mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
37 lines
No EOL
1.1 KiB
JavaScript
Executable file
37 lines
No EOL
1.1 KiB
JavaScript
Executable file
// Detect It Easy: detection rule file
|
|
// Author: hypn0 <hypn0@mail.ru>
|
|
|
|
init("packer", "XPACK");
|
|
|
|
function detect() {
|
|
if (MSDOS.compareEP("8becfa33c08ed0bc....2e8f06....2e8f06....eb$$0ebb....535feb$$178be5fb48d1e8eb")) {
|
|
sVersion = "1.52";
|
|
bDetected = true;
|
|
}
|
|
if (MSDOS.compareEP("e90000e9$$$$2ec706........8beceb$$2ec606......eb009a")) {
|
|
sVersion = "1.0j";
|
|
bDetected = true;
|
|
}
|
|
if (MSDOS.compareEP("b8....15....8beceb$$b8....ffe0")) {
|
|
sVersion = "1.65, 1.66";
|
|
bDetected = true;
|
|
}
|
|
if (MSDOS.compareEP("b8....15....813e........e8$$$$e8$$$$eb$$1e0e1f8beceb")) {
|
|
sVersion = "1.67.l";
|
|
bDetected = true;
|
|
}
|
|
if (MSDOS.compareEP("b8....15....eb$$b8....ffe0")) {
|
|
sVersion = "1.67j";
|
|
bDetected = true;
|
|
}
|
|
if (MSDOS.compareEP("8beceb$$b8....ffe0")) {
|
|
sVersion = "1.65b2";
|
|
bDetected = true;
|
|
}
|
|
if (MSDOS.compareEP("e9$$$$8beceb$$b8....ffe0")) {
|
|
sVersion = "1.44";
|
|
bDetected = true;
|
|
}
|
|
|
|
return result();
|
|
} |