mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
75 lines
2.2 KiB
Text
75 lines
2.2 KiB
Text
// DIE's signature file
|
|
|
|
init("packer","WWPACK");
|
|
|
|
function detect(bShowType,bShowVersion,bShowOptions)
|
|
{
|
|
if(MSDOS.compare("'WWP'",0x1c))
|
|
{
|
|
if(MSDOS.compareEP("B8....8CCA03D08CC981C1....51"))
|
|
{
|
|
if(MSDOS.compareEP("6A..06068CD383....536A..FC",14))
|
|
{
|
|
sVersion="3.00";
|
|
sOptions="Extractable";
|
|
}
|
|
else if(MSDOS.compareEP("33C9B1..510606BB....538CD3",14))
|
|
{
|
|
sVersion="3.02";
|
|
sOptions="Extractable";
|
|
}
|
|
else if(MSDOS.compareEP("BB....53",20))
|
|
{
|
|
sVersion="3.03";
|
|
}
|
|
else if(MSDOS.compareEP("B1..518CD3",20))
|
|
{
|
|
sVersion="3.05c4";
|
|
sOptions="Modified";
|
|
}
|
|
}
|
|
else if(MSDOS.compareEP("BE....BA....BF....B9....8CCD8EDD81ED....06068BDD2BDA8BD3FC"))
|
|
{
|
|
sVersion="3.00";
|
|
sOptions="Relocations pack";
|
|
}
|
|
else if(MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA1E8EDB011533C02EAC"))
|
|
{
|
|
sVersion="3.02";
|
|
sOptions="Relocations pack";
|
|
}
|
|
else if(MSDOS.compareEP("0305....B8....8CCA03D08CC981C1....51B9....510606B1..518CD3"))
|
|
{
|
|
sVersion="3.05c4";
|
|
if(MSDOS.compareEP("1A",3))
|
|
{
|
|
sOptions="Extractable";
|
|
}
|
|
else if(MSDOS.compareEP("1B",3))
|
|
{
|
|
sOptions="Unextractable";
|
|
}
|
|
if(MSDOS.compareEP("C0",2))
|
|
{
|
|
sOptions=sOptions.append("Password check","Virus shield");
|
|
}
|
|
else if(MSDOS.compareEP("80",2))
|
|
{
|
|
sOptions=sOptions.append("Password check");
|
|
}
|
|
else if(MSDOS.compareEP("40",2))
|
|
{
|
|
sOptions=sOptions.append("Virus shield");
|
|
}
|
|
}
|
|
bDetected=1;
|
|
}
|
|
else if(MSDOS.compareEP("BE....BF....B9....8CCD81ED....8BDD81EB....8BD3FCFA"))
|
|
{
|
|
sVersion="3.04/3.05";
|
|
sOptions="Relocations pack";
|
|
bDetected=1;
|
|
}
|
|
|
|
return result(bShowType,bShowVersion,bShowOptions);
|
|
}
|