// Detect It Easy: detection rule file
// Author: nicholasmckinney

// https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py
meta("shellcode", "Monoxgas sRDI");

function detect() {
    if (Binary.isDeepScan()) {
        // 32-bit and 64-bit start out with the same first 5 bytes (relative jump)
        var jumpStartOffset = Binary.findSignature(0, Binary.getSize(), "E800000000");

        var currentOffset = jumpStartOffset + 5;

        // Possible 64-bit sRDI
        // https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py#L76-L80
        if (Binary.readDword(currentOffset) == 0xC8894959) {
            sOptions = "AMD64";
            bDetected = true;
        } else if (Binary.readDword(currentOffset) == 0xE5895558) { // Possible 32-bit sRDI
            sOptions = "x86";
            bDetected = true;
        }
    }
    return result();
}
