die-python 0.4.0__cp313-abi3-win_amd64.whl

db/PE/DS.NetHASP_dongle.5.sg

@@ -0,0 +1,19 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "NetHASP dongle reference");
+
+function detect() {
+    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
+
+    if (nSize > 50000000)
+        nSize = 50000000;
+
+    if (PE.findString(0, nSize, "NETHASP_00112233445566zz") != -1 ||
+        PE.findString(0, nSize, "nethasp.ini") != -1) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DS.Novex_dongle.4.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "Novex/Guardant dongle reference");
+
+function detect() {
+    // I'm (adoxa) guessing this don't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    if (PE.findString(0, PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize(), "\\\\.\\NVKEY") != -1) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DS.RLM.4.sg

@@ -0,0 +1,25 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("library", "Reprise License Manager (RLM)");
+
+function detect() {
+    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
+
+    if (nSize > 50000000)
+        nSize = 50000000;
+
+    var nOffset = PE.findString(0, nSize, "Reprise License Manager (RLM)");
+    if (nOffset != -1) {
+        sVersion = PE.getString(nOffset, 200).match(/\d\S*\w/i);
+        bDetected = true;
+        nOffset = PE.findSignature(0, nSize, "44894c24..4c894424..48895424..48894c24..b8........e8........482be0488b05........4833c448898424........48c78424................48c78424................48c78424................c74424..........c74424..........488b8424........4805........48894424..c74424..........c74424..........c74424..........c78424................4883bc24..........74..488b8424........c7");
+        //v8.0-9.1 x64
+        if (nOffset != -1) {
+            sOptions = "rlm_pubkey at " + nOffset;
+        }
+    }
+
+    return result();
+}

db/PE/DS.SenseLock_dongle.5.sg

@@ -0,0 +1,20 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "SenseLock dongle reference");
+
+function detect() {
+    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
+
+    if (nSize > 50000000)
+        nSize = 50000000;
+
+    if (PE.findString(0, nSize, "sense4.dll") != -1 ||
+        PE.findString(0, nSize, "S4Open") != -1) { // PE.findString(0, nSize, "S4Startup") != -1 || PE.findString(0, nSize, "S4Execute") != -1
+
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DS.Sentinel_SuperPro.2.sg

@@ -0,0 +1,21 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Sentinel SuperPro");
+
+function detect() {
+    if (PE.compareEP("68........6A016A00FF15........A3........FF15........33C93DB7000000A1")) {
+        sVersion = "6.4.0";
+        sOptions = "Automatic Protection";
+        bDetected = true;
+    } else if (PE.compareEP("A1........558B......85C074..85ED75..A1........5055FF15........8B0D")) {
+        sVersion = "6.4.1";
+        sOptions = "Automatic Protection";
+        bDetected = true;
+    } else if (PE.compareEP("A1........85C00F85........C705................33C050C70485................E8")) {
+        sVersion = "6.4.5.0";
+        sOptions = "Automatic Protection";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DS.Sentinel_SuperPro_dongle.5.sg

@@ -0,0 +1,20 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "Sentinel SuperPro dongle reference");
+
+function detect() {
+    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
+
+    if (nSize > 50000000)
+        nSize = 50000000;
+
+    // Originally searched for "RNBOsproInitialize", "RNBOsproGetKeyInfo" and
+    // "RNBOsproGetVersion", but this should be enough.
+    if (PE.findString(0, nSize, "RNBOspro") != -1) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DS.Sentinel_dongle.5.sg

@@ -0,0 +1,28 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "Rainbow Sentinel dongle reference");
+
+function detect() {
+    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
+
+    if (nSize > 50000000)
+        nSize = 50000000;
+
+    if (PE.findString(0, nSize, "SNTNLUSB") != -1) {
+        bDetected = true;
+    } else {
+        var nOffset = 0;
+        while ((nOffset = PE.findString(nOffset, nSize - nOffset, "\\\\.\\")) != -1) {
+            nOffset += 4;
+            if (PE.compare("'SENTINEL.VXD'", nOffset) ||
+                PE.compare("'SntnlUsb'", nOffset)) {
+                bDetected = true;
+                break;
+            }
+        }
+    }
+
+    return result();
+}

db/PE/DS.SoftLok_dongle.5.sg

@@ -0,0 +1,17 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "SoftLok dongle reference");
+
+function detect() {
+    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
+
+    if (nSize > 50000000)
+        nSize = 50000000;
+
+    if (PE.findSignature(0, nSize, "5c5c2e5c'MNXX'") != -1 || PE.findSignature(0, nSize, "5c5c2e5c'SoftLok'") != -1) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DS.Unikey_dongle.5.sg

@@ -0,0 +1,30 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "Unikey/Activator dongle reference");
+
+function detect() {
+    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
+
+    if (nSize > 50000000)
+        nSize = 50000000;
+
+    if (PE.findString(0, nSize, "SSIVDDP.DLL") != -1 ||
+        PE.findSignature(0, nSize, "5C004400650076006900630065005C005300530049005000440044005000") != -1) // L"\\Device\\SSIPDDP"
+    {
+        bDetected = true;
+    } else {
+        var nOffset = 0;
+        while ((nOffset = PE.findString(nOffset, nSize - nOffset, "\\\\.\\")) != -1) {
+            nOffset += 4;
+            if (PE.compare("'SSIPDDP'", nOffset) ||
+                PE.compare("'PIPE\\SSINetPipe'", nOffset)) {
+                bDetected = true;
+                break;
+            }
+        }
+    }
+
+    return result();
+}

db/PE/DS.WIBU_Key_dongle.5.sg

@@ -0,0 +1,20 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "WIBU Key dongle reference");
+
+function detect() {
+    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();
+
+    if (nSize > 50000000)
+        nSize = 50000000;
+
+    if (PE.findString(0, nSize, "WIBUKEY") != -1 ||
+        PE.findString(0, nSize, "WkWin32.dll") != -1 ||
+        PE.findString(0, nSize, "WKWIN32.DLL") != -1) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DS.Wizzkey_dongle.5.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protection", "Wizzkey dongle reference");
+
+function detect() {
+    // I'm (adoxa) guessing this doesn't occur in the overlay, so don't search it (avoid wasting time on big installers).
+    if (PE.findString(0, PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize(), "\\\\.\\WIZZKEYRL") != -1) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DYAMAR.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("protector", "DYAMAR");
+
+function detect() {
+    if (PE.section[".dyamarC"] && PE.section[".dyamarD"]) {
+        sVersion = "1.3.5";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DZA_Patcher.2.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+
+init("protector", "DZA Patcher");
+
+function detect() {
+    if (PE.compareEP("EB08'5H40L1N'0060E8000000005D8BD581ED........2B95........83EA108995........8B442420250000FFFF")) {
+        sVersion = "1.3";
+        bDetected = true;
+    } else if (PE.compareEP("BF........9968........68........5252525252525257E81501000085C0751C9952525752E8CB000000FF35")) {
+        sVersion = "1.3";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Daemon_Protect.2.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protector", "Daemon Protect");
+
+function detect() {
+    if (PE.compareEP("60609c8cc932c9e3$$9d6130e230e231c055e8")) {
+        sVersion = "0.6.7";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DalKrypt.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("protector", "DalKrypt");
+
+function detect() {
+    if (PE.compareEP("68........5868........5F33DBEB0D8A140380EA0780F2048814034381FB........72EBFFE7")) {
+        sVersion = "1.0";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DataAnubis.1.sg

@@ -0,0 +1,11 @@
+// Detect It Easy: detection rule file
+
+init("cryptor", "DataAnubis");
+
+function detect() {
+    if (PE.isNetObjectPresent("_Lambda$__R20-1") && PE.isNetObjectPresent("_Lambda$__R97-1")) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DeepSea.2.sg

@@ -0,0 +1,18 @@
+// Detect It Easy: detection rule file
+
+init("protector", "DeepSea");
+
+function detect() {
+    if (PE.isNET()) {
+        var nOffset = PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "DeepSeaObfuscator");
+        if (nOffset != -1) {
+            if (PE.compare("'Evaluation'", nOffset + 18)) {
+                sVersion = "4.X";
+                sOptions = "Evaluation";
+            }
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/DelZip_SFX.2.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("sfx", "DelZip");
+
+function detect() {
+    if (PE.compareEP("558bec83c4..33c08945..b8........e8........33c05568........64ff306489206a..68........6a")) {
+        if (PE.compareOverlay("'MPV'")) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Delphi.4.sg

@@ -0,0 +1,270 @@
+// Detect It Easy: detection rule file
+// 1995-2007 Borland Delphi
+// 2007-2014 Embarcadero Delphi;
+// https://docwiki.embarcadero.com/RADStudio/Alexandria/en/Compiler_Versions
+// coauthor: sendersu
+
+init("compiler", "Borland Delphi");
+
+includeScript("Borland");
+
+function getVersion() {
+    if (PE.isNET()) {
+        if (PE.isNetObjectPresent("Borland.Vcl.Types")) {
+            sVersion = "8";
+        } else if (PE.isNetObjectPresent("Borland.Eco.Interfaces")) {
+            sVersion = "8 Eco WinForm";
+        } else if (PE.isNetObjectPresent("Borland.Delphi.System") &&
+            PE.isNetObjectPresent("WinForm")) {
+            sVersion = "8 WinForm";
+        } else if (PE.isNetObjectPresent("Borland.Delphi.Units")) {
+            sVersion = "2005 for .NET";
+        } else if (PE.isNetObjectPresent("Borland.Studio.Delphi")) {
+            sName = "Embarcadero Delphi";
+            sVersion = "XE*";
+            sOptions = ".NET";
+        } else {
+            return 0;
+        }
+        return 1;
+    }
+
+    var nSectionOffset = PE.section[0].FileOffset,
+        nSectionSize = PE.section[0].FileSize,
+        nOffset = nSectionOffset,
+        nSize = nSectionSize,
+        nOffset2,
+        nAddress,
+        nLng,
+        nLng1,
+        bNewVersion = 0;
+
+    var nAddressSize = PE.isPEPlus() ? 8 : 4;
+
+    while (nSize > 0) {
+        nOffset = PE.findSignature(nOffset, nSize, "0708'TControl'");
+        if (nOffset == -1) {
+            break;
+        }
+        nAddress = PE.readDword(nOffset + 10);
+        nOffset2 = PE.VAToOffset(nAddress);
+        if (nOffset2 != -1) {
+            if ((nOffset2 >= nSectionOffset) && (nOffset2 < nSectionOffset + nSectionSize)) {
+                nLng = PE.readDword(nOffset2 - 10 * nAddressSize);
+                nLng1 = PE.readDword(nOffset2 - 10 * nAddressSize - 11 * nAddressSize);
+
+                switch (nLng) {
+                    case 0:
+                        if (nLng1 == 0x746E4907) {
+                            sVersion = "3";
+                        } else if (nLng1 == 0x4F540774) {
+                            sVersion = "2";
+                        }
+                        break;
+
+                    case 0x0B4:
+                        sVersion = "C++ Builder";
+                        break;
+                    case 0x114:
+                        sVersion = "4";
+                        break;
+                    case 0x120:
+                        sVersion = "5";
+                        break;
+                    case 0x128:
+                        sVersion = "6 CLX";
+                        break;
+                    case 0x12C:
+                        sVersion = "7 CLX";
+                        break;
+                    case 0x138:
+                        sVersion = "Kylix";
+                        break;
+                    case 0x15C:
+                    case 0x160:
+                        sVersion = (nLng1 == 0x40100000 || nLng1 == 0x100000) ? "7" : "6";
+                        break;
+
+                    case 0x164:
+                        sVersion = "2005";
+                        break;
+                    case 0x190:
+                        sVersion = "2006";
+                        break;
+
+                    default:
+                        nLng = PE.readDword(nOffset2 - 13 * nAddressSize);
+
+                        if (nLng == 0x1A4) {
+                            sName = "Embarcadero Delphi";
+                            sVersion = "2009";
+                        } else if (nLng == 0x1AC) {
+                            if (PE.resource["PACKAGEINFO"]) {
+                                nOffset = PE.resource["PACKAGEINFO"].Offset;
+                                nSize = PE.resource["PACKAGEINFO"].Size;
+                                if (PE.isSignaturePresent(nOffset, nSize, "'ExcUtils'")) {
+                                    sName = "Embarcadero Delphi";
+                                    sVersion = "XE";
+                                } else if (PE.isSignaturePresent(nOffset, nSize, "'StrUtils'")) {
+                                    sName = "Embarcadero Delphi";
+                                    sVersion = "2010";
+                                } else {
+                                    sName = "Embarcadero Delphi";
+                                    sVersion = "2010 or XE";
+                                }
+                            }
+                        } else if (nLng == 0x1B4) {
+                            // 32
+                            sName = "Embarcadero Delphi";
+                            sVersion = "XE2-XE4";
+                        } else if ((nLng == 0x2F0) || (nLng == 0x2F8)) {
+                            // 64
+                            sName = "Embarcadero Delphi";
+                            sVersion = "XE2";
+                        } else if (nLng == 0x1BC) {
+                            // 32
+                            sName = "Embarcadero Delphi";
+                            sVersion = "XE5-XE6";
+                            bNewVersion = 1;
+                        } else {
+                            if (nAddressSize == 8) {
+                                nLng = PE.readDword(nOffset2 - 16 * nAddressSize);
+                                if (nLng == 0x2F8) {
+                                    // 64
+                                    sName = "Embarcadero Delphi";
+                                    sVersion = "XE3-X4";
+                                } else if (nLng == 0x308) {
+                                    // 64
+                                    sName = "Embarcadero Delphi";
+                                    sVersion = "XE5-XE6";
+                                    bNewVersion = 1;
+                                }
+                            }
+                        }
+                }
+
+                if ((sVersion != "") && (!bNewVersion)) {
+                    return 1;
+                }
+            }
+        }
+
+        nOffset++;
+        nSize = nSectionSize - (nOffset - nSectionOffset + 1);
+    }
+
+    if (PE.resource["PACKAGEINFO"]) {
+        nOffset = PE.resource["PACKAGEINFO"].Offset;
+        nSize = PE.resource["PACKAGEINFO"].Size;
+
+        if (PE.isSignaturePresent(nOffset, nSize, "'System.SysUtils'")) {
+            sName = "Embarcadero Delphi";
+            sVersion = "XE2-XE6";
+            bNewVersion = 1;
+        } else if (PE.isSignaturePresent(nOffset, nSize, "'ExcUtils'")) {
+            sName = "Embarcadero Delphi";
+            sVersion = "XE";
+        } else if (PE.isSignaturePresent(nOffset, nSize, "'StrUtils'")) {
+            sName = "Embarcadero Delphi";
+            sVersion = "2009-2010";
+        } else if (PE.isSignaturePresent(nOffset, nSize, "'ImageHlp'")) {
+            sVersion = "2006";
+        } else if (PE.isSignaturePresent(nOffset, nSize, "'SysInit'")) {
+            sVersion = "6-7 or 2005";
+        }
+
+        if ((sVersion != "") && (!bNewVersion)) {
+            return 1;
+        }
+    } else {
+        if (PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "Borland\\Delphi") != -1) {
+            sVersion = "2-3";
+            return 1;
+        }
+    }
+
+    if (bNewVersion) {
+        if (PE.section[".rdata"]) {
+            var nRDataOffset = PE.section[".rdata"].FileOffset;
+            var nRDataSize = PE.section[".rdata"].FileSize;
+            var nVersionOffset = PE.findString(nRDataOffset, nRDataSize, "Embarcadero Delphi for Win");
+            if (nVersionOffset != -1) {
+                var sCompilerVersion = PE.getString(nVersionOffset + 46, 4);
+                if (sCompilerVersion == "28.0") {
+                    sVersion = "XE7";
+                } else if (sCompilerVersion == "29.0") {
+                    sVersion = "XE8";
+                } else if (sCompilerVersion == "30.0") {
+                    sVersion = "10 Seattle";
+                } else if (sCompilerVersion == "31.0") {
+                    sVersion = "10.1 Berlin";
+                } else if (sCompilerVersion == "32.0") {
+                    sVersion = "10.2 Tokyo";
+                } else if (sCompilerVersion == "33.0") {
+                    sVersion = "10.3 Rio";
+                } else if (sCompilerVersion == "34.0") {
+                    sVersion = "10.4 Sydney";
+                } else if (sCompilerVersion == "35.0") {
+                    sVersion = "11.0 Alexandria";
+                } else if (sCompilerVersion == "36.0") {
+                    sVersion = "12.0 Athens";
+                } else {
+                    sVersion = "12.x Athens++";
+                }
+            }
+        }
+
+        return 1;
+    }
+
+    return 0;
+}
+
+function detect() {
+    if (bBorlandC) { // can't be Delphi if it's already C/C++
+        return null;
+    }
+
+    if (PE.resource["PACKAGEINFO"]) {
+        bDetected = true;
+        getVersion();
+    }
+    if (PE.resource["DVCLAL"]) {
+        bDetected = true;
+        getVersion();
+
+        // try to decode DVCLAL (Delphi Visual Component Library Access License) values
+        nOffset = PE.getResourceNameOffset("DVCLAL");
+        if (PE.compare("A28CDF987B3C3A7926713F090F2A2517", nOffset)) {
+            sOptions = "Professional";
+        } else if (PE.compare("23785D23B6A5F31943F3400226D111C7", nOffset)) {
+            sOptions = "Standard";
+        } else if (PE.compare("263D4F38C28237B8F3244203179B3A83", nOffset)) {
+            sOptions = "Enterprise";
+        }
+    } else if (PE.resource["TMAINFORM"]) {
+        bDetected = true;
+        getVersion();
+    } else if (PE.isNET()) {
+        if (getVersion()) {
+            bDetected = true;
+        }
+    } else if (PE.compare("0A06'string'", PE.section[0].FileOffset)) {
+        sVersion = "2";
+        bDetected = true;
+    } else if (PE.findSignature(PE.section[0].FileOffset, 100, "07'Boolean'") != -1) {
+        bDetected = true;
+        getVersion();
+    } else if (PE.findSignature(PE.section[0].FileOffset, 100, "06'String'") != -1) {
+        bDetected = true;
+        getVersion();
+    } else if (PE.findSignature(PE.section[0].FileOffset, 0x100, "FF25........8BC0FF25........8BC0")) {
+        if (getVersion()) {
+            bDetected = true;
+        }
+    }
+
+    _setLang("Object Pascal (Delphi)", bDetected);
+
+    return result();
+}