Detect-It-Easy/db/PE/protector_CodeVeil.2.sg

// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "CodeVeil");

function detect() {
    if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$8bff60e8$$$$$$$$5ee8")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.isNet()) {
        if (PE.isNetObjectPresent("____KILL")) {
            sVersion = "4.X";
            bDetected = true;
        } else if (PE.isNetUStringPresent("E_TamperDetected")) {
            sVersion = "3.X-4.X";
            bDetected = true;
        }
    }

    return result();
}