// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "nPack");

function detect() {
    if (PE.compareEP("833D..........7505E901000000C3E841000000B8........2B05........A3........E85E000000E8")) {
        switch (PE.getEntryPointSignature(42, 7)) {
            case "E0010000E8EC06": sVersion = "1.1.150.2006.Beta"; break;
            case "EC010000E8F806": sVersion = "1.1.200.2006.Beta"; break;
            default: sVersion = "1.1.XXX";
        }

        bDetected = true;
    } else if (PE.compareEP("833D..........7505E901000000C3E846000000E873000000B8........2B05........A3........E89C000000E8")) {
        switch (PE.readDword(PE.getEntryPointOffset() + 47)) {
            case 0x204: sVersion = "1.1.250.2006.Beta"; break;
            case 0x22D: sVersion = "1.1.300.2006.Beta"; break;
            case 0x248: sVersion = "1.1.800.2008.Beta"; break;
            default: sVersion = "1.1.XXX";
        }

        bDetected = true;
    } else if (PE.compareEP("833C24..0F84........8D6424") && PE.isImportPositionHashPresent(0, 0xba8bf4be)) {
        bDetected = true;
    }

    if (bDetected && !PE.isSectionNamePresent(".nPack")) {
        sOptions = "modified";
    }

    return result();
}
