Detect-It-Easy/db/PE/CodeVeil.2.sg

// DIE's signature file

init("protector","CodeVeil");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("e9$$$$$$$$e9$$$$$$$$8bff60e8$$$$$$$$5ee8"))
    {
        sVersion="1.2";
        bDetected=1;
    }
    else if(PE.isNET())
    {
        if(PE.isNETStringPresent("____KILL"))
        {
            sVersion="4.X";
            bDetected=1;
        }
        else if(PE.isNETUnicodeStringPresent("E_TamperDetected"))
        {
            sVersion="3.X-4.X";
            bDetected=1;
        }
    }

    return result(bShowType,bShowVersion,bShowOptions);
}