// Detect It Easy: detection rule file format
// Author: r0da https://github.com/whereisr0da

init("protector", "KoiVM");

function detect(bShowType, bShowVersion, bShowOptions) {

    if (PE.isNET() && _getNumberOfResults("protector") <= 1) {
        if (PE.isSignatureInSectionPresent(0, "'KoiVM.Runtime'")) {
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'VMEntryRun'")) {
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'KoiVM'")) {
            bDetected = true;
        }
        sVersion = "2.0+";
    }

    return result(bShowType, bShowVersion, bShowOptions);
}