mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
50 lines
1.3 KiB
Text
50 lines
1.3 KiB
Text
// DIE's signature file
|
|
|
|
init("installer","Inno Setup Module");
|
|
|
|
function getVersion(sSection)
|
|
{
|
|
if(PE.section[sSection])
|
|
{
|
|
var nOffset=PE.section[sSection].FileOffset;
|
|
var nSize=PE.section[sSection].FileSize;
|
|
if(nSize<0x2000)
|
|
{
|
|
var nInno=PE.findString(nOffset,nSize,"Inno Setup Setup Data");
|
|
if(nInno!=-1)
|
|
{
|
|
var sRawVersion=PE.getString(nInno+23);
|
|
sVersion=sRawVersion.substring(0,sRawVersion.indexOf(')'));
|
|
if(/\(u\)/.test(sRawVersion))
|
|
{
|
|
sOptions="unicode";
|
|
}
|
|
return 1;
|
|
}
|
|
else
|
|
{
|
|
nInno=PE.findSignature(nOffset,nSize,"'i1.'............'32'1A");
|
|
if(nInno!=-1)
|
|
{
|
|
sVersion=PE.getString(nInno+1).replace(/-.*/,"");
|
|
return 1;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
function detect(bShowType,bShowVersion,bShowOptions)
|
|
{
|
|
if(PE.compareOverlay("'zlb'1A")||PE.compareOverlay("'idska32'1A"))
|
|
{
|
|
if(getVersion("DATA")||getVersion(".data"))
|
|
{
|
|
bDetected=1;
|
|
}
|
|
}
|
|
|
|
return result(bShowType,bShowVersion,bShowOptions);
|
|
}
|