno Setup Setup Data")
|
||||
if(-1!=n)return getVersionAndOptions(n+23),1
|
||||
if(-1!=(n=PE.findSignature(t,e,"'i1.'............'32'1A")))return sVersion=PE.getString(n+1).replace(/-.*/,""),1}}return 0}function detect(){var e
|
||||
return PE.compareOverlay("'zlb'1A")||PE.compareOverlay("'idska32'1A")?(getVersion("DATA")||getVersion(".data"),bDetected=!0):"InUn"==PE.getString(48,4)&&(sOptions="uninstall",-1!=(e=PE.findString(PE.getOverlayOffset(),Math.min(256,PE.getOverlaySize()),"Inno Setup Messages"))&&(getVersionAndOptions(e+21),bDetected=!0),bDetected||-1!=(e=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Inno Setup version"))&&(getVersionAndOptions(e+19),bDetected=!0),bDetected||(getVersion("DATA")||getVersion(".data"))&&(bDetected=!0)),bDetected||(PE.compareOverlay("'Inno Setup Messages'")?(sOptions="uninstall",getVersionAndOptions(PE.getOverlayOffset()+21),bDetected=!0):PE.compareOverlay("'Inno Setup Setup Data'")&&(getVersionAndOptions(PE.getOverlayOffset()+23),bDetected=!0)),PE.compareOverlay("78da")?(sOptions="zlib",(PE.compareEP("558bec83c4..53565733c08945..8945")||PE.compareEP("558bec83c4..e8........e8........e8"))&&(bDetected=!0)):PE.compareOverlay("'Inno'",52)&&(sOptions="with stub",bDetected=!0),bDetected||PE.isNET()&&"This installation was built with Inno Setup."==PE.getVersionStringInfo("Comments")&&(bDetected=!0),result()}init("installer","Inno Setup Module")
|
||||
return PE.compareOverlay("'zlb'1A")||PE.compareOverlay("'idska32'1A")?(getVersion("DATA")||getVersion(".data"),bDetected=!0):"InUn"==PE.getString(48,4)&&(sOptions="uninstall",-1!=(e=PE.findString(PE.getOverlayOffset(),Math.min(256,PE.getOverlaySize()),"Inno Setup Messages"))&&(getVersionAndOptions(e+21),bDetected=!0),bDetected||-1!=(e=PE.findString(PE.section[0].FileOffset,PE.section[0].FileSize,"Inno Setup version"))&&(getVersionAndOptions(e+19),bDetected=!0),bDetected||(getVersion("DATA")||getVersion(".data"))&&(bDetected=!0)),bDetected||(PE.compareOverlay("'Inno Setup Messages'")?(sOptions="uninstall",getVersionAndOptions(PE.getOverlayOffset()+21),bDetected=!0):PE.compareOverlay("'Inno Setup Setup Data'")&&(getVersionAndOptions(PE.getOverlayOffset()+23),bDetected=!0)),PE.compareOverlay("78da")?(sOptions="zlib",(PE.compareEP("558bec83c4..53565733c08945..8945")||PE.compareEP("558bec83c4..e8........e8........e8"))&&(bDetected=!0)):PE.compareOverlay("'Inno'",52)&&(sOptions="with stub",bDetected=!0),bDetected||PE.isNet()&&"This installation was built with Inno Setup."==PE.getVersionStringInfo("Comments")&&(bDetected=!0),result()}init("installer","Inno Setup Module")
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
function detect(){if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))for(var e=0;e<PE.resource.length;e++){if(854==PE.resource[e].Type||808==PE.resource[e].Type||884==PE.resource[e].Type){sVersion="7.10.11(i32)",bDetected=!0
|
||||
break}if(686==PE.resource[e].Type||640==PE.resource[e].Type){sVersion="6.59.09(i32)",bDetected=!0
|
||||
function detect(){if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15"))for(var e=0;e<PE.resource.length;e++){if(854==PE.resource[e].Type||808==PE.resource[e].Type||884==PE.resource[e].Type){sVersion="7.10.11, i32",bDetected=!0
|
||||
break}if(686==PE.resource[e].Type||640==PE.resource[e].Type){sVersion="6.59.09, i32",bDetected=!0
|
||||
break}}return result()}init("installer","Instalit")
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
function detect(){if(PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")){if(PE.isOverlayPresent())nOffset=PE.readByte(PE.getOverlayOffset())+PE.getOverlayOffset()+12,PE.compare("135d658c",nOffset)?(sVersion="3.X",bDetected=!0):PE.compare("'PK'0304",nOffset)&&(sVersion="3.X",sOptions="zip",bDetected=!0)
|
||||
else for(var e=0;e<PE.resource.length;e++)if(3e3==PE.resource[e].Type&&PE.compare("'SZDD'",PE.resource[e].Offset)){sVersion="2.x",bDetected=!0
|
||||
else for(var e=0;e<PE.resource.length;e++)if(3e3==PE.resource[e].Type&&PE.compare("'SZDD'",PE.resource[e].Offset)){sVersion="2.X",bDetected=!0
|
||||
break}PE.isSectionNamePresent("_cabinet")&&(bDetected=!0)}else PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")?-1!==PE.findSignature(PE.getOverlayOffset(),256,"'InstallShield Native Installer'")?(sName+=" Java Edition",bDetected=!0):-1!==PE.findSignature(PE.getOverlayOffset(),256,"'setup.class'")&&(sName+=" Java Edition",sVersion="3.X",bDetected=!0):PE.compareEP("558BEC83EC4456FF15........8BF085F675086AFFFF15........8A06578B3D")?bDetected=!0:PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d2")?-1!==PE.findSignature(PE.getOverlayOffset(),Math.min(8192,PE.getOverlaySize()),"'ISc('")&&(sVersion="19.X",bDetected=!0):PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7")?-1!==PE.findSignature(PE.getOverlayOffset(),Math.min(8192,PE.getOverlaySize()),"'ISSetupStream'")&&(sVersion="18.X",bDetected=!0):PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc7")?-1!==PE.findSignature(PE.getOverlayOffset(),Math.min(65536,PE.getOverlaySize()),"'ISc('")&&(sVersion="25.X",bDetected=!0):PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")?PE.compareOverlay("'ISSetupStream'")&&(sVersion="29.X",bDetected=!0):PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7")&&PE.compareOverlay("'ISSetupStream'")&&(sVersion="19.X",bDetected=!0)
|
||||
return"InstallShield"!=PE.getVersionStringInfo("ProductName").substr(0,13)&&"InstallShield Software Corporation"!=PE.getVersionStringInfo("CompanyName")||(sVersion=PE.getVersionStringInfo("FileVersion").replace(/, /g,".").trim(),bDetected=!0),bDetected||/InstallShield/.test(PE.getManifest())&&(bDetected=!0),result()}init("installer","InstallShield")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.compareEP("83ec..56ff15........8bf08a063c..75..8a46..463c..74..84c074..8a46..463c..75..803e..75..46eb")&&(bDetected=!0),sLang="C/C++",result()}init("compiler","Intel C/C++ Compiler")
|
||||
function detect(){if(!PE.isNet())return PE.compareEP("83ec..56ff15........8bf08a063c..75..8a46..463c..74..84c074..8a46..463c..75..803e..75..46eb")&&(bDetected=!0),sLang="C/C++",result()}init("compiler","Intel C/C++ Compiler")
|
||||
|
|
|
|||
1
dbs_min/db/PE/Intel_XeSS.4.sg
Normal file
1
dbs_min/db/PE/Intel_XeSS.4.sg
Normal file
|
|
@ -0,0 +1 @@
|
|||
function detect(){return PE.isLibraryPresent("libxess.dll")&&(bDetected=!0),result()}init("library","Intel XeSS")
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
function detect(){var t,e=PE.section[PE.nLastSection].FileOffset
|
||||
return PE.compare("E9........CC",e)&&(t=PE.section[PE.nLastSection].FileSize,-1!=(e=PE.findString(e,t,"Protected by IntelliProtector")))&&(sVersion=PE.getString(e+30),bDetected=!0),result()}init("protector","IntelliProtector")
|
||||
function detect(){var t=PE.section[PE.nLastSection].FileOffset
|
||||
return PE.compare("E9........CC",t)&&-1!=(t=PE.findString(t,PE.section[PE.nLastSection].FileSize,"Protected by IntelliProtector"))&&(sVersion=PE.getString(t+30),bDetected=!0),result()}init("protector","IntelliProtector")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&-1!=PE.findSignature(0,PE.getSize()-PE.getOverlaySize(),"0013'Inx .NET Obfuscator'0000")&&(bDetected=!0),result()}init("protector","Inx Obfuscator")
|
||||
function detect(){return PE.isNet()&&-1!=PE.findSignature(0,PE.getSize()-PE.getOverlaySize(),"0013'Inx .NET Obfuscator'0000")&&(bDetected=!0),result()}init("protector","Inx Obfuscator")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&PE.isNetObjectPresent("Microsoft.JScript.Vsa")&&(bDetected=!0),sLang="JavaScript",result()}init("compiler","JScript")
|
||||
function detect(){return PE.isNet()&&PE.isNetObjectPresent("Microsoft.JScript.Vsa")&&(bDetected=!0),sLang="JavaScript",result()}init("compiler","JScript")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&_getNumberOfResults("protector")<=1&&((PE.isSignatureInSectionPresent(0,"'KoiVM.Runtime'")||PE.isSignatureInSectionPresent(0,"'VMEntryRun'")||PE.isSignatureInSectionPresent(0,"'KoiVM'"))&&(bDetected=!0),sVersion="2.0+"),result()}init("protector","KoiVM")
|
||||
function detect(){return PE.isNet()&&_getNumberOfResults("protector")<=1&&((PE.isSignatureInSectionPresent(0,"'KoiVM'")||PE.isSignatureInSectionPresent(0,"'VMEntryRun'"))&&(bDetected=!0),sVersion="2.0+"),result()}init("protector","KoiVM")
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
function detect(){var t=PE.section[".rdata"]
|
||||
return t&&PE.isSignaturePresent(t.Offset,512,"6B006F0074006C0069006E0078002E00630069006E007400650072006F007000")&&(bDetected=!0),sLang="Kotlin",result()}init("compiler","Kotlin")
|
||||
function detect(){var t
|
||||
if(!PE.isNet())return(t=PE.section[".rdata"])&&PE.isSignaturePresent(t.Offset,512,"6B006F0074006C0069006E0078002E00630069006E007400650072006F007000")&&(bDetected=!0),sLang="Kotlin",result()}init("compiler","Kotlin")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.compareEP("64a1........5589e56a..68........68........506489..........83ec..53565789")&&(sVersion="1.3",bDetected=!0),sLang="C",result()}init("compiler","LCC-Win32")
|
||||
function detect(){if(!PE.isNet())return PE.compareEP("64a1........5589e56a..68........68........506489..........83ec..53565789")&&(sVersion="1.3",bDetected=!0),sLang="C",result()}init("compiler","LCC-Win32")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&PE.isNetObjectPresent(".protect")&&PE.isNetObjectPresent("haspdnert.dll")&&(bDetected=!0),result()}init("protector","SafeNet Sentinel LDK .NET")
|
||||
function detect(){return PE.isNet()&&PE.isNetObjectPresent(".protect")&&PE.isNetObjectPresent("haspdnert.dll")&&(bDetected=!0),result()}init("protector","SafeNet Sentinel LDK .NET")
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
function detect(){if(PE.isNET()){if(bDetected=!0,validateReferences(isPositive=!0,references=["System.Security.Cryptography","System.Collections.Generic","System.Resources","System.Reflection"]))return bDetected=!1,null
|
||||
PE.isSignatureInSectionPresent(0,"3c50726976617465496d706c656d656e746174696f6e44657461696c733e7b........................................................................7d")&&PE.isSignatureInSectionPresent(0,"24........................................................................")&&PE.isNetObjectPresent("<Initialize>o__SiteContainer0")&&PE.isNetObjectPresent("$$method0x6000005-1")&&PE.isNetObjectPresent("Assembly")&&PE.isNetObjectPresent("Rfc2898DeriveBytes")&&PE.isNetObjectPresent("AES_Decrypt")&&PE.isNetObjectPresent("<>p__Site1")&&!PE.isNetObjectPresent("Chainski")||(bDetected=!1)}return result()}function validateReferences(e,t){for(var i=0;i<t.length;i++){var n="00'"+t[i]+"'00"
|
||||
if(1==e){if(!PE.isSignatureInSectionPresent(0,n))return!0}else if(PE.isSignatureInSectionPresent(0,n))return!0}return!1}init("cryptor","LimeCrypter")
|
||||
function detect(){if(PE.isNet()){if(bDetected=!0,validateReferences(isPositive=!0,references=["System.Security.Cryptography","System.Collections.Generic","System.Resources","System.Reflection"]))return void(bDetected=!1)
|
||||
PE.isSignatureInSectionPresent(0,"3c50726976617465496d706c656d656e746174696f6e44657461696c733e7b........................................................................7d")&&PE.isSignatureInSectionPresent(0,"24........................................................................")&&PE.isNetObjectPresent("<Initialize>o__SiteContainer0")&&PE.isNetObjectPresent("$$method0x6000005-1")&&PE.isNetObjectPresent("Assembly")&&PE.isNetObjectPresent("Rfc2898DeriveBytes")&&PE.isNetObjectPresent("AES_Decrypt")&&PE.isNetObjectPresent("<>p__Site1")&&!PE.isNetObjectPresent("Chainski")||(bDetected=!1)}return result()}function validateReferences(e,t){for(var i=0;i<t.length;i++){var r="00'"+t[i]+"'00"
|
||||
if(1==e){if(!PE.isSignatureInSectionPresent(0,r))return!0}else if(PE.isSignatureInSectionPresent(0,r))return!0}return!1}init("cryptor","LimeCrypter")
|
||||
|
|
|
|||
|
|
@ -1,2 +1 @@
|
|||
function detect(){var e=PE.getString(46,13)
|
||||
return"It's .NET EXE"!=e&&"Win32 .EXE.\r\n"!=e&&"Win64 .EXE.\r\n"!=e&&"Win32 .DLL.\r\n"!=e&&"Win64 .DLL.\r\n"!=e||(-1!=(e=PE.findString(496,16,"v"))&&(sVersion=PE.getString(e+1,511-e)),bDetected=!0),bDetected||PE.isNET()||(PE.compareEP("575653515255e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb")?(sVersion="0.71-0.75",bDetected=!0):PE.compareEP("60e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb")?(sVersion="0.77",bDetected=!0):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc857498a4439..74..880431eb")?(sVersion="0.85-0.97",bDetected=!0):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..74..880431eb")?(sVersion="1.27",bDetected=!0):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..88043175")&&(sVersion="2.01-2.12",bDetected=!0),PE.isPEPlus()&&(PE.compareEP("57565351524150e8$$$$$$$$488d05........488b304803f0482bc0488bfe66adc1e0..488bc8ad2bc84803f18bc8ffc98a4439..74..880431eb")?(sVersion="0.71-0.92",bDetected=!0):PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857ffc98a4439..74..880431eb")?(sVersion="0.97",bDetected=!0):PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857448bc1ffc98a4439..88043175")&&(sVersion="1.27-2.12",bDetected=!0))),result()}init("packer","MPRESS")
|
||||
function detect(){switch(PE.getString(46,13)){case"It's .NET EXE":case"Win32 .EXE.\r\n":case"Win64 .EXE.\r\n":case"Win32 .DLL.\r\n":case"Win64 .DLL.\r\n":var e=PE.findString(496,16,"v");-1!=e&&(sVersion=PE.getString(e+1,511-e)),bDetected=!0}return bDetected||PE.isNet()||(PE.compareEP("575653515255e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb")?(sVersion="0.71-0.75",bDetected=!0):PE.compareEP("60e8$$$$$$$$e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc8ad2bc803f18bc8498a4439..74..880431eb")?(sVersion="0.77",bDetected=!0):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc857498a4439..74..880431eb")?(sVersion="0.85-0.97",bDetected=!0):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..74..880431eb")?(sVersion="1.27",bDetected=!0):PE.compareEP("60e8$$$$$$$$5805........8b3003f02bc08bfe66adc1e0..8bc850ad2bc803f18bc85751498a4439..88043175")&&(sVersion="2.01-2.12",bDetected=!0),PE.is64()&&(PE.compareEP("57565351524150e8$$$$$$$$488d05........488b304803f0482bc0488bfe66adc1e0..488bc8ad2bc84803f18bc8ffc98a4439..74..880431eb")?(sVersion="0.71-0.92",bDetected=!0):PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857ffc98a4439..74..880431eb")?(sVersion="0.97",bDetected=!0):PE.compareEP("57565351524150488d05........488b304803f0482bc0488bfe66adc1e0..488bc850ad2bc84803f18bc857448bc1ffc98a4439..88043175")&&(sVersion="1.27-2.12",bDetected=!0))),result()}init("packer","MPRESS")
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isSectionNamePresent(".MaskPE")&&PE.compareEP("60")&&-1!==PE.findSignature(PE.nEP,256,"6160e8........8bc33e8b..40e8")&&(sVersion="2.0",bDetected=!0),result()}init("protector","MaskPE")
|
||||
function detect(){return PE.isSectionNamePresent(".MaskPE")&&PE.compareEP("60")&&-1!==PE.findSignature(PE.getEntryPointOffset(),256,"6160e8........8bc33e8b..40e8")&&(sVersion="2.0",bDetected=!0),result()}init("protector","MaskPE")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&(PE.isNetObjectPresent("Attick.dll")&&PE.isNetObjectPresent("CheckRuntime")?(sVersion="1.X",sOptions="runtime",bDetected=!0):PE.isSignatureInSectionPresent(0,"00'InfaceMax 'ffffff005f175920ffff00'toCode_interface'00")?(sVersion="1.X",bDetected=!0):PE.isNetObjectPresent("MRuntime3.dll")&&(sVersion="3.X",bDetected=!0)),result()}init("protector","Maxtocode")
|
||||
function detect(){return PE.isNet()&&(PE.isNetObjectPresent("Attick.dll")&&PE.isNetObjectPresent("CheckRuntime")?(sVersion="1.X",sOptions="Runtime",bDetected=!0):PE.isSignatureInSectionPresent(0,"00'InfaceMax 'ffffff005f175920ffff00'toCode_interface'00")?(sVersion="1.X",bDetected=!0):PE.isNetObjectPresent("MRuntime3.dll")&&(sVersion="3.X",bDetected=!0)),result()}init("protector","Maxtocode")
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -1,3 +1,3 @@
|
|||
function getMinGWVersion(){var e,i,t="",n=PE.section[".rdata"]
|
||||
return t=n&&(e=n.FileOffset,n=n.FileSize,""==(t=-1!=(i=PE.findString(e,n,"GCC: "))?PE.getString(i,128):t))&&-1!=(i=PE.findString(e,n,"gcc-"))?(t=PE.getString(i)).substring(0,t.indexOf("/")):t}function detect(){var e,i
|
||||
return!n||(e=n.FileOffset,n=n.FileSize,t=-1!=(i=PE.findString(e,n,"GCC: "))?PE.getString(i,128):t)||-1!=(i=PE.findString(e,n,"gcc-"))&&(t=(t=PE.getString(i)).substring(0,t.indexOf("/"))),t}function detect(){var e,i
|
||||
return 2==PE.getMajorLinkerVersion()&&(e=PE.getMinorLinkerVersion(),bFPC||!(e<=30||36==e||41==e||44==e||56==e)||!PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'00000000000000'PE'0000")||PE.isSectionNamePresent(".rsrc")&&(e=PE.section[".rsrc"],PE.isSignaturePresent(e.FileOffset+e.FileOffset-512,512,"'Microsoft Corp.'"))||(bDetected=!0)),bDetected?sVersion=getMinGWVersion():(e=PE.section[".buildid"],i=PE.section[".rdata"],!(bDetected=i?PE.isSignaturePresent(i.FileOffset,256,"'mingw'"):bDetected)&&e&&i&&(bDetected=PE.isSignaturePresent(i.FileOffset,i.FileSize,"'Mingw'"))),bDetected&&!PE.isOverlayPresent()&&(sOptions="stripped"),sLang="C/C++",result()}init("compiler","MinGW"),includeScript("FPC")
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
function detect(){if(PE.compareEP("558BEC83C4F0B8........E8....FFFF6A0068........6A0A6A00E8....FFFFE8....FFFF8D4000")){switch(PE.readWord(PE.nEP+33)){case 62959:sVersion="1.0"
|
||||
function detect(){if(PE.compareEP("558BEC83C4F0B8........E8....FFFF6A0068........6A0A6A00E8....FFFFE8....FFFF8D4000")){switch(PE.readWord(PE.getEntryPointOffset()+33)){case 62959:sVersion="1.0"
|
||||
break
|
||||
case 62847:sVersion="1.1"
|
||||
break
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&PE.isSignatureInSectionPresent(0,"00'NetzStarter'00'netz'00")&&(bDetected=!0),result()}init("packer",".NETZ")
|
||||
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"00'NetzStarter'00'netz'00")&&(bDetected=!0),result()}init("packer",".NETZ")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
function detect(){return PE.isNET()&&PE.isSignatureInSectionPresent(0,"'Protected_By_Attribute'00'NETSpider.Attribute'")&&(sVersion="0.5-1.3",bDetected=!0),result()}init("protector",".NET Spider")
|
||||
function detect(){return PE.isNet()&&PE.isSignatureInSectionPresent(0,"'Protected_By_Attribute'00'NETSpider.Attribute'")&&(sVersion="0.5-1.3",bDetected=!0),result()}init("protector",".NET Spider")
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
function detect(){if(PE.isNET()){if("It's NecroVM!"==PE.getString(46,13)&&PE.isSignatureInSectionPresent(0,"5F00'VmLoad'00'mscorlib'"))return n="",-1!=(r=PE.findString(496,16,"v"))&&(n=PE.getString(r+1,511-r)),_setResult("packer","NecroVM Compressor",n,"LZMAT"),""
|
||||
function detect(){if(PE.isNet()){if("It's NecroVM!"==PE.getString(46,13)&&PE.isSignatureInSectionPresent(0,"5F00'VmLoad'00'mscorlib'"))return n="",-1!=(r=PE.findString(496,16,"v"))&&(n=PE.getString(r+1,511-r)),_setResult("packer","NecroVM Compressor",n,"LZMAT"),""
|
||||
for(var e=["System.Reflection","System.Security.Cryptography","System.Runtime.InteropServices"],t=0;t<e.length;t++)if(!PE.isSignatureInSectionPresent(0,"00'"+e[t]+"'00"))return""
|
||||
var n,r="NecroVM.Runtime"
|
||||
PE.isSignatureInSectionPresent(0,"50??'"+r+"'")&&PE.isNetObjectPresent(r)&&PE.isSignatureInSectionPresent(0,"'info'00'flags'00'nativeEntry'00'nativeSizeOfCode'")&&(PE.isSignatureInSectionPresent(0,"0005'_'00'_'00")&&_setResult("protection","NecroVM Code Container","",""),PE.isSignatureInSectionPresent(0,"2000690073002000740061006d00700065007200650064002e00")&&_setResult("protection","NecroVM Anti-Tamper","",""),n="Virtualization",PE.isSignatureInSectionPresent(0,"00'm_1'")&&(n+=" + Obfuscation"),_setResult("protector","NecroVM","2.X",n))}return result()}
|
||||
|
|
@ -1,5 +1,4 @@
|
|||
function detect(){var e=!1,t="",n=""
|
||||
if(PE.section[".reacto"]?0==PE.section[1].FileSize&&0==PE.section[2].FileSize&&0==PE.section[3].FileSize&&(n="2.0-2.1"):PE.compareEP("558becb90f0000006a006a004975f951535657b8........e8")?n="2.X-3.X":PE.resource.__&&PE.compareEP("e8$$$$$$$$8bff558bec83ec10")?PE.compareEP("e8........e9........6a0c68")?n="4.2":PE.compareEP("e8........e9........8bff558bec83ec208b45085657")&&(n="4.5-4.7"):PE.isNET()&&(PE.isSignatureInSectionPresent(0,"558becb90f0000006a006a004975f951535657b8........e8")?n="3.X":2<=PE.section.length&&3221225536==PE.section[1].Characteristics&&PE.isSignatureInSectionPresent(1,"5266686E204D182276B5331112330C6D0A204D18229EA129611C76B505190158")&&(n="4.8-4.9")),PE.isNET()){if(PE.isNetObjectPresent("NecroVM.Runtime"))return null
|
||||
PE.isSignatureInSectionPresent(0,"6D5F6973526561644F6E6C790B636F6D70617265496E666F0874657874496E666F076E756D496E666F0C6461746554696D65496E666F0863616C656E6461720A6D5F646174614974656D0963756C747572654944066D5F6E616D65116D5F757365557365724F76657272696465")&&(n="6.X")
|
||||
if(PE.section[".reacto"]?0==PE.section[1].FileSize&&0==PE.section[2].FileSize&&0==PE.section[3].FileSize&&(n="2.0-2.1"):PE.compareEP("558becb90f0000006a006a004975f951535657b8........e8")?n="2.X-3.X":PE.resource.__&&PE.compareEP("e8$$$$$$$$8bff558bec83ec10")?PE.compareEP("e8........e9........6a0c68")?n="4.2":PE.compareEP("e8........e9........8bff558bec83ec208b45085657")&&(n="4.5-4.7"):PE.isNet()&&(PE.isSignatureInSectionPresent(0,"558becb90f0000006a006a004975f951535657b8........e8")?n="3.X":2<=PE.section.length&&3221225536==PE.section[1].Characteristics&&PE.isSignatureInSectionPresent(1,"5266686E204D182276B5331112330C6D0A204D18229EA129611C76B505190158")&&(n="4.8-4.9")),PE.isNet()&&!PE.isNetObjectPresent("NecroVM.Runtime")){PE.isSignatureInSectionPresent(0,"6D5F6973526561644F6E6C790B636F6D70617265496E666F0874657874496E666F076E756D496E666F0C6461746554696D65496E666F0863616C656E6461720A6D5F646174614974656D0963756C747572654944066D5F6E616D65116D5F757365557365724F76657272696465")&&(n="6.X")
|
||||
for(var i="",r=0;r<5;r++)i+="'m_'%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%00"
|
||||
PE.isSignatureInSectionPresent(0,i)&&(t+="Control Flow",n="6.X"),PE.isSignatureInSectionPresent(0,"24246D6574686F643078363030303331372D310024246D6574686F643078363030303333322D310024246D6574686F643078363030303333322D320024246D6574686F643078363030303334302D310024246D6574686F643078363030303334302D320024246D6574686F643078363030303335332D310024246D6574686F64")&&(n="6.5"),PE.isSignatureInSectionPresent(0,"2000690073002000740061006D00700065007200650064002E00")&&PE.isNetObjectPresent("BinaryReader")&&(t+=(0!=t.length?" + ":"")+"Anti-Tamper"),PE.isSignatureInSectionPresent(0,"45007A006900720069007A0027007300200022002E004E00450054002000520065006100630074006F0072002200210020005400680069007300200061")&&PE.isNetObjectPresent("DateTime")&&(n+=(0!=n.length?" ":"")+"Unregistered"),(e=0==t.length&&0==n.length?e:!0)&&(PE.isNetObjectPresent("SuppressIldasmAttribute")&&(t+=(0!=t.length?" + ":"")+"Anti-ILDASM"),_setResult("protector",".NET Reactor",n,t))}}init("protector",".NET Reactor")
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
function detect(){if(PE.isNET()){if(bDetected=!0,validateReferences(isPositive=!0,references=["System.Security.Cryptography","System.Text","System.CodeDom.Compiler","System.Reflection"]))return bDetected=!1,null
|
||||
PE.isSectionNamePresent("!Sugar")||(bDetected=!1),PE.isNetObjectPresent("_Lambda$__1")&&PE.isNetObjectPresent("_Lambda$__2")&&PE.isNetObjectPresent("k.exe")||(sOptions+="renaming"),PE.isNetObjectPresent("ConfusedByAttribute")&&(sOptions+=(sOptions?" + ":"")+"fake signs")}return result()}function validateReferences(e,t){for(var r=0;r<t.length;r++){var i="00'"+t[r]+"'00"
|
||||
if(1==e){if(!PE.isSignatureInSectionPresent(0,i))return!0}else if(PE.isSignatureInSectionPresent(0,i))return!0}return!1}init("protector","NetShield Protector")
|
||||
function detect(){if(PE.isNet()){if(bDetected=!0,validateReferences(isPositive=!0,references=["System.Security.Cryptography","System.Text","System.CodeDom.Compiler","System.Reflection"]))return void(bDetected=!1)
|
||||
PE.isSectionNamePresent("!Sugar")||(bDetected=!1),PE.isNetObjectPresent("_Lambda$__1")&&PE.isNetObjectPresent("_Lambda$__2")&&PE.isNetObjectPresent("k.exe")||(sOptions+="renaming"),PE.isNetObjectPresent("ConfusedByAttribute")&&(sOptions+=(sOptions?" + ":"")+"fake signs")}return result()}function validateReferences(e,t){for(var i=0;i<t.length;i++){var n="00'"+t[i]+"'00"
|
||||
if(1==e){if(!PE.isSignatureInSectionPresent(0,n))return!0}else if(PE.isSignatureInSectionPresent(0,n))return!0}return!1}init("protector","NetShield")
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue