// Detect It Easy: detection rule file format

init("protector", "eXPressor");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("E935140000E931130000E998120000E9EF0C0000E94213")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("E915130000E9F0120000E958120000E9AF0C0000E9AE02")) {
        sVersion = "1.1";
        bDetected = true;
    } else if (PE.compareEP("558BEC81EC....0000535657EB0C'ExPr-v.1.2.'")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("558BEC83EC..535657EB0C'ExPr-v.1.3.'")) {
        sVersion = "1.3";
        bDetected = true;
    } else if (PE.compareEP("558BEC83EC..535657EB0C'ExPr-v.1.4.'")) {
        sVersion = "1.4";
        bDetected = true;
    } else if (PE.compareEP("8BEC83EC..5356578365....F3EB0C'eXPr-v.1.4.'")) {
        sVersion = "1.4";
        bDetected = true;
    } else if (PE.compareEP("558BEC83EC..5356578365..00F3EB0C'eXPr-v.1.4.'00")) {
        sVersion = "1.4.5.X";
        bDetected = true;
    } else if (PE.compareEP("558BEC81EC........53565783A5..........F3EB0C'eXPr-v.1.5.'00")) {
        sVersion = "1.5.0.X";
        bDetected = true;
    } else if (PE.compareEP("558BEC81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")) {
        sVersion = "1.6";
        bDetected = true;
    } else if (PE.compareEP("..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")) {
        sVersion = "1.6";
        bDetected = true;
    } else if (PE.compareEP("6a..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")) {
        sVersion = "1.6";
        bDetected = true;
    } else if (PE.compareEP("6a..6a..6a..6a..68........E8$$$$$$$$....81EC........53565783A5..........F3EB0C'eXPr-v.1.6.'")) {
        sVersion = "1.6";
        bDetected = true;
    } else if (PE.compareEP("EB0168EB01........83EC0C535657EB01..833D........007408EB01E9E956010000EB02")) {
        bDetected = true;
    } else if (PE.compareEP("68########eb$$eb$$558bec83ec..535657eb$$833d..........74")) {
        sVersion = "1.6.1";
        bDetected = true;
    } else if (PE.compareEP("68........C3")) {
        if (PE.section.length >= 3) {
            if (PE.section[0].FileSize == 0) {
                if (PE.section[2].Name == ".code") {
                    sVersion = "1.5-1.6";
                    bDetected = true;
                }
            }
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}