die-python 0.1.0__cp39-cp39-win_amd64.whl

db/PE/VCasm-Protector.2.sg

@@ -0,0 +1,21 @@
+// DIE's signature file
+
+init("protector", "VCasm-Protector");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareEP("558BEC6AFF68........68........64A1000000005064892500000000E803000000")) {
+        sVersion = "1.0X";
+        bDetected = true;
+    } else if (PE.compareEP("EB..'[VProtect]'")) {
+        if (PE.compareEP("..0A")) {
+            sVersion = "1.0e";
+        } else if (PE.compareEP("..0B")) {
+            sVersion = "1.1-1.2";
+        } else {
+            sVersion = "1.X";
+        }
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/VMProtect.2.sg

@@ -0,0 +1,287 @@
+// DIE's signature file
+
+// 16:27 26.01.2013 detect improved //ajax
+//  2:30 27.01.2013 bugfixes
+// 14:14 27.01.2013 bugfixes
+// 2022/10 new detect hypn0 <hypn0@mail.ru>
+
+init("protector", "VMProtect");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.isNET()) return null; // Native files only
+
+    var nNumberOfSections = PE.getNumberOfSections();
+
+    var sVMPSectionName;
+
+    for (var i = nNumberOfSections - 1; i >= 0; i--) {
+        if (i == PE.getRelocsSection()) {
+            continue;
+        }
+        if (i == PE.getResourceSection()) {
+            continue;
+        }
+
+        if (PE.getSectionName(i) != "") {
+            sVMPSectionName = PE.getSectionName(i);
+
+            if ((i > 0) &&
+                (sVMPSectionName == ".vmp0")) {
+                bDetected = true;
+
+                break;
+            } else if ((i > 1) &&
+                (sVMPSectionName.substr(sVMPSectionName.length - 1) == "1")) {
+                var sCollision = PE.getSectionNameCollision("0", "1");
+
+                if (PE.isSectionNamePresent(sCollision + "1")) {
+                    bDetected = true;
+
+                    break;
+                }
+            } else if ((i > 2) &&
+                (sVMPSectionName.substr(sVMPSectionName.length - 1) == "2")) {
+                var sCollision = PE.getSectionNameCollision("1", "2");
+
+                if (PE.isSectionNamePresent(sCollision + "1") &&
+                    PE.isSectionNamePresent(sCollision + "0")) {
+                    bDetected = true;
+
+                    break;
+                }
+            } else if ((i > 3) &&
+                (sVMPSectionName.substr(sVMPSectionName.length - 1) == "3")) {
+                var sCollision = PE.getSectionNameCollision("2", "3");
+
+                if (PE.isSectionNamePresent(sCollision + "2") &&
+                    PE.isSectionNamePresent(sCollision + "1") &&
+                    PE.isSectionNamePresent(sCollision + "0")) {
+                    bDetected = true;
+
+                    break;
+                }
+            }
+        }
+
+        break;
+    }
+
+    if (bDetected) {
+        if (PE.is64()) {
+            sVersion = "2.XX-3.XX";
+        }
+
+        if (sVMPSectionName != "") {
+            if ((sVMPSectionName.substr(sVMPSectionName.length - 1) == "0")) {
+                sOptions = "Min protection";
+            }
+        }
+
+        if (PE.isImportPositionHashPresent(-1, 0x1ff3103f)) {
+            sVersion = "1.70";
+        } else if (PE.isImportPositionHashPresent(-1, 0x0c16df2d)) {
+            sVersion = "1.70";
+            sOptions = "Max protection";
+        } else if (PE.isImportPositionHashPresent(-1, 0x9d12b153)) {
+            sVersion = "2.0.3-2.13";
+        } else if (PE.isImportPositionHashPresent(-1, 0x1e5500c1)) {
+            sVersion = "3.0.0";
+        } else if (PE.isImportPositionHashPresent(-1, 0xc5fb6a4b)) {
+            sVersion = "3.0.9";
+        } else if (PE.isImportPositionHashPresent(-1, 0x5caa99c7)) {
+            sVersion = "3.2.0-3.5.0";
+        }
+    }
+
+    if ((!bDetected) && (PE.isDeepScan()) && (PE.isVerbose())) {
+        var da = "";
+        var das = "";
+        var res = 0;
+        var jmp = 0;
+        var ep = PE.OffsetToVA(PE.getEntryPointOffset());
+        var count = 0;
+
+        while ((das.substr(0, das.indexOf('+')) != "MOV EDX, DWORD PTR [EAX*4 ") &&
+            (das.substr(0, das.indexOf('+')) != "MOV EBX, DWORD PTR [EAX*4 ") &&
+            (das.substr(0, das.indexOf('+')) != "MOV ECX, DWORD PTR [EAX*4 ") && count < 1000) {
+            count++;
+            var byte = PE.readByte(PE.VAToOffset(ep));
+            var da = PE.getDisasmString(ep);
+            var das = da;
+
+            if (da.indexOf(' ') != -1) {
+                da = da.substr(0, da.indexOf(' '));
+            }
+
+            if ((byte == 0xFF && da == "JMP") || ((byte == 0xC3 || byte == 0xC2) && da == "RET")) {
+                var fresh = 1;
+                break;
+            }
+
+            if (byte == 0xFF && da == "CALL") { break; }
+
+            if (da.indexOf(' ') != -1) {
+                da = da.substr(0, da.indexOf(' '));
+            }
+
+            if (da == "CLC" || da == "CMC") { res++; }
+            if (da == "PUSHFD") { res++; }
+            if (da == "PUSHAL") { res++; }
+            if (da == "XOR") { res++; }
+            if (da == "NEG" || da == "NOT") { res++; }
+            if (da == "SAR" || da == "SAL") { res++; }
+            if (da == "JMP" || da == "CALL") { jmp++; }
+            if (da == "BT" || da == "BTR" || da == "BTS" || da == "BTC") { res++; }
+            if (da == "BSF" || da == "BSR" || da == "BSWAP") { res++; }
+            if (da == "ROL" || da == "ROR" || da == "RCL" || da == "RCR") { res++; }
+
+            ep = PE.getDisasmNextAddress(ep);
+        }
+
+        if (res > 10 && count < 200) {
+            sOptions = "count " + count;
+            if (fresh == 1) { sVersion = "new " + res + " jmp " + jmp; } else { sVersion = "old " + res + " jmp " + jmp; }
+            bDetected = true;
+            sOptions = "DS";
+        }
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}
+
+function detectVMP(sSectionName) {
+    if (PE.section[sSectionName]) {
+        nCharacteristics = PE.section[sSectionName].Characteristics;
+        if ((nCharacteristics == 0x60000060) || (nCharacteristics == 0xE0000060) || (nCharacteristics == 0xE0000040) || (nCharacteristics == 0x68000060) || (nCharacteristics == 0xe2000060)) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+function detectVMP2() {
+    if (PE.section.length > 7) {
+        var nCount = 5;
+        var nResource = PE.getResourceSection();
+        var nRelocs = PE.getRelocsSection();
+
+        if (nResource > PE.section.length - nCount) {
+            nCount++;
+        }
+        if (nRelocs > PE.section.length - nCount) {
+            nCount++;
+        }
+
+        var nDetectCount = 0;
+        var nLastVMPSection = 0;
+
+        for (var nSection = PE.section.length - nCount; nSection < PE.section.length; nSection++) {
+            if ((nSection == nResource) || (nSection == nRelocs)) {
+                continue;
+            }
+            if ((PE.section[nSection].FileSize == 0) && (PE.section[nSection].FileOffset == 0)) {
+                nDetectCount++;
+            }
+
+            if ((PE.section[nSection].FileSize != 0) && (PE.section[nSection].FileOffset != 0)) {
+                nLastVMPSection = nSection;
+            }
+        }
+
+        if (nDetectCount >= 3) {
+            if (PE.getEntryPointSection() == nLastVMPSection) {
+                if (PE.section[nLastVMPSection].Characteristics == 0xE0000060) {
+                    if (PE.calculateEntropy(PE.section[nLastVMPSection].FileOffset, PE.section[nLastVMPSection].FileSize) > 7.6) {
+                        return 1;
+                    }
+                } else if (PE.section[nLastVMPSection].Characteristics & 0x20000000) // Fix sent Deniskore
+                {
+                    var nSectionOffset = PE.section[nLastVMPSection].FileOffset;
+                    var nSectionSize = PE.section[nLastVMPSection].FileSize;
+                    var nOffset = nSectionOffset;
+                    var nSize = nSectionSize;
+                    var nCount = 0;
+                    var nSignatureOffset;
+                    while (nSize > 0) {
+                        nSignatureOffset = PE.findSignature(nOffset, nSize, "9c8d64");
+                        if (nSignatureOffset == -1)
+                            break;
+                        nCount++;
+                        nOffset = nSignatureOffset + 3;
+                        nSize = nSectionSize - (nSignatureOffset - nSectionOffset);
+                        if (nCount >= 2) {
+                            return 1;
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    return 0;
+}
+
+function detect_old(bShowType, bShowVersion, bShowOptions) {
+    var nSectionNumber = 0;
+    var nCharacteristics = 0;
+    var collision = "";
+
+    if (PE.section[".vmp0"] && (PE.compareEP("68........E9") || PE.compareEP("68........E8"))) {
+        sVersion = "1.60-2.05";
+        bDetected = true;
+    } else if (detectVMP(".vmp0")) {
+        bDetected = true;
+    } else if (detectVMP(".vmp1")) {
+        bDetected = true;
+    } else if (detectVMP(".vmp2")) {
+        bDetected = true;
+    } else if (PE.compareEP("54c70424........9c60c74424..........c64424....887424..60")) {
+        sVersion = "2.06";
+        bDetected = true;
+    } else if (PE.compareEP("e8$$$$$$$$e9$$$$$$$$880424881c24c70424........9ce8")) {
+        sVersion = "2.07";
+        bDetected = true;
+    } else if (PE.compareEP("9ce8$$$$$$$$e8$$$$$$$$c74424..........e9$$$$$$$$e8$$$$$$$$c74424..........526068")) {
+        sVersion = "2.12-13";
+        bDetected = true;
+    } else if (PE.compareEP("9c9cc74424..........9cc74424..........9c528d6424..e9")) {
+        sVersion = "2.12-13";
+        bDetected = true;
+    } else if (PE.compareEP("68........e8$$$$$$$$41574150448ac350410f96c057415148c7c7")) {
+        sVersion = "3.0x";
+        bDetected = true;
+    } else {
+        collision = PE.getSectionNameCollision("0", "1");
+
+        if (collision != "") {
+            if ((PE.compareEP("68........E9") || PE.compareEP("68........E8"))) {
+                sVersion = "1.X";
+                bDetected = true;
+            } else if ((PE.compareEP("9cE9") || PE.compareEP("9cFF"))) {
+                sVersion = "2.X";
+                bDetected = true;
+            } else if (detectVMP(collision + "0") && detectVMP(collision + "1")) {
+                bDetected = true;
+            }
+        }
+        if (!bDetected) {
+            if (detectVMP2()) {
+                sVersion = "2.X";
+                bDetected = true;
+            }
+        }
+    }
+
+    if (bDetected) {
+        if (PE.section.length < 3) {
+            bDetected = false;
+        } else if (PE.section.length == 3) {
+            if (PE.section[0].FileSize == 0) {
+                bDetected = false;
+            }
+        }
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/VMProtect_NET.2.sg

@@ -0,0 +1,54 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("protector", "VMProtect");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+
+    if (PE.isNET() && PE.getNumberOfSections() >= 3 && PE.isNetObjectPresent("SuppressIldasmAttribute")) {
+
+        const chunk = "%% %% %% %% %% %% %% %% 00", // chunk size is 8 bytes
+            scanBytes = PE.getSize() - PE.getOverlaySize();
+
+        var patternFromCctor = "'<Module>'00",
+            globalBigPattern = "00";
+
+        for (var t = 0; t < 4; t++) {
+            patternFromCctor += chunk;
+
+            for (var i = 0; i < 2; i++) {
+                globalBigPattern += chunk;
+            }
+        }
+
+        if (PE.findSignature(0x00, scanBytes, patternFromCctor) != -1) {
+            if (PE.findSignature(0x00, scanBytes, globalBigPattern) != -1) {
+                sVersion = "3.X";
+                bDetected = true;
+            }
+        }
+
+
+        if (bDetected) {
+            if (PE.findSignature(0x00, scanBytes, generateUnicodeSignatureMask("Program will be terminated."))) { // Unicode [global] string
+                sOptions = "Resources protection";
+            }
+
+            if (PE.getSectionNameCollision("0", "1")) {
+                sOptions += (sOptions.length != 0 ? " + " : "") + "Custom sections";
+            }
+        }
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}
+
+function generateUnicodeSignatureMask(inputString) {
+    var output = "";
+    for (var c = 0; c < inputString.length; c++) { output += (c != 0 ? "00" : "") + "'" + inputString[c] + "'"; }
+    return output;
+}
+
+// Hello Ivan Permyakov and thanks for your contribution to Open Source!

db/PE/VMWare.1.sg

@@ -0,0 +1,41 @@
+// DIE's signature file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "VMWare");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareOverlay("'RWMV'")) {
+        if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")) {
+            sName += " Installation Launcher";
+            bDetected = true;
+        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")) {
+            sName += " Installation Launcher";
+            bDetected = true;
+        } else if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0")) {
+            sName += " Installation Launcher";
+            bDetected = true;
+        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
+            sName += " Installation Launcher";
+            bDetected = true;
+        }
+    }
+
+    if (PE.isOverlayPresent() && PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")) {
+        var nSize = Math.min(PE.getOverlaySize(), 0x100);
+        if (PE.findString(PE.getOverlayOffset(), nSize, "BZh91AY&") != -1) {
+            sName += " Software Installer";
+            sOptions = "bzip2";
+            bDetected = true;
+        } else if (PE.findSignature(PE.getOverlayOffset(), nSize, "d0cf11e0a1b11ae1") != -1) {
+            sName += " Software Installer";
+            sOptions = "MS Compound";
+            bDetected = true;
+        }
+    }
+
+    if (bDetected) {
+        sVersion = PE.getFileVersion();
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/VPacker.2.sg

@@ -0,0 +1,13 @@
+// DIE's signature file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("packer", "VPacker");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareEP("60e8$$$$$$$$558bec83c4..5356578b45..83c0..8b008945..837d....75..e8........8945..e8........8b10")) {
+        sVersion = "0.02.10";
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/VaySoft_PDF2EXE.2.sg

@@ -0,0 +1,16 @@
+// DIE's signature file
+// Author: A.S.L  <asl@onet.eu>
+
+init("protector", "VaySoft PDF to EXE Converter");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareEP("558BECB9")) {
+        if (PE.compareOverlay("255B484220322A")) {
+            sOptions = "PDF Adv.Xor Ovl.";
+            sVersion = 6.82;
+            bDetected = true;
+        }
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/VbsToExe.1.sg

@@ -0,0 +1,29 @@
+// DIE's signature file
+// sign by A.S.L  - asl@onet.eu
+// fixed by adoxa
+
+init("protector", "Vbs To Exe");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.resource["D"]) {
+        if (PE.compare("'2edecompile'", PE.resource["D"].Offset + 2)) {
+            sVersion = "v2.0.2.0";
+            bDetected = true;
+        } else if (PE.resource["D"].Size == 14 &&
+            PE.isResourceNamePresent("B") &&
+            PE.isResourceNamePresent("F") &&
+            PE.isResourceNamePresent("I") &&
+            PE.isResourceNamePresent("N") &&
+            PE.isResourceNamePresent("O")) {
+            sVersion = "v2.0.2.0";
+            bDetected = true;
+        }
+        if (bDetected) {
+            if (PE.resource["P"]) {
+                sOptions = "Protected";
+            }
+        }
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/Virbox.2.sg

@@ -0,0 +1,13 @@
+// DIE's signature file
+// Author: Vito <@ScalletaZ>
+
+init("packer", "Virbox");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compare("'SENS'", 40)) {
+        sVersion = "Virbox Protector";
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/Virtual Pascal.4.sg

@@ -0,0 +1,14 @@
+// DIE's signature file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("compiler", "Virtual Pascal");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareEP("b9........b8........e8$$$$$$$$83ec..fc51e8")) {
+        sVersion = "2.1";
+        bDetected = true;
+    }
+
+    _setLang("Pascal", bDetected);
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/Vise.1.sg

@@ -0,0 +1,16 @@
+// DIE's signature file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "Vise");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
+        if (PE.compareOverlay("'ESIV'")) {
+            bDetected = true;
+        } else if (PE.compare("'SIVM'", 0xf000)) {
+            bDetected = true;
+        }
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/Visual Objects.4.sg

@@ -0,0 +1,12 @@
+// DIE's signature file
+init("compiler", "Visual Objects");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compare("'This Visual Objects application cannot be run in DOS mode'", 0x312)) {
+        sVersion = "2.XX";
+        bDetected = true;
+    }
+
+    _setLang("Visual Objects", bDetected);
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/Visual Prolog.4.sg

@@ -0,0 +1,14 @@
+// DIE's signature file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("compiler", "Visual Prolog");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareEP("558bec57dbe3d92d........68........e8........8325..........75..6a..eb..33c066a1........50e8........8038")) {
+        sVersion = "5.2";
+        bDetected = true;
+    }
+
+    _setLang("Visual Prolog", bDetected);
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/VisualStudio_NET.6.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("tool", "Visual Studio");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.isNET() && PE.findSignature(0x00, PE.getSize() - PE.getOverlaySize(), "590100'KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator'") !== -1) {
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/Vulkan.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "Vulkan");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.isLibraryPresentExp(/[V|v]ulkan/i)) {
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/WF.Guna.UI2.4.sg

@@ -0,0 +1,15 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "Guna UI");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.isNET() && PE.isNetObjectPresent("Guna.UI2") && PE.isNetObjectPresent("Guna.UI2.WinForms")) {
+        bDetected = true;
+        sVersion = "v2";
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/WF.Krypton.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "Krypton UI");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.isNET() && PE.isNetObjectPresent("ComponentFactory.Krypton.Toolkit")) {
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/WF.MetroFramework.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "MetroFramework UI");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.isNET() && PE.isNetObjectPresent("MetroFramework")) {
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/WF_WPF.MaterialSkin.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "MaterialSkin UI");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.isNET() && PE.isNetObjectPresent("MaterialSkin")) {
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/WWPACK.2.sg

@@ -0,0 +1,11 @@
+// DIE's signature file
+
+init("packer", "WWPACK");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareEP("53558BE833DBEB60'\r\n\r\nWWPack32'")) {
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}