// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "InstallShield");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.isOverlayPresent()) {
            nOffset = PE.readByte(PE.getOverlayOffset()) + PE.getOverlayOffset() + 12;
            if (PE.compare("135d658c", nOffset)) {
                sVersion = "3.X";
                bDetected = true;
            } else if (PE.compare("'PK'0304", nOffset)) {
                sVersion = "3.X";
                sOptions = "zip";
                bDetected = true;
            }
        } else {
            for (var i = 0; i < PE.resource.length; i++) {
                if (PE.resource[i].Type == 3000) //IS2
                {
                    if (PE.compare("'SZDD'", PE.resource[i].Offset)) {
                        sVersion = "2.X"
                        bDetected = true;
                        break;
                    }
                }
            }
        }

        if (PE.isSectionNamePresent("_cabinet")) {
            bDetected = true;
        }

    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x100, "'InstallShield Native Installer'") !== -1) {
            sName += " Java Edition";
            bDetected = true;
        } else if (PE.findSignature(PE.getOverlayOffset(), 0x100, "'setup.class'") !== -1) {
            sName += " Java Edition";
            sVersion = "3.X";
            bDetected = true;
        }
    } else if (PE.compareEP("558BEC83EC4456FF15........8BF085F675086AFFFF15........8A06578B3D")) {
        bDetected = true;
    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15........33d2")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(0x2000, PE.getOverlaySize()), "'ISc('") !== -1) {
            sVersion = "19.X";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(0x2000, PE.getOverlaySize()), "'ISSetupStream'") !== -1) {
            sVersion = "18.X";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc7")) {
        if (PE.findSignature(PE.getOverlayOffset(), Math.min(0x10000, PE.getOverlaySize()), "'ISc('") !== -1) {
            sVersion = "25.X";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")) {
        if (PE.compareOverlay("'ISSetupStream'")) {
            sVersion = "29.X";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5657bf........be........3bc774..85c674..f7")) {
        if (PE.compareOverlay("'ISSetupStream'")) {
            sVersion = "19.X";
            bDetected = true;
        }
    }

    if (PE.getVersionStringInfo("ProductName").substr(0, 13) == "InstallShield" || PE.getVersionStringInfo("CompanyName") == "InstallShield Software Corporation") {
        sVersion = PE.getVersionStringInfo("FileVersion").replace(/, /g, ".").trim();
        bDetected = true;
    }

    if (!bDetected) {
        if (/InstallShield/.test(PE.getManifest())) {
            bDetected = true;
        }
    }

    return result();
}
