// Detect It Easy: detection rule file format

init("packer", "NsPacK");

function getNSPackVersion() {
    if ((PE.section[0].FileSize > 0) && (PE.section[0].FileOffset < 0x200)) {
        sVersion = "2.x";
    } else if ((PE.section[0].FileSize == 0) && (PE.section[0].FileOffset >= 0x200)) {
        sVersion = "3.x";
    }
}

function detect(bShowType, bShowVersion, bShowOptions) {
    var nNumberOfFunctions = PE.getNumberOfImportThunks(0);
    if ((nNumberOfFunctions == 6) && (!PE.getSizeOfCode())) {
        if (PE.getImportFunctionName(0, 0) == "LoadLibraryA" &&
            PE.getImportFunctionName(0, 1) == "GetProcAddress" &&
            PE.getImportFunctionName(0, 2) == "VirtualProtect" &&
            PE.getImportFunctionName(0, 3) == "VirtualAlloc" &&
            PE.getImportFunctionName(0, 4) == "VirtualFree" &&
            PE.getImportFunctionName(0, 5) == "ExitProcess") {
            getNSPackVersion();
            bDetected = true;
        }
    }
    if (!bDetected) {
        if (PE.isLibraryPresent("mscoree.dll") &&
            PE.getImportLibraryName(0) == "KERNEL32.dll" &&
            PE.getImportFunctionName(0, nNumberOfFunctions - 1) == "GetSystemInfo") {
            getNSPackVersion();
            sOptions = ".NET";
            bDetected = true;
        } else if (PE.isNetObjectPresent("nsnet")) {
            sVersion = "3.X";
            bDetected = true;
        } else if (PE.compareEP("9c60e8..........83....8d8d........8039..0f..........c601..8bc5")) {
            sVersion = "3.7";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d9d........8a033c..74..8d9d........8a03")) {
            sVersion = "3.1";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8338..0f..........c700........8bd5")) {
            sVersion = "3.6";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8038..0f..........c600..8bd5")) {
            sVersion = "3.5";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5db8........2be88db5........8a063c..74..8bf5")) {
            sVersion = "2.9";
            bDetected = true;
        } else if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$e9$$$$$$$$9c60e8........5db8........2be88db5........8b06")) {
            sVersion = "2.3-2.9";
            bDetected = true;
        } else if (PE.compareEP("9c60e8........5d83ed..8d85........8038..74..8d85........8038..0f84........c600..8bd5")) {
            sVersion = "3.3";
            bDetected = true;
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}