mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
4eebb1c386
Renamed numerous db_extra/PE and db/Binary rule files to use consistent prefixes (e.g., cryptor_, protector_, installer_, etc.) for improved organization and clarity. Minor metadata and whitespace adjustments were made in a few files to match naming conventions.
20 lines
No EOL
547 B
JavaScript
20 lines
No EOL
547 B
JavaScript
// Detect It Easy: detection rule file
|
|
|
|
meta("protector", "Adept Protector");
|
|
|
|
function detect() {
|
|
if (PE.isNET()) {
|
|
var nOffset = PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "ByAdeptProtector");
|
|
if (nOffset != -1) {
|
|
if (PE.compare("'Smashed'", nOffset - 7)) {
|
|
sOptions = "Evaluation";
|
|
} else if (PE.compare("'STAThreadAttribute'", nOffset + 17)) {
|
|
sVersion = "2.1";
|
|
}
|
|
|
|
bDetected = true;
|
|
}
|
|
}
|
|
|
|
return result();
|
|
} |