// Detect It Easy: detection rule file format

init("protector", "DNGuard");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.isNET()) {
        if (_getNumberOfResults("protector") <= 1 && (PE.isNetObjectPresent("ZYXDNGuarder") || PE.isNetObjectPresent("HVMRuntm.dll"))) {
            bDetected = true;
        }

        if (!bDetected) {
            if (PE.isSignatureInSectionPresent(0, "'A newer version of DNGuard Runtime library is needed to run this application.'")) {
                bDetected = true;
            }
        }
    } else if (PE.is64()) {
        var rdataSection = PE.section[".rdata"];

        if (rdataSection && PE.isSignaturePresent(rdataSection.FileOffset, rdataSection.FileSize, "'DNGuard'") &&
            PE.isImportPositionHashPresent(0, 0x38432571) && PE.compareEP("48 83 EC 28 E8 07 AD")) {
            bDetected = true;

            if (!PE.section[".I:R"]) {
                sOptions = "modified";
            }
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}