// Detect It Easy: detection rule file format

init("protector", "NTkrnl Protector");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("68........e8") && (PE.nLastSection >= 1)) {
        if (PE.getNumberOfImports() == 1) {
            if (PE.getNumberOfImportThunks(0) == 2) {
                if ((PE.getImportFunctionName(0, 0) == "LoadLibraryA") && (PE.getImportFunctionName(0, 1) == "GetProcAddress")) {
                    if (PE.isSignatureInSectionPresent(1, "'http://www.ntcore.com  '")) {
                        sVersion = "0.1";
                        bDetected = true;
                    } else if (PE.isSignatureInSectionPresent(1, "'http://www.ntkrnl.com'")) {
                        sVersion = "0.15";
                        bDetected = true;
                    }
                    /* if(bDetected)
                    {
                        var nFind=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"Version ");
                        if(nFind!=-1)
                        {
                            sVersion=PE.getString(nFind,20);
                            var aVersion=sVersion.match(/Version ?(.*?) /);
                            sVersion=aVersion[1];
                        }
                    } */
                }

            }
        }
    }
    if (PE.compareEP("68........e8........c3") && (PE.compareEP("68########60e8$$$$$$$$5d4555c3"))) {
        bDetected = true;
    }

    return result(bShowType, bShowVersion, bShowOptions);
}