mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
4d6d56cc30
In detect(), assign sType.toLowerCase() to a local variable and only append it to sOptions when non-empty. This prevents empty strings from being added to sOptions when the debug type is blank, making debug data type handling more robust.
54 lines
1.8 KiB
JavaScript
Executable file
54 lines
1.8 KiB
JavaScript
Executable file
// Detect It Easy: detection rule file
|
|
// Author: horsicq <horsicq@gmail.com>
|
|
// Enhanced: DosX
|
|
|
|
// Reports each PE Debug Directory entry as a separate detection result.
|
|
// For UNKNOWN-typed entries the raw data is inspected to identify the format.
|
|
|
|
meta("debug data", "Records");
|
|
|
|
function detect() {
|
|
var numOfDebugDataRecords = PE.getNumberOfDebugDataRecords();
|
|
|
|
if (numOfDebugDataRecords > 0) {
|
|
bDetected = true;
|
|
}
|
|
|
|
for (var i = 0; i < numOfDebugDataRecords; i++) {
|
|
var sType = PE.getDebugDataType(i);
|
|
|
|
if (sType === "UNKNOWN") {
|
|
detectUnknownDebugData(PE.getDebugDataOffset(i), PE.getDebugDataSize(i));
|
|
} else {
|
|
var typeToAppend = sType.toLowerCase();
|
|
|
|
if (typeToAppend) {
|
|
sOptions = sOptions.append(typeToAppend);
|
|
}
|
|
}
|
|
}
|
|
|
|
return result();
|
|
}
|
|
|
|
function detectUnknownDebugData(nDataOffset, nDataSize) {
|
|
if (nDataSize < 2) {
|
|
return;
|
|
}
|
|
|
|
// Borland TDS (Turbo Debugger Symbols)
|
|
if (PE.readWord(nDataOffset) === 0x52FB) {
|
|
var minor = PE.readByte(nDataOffset + 2),
|
|
major = PE.readByte(nDataOffset + 3),
|
|
minorStr = ((minor >> 4) * 10 + (minor & 0x0F)).toString(),
|
|
majorStr = ((major >> 4) * 10 + (major & 0x0F)).toString(),
|
|
sVer = majorStr + "." + minorStr,
|
|
nSymbols = PE.readWord(nDataOffset + 0xE);
|
|
|
|
_setResult("debug data", "Borland TDS", sVer, nSymbols ? (nSymbols + " symbols") : "");
|
|
} else if (PE.compare("'FB09'", nDataOffset)) {
|
|
_setResult("debug data", "Borland TDS", "", "Delphi TDS");
|
|
} else if (PE.compare("'FB0A'", nDataOffset)) {
|
|
_setResult("debug data", "Borland TDS", "", "C++ TDS");
|
|
}
|
|
}
|