// Detect It Easy: detection rule file
// Author: LinXP

meta("archive", "UnrealEngine");

function detect() {
    if (Binary.getSize() >= 0x400) {
        if (Binary.compare("C1832A9E")) {
            bDetected = true;
            sName += "\\Unreal Package"
            var nVer = Binary.read_uint16(0x04);
            var nLicVer = Binary.read_uint16(0x06);
            sVersion = sVersion.append(nVer, nLicVer);

        } else if (Binary.compare("E1126F5A", Binary.getSize() - 204)) {
            bDetected = true;
            sName += "\\UE4 package (.PAK)"
            sVersion = Binary.read_uint32(Binary.getSize() - 200);
            switch (Binary.read_uint8(Binary.getSize() - 206)) {
                case 0:
                    break;
                case 1:
                    sOptions = sOptions.append("Index Is Encrypted");
                    break;
                default:
                    bDetected = false;
            }
            sOptions = sOptions.append(Binary.getString(Binary.getSize() - 160));

        }

    }

    return result();
}