// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "PROTECT! EXE");

includeScript("read");

function detect() {

    var bEnableNewEngine = true; // Need more researches

    if (bEnableNewEngine) {
        var a1 = [0xFD, 0x1E, 0x0E, 0x0E, 0x07, 0x1F], a2 = [0xFD, 0x1E, 0x0E, 0x07, 0x0E, 0x1F],
            a3 = [0xFC, 0x1E, 0x0E, 0x1F, 0x0E, 0x07], a4 = [0xFC, 0x1E, 0x0E, 0x0E, 0x1F, 0x07],
            a5 = [0x1E, 0xFD, 0x0E, 0x07, 0x0E, 0x1F], a6 = [0x1E, 0xFD, 0x0E, 0x0E, 0x07, 0x1F],
            a7 = [0x1E, 0xFC, 0x0E, 0x1F, 0x0E, 0x07], a8 = [0x1E, 0xFC, 0x0E, 0x0E, 0x1F, 0x07],
            bt = [0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
            cnt_arr = 0,
            ep = MSDOS.OffsetToVA(MSDOS.getEntryPointOffset()),
            count = 0;
        while (count < 0x50) {
            count++;
            var byte = MSDOS.readByte(MSDOS.VAToOffset(ep));
            if (byte == 0xFD || byte == 0x1E || byte == 0x0E || byte == 0x07 || byte == 0x1F || byte == 0xFC) {
                bt[cnt_arr] = byte; cnt_arr++;
            }
            if (cnt_arr == 6) { break; }
            ep = MSDOS.getDisasmNextAddress(ep);
        }
        if (compareArrays(a1, bt) || compareArrays(a2, bt) || compareArrays(a3, bt) ||
            compareArrays(a4, bt) || compareArrays(a5, bt) || compareArrays(a6, bt) ||
            compareArrays(a7, bt) || compareArrays(a8, bt)) { sVersion = "5.5"; bDetected = true; }
    }

    if (MSDOS.compareEP("1e0e0e1f07") || MSDOS.compareEP("1e0e0e071f") || MSDOS.compareEP("1e0e1f0e07")) {
        var b = MSDOS.readByte(MSDOS.getEntryPointOffset() + 5);
        if (b == 0xBA || b == 0xBB || b == 0xBD || b == 0xBE || b == 0xBF || b == 0xE8) {
            sVersion = "5.0"; sOptions = "type 1";
            bDetected = true;
        }
    } else if (MSDOS.compareEP("5053515657061e0e1f")) {
        sVersion = "5.0"; sOptions = "type 2";
        bDetected = true;
    } else if (MSDOS.compareEP("0e071e0e1f")) {
        var b = MSDOS.readByte(MSDOS.getEntryPointOffset() + 5);
        if (b == 0xBA || b == 0xBB || b == 0xBD || b == 0xBE || b == 0xBF) {
            sVersion = "4.1";
            bDetected = true;
        }
    } else if (MSDOS.compareEP("8cdb0e0e1f07b9....e800005e81c6....89f7ac34..aae2")) {
        sVersion = "4.0";
        bDetected = true;
    } else if (MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ed8fafcbe....0e07")) {
        sVersion = "3.1";
        bDetected = true;
    } else if (MSDOS.compareEP("2ea3....8cd82ea3....8cc82ea3....2e892e....33c08ec0fafc26a1....2ea3....26a1")) {
        sVersion = "3.0";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$1e068cc88ed88ec0be....8bfeb9....ac")) {
        sVersion = "2.0";
        bDetected = true;
    } else if (MSDOS.compareEP("e8$$$$1e068cc88ed88ec02ec606")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("8cd805....50b8....501e068cda83c2..b9....be....0e1fad8bd8ad03c28ec0260117e2")) {
        sOptions = "relocpacker";
        sVersion = "1.0";
        bDetected = true;
    } else if (MSDOS.compareEP("1eb430cd213c..73..cd20be....e8....e8")) {
        sVersion = "6.0";
        bDetected = true;
    }
    return result();
}