// Detect It Easy: detection rule file format

init("protector", "ARM Protector");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("E8040000008360EB0C5DEB05")) {
        switch (PE.readDword(PE.nEP + 42)) {
            case 0xAB3:
                sVersion = "0.5";
                break;
            case 0xBA1:
                sVersion = "0.6";
                break;
            default:
                sVersion = "0.1b-0.3b";
        }
        bDetected = true;
    }

    return result(bShowType, bShowVersion, bShowOptions);
}