// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protection", "Hardlock dongle reference");

function detect() {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    var nOffset = 0;
    var foundOffset;
    while (true) {
        foundOffset = PE.findString(nOffset, nSize - nOffset, "\\.\\");
        if (foundOffset === -1) break;
        nOffset = foundOffset + 4;
        if (PE.compare("'HARDLOCK.VXD'", nOffset) ||
            PE.compare("'FEnteDev'", nOffset)) {
            bDetected = true;
            break;
        }
    }

    return result();
}