// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "MARX Crypto-Box dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    if (PE.findString(0, nSize, "MARXDEV1.SYS") !== -1) {
        bDetected = true;
    } else {
        var nOffset = 0;
        var foundOffset;
        while (true) {
            foundOffset = PE.findString(nOffset, nSize - nOffset, "\\.\\");
            if (foundOffset === -1) break;
            nOffset = foundOffset + 4;
            if (PE.compare("'MARXDEV'", nOffset) ||
                PE.compare("'Cb7Dev'", nOffset) ||
                PE.compare("'CB7'", nOffset) ||
                PE.compare("'CBUSB'", nOffset)) {
                bDetected = true;
                break;
            }
        }
    }

    return result();
}