// Detect It Easy: detection rule file format
// Author: ajax
// History:
// 22:54 17.01.2013 add generic
// 22:30 14.07.2013 improved generic

init("protector", "Obsidium");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.isNET()) return null;

    if (PE.compareEP("E8AB1C")) {
        sVersion = "1.0.0.59";
        bDetected = true;
    } else if (PE.compareEP("E8AF1C0000")) {
        sVersion = "1.0.0.61";
        bDetected = true;
    } else if (PE.compareEP("EB02....E8E71C0000")) {
        sVersion = "1.1.1.1";
        bDetected = true;
    } else if (PE.compareEP("EB02....E8771E0000")) {
        sVersion = "1.2";
        bDetected = true;
    } else if (PE.compareEP("EB02....E83F1E0000")) {
        sVersion = "1.2.0.0";
        bDetected = true;
    } else if (PE.compareEP("E80E0000008B54240C8382B8000000")) {
        sVersion = "1.2.5.0";
        bDetected = true;
    } else if (PE.compareEP("EB01..E829000000EB02....EB01..8B54240CEB04")) {
        sVersion = "1.2.5.8";
        bDetected = true;
    } else if (PE.compareEP("E80E00000033C08B54240C8382B80000000DC36467FF36")) {
        sVersion = "1.2.X";
        bDetected = true;
    } else if (PE.compareEP("EB04........E829000000EB02....EB01..8B54240CEB02")) {
        sVersion = "1.3.0.0";
        bDetected = true;
    } else if (PE.compareEP("EB02....E825000000EB04........EB01..8B54240CEB01")) {
        sVersion = "1.3.0.4";
        bDetected = true;
    } else if (PE.compareEP("EB01..E826000000EB02....EB02....8B54240CEB01")) {
        sVersion = "1.3.0.13";
        bDetected = true;
    } else if (PE.compareEP("EB02....E828000000EB04........EB01..8B54240CEB")) {
        sVersion = "1.3.0.17";
        bDetected = true;
    } else if (PE.compareEP("EB03......E82E000000EB04........EB04........8B")) {
        sVersion = "1.3.0.21";
        bDetected = true;
    } else if (PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB04")) {
        sVersion = "1.3.0.37";
        bDetected = true;
    } else if (PE.compareEP("EB02....E827000000EB02....EB03......8B54240CEB01")) {
        sVersion = "1.3.1.1";
        bDetected = true;
    } else if (PE.compareEP("EB04........E82A000000EB03......EB04........8B54")) {
        sVersion = "1.3.2.2";
        bDetected = true;
    } else if (PE.compareEP("EB01..E829000000EB02....EB03......8B54240CEB02")) {
        sVersion = "1.3.3.1";
        bDetected = true;
    } else if (PE.compareEP("EB01..E82B000000EB02....EB02....8B54240CEB03")) {
        sVersion = "1.3.3.2";
        bDetected = true;
    } else if (PE.compareEP("EB02....E829000000EB03......EB03......8B..240CEB")) {
        sVersion = "1.3.3.3";
        bDetected = true;
    } else if (PE.compareEP("EB02....E829000000EB03......EB02....8B54240CEB03")) {
        sVersion = "1.3.3.4";
        bDetected = true;
    } else if (PE.compareEP("EB04........E828000000EB01..............8B54240")) {
        sVersion = "1.3.3.6";
        bDetected = true;
    } else if (PE.compareEP("EB02....E827000000EB03......EB01..8B54240CEB03")) {
        sVersion = "1.3.3.7";
        bDetected = true;
    } else if (PE.compareEP("EB02....E82C000000EB04........EB04........8B5424")) {
        sVersion = "1.3.3.7";
        bDetected = true;
    } else if (PE.compareEP("EB04........E828000000EB01..EB01..8B54240CEB04")) {
        sVersion = "1.3.3.8";
        bDetected = true;
    } else if (PE.compareEP("EB02....E829000000EB03......EB01..8B54240CEB04")) {
        sVersion = "1.3.3.9";
        bDetected = true;
    } else if (PE.compareEP("EB01..E82A000000EB04........EB02....8B54240CEB03")) {
        sVersion = "1.3.4.1";
        bDetected = true;
    } else if (PE.compareEP("EB02....E826000000EB03......EB01..8B54240CEB02")) {
        sVersion = "1.3.4.2";
        bDetected = true;
    } else if (PE.compareEP("EB03......E8........EB02....EB04........8B54240C")) {
        sVersion = "1.3.5.0";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB04........E8........EB02....EB04........33C0")) {
        sVersion = "1.4.2.0";
        bDetected = true;
    } else if (PE.compareEP("EB02....50EB04........E8........EB01..EB01..8B54240C")) {
        sVersion = "unknown 1";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB02....EB01..33C0")) {
        sVersion = "unknown 2";
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB04........E8........EB02....EB04........33C0")) {
        sVersion = "unknown 3";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB02....E8........EB05..........EB04........33C0")) {
        sVersion = "unknown 4";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB04........EB02....33C0")) {
        sVersion = "unknown 5";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB04........E8........EB03......EB03......33C0")) {
        sVersion = "unknown 6";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB01..EB02....33C0")) {
        sVersion = "unknown 7";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB05..........EB04........33C0")) {
        sVersion = "unknown 8";
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB02....E8........EB02....EB03......33C0")) {
        sVersion = "unknown 9";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB04........E8........EB04........EB01..33C0")) {
        sVersion = "unknown 10";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB04........E8........EB04........EB03......8B54240C")) {
        sVersion = "unknown 11";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB02....E8........EB03......EB02....8B54240C")) {
        sVersion = "unknown 12";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB05..........E8........EB01..EB02....33C0")) {
        sVersion = "unknown 13";
        bDetected = true;
    } else if (PE.compareEP("EB04........E8........EB01..EB01..8B54240C")) {
        sVersion = "unknown 14";
        bDetected = true;
    } else if (PE.compareEP("EB03......E8........EB04........EB01..8B54240C")) {
        sVersion = "unknown 15";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB02....E8........EB01..EB03......33C0")) {
        sVersion = "unknown 16";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB02....EB04........33C0")) {
        sVersion = "unknown 17";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB03......E8........EB04........EB01..33C0")) {
        sVersion = "unknown 18";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB03......EB04........33C0")) {
        sVersion = "unknown 19";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB04........EB03......33C0")) {
        sVersion = "unknown 20";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB01..E8........EB03......EB02....33C0")) {
        sVersion = "unknown 21";
        bDetected = true;
    } else if (PE.compareEP("EB02....50EB02....E8........EB04........EB01..33C0")) {
        sVersion = "unknown 22";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB02....E8........EB03......EB05..........33C0")) {
        sVersion = "unknown 23";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB01..E8........EB02....EB03......33C0")) {
        sVersion = "unknown 24";
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB04........E8........EB04........EB03......33C0")) {
        sVersion = "unknown 25";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB03......EB02....33C0")) {
        sVersion = "unknown 26";
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB02....E8........EB03......EB04........33C0")) {
        sVersion = "unknown 27";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB01..E8........EB04........EB04........33C0")) {
        sVersion = "unknown 28";
        bDetected = true;
    } else if (PE.compareEP("EB02....50EB01..E8........EB05..........EB01..33C0")) {
        sVersion = "unknown 29";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB04........E8........EB04........EB01..33C0")) {
        sVersion = "unknown 30";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB01..E8........EB01..EB02....33C0")) {
        sVersion = "unknown 31";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB05..........E8........EB05..........EB03......33C0")) {
        sVersion = "unknown 32";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB02....E8........EB04........EB02....33C0")) {
        sVersion = "unknown 33";
        bDetected = true;
    } else if (PE.compareEP("EB03......50EB02....E8........EB03......EB02....33C0")) {
        sVersion = "unknown 34";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB04........E8........EB01..EB05..........33C0")) {
        sVersion = "unknown 35";
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB01..E8........EB01..EB03......33C0")) {
        sVersion = "unknown 36";
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB04........E8........EB01..EB02....33C0")) {
        sVersion = "unknown 37";
        bDetected = true;
    } else if (PE.compareEP("EB04........50EB03......E8........EB04........EB03......33C0")) {
        sVersion = "unknown 38";
        bDetected = true;
    } else if (PE.compareEP("EB05..........50EB03......E8........EB01..EB01..33C0")) {
        sVersion = "unknown 39";
        bDetected = true;
    } else if (PE.compareEP("EB01..50EB03......E8........EB05..........EB03......33C0")) {
        sVersion = "unknown 40";
        bDetected = true;
    } else if (PE.compareEP("EB")) {
        var ep = PE.OffsetToVA(PE.getEntryPointOffset());
        var byte = PE.readByte(PE.VAToOffset(ep) + 1);
        if (byte < 6) {
            ep = PE.getDisasmNextAddress(ep);
            byte = PE.readByte(PE.VAToOffset(ep));
            if (byte == 0x50) {
                ep = PE.getDisasmNextAddress(ep);
                byte = PE.readByte(PE.VAToOffset(ep));
                if (byte == 0xEB) {
                    byte = PE.readByte(PE.VAToOffset(ep) + 1);
                    if (byte < 6) {
                        ep = PE.getDisasmNextAddress(ep);
                        byte = PE.readByte(PE.VAToOffset(ep));
                        if (byte == 0xE8) {
                            ep = PE.getDisasmNextAddress(ep + 5);
                            byte = PE.readByte(PE.VAToOffset(ep));
                            if (byte == 0xEB) {
                                byte = PE.readByte(PE.VAToOffset(ep) + 1);
                                if (byte < 6) {
                                    ep = PE.getDisasmNextAddress(ep);
                                    if (PE.compare('8B54240C', PE.VAToOffset(ep)) || PE.compare('33C0', PE.VAToOffset(ep))) {
                                        sVersion = "v1.4.X.X";
                                        bDetected = true;

                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    } else if (PE.compareEP("eb08................eb03......50eb02")) {
        sVersion = "1.6b43";
        bDetected = true;
    } else if (PE.compareEP("E84719")) {
        bDetected = true;
    } else if (PE.compareEP("EB$$E8....0000EB$$EB$$8B54240CEB")) {
        bDetected = true;
    }
    // Generic
    else if (PE.getEntryPointSection() == PE.nLastSection) {
        if (PE.compareEP("EB")) {
            if (PE.getImportSection() >= 0) {
                if (PE.isOverlayPresent()) {
                    bDetected = true;
                }
            }
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}