Skip to content

Commit b9caa5d

Browse files
DosX-devDosX-dev
committed
Code review
1 parent 68770da commit b9caa5d

17 files changed

+65
-142
lines changed

‎db/PE/ClickTeam.1.sg

+3-3
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ function detect() {
1111
} else if (PE.compareOverlay("..120100....0000")) {
1212
bDetected = true;
1313
}
14-
}
15-
16-
return result();
14+
}
15+
16+
return result();
1717
}

‎db/PE/FDM_Installer.1.sg

-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ function detect() {
99
sVersion = "1.0";
1010
bDetected = true;
1111
} else {
12-
sVersion = "x.x";
1312
bDetected = true;
1413
}
1514
}

‎db/PE/Go.4.sg

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ function detect() {
5050
sVersion = "1.x";
5151
} else if (PE.compareEP("e9....ffffcccccccccccccccccccccc83ec28895c241c896c241089742414897c2418890424894c2404e8") ||
5252
PE.compareEP("e9$$$$$$$$488b3c24488d742408e9$$$$$$$$4889f84889f34883ec284883e4f0")) { //x86-64
53-
sVersion = "1.18.x-1.24.0";
53+
sVersion = "1.18.X-1.24.0";
5454
} else if (PE.isSignatureInSectionPresent(0, "ff20'Go build ID: '")) {
5555
sVersion = "1.15.0-X.XX.X";
5656
} else {

‎db/PE/InstallShield.1.sg

-18
Original file line numberDiff line numberDiff line change
@@ -68,23 +68,5 @@ function detect() {
6868
}
6969
}
7070

71-
/*else if(PE.isOverlayPresent()&&
72-
(searchSection(".rsrc",0x10000)||searchSection(".data",0x1000))) // Too slow on some files :(
73-
{
74-
bDetected=1;
75-
} */
76-
7771
return result();
78-
}
79-
80-
function searchSection(sSection, nLimit) {
81-
if (PE.section[sSection]) {
82-
var nOffset = PE.section[sSection].FileOffset;
83-
var nSize = PE.section[sSection].FileSize;
84-
if (PE.findString(nOffset, Math.min(nLimit, nSize), "InstallShield") != -1) {
85-
return 1;
86-
}
87-
}
88-
89-
return 0;
9072
}

‎db/PE/LDK.2.sg

+9-11
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,13 @@ If errors pls contact sendersu on exelab.ru
77
init("protector", "SafeNet Sentinel LDK");
88

99
function detect() {
10-
if (PE.getNumberOfSections() == 4) {
11-
if (PE.isSectionNamePresent(".AKS1") &&
12-
PE.isSectionNamePresent(".AKS2") &&
13-
PE.isSectionNamePresent(".AKS3") &&
14-
PE.isSectionNamePresent(".rsrc")
15-
) {
16-
bDetected = true;
17-
}
18-
}
19-
20-
return result();
10+
if (PE.getNumberOfSections() == 4 &&
11+
PE.isSectionNamePresent(".AKS1") &&
12+
PE.isSectionNamePresent(".AKS2") &&
13+
PE.isSectionNamePresent(".AKS3") &&
14+
PE.isSectionNamePresent(".rsrc")) {
15+
bDetected = true;
16+
}
17+
18+
return result();
2119
}

‎db/PE/Lua_Runtime.4.sg

-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ function detect() {
1212
bDetected = true;
1313
}
1414

15-
1615
_setLang("Lua", bDetected);
1716

1817
return result();

‎db/PE/Lyme_SFX.1.sg

+3-5
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,9 @@
44
init("sfx", "Lyme SFX");
55

66
function detect() {
7-
if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
8-
if (PE.compareOverlay("789c")) {
9-
sOptions = "zlib";
10-
bDetected = true;
11-
}
7+
if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15") && PE.compareOverlay("789c")) {
8+
sOptions = "zlib";
9+
bDetected = true;
1210
}
1311

1412
return result();

‎db/PE/MSLRH.2.sg

+5-32
Original file line numberDiff line numberDiff line change
@@ -6,112 +6,85 @@ function detect() {
66
if (PE.compareEP("EB033A4D3A1EEB02CD209CEB02CD20EB02CD2060EB02C705EB02CD20E803000000E9EB04584050C3619D1FEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150")) {
77
sVersion = "0.32a";
88
sOptions = "fake .BJFNT 1.3";
9-
bDetected = true;
109
} else if (PE.compareEP("60E802000000EB095D5581ED39394400C361EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458740475")) {
1110
sVersion = "0.32a";
1211
sOptions = "fake ASPack 2.11d";
13-
bDetected = true;
1412
} else if (PE.compareEP("60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00A002EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003")) {
1513
sVersion = "0.32a";
1614
sOptions = "fake ASPack 2.12";
17-
bDetected = true;
1815
} else if (PE.compareEP("60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB0073000061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586B")) {
1916
sVersion = "0.32a";
2017
sOptions = "fake ASPack 2.12";
21-
bDetected = true;
2218
} else if (PE.compareEP("3BC074028183553BC074028183533BC97401BC563BD27402818557E8000000003BDB74019083C414EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")) {
2319
sVersion = "0.32a";
2420
sOptions = "fake EXE32Pack 1.3x";
25-
bDetected = true;
2621
} else if (PE.compareEP("558BEC6AFF68........68........64A1000000005064892500000000648F050000000083C40C5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")) {
2722
sVersion = "0.32a";
2823
sOptions = "fake Microsoft Visual C++";
29-
bDetected = true;
3024
} else if (PE.compareEP("558BEC538B5D08568B750C578B7D1085F65F5E5B5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458")) {
3125
sVersion = "0.32a";
3226
sOptions = "fake MSVC++ 6.0 DLL";
33-
bDetected = true;
3427
} else if (PE.compareEP("558BEC538B5D08568B750C5E5B5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB")) {
3528
sVersion = "0.32a";
3629
sOptions = "fake MSVC++ 7.0 DLL Method 3";
37-
bDetected = true;
3830
} else if (PE.compareEP("558BEC5657BF010000008B750C85F65F5E5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C40458740475")) {
3931
sVersion = "0.32a";
4032
sOptions = "fake MSVC++ DLL Method 4";
41-
bDetected = true;
4233
} else if (PE.compareEP("E9A6000000B07B4000786040007C60400000000000B03F000012624000'NeoLite Executable File Compressor\r\nCopyright (c) 1998'2C31")) {
4334
sVersion = "0.32a";
4435
sOptions = "fake Neolite 2.0";
45-
bDetected = true;
4636
} else if (PE.compareEP("9C60E8000000005DB8B38540002DAC8540002BE88DB5D3FEFFFF8B0683F80074118DB5DFFEFFFF8B0683F8010F84F1010000619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874")) {
4737
sVersion = "0.32a";
4838
sOptions = "fake nSPack 1.3";
49-
bDetected = true;
5039
} else if (PE.compareEP("FC5550E8000000005DEB01E360E803000000D2EB0B58EB014840EB0135FFE0E761585DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A58")) {
5140
sVersion = "0.32a";
5241
sOptions = "fake PC-Guard 4.xx";
53-
bDetected = true;
5442
} else if (PE.compareEP("E8000000005B83EB05EB04'RND!'85C07302F70550E808000000EAFF58EB18EB010FEB02CD20EB03EACD205858EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB")) {
5543
sVersion = "0.32a";
5644
sOptions = "fake PE Crypt 1.02";
57-
bDetected = true;
5845
} else if (PE.compareEP("EB03CD20C71EEB03CD20EA9CEB02EB01EB01EB60EB03CD20EBEB01EBE803000000E9EB04584050C3EB03CD20EBEB03CD2003619D83C404EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83")) {
5946
sVersion = "0.32a";
6047
sOptions = "fake PE Lock NT 2.04";
61-
bDetected = true;
6248
} else if (PE.compareEP("9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802")) {
6349
sVersion = "0.32a";
6450
sOptions = "fake PEBundle 0.2-3.x";
65-
bDetected = true;
6651
} else if (PE.compareEP("9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD83BD9C38400001619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200000029")) {
6752
sVersion = "0.32a";
6853
sOptions = "fake PEBundle 2.0x-2.4x";
69-
bDetected = true;
7054
} else if (PE.compareEP("EB06682EA80000C39C60E80200000033C08BC483C004938BE38B5BFC81EB3F904000619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A")) {
7155
sVersion = "0.32a";
7256
sOptions = "fake PECompact 1.4x";
73-
bDetected = true;
7457
} else if (PE.compareEP("60E82B000000'\r\n\r\n\r\nRegistAred to: NON-COMMERCIAL!!\r\n\r\n\r'005861EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4087404")) {
7558
sVersion = "0.32a";
7659
sOptions = "fake PESHiELD 0.25";
77-
bDetected = true;
7860
} else if (PE.compareEP("B8........6A0068........64FF350000000064892500000000669C605083C40461669D648F050000000083C408EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB")) {
7961
sVersion = "0.32a";
8062
sOptions = "fake PEtite 2.1";
81-
bDetected = true;
8263
} else if (PE.compareEP("60E801000000E883C404E801000000E95D81EDFF22400061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83")) {
8364
sVersion = "0.32a";
8465
sOptions = "fake PEX 0.99";
85-
bDetected = true;
8666
} else if (PE.compareEP("60E8000000005D81ED0600000064A02300000083C50661EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4")) {
8767
sVersion = "0.32a";
8868
sOptions = "fake SVKP 1.11";
89-
bDetected = true;
9069
} else if (PE.compareEP("60BE00908B008DBE0080B4FF5783CDFFEB3A9090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB730B75198B1E83EEFC11DB7210586190EB05E8EB0440")) {
9170
sVersion = "0.32a";
9271
sOptions = "fake UPX 0.89.6-1.02/1.05-1.24";
93-
bDetected = true;
9472
} else if (PE.compareEP("53558be833dbeb$$e800000000582d........506033c9505850508be851fd2e2b84..........8bf02e03b4..........8bf8")) {
9573
sVersion = "0.32a";
9674
sOptions = "fake WWPack32 1.x";
97-
bDetected = true;
9875
} else if (PE.compareEP("60E8000000005D81EDF31D4000B97B0900008DBD3B1E40008BF7AC902C8AC0C078900462EB010061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E80200")) {
9976
sVersion = "0.32a";
100-
sOptions = "fake yoda's cryptor 1.2";
101-
bDetected = true;
77+
sOptions = "fake Yoda's Cryptor 1.2";
10278
} else if (PE.compareEP("60EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8")) {
10379
sVersion = "0.1-0.2";
104-
bDetected = true;
10580
} else if (PE.compareEP("60D1CB0FCAC1CAE0D1CA0FC8EB01F1")) {
10681
sVersion = "0.31";
107-
bDetected = true;
10882
} else if (PE.compareEP("EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003")) {
10983
sVersion = "0.32a";
110-
bDetected = true;
11184
} else if (PE.compareEP("558bec5657bf........8b75..85f65f5e5deb$$eb$$eb$$e8$$$$$$$$e8$$$$$$$$eb$$83c4")) {
11285
sVersion = "0.31a";
113-
bDetected = true;
114-
}
115-
116-
return result();
86+
}
87+
88+
bDetected = Boolean(sVersion);
89+
return result();
11790
}

‎db/PE/Microsoft_Compound-based_installer.1.sg

+3-4
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,9 @@
44
init("installer", "Microsoft Compound-based installer (MSI)");
55

66
function detect() {
7-
if (PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c05568........64ff3064892033c05568")) {
8-
if (PE.compareOverlay("d0cf11e0a1b11ae1")) {
9-
bDetected = true;
10-
}
7+
if (PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c05568........64ff3064892033c05568") &&
8+
PE.compareOverlay("d0cf11e0a1b11ae1")) {
9+
bDetected = true;
1110
}
1211

1312
return result();

‎db/PE/Microsoft_dotNET_installer.1.sg

+1-2
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ init("installer", "Microsoft dotNET installer");
55

66
function detect() {
77
if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374")) {
8-
var ArcOffset = PE.findSignature(PE.getOverlayOffset(), Math.min(0x110, PE.getOverlaySize()), "'7z'bcaf");
9-
if (ArcOffset != -1) {
8+
if (PE.findSignature(PE.getOverlayOffset(), Math.min(0x110, PE.getOverlaySize()), "'7z'bcaf") != -1) {
109
sOptions = "7zip";
1110
bDetected = true;
1211
}

‎db/PE/NanoZip.1.sg

+4-6
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,10 @@
44
init("sfx", "NanoZip");
55

66
function detect() {
7-
if (PE.compareEP("60be........8dbe........5789e58d9c24........31c05039dc75")) {
8-
if (PE.compareOverlay("AE01'NanoZip 0.09 alpha'")) {
9-
sVersion = "0.09a";
10-
sOptions = "nz_w32c.sfx";
11-
bDetected = true;
12-
}
7+
if (PE.compareEP("60be........8dbe........5789e58d9c24........31c05039dc75") && PE.compareOverlay("AE01'NanoZip 0.09 alpha'")) {
8+
sVersion = "0.09a";
9+
sOptions = "nz_w32c.sfx";
10+
bDetected = true;
1311
}
1412

1513
return result();

‎db/PE/NativeCryptor_by_DosX.2.sg

+1-5
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,7 @@
33
init("cryptor", "NativeCryptor by DosX");
44

55
function detect() {
6-
if (PE.getNumberOfSections() >= 3) {
7-
if (PE.compareOverlay("'7stgc_hdr'00")) {
8-
bDetected = true;
9-
}
10-
}
6+
bDetected = PE.getNumberOfSections() >= 3 && PE.compareOverlay("'7stgc_hdr'00");
117

128
return result();
139
}

‎db/PE/PACE.2.sg

+5-5
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@ init("protector", "PACE");
55

66
function detect() {
77
if (PE.compareEP("833d..........75..E8........a3........e8$$$$$$$$56578b3d........8bc7e8........8bf085f674..5668........68........ff15")) {
8-
sName += " Eden wrapper";
8+
sVersion = "Eden wrapper";
99
bDetected = true;
1010
}
1111
if (PE.compareEP("558bec81ec........5356578d45..6a..5068........ff15........85c074..8b45..eb..8b75..6a..56ff15........85c075..66813e")) {
12-
sName += " InterLok";
12+
sVersion = "InterLok";
1313
bDetected = true;
14-
}
15-
16-
return result();
14+
}
15+
16+
return result();
1717
}

‎db/PE/UPX_scrambler.2.sg

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Detect It Easy: detection rule file
22

3-
init("tool", "UPX scrambler");
3+
init("tool", "UPX Scrambler");
44

55
function detect() {
66
if (PE.compareEP("E8000000005983C10751C3C3BE........83EC04893424B9800000008136........50B80400000050033424585883E903E2E9EBD6")) {
@@ -9,10 +9,10 @@ function detect() {
99
} else if (PE.compareEP("66C705........7507E9..FEFFFF00")) {
1010
bDetected = true;
1111
} else if (PE.compareEP("9061BE........8DBE........5783CDFF")) {
12-
sVersion = "1.x";
12+
sVersion = "1.X";
1313
bDetected = true;
1414
} else if (PE.compareEP("9061BE........8DBE........c787................5783CDFF")) {
15-
sVersion = "1.x";
15+
sVersion = "1.X";
1616
bDetected = true;
1717
}
1818

‎db/PE/linker.6.sg

+8-27
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Detect It Easy: detection rule file
22

3-
init("linker", "unknown", PE.getCompilerVersion(), PE.getGeneralOptionsEx());
3+
init("linker", "Unknown");
44

55
includeScript("FASM");
66
includeScript("RosASM");
@@ -46,16 +46,18 @@ function detect() {
4646
sOptions = sOptions.append("RTM32");
4747
}
4848
bDetected = true;
49-
} else if (PE.compare( /*[Tt]*/ "'his is a Windows '" /*(?:95|NT)*/ , 0x4f)) {
49+
} else if (PE.compare( /*[Tt]*/ "'his is a Windows '" /*(?:95|NT)*/, 0x4f)) {
5050
sName = "Watcom Linker";
5151
sVersion += "*";
5252
bDetected = true;
5353
} else if (PE.compare("'MZ'6c000100000002000000ffff000000000000110000004000000000000000'Win'....' Program!\r\n\b409ba0001cd21b44ccd2160000000'GoLink, GoAsm www.GoDevTool.com'00")) {
5454
sName = "GoLink";
5555
bDetected = true;
5656
}
57-
var nMajor = PE.getMajorLinkerVersion();
58-
var nMinor = PE.getMinorLinkerVersion();
57+
58+
var nMajor = PE.getMajorLinkerVersion(),
59+
nMinor = PE.getMinorLinkerVersion();
60+
5961
if ((nMajor == 2) && (nMinor == 18)) {
6062
sName = "Watcom Linker";
6163
bDetected = true;
@@ -70,29 +72,8 @@ function detect() {
7072
}
7173
}
7274

73-
/* if(!bDetected&&(bShowVersion||bShowOptions))
74-
{
75-
if(!bShowType)
76-
{
77-
sName+=" "+sType;
78-
}
79-
bDetected=1;
80-
} */
81-
82-
if (bFASM) {
83-
// FASM doesn't have a linker.
84-
bDetected = false;
85-
}
86-
if (bRosASM) {
87-
// RosASM doesn't have a linker.
88-
bDetected = false;
89-
}
90-
if (bSpASM) {
91-
// SpASM doesn't have a linker.
92-
bDetected = false;
93-
}
94-
if (bFPC) {
95-
// Free Pascal doesn't have a linker.
75+
// Doesn't have a linker.
76+
if (bFASM || bRosASM || bSpASM || bFPC) {
9677
bDetected = false;
9778
}
9879

0 commit comments

Comments
 (0)