die-python 0.4.0__cp313-abi3-win_amd64.whl

die/db/db/PE/Pantaray_QSetup.1.sg

@@ -0,0 +1,29 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "Pantaray QSetup");
+
+function detect() {
+
+    if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3........a1........a3........33c0a3........33c0a3........e8........ba........8bc3e8........5bc3")) {
+        if (PE.compareOverlay("970300000201")) {
+            sVersion = "10.0.0.x";
+            bDetected = true;
+        } else if (PE.compareOverlay("370700000201")) {
+            sVersion = "11.0.0.x";
+            bDetected = true;
+        }
+        var ArcOffset = PE.findSignature(PE.getOverlayOffset(), 0x400, "'|http:'");
+        if (ArcOffset != -1) {
+            sVersion = "6.0.0.0";
+            bDetected = true;
+        }
+        var ArcOffset = PE.findSignature(PE.getOverlayOffset(), 0x400, "'|www.'");
+        if (ArcOffset != -1) {
+            sVersion = "8.0.0.0";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/PE/Paquet.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("sfx", "Paquet archive");
+
+function detect() {
+    if (PE.compareEP("558bec81c4........53565733c08985........8985........e8........e8")) {
+        if (PE.compareOverlay("04'PBG'")) {
+            sVersion = "1.5";
+            sOptions = "1998 by Guillaume Di Giusto";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/PE/Paquet_Builder.1.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "Paquet Builder");
+
+function detect() {
+    if (PE.compareEP("5589e56a..68........68........64ff35........648925........83ec..83ec..5356578965..68")) {
+        if (PE.compareOverlay("'PB'................................'7z'")) {
+            sOptions = "7zip";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/PE/Patch.1.sg

@@ -0,0 +1,20 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("patcher", "Patch");
+
+function detect() {
+    if (PE.compareEP("e8$$$$$$$$558bec81c4........5657536a..e8........a3........c745..........6a..68........6a..e8")) {
+        for (var i = 0; i < PE.resource.length; i++) {
+            if (PE.resource[i].Type == "RT_RCDATA") {
+                if (PE.compare("a28ff4c4", PE.resource[i].Offset)) {
+                    sVersion = "2.0";
+                    bDetected = true;
+                    break;
+                }
+            }
+        }
+    }
+
+    return result();
+}

die/db/db/PE/PePack.2.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("packer", "PE-PACK");
+
+function detect() {
+    if (PE.compareEP("60E8000000005D83ed..80bd..........0f84........c685..........8bc52b..........89..........89")) {
+        sVersion = "0.99";
+        bDetected = true;
+    } else if (PE.compareEP("74..E9$$$$$$$$60E8........5D83ED..80............0F84........C685..........8BC52B..........89")) {
+        sVersion = "1.0";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/PE/PeX.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("packer", "PeX");
+
+function detect() {
+    if (PE.compareEP("E9$$$$$$$$60e8$$$$$$$$83c404e8")) {
+        sVersion = "0.99";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/PE/Pe_Ninja.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("protector", "PE Ninja");
+
+function detect() {
+    if (PE.compareEP("5D8BC581ED........2B85........2D710200008985........0FB6B5........8BFD")) {
+        sOptions = "modified";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/PE/Pelles_C.4.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+init("compiler", "Pelles C")
+
+function detect() {
+    if (PE.compareEP("5589E56AFF68........68........64FF35000000006489250000000083EC0C")) {
+        bDetected = true;
+    }
+
+    _setLang("C", bDetected);
+
+    return result();
+}

die/db/db/PE/Perl.3.sg

@@ -0,0 +1,93 @@
+// Detect It Easy: detection rule file
+// Author: hbasrc <rob.cheung+git@gmail.com>
+
+init("library", "Perl5 xs");
+
+
+function detect() {
+    if (!PE.isDll()) return;
+
+    var sLib = PE.isLibraryPresentExp(/perl(5)_?(\d\d*)/i);
+    if (sLib) {
+
+        bDetected = true;
+        sVersion = sLib[1] + "." + sLib[2];
+
+        _setLang("Perl", bDetected);
+
+    
+    }
+
+    var sInterp = PE.isExportFunctionPresentExp("Perl_sv_bless|perl_parse");
+    if (sInterp) {
+        bDetected = true;
+        sVersion = "v" + getPerlVersion();
+
+        _setLang("Perl", bDetected);
+
+        return _setResult("library", "Perl Runtime", sVersion, "");
+    }
+
+    return result();
+}
+
+function getPerlVersion() {
+    const verSig = [
+        "'erl5'..'.dll'", // v5.x
+        "'erl5'....'.dll'", // v5.xx
+        "'erl5_'..'.dll'", // cygwin or msys
+        "'erl5_'....'.dll'"
+    ];
+
+    var nExp = PE.getExportSection();
+    var sPLVersion = String();
+    var nMinorVer = 0;
+    var nGot = -1;
+
+    for (var i = 0; i < verSig.length; ++i) {
+        nGot = PE.findSignature(PE.section[nExp].FileOffset, PE.getSize(), verSig[i]);
+        if (nGot > -1) break;
+    }
+
+    if (nGot > 0) {
+        var sRes = PE.getString(nGot, 12);
+        //_log(" >>debug: Got DLL-ver = " + sRes);
+
+        sRes = sRes.match(/(5)_?(\d\d*)/);
+
+        if (sRes) {
+            sPLVersion = sRes[1] + "." + sRes[2];
+            nMinorVer = Number(sRes[2]);
+        } else {
+            return sPLVersion;
+        }
+
+        // find 5.X.X or 5.xx.x
+        var sSign = nMinorVer > 9 ? "'5.' .. .. '.' .. " : "'5.' .. '.' ..";
+        var patchVer = findPatchVersion(sSign);
+
+        if (patchVer > 0) sPLVersion += "." + patchVer;
+    }
+
+    return sPLVersion;
+}
+
+function findPatchVersion(sSign) {
+    var nOffset = 0;
+    var nSize = PE.getSize();
+    var nPatchVer = 0;
+    var nGot = -1;
+
+    // Traverse and find the max number
+    while ((nGot = PE.findSignature(nOffset, nSize, sSign)) != -1) {
+        var sRes = PE.getString(nGot, 12);
+        nOffset = nGot + sRes.length;
+
+        //_log("  >>debug: Got patchVer = " + sRes);
+
+        sRes = sRes.match(/5\.\d\d*\.(\d\d*)/);
+        if (sRes && sRes[1] > nPatchVer) nPatchVer = sRes[1];
+    }
+
+    return nPatchVer;
+}

die/db/db/PE/PerlApp.1.sg

@@ -0,0 +1,21 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("compiler", "PerlApp");
+
+function detect() {
+    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..8365....6a..ff15")) {
+        for (var i = 0; i < PE.getNumberOfResources(); i++) {
+            if (PE.resource[i].Type == "232") { // BFS
+                if (PE.compare("ff'BFS'01", PE.resource[i].Offset)) {
+                    bDetected = true;
+                    break;
+                }
+            }
+        }
+    }
+
+    _setLang("Perl", bDetected);
+
+    return result();
+}

die/db/db/PE/Petite.2.sg

@@ -0,0 +1,56 @@
+// Detect It Easy: detection rule file
+
+init("packer", "Petite");
+
+function detect() {
+    if (PE.compareEP("9C60E8CA......03..04..05..06..07..08")) {
+        sVersion = "1.2";
+        bDetected = true;
+    } else if (PE.compareEP("669C60E8$$$$$$$$582c..508bc88bd081c1........81c2........89208be15081")) {
+        sVersion = "1.2";
+        bDetected = true;
+    } else if (PE.compareEP("669C60508D8800F000008D90041600008BDC8BE1")) {
+        sVersion = "1.3";
+        bDetected = true;
+    }
+    /*else if(PE.compareEP("B8........669C60508BD8030068........6a..ff....8bcc8da0"))
+    {
+        sVersion="1.4";
+        bDetected=1;
+    }*/
+    else if (PE.compareEP("669C60508BD803006854BC00006A00FF50148BCC")) {
+        sVersion = "1.4";
+        bDetected = true;
+    } else if (PE.compareEP("64FF350000000064892500000000669C60508BD8")) {
+        sVersion = "2.1-2.3";
+        bDetected = true;
+    } else if (PE.compareEP("B8........669C60508D..........68........83")) {
+        bDetected = true;
+    } else if (PE.compareEP("B8........669C60508D88........8d90........8bdc8be168")) {
+        sVersion = "1.3, 1.3a";
+        bDetected = true;
+    }
+    /*else if(PE.compareEP("B8........669C60508BD803..6854BC....6A..FF50188BCC8DA054BC"))
+    {
+        sVersion="2.0";
+        bDetected=1;
+    }*/
+    else if (PE.compareEP("B8........6A..68........64FF35........648925........669C6050")) {
+        sVersion = "2.1";
+        bDetected = true;
+    } else if (PE.compareEP("B8........68........64FF35........648925........669C6050")) {
+        sVersion = "2.2";
+        bDetected = true;
+    } else if (PE.compareEP("b8........669c605033db8d90........68........833a..0f84........8b0a")) {
+        sVersion = "2.2";
+        bDetected = true;
+    } else if (PE.compareEP("b8........669c60508bd803..68........6a..ff50")) {
+        sVersion = "1.4-2.2";
+        bDetected = true;
+    } else if (PE.compareEP("B8........608DA8........68........6A40680030000068........6A00FF90........8944241CBB........8DB5........8BF850")) {
+        sVersion = "2.X";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/PE/Phoenix.2.sg

@@ -0,0 +1,19 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Phoenix");
+
+function detect() {
+    if (PE.isNET()) {
+        if (PE.isSignatureInSectionPresent(0, "0000010b160c..........0208..........0d0906085961d21304091e630861d21305070811051e62110460d19d081758")) {
+            sVersion = "1.7-1.8";
+            bDetected = true;
+        } else if (PE.isSignatureInSectionPresent(0, "'?.resources'")) {
+            sVersion = "1.X";
+            bDetected = true;
+        } else if (PE.compareEP_NET("1b3002001c00000000000000280100000a280200000add01000000dc28070000")) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/PE/Photo_Compiler.2.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+// Author: A.S.L. <asl@onet.eu> 2019.10.20
+// Exeinfo Pe - don't detect this
+
+init("protector", "Photo Compiler");
+
+function detect(bShowType, bShowOptions) {
+    if ((PE.compareEP("558bEC83C4F0B8")) && (PE.compareOverlay("'PK'"))) {
+        if (PE.isSignatureInSectionPresent(0, "'PhotoCompiler.Runtime'")) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/PE/PowerBASIC.4.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("compiler", "PowerBASIC");
+
+function detect() {
+    if (PE.compareEP("558bec535657bb........662ef705............0f85........6a..ff15........e8........c783")) {
+        bDetected = true;
+    }
+
+    _setLang("Basic", bDetected);
+
+    return result();
+}

die/db/db/PE/Power_Screen_Recorder.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("player", "Power Screen Recorder");
+
+function detect() {
+    if (PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8........e8")) {
+        if (PE.findSignature(PE.getSize() - 0x500, 0x500, "'xzjtlx'") != -1) {
+            sVersion = "6.x-7.x";
+            sOptions = "by www.tlxsoft.com";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/PE/Private_EXE_Protector.2.sg

@@ -0,0 +1,86 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Private EXE Protector");
+
+function detect() {
+    if (PE.compareEP("558BEC83C4F4FC5357568B7424208B7C242466813E4A430F85A502000083C60A33DB")) {
+        sVersion = "1.9.7";
+        bDetected = true;
+    } else if (PE.compareEP("B8........B9..9001..BE........68........6801......C3")) {
+        sVersion = "1.x";
+        bDetected = true;
+    } else if (PE.compareEP("89....380000008B..0000000081..........89..0000000081..0400000081..0400000081..000000000F85D6FFFFFF")) {
+        sVersion = "2.0";
+        bDetected = true;
+    } else if (PE.compareEP("52ba........c702########....50....53....51....52....56..57....55....81ee")) {
+        sVersion = "3.04";
+        bDetected = true;
+    } else if (PE.compareEP("EB08....0000000000007.009C")) {
+        sVersion = "4.0-4.12";
+        bDetected = true;
+    } else if (PE.compareEP("EB08....0000000000007.0068")) {
+        sVersion = "4.0-4.12";
+        bDetected = true;
+    } else if (PE.compareEP("6064ff35........b9........89ce81c6........ba........bd........8b0683c6..8b1e89dffcf829c333dd31c3891e")) {
+        sVersion = "4.x";
+        bDetected = true;
+    } else if (PE.compareEP("51b9........c701........59ff35........c3")) {
+        sVersion = "3.4.0";
+        bDetected = true;
+    } else if (PE.compareEP("53bb........c703........5bff35........c3")) {
+        sVersion = "3.4.0";
+        bDetected = true;
+    } else if (PE.findSignature(PE.getEntryPointOffset(), 0xB00, "b900000000f3ae") != -1) {
+        sVersion = "3.0.0-3.3.5";
+        bDetected = true;
+    } else if (PE.findSignature(PE.getEntryPointOffset(), 0xB00, "b900000000f366") != -1) {
+        sVersion = "3.0.0-3.3.5";
+        bDetected = true;
+    } else if (PE.getNumberOfImports() == 1 &&
+            PE.getImportLibraryName(0) == "KERNEL32.DLL" && PE.getNumberOfImportThunks(0) == 1 &&
+            (PE.section[0].Characteristics == 0xc0000020 && PE.getEntryPointOffset() == 0x400 ||
+             PE.section[0].Characteristics == 0xe0000020 && PE.getEntryPointOffset() == 0x200 ||
+             PE.section[0].Characteristics == 0xe0000020 && PE.getEntryPointOffset() == 0x400 ||
+             PE.section[0].Characteristics == 0x60000020 && PE.getEntryPointOffset() == 0x400 ||
+             PE.section[0].Characteristics == 0xe0000080 && PE.getEntryPointOffset() == 0x400 ||
+             PE.section[0].Characteristics == 0xc0000040 && PE.getEntryPointOffset() == 0x400 ||
+             PE.section[0].Characteristics == 0xe0000060 && PE.getEntryPointOffset() == 0x400 ||
+             PE.section[0].Characteristics == 0xe0000040 && PE.getEntryPointOffset() == 0x400 ||
+             PE.section[0].Characteristics == 0xf0000040 && PE.getEntryPointOffset() == 0x400)) {
+                sVersion = "2.00-2.25";
+                bDetected = true;
+    } else if (PE.section.length >= 3) {
+        if (PE.getNumberOfImports() == 1 &&
+            PE.getImportLibraryName(0) == "KERNEL32.DLL" &&
+            PE.getImportFunctionName(0, 0) == "ExitProcess") {
+            if (PE.getAddressOfEntryPoint() == 0x1000 &&
+                PE.section[0].FileSize != 0x200 &&
+                PE.section[0].FileSize != 0x400 &&
+                PE.section[0].Characteristics == 0xe0000020) {
+                bDetected = true;
+                sVersion = "1.X";
+            } else if (PE.section[0].Characteristics == 0xe4000000 &&
+                PE.section[1].Characteristics == 0xC0000000 &&
+                PE.section[2].Characteristics == 0x50000040) {
+                bDetected = true;
+                sVersion = "1.7";
+            }
+        } else if ((PE.getNumberOfImports() == 1) || (PE.getNumberOfImports() == 2)) {
+            if (PE.getImportLibraryName(0) == "KERNEL32.DLL") {
+                if (PE.getNumberOfImportThunks(0) == 1) {
+                    var nSection = PE.nLastSection;
+                    if (PE.section[nSection].Name == ".rsrc") {
+                        nSection--;
+                    }
+                    if (PE.section[nSection].Characteristics == 0xE0000000 &&
+                        PE.section[nSection - 1].Characteristics == 0xE0000000) {
+                        bDetected = true;
+                        sVersion = "2.X";
+                    }
+                }
+            }
+        }
+    }
+
+    return result();
+}

die/db/db/PE/PureBasic.4.sg

@@ -0,0 +1,55 @@
+// Detect It Easy: detection rule file
+
+init("compiler", "PureBasic");
+
+function detect() {
+
+
+    var codeSectionDetected = false; // If no code section is detected, then it is not PureBasic
+
+    for (var i = 1; i < PE.getNumberOfSections() && !codeSectionDetected; i++) {
+        if (PE.section[i].Characteristics == 0x60000020) {
+            codeSectionDetected = true;
+        }
+    }
+
+    if (!codeSectionDetected) return false;
+
+
+    if (!PE.is64()) {
+        if (PE.compareEP("68....0000680000000068......00E8......0083C40C6800000000E8......00A3")) {
+            sVersion = "4.X-6.X";
+            bDetected = true;
+        } else if (PE.compareEP("837C24080175..8B442404A3........E8")) {
+            sVersion = "4.X";
+            bDetected = true;
+        }
+    } else {
+        if (PE.compareEP("4883EC..49C7C0........4831D248B9................E8........4831C9E8")) {
+            sVersion = "4.X-6.X";
+            bDetected = true;
+        }
+    }
+
+    if (PE.isSectionNamePresent(".drectve")) {
+        var sn = PE.getSectionNumber(".drectve");
+
+        if (PE.isSignatureInSectionPresent(sn, "'pb_datapointer'")) {
+            sVersion = "6.X";
+            sOptions = "gcc";
+            bDetected = true;
+        }
+    }
+
+    if (!bDetected && PE.getImportLibraryName(0) === "KERNEL32.dll") {
+        const rdataSection = PE.section[".rdata"];
+
+        if (rdataSection) {
+            bDetected = PE.findSignature(rdataSection.FileOffset, 5120, "1415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F30313233") !== -1;
+        }
+    }
+
+    _setLang("PureBasic", bDetected);
+
+    return result();
+}

die/db/db/PE/PwdProtect.2.sg

@@ -0,0 +1,11 @@
+// Made by KDSS-Research
+
+init("protector", "PwdProtect");
+
+function detect() {
+    if (PE.isSectionNamePresent(".pwdprot")) {
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/PE/Py2exe.1.sg

@@ -0,0 +1,15 @@
+init("packer", "py2exe");
+
+function detect() {
+    for (var i = 0; i < PE.getNumberOfResources(); i++) {
+        // py2exe magic number
+        if (PE.compare("12345678", PE.resource[i].Offset)) {
+            bDetected = true;
+            break;
+        }
+    }
+
+    _setLang("Python", bDetected);
+
+    return result();
+}

die/db/db/PE/PyInstaller.2.sg

@@ -0,0 +1,72 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("packer", "PyInstaller"); // python = 💩
+
+includeScript("python");
+
+function detect() {
+    const overlaySignatureDetected = PE.compareOverlay("78da");
+
+
+    if (overlaySignatureDetected) {
+        const rdata = PE.section[".rdata"];
+
+        if (rdata &&
+            PE.findString(
+                rdata.FileOffset,
+                rdata.FileSize,
+                "PyInstaller: FormatMessageW failed."
+            ) != -1) {
+            bDetected = true;
+        }
+    }
+
+    for (var i = 0; i < PE.getNumberOfResources() && !bDetected; i++) {
+        const resSize = PE.getResourceSizeByNumber(i);
+        if ((
+                resSize == 0x909b && // black
+                PE.calculateMD5(PE.getResourceOffsetByNumber(i), resSize) == "20d36c0a435caad0ae75d3e5f474650c"
+            ) || (
+                resSize == 0x952c && // white
+                PE.calculateMD5(PE.getResourceOffsetByNumber(i), resSize) == "f6fbada22d6a6c07ef8fdaa504f117d5"
+            )) {
+
+            if (!overlaySignatureDetected) {
+                sOptions = "custom";
+            } else {
+                sOptions = PE.section[".rdata"] ? "modified" : "packed";
+            }
+
+            bDetected = true;
+        }
+    }
+
+    if (!bDetected && overlaySignatureDetected && PE.findSignature(
+            PE.getOverlayOffset(),
+            PE.getOverlaySize(),
+            "4d45490c0b0a0b0e"
+        ) != -1) {
+        sOptions = "overlay; modified";
+        bDetected = true;
+    }
+
+    var version;
+    for (var i = 0; i < 2 && !version; i++) {
+        var sign = PE.findSignature(
+            PE.getOverlayOffset(),
+            PE.getOverlaySize(),
+            "00 00 ?? ** 70 79 74 68 6F 6E'" + [2, 3][i] + "'** ** ** ** ?? ?? ?? 00 00 00 00 00 00 00 00 00 00" +
+            "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00");
+
+        if (sign && PE.findString(sign, 15, ".") != -1) {
+            version = "v" + getPythonVersionByDll(PE.getString(sign + 3, 15));
+        }
+    }
+
+    _setLang("Python", bDetected, version);
+
+    return result();
+}

die/db/db/PE/PyInstallerHider.1.sg

@@ -0,0 +1,27 @@
+// Made by KDSS-Research
+// Contact Me: koffidev365supp@gmail.com
+
+// Program name:
+// ----------------------
+// PyInstaller Hider by KDSS-Research
+
+init("scrambler", "PyInstaller Hider");
+
+function detect() {
+    if (PE.isSectionNamePresent(".rdata")) {
+        var n2 = PE.findString(PE.section[".rdata"].FileOffset, PE.section[".rdata"].FileSize, "Failed to get address for PyUnicode_Join");
+
+        var n3 = PE.findString(PE.section[".rdata"].FileOffset, PE.section[".rdata"].FileSize, "Failed to get address for PyImport_AddModule");
+        if (n2 != -1) {
+            if (n3 == -1) {
+                bDetected = true;
+            }
+
+        }
+    }
+
+
+    _setLang("Python", bDetected);
+
+    return result();
+}