// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>
// Updated: DosX

meta("protector", "PE-SHiELD");

function detect() {
    if (PE.compareEP("E9$$$$$$$$60E8$$$$$$$$5D83ED..EB$$8DB5........BA........8A3C1632FA80....80....88....4AEB")) {
        sVersion = "0.25";
        bDetected = true;
    } else if (PE.compareEP("60E8$$$$$$$$5D83ED..EB$$8D....................8A....32..80....80....88......EB")) {
        sVersion = "0.25-0.26";
        bDetected = true;
    } else if (PE.compareEP("60E8$$$$$$$$414e414b494e5d83ed..eb$$8d....................8a....32")) {
        sVersion = "0.2";
        bDetected = true;
    }

    var peShieldSection = PE.section["PESHiELD"];

    if (!bDetected) {
        if (PE.isImportPositionHashPresent(0, 0x3651f68d) && peShieldSection) {
            bDetected = true;
        }
    } else if (!peShieldSection) {
        sOptions = "modified";
    }

    return result();
}