mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
Add detection for the .NET 'sqlite-net' library in the PE scanner. Inserted a comment linking to the sqlite-net GitHub repo and added logic: if not already detected and PE.isNet() and PE.isNetObjectPresent("SQLite-net"), append -net to sName and set bDetected = true. This enables identifying sqlite-net in .NET PE files.
46 lines
No EOL
1.1 KiB
JavaScript
46 lines
No EOL
1.1 KiB
JavaScript
// Detect It Easy: detection rule file
|
|
|
|
// Author: DosX
|
|
// E-Mail: collab@kay-software.ru
|
|
// GitHub: https://github.com/DosX-dev
|
|
// Telegram: @DosX_dev
|
|
|
|
// https://github.com/praeclarum/sqlite-net (.NET)
|
|
meta("library", "SQLite");
|
|
|
|
function detect() {
|
|
var sLibrary = PE.isLibraryPresentExp(/sqlite\d+/i);
|
|
if (sLibrary) {
|
|
var match = /sqlite(\d+)/i.exec(sLibrary);
|
|
|
|
if (match) {
|
|
sVersion = match[1];
|
|
}
|
|
|
|
bDetected = true;
|
|
} else {
|
|
var sExportFunction = PE.isExportFunctionPresentExp(/sqlite\d+/i);
|
|
if (sExportFunction) {
|
|
sOptions = "static"; // EAT
|
|
|
|
var match = /sqlite(\d+)/i.exec(sExportFunction);
|
|
|
|
if (match) {
|
|
sVersion = match[1];
|
|
}
|
|
|
|
bDetected = true;
|
|
} else if (PE.isLibraryPresentExp(/sqlite|sqlmin|sqllang|sqltses|sqldk/i)) {
|
|
bDetected = true;
|
|
}
|
|
}
|
|
|
|
if (!bDetected && PE.isNet()) {
|
|
if (PE.isNetObjectPresent("SQLite-net")) {
|
|
sName += "-net";
|
|
bDetected = true;
|
|
}
|
|
}
|
|
|
|
return result();
|
|
} |