mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
09e52a2dc9
Renamed and reorganized numerous database files across APK, DEX, ELF, PE, and other directories to use consistent prefixes such as 'library_', 'protector_', 'packer_', 'cryptor_', 'tool_', and similar. This improves clarity, maintainability, and categorization of the database entries.
32 lines
No EOL
818 B
JavaScript
32 lines
No EOL
818 B
JavaScript
// Detect It Easy: detection rule file
|
|
|
|
// Author: DosX
|
|
// E-Mail: collab@kay-software.ru
|
|
// GitHub: https://github.com/DosX-dev
|
|
// Telegram: @DosX_dev
|
|
|
|
meta("library", "Lua Runtime");
|
|
|
|
function detect() {
|
|
if (PE.isLibraryPresentExp(/^lua5/i)) {
|
|
sLang = "Lua";
|
|
sVersion = "5.X";
|
|
bDetected = true;
|
|
} else if (PE.isExportFunctionPresentExp(/^lua(L)?_/)) {
|
|
sOptions = "static"; // EAT
|
|
bDetected = true;
|
|
|
|
var rdataSection = PE.section[".rdata"];
|
|
|
|
if (rdataSection) {
|
|
var embeddedLuaVersion = PE.findSignature(rdataSection.FileOffset, rdataSection.FileSize, "'Lua ' %% '.' %%");
|
|
|
|
if (embeddedLuaVersion !== -1) {
|
|
sVersion = PE.getString(embeddedLuaVersion + 4, 3);
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
return result();
|
|
} |