mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
09e52a2dc9
Renamed and reorganized numerous database files across APK, DEX, ELF, PE, and other directories to use consistent prefixes such as 'library_', 'protector_', 'packer_', 'cryptor_', 'tool_', and similar. This improves clarity, maintainability, and categorization of the database entries.
66 lines
No EOL
2.1 KiB
JavaScript
66 lines
No EOL
2.1 KiB
JavaScript
// Detect It Easy: detection rule file
|
|
|
|
// Author: DosX
|
|
// E-Mail: collab@kay-software.ru
|
|
// GitHub: https://github.com/DosX-dev
|
|
// Telegram: @DosX_dev
|
|
|
|
// https://vmpsoft.com/
|
|
meta("protector", "VMProtect");
|
|
|
|
function detect() {
|
|
|
|
if (PE.isNet() &&
|
|
PE.isNetGlobalCctorPresent() &&
|
|
PE.getNumberOfSections() >= 3 &&
|
|
PE.isNetObjectPresent("SuppressIldasmAttribute") &&
|
|
PE.isNetObjectPresent("kernel32") &&
|
|
PE.isNetObjectPresent("get_IsAttached") &&
|
|
PE.isNetObjectPresent("OpCodes")) {
|
|
|
|
const
|
|
chunk = "%% %% %% %% %% %% %% %% 00", // chunk size is 8 bytes
|
|
scanBytes = PE.getSize() - PE.getOverlaySize();
|
|
|
|
var globalBigPattern = "00";
|
|
|
|
for (var i = 0; i < 12; i++) {
|
|
globalBigPattern += chunk;
|
|
}
|
|
|
|
var firstSection = PE.section[0];
|
|
|
|
if (PE.isSignaturePresent(firstSection.FileOffset, scanBytes, "'<Module>' 00" + chunk) &&
|
|
PE.isSignaturePresent(firstSection.FileOffset, scanBytes, globalBigPattern)) {
|
|
sVersion = "3.X";
|
|
bDetected = true;
|
|
}
|
|
|
|
|
|
if (bDetected) {
|
|
if (PE.isSignaturePresent(firstSection.FileOffset, scanBytes, generateUnicodeSignatureMask("Program will be terminated."))) { // Unicode [global] string
|
|
sOptions = "Resources protection";
|
|
}
|
|
|
|
var sectionNameCollision = PE.getSectionNameCollision("0", "1");
|
|
|
|
if (sectionNameCollision === ".vmp") {
|
|
sVersion = "2.X-3.X";
|
|
} else if (sectionNameCollision) {
|
|
sOptions += (sOptions.length != 0 ? " + " : "") + "Custom sections";
|
|
}
|
|
|
|
bDetected = bDetected && !PE.isNetObjectPresent("VMProtect"); // fake signature
|
|
}
|
|
}
|
|
|
|
return result();
|
|
}
|
|
|
|
function generateUnicodeSignatureMask(inputString) {
|
|
var output = "";
|
|
for (var c = 0; c < inputString.length; c++) { output += (c != 0 ? "00" : "") + "'" + inputString[c] + "'"; }
|
|
return output;
|
|
}
|
|
|
|
// Hello Ivan Permyakov and thanks for your contribution to Open Source!
|