mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
Renamed MSDOS.AddressToOffset to MSDOS.addressToOffset for consistency and added a backward compatibility alias. Updated detection scripts to use the new method name. Renamed and updated several PE rule files for clarity and accuracy, including metadata corrections and minor code improvements.
58 lines
No EOL
1.6 KiB
Text
58 lines
No EOL
1.6 KiB
Text
// Detect It Easy: DiE-JS framework file
|
|
// Don't change anything unless you're sure about what you're doing
|
|
|
|
var File = MSDOS;
|
|
var X = MSDOS;
|
|
|
|
/**
|
|
* Get the “base” offset, after the header.
|
|
* @param {Int} [nOffset=0] - The offset from the base offset.
|
|
* @returns {Int}
|
|
*/
|
|
MSDOS.getBaseOffset = function (nOffset) {
|
|
if (arguments.length == 0) {
|
|
nOffset = 0;
|
|
}
|
|
return (MSDOS.readWord(8) << 4) + nOffset;
|
|
}
|
|
|
|
/**
|
|
* Translate segment/offset address pair to file offset.
|
|
* @param {UShort} nSegment - Segment address.
|
|
* @param {UShort} [nOffset=0] - Offset address.
|
|
* @returns {Int}
|
|
*/
|
|
MSDOS.addressToOffset = function (nSegment, nOffset) {
|
|
if (arguments.length == 1) {
|
|
nOffset = 0;
|
|
}
|
|
nOffset += nSegment << 4;
|
|
return MSDOS.getBaseOffset(nOffset & 0xFFFFF);
|
|
}
|
|
|
|
// Backward compatibility alias
|
|
MSDOS.AddressToOffset = function () { MSDOS.addressToOffset.apply(this, arguments); }
|
|
|
|
/**
|
|
* Get the entry point file offset.
|
|
* @param {Int} [nOffset=0] - The offset from the entry point.
|
|
* @returns {Int}
|
|
*/
|
|
MSDOS.getEntryPointOffset = function (nOffset) {
|
|
if (arguments.length == 0) {
|
|
nOffset = 0;
|
|
}
|
|
return MSDOS.addressToOffset(MSDOS.readWord(0x16), MSDOS.readWord(0x14)) + nOffset;
|
|
}
|
|
|
|
/**
|
|
* Get the NewExe (or LE/LX) file offset (assuming it's valid).
|
|
* @param {Int} [nOffset=0] - The offset from the NewExe offset.
|
|
* @returns {Int}
|
|
*/
|
|
MSDOS.getNEOffset = function (nOffset) {
|
|
if (arguments.length == 0) {
|
|
nOffset = 0;
|
|
}
|
|
return MSDOS.readDword(0x3C) + nOffset;
|
|
} |