// Detect It Easy: detection rule file format
// Author: hors, sendersu
/*
If errors pls contact sendersu on cracklab.team
*/

init("protector", "Safengine Shielden");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("E8........5361")) {
        if (PE.section[PE.nLastSection].FileSize == 0x1000 &&
            PE.section[PE.nLastSection].VirtualSize == 0x1000) {
            sVersion = "2.X";
            bDetected = true;
        }
        if (PE.section[PE.nLastSection].FileSize == 0x2000 &&
            PE.section[PE.nLastSection].VirtualSize == 0x2000) {
            sVersion = "";
            bDetected = true;
        }
    }
    if (PE.compareEP("EB$$E9$$$$$$$$E8........'Safengine Shielden'")) {
        sVersion = "2.X";
        bDetected = true;
    }
    if (PE.compareEP("E8........'Shielden'")) {
        var nOffset = PE.findString(PE.getEntryPointOffset(), 0x50, "Shielden v");
        if (nOffset != -1) {
            sName = "Shielden"
            sVersion = PE.getString(nOffset + 10);
            bDetected = true;
        }
    }
    if (bDetected == 1) {
        // try to deduce specific version from payload (if present)
        var nOffset = PE.findString(0, PE.getSize(), "Safengine Shielden v")
        if (nOffset != -1) {
            sVersion = PE.getString(nOffset + 19)
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}