Detect-It-Easy/db/PE/CodeVeil.2.sg

// Detect It Easy: detection rule file format

init("protector", "CodeVeil");

function detect() {
    if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$8bff60e8$$$$$$$$5ee8")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.isNET()) {
        if (PE.isNetObjectPresent("____KILL")) {
            sVersion = "4.X";
            bDetected = true;
        } else if (PE.isNetUStringPresent("E_TamperDetected")) {
            sVersion = "3.X-4.X";
            bDetected = true;
        }
    }

    return result();
}