// Detect It Easy: detection rule file format

init("protector", "Phoenix");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.isNET()) {
        if (PE.isSignatureInSectionPresent(0, "0000010b160c..........0208..........0d0906085961d21304091e630861d21305070811051e62110460d19d081758")) {
            sVersion = "1.7-1.8";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'?.resources'")) {
            sVersion = "1.X";
            bDetected = true;
        } else if (PE.compareEP_NET("1b3002001c00000000000000280100000a280200000add01000000dc28070000")) {
            bDetected = true;
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}