die-python 0.4.0__cp313-abi3-win_amd64.whl

db/PE/Denuvo.2.sg

@@ -0,0 +1,97 @@
+// Detect It Easy: detection rule file
+// Author: deadmau5 <deadmau5@tutanota.de>
+// Updated: DosX (@DosX-dev)
+
+init("protector", "Denuvo");
+
+function detect() {
+    if (PE.isSectionNamePresent(".arch") || PE.isSectionNamePresent(".edata") || PE.isSectionNamePresent(".srdata") || PE.isSectionNamePresent(".xpdata") || PE.isSectionNamePresent(".xdata") || PE.isSectionNamePresent(".xtls")) {
+        if (PE.is64()) {
+            // Mad Max, Metal Gear Solid: TPP, Rise of the Tomb Raider
+            if (PE.compareEP("51 52 41 50 41 51 4C 8D ?? ?? ?? ?? ?? 4C 8D ?? ?? ?? ?? ?? 4D 29 C1")) {
+                sVersion = "v1.0";
+                bDetected = true;
+            }
+            // Lords of the Fallen, Batman: AK, Just Cause 3, Sherlock Holmes: TdD, Tales of Berseria etc
+            else if (PE.compareEP("48 8D 0D ?? ?? ?? ?? E9 ?? ?? ?? ??")) {
+                sVersion = "v2.0a";
+                bDetected = true;
+            }
+            // Yesterday Origins
+            else if (PE.compareEP("48 89 ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 4C 89 ?? ?? ?? ?? ?? 48 83 FA 01")) {
+                sVersion = "v2.0b";
+                bDetected = true;
+            }
+            // Sniper Ghost Warrior 3 (beta), Dead Rising 4 (SteamStub-free)
+            else if (PE.compareEP("?? ?? ?? ?? ?? ?? ?? ?? 4C 89 1C 24 49 89 E3")) {
+                sVersion = "v3.0a";
+                bDetected = true;
+            }
+            // Atomic Heart
+            else if (PE.compareEP("48 8D 64 24 .. 50 51 52 80 3D .. .. .. .. .. 75 .. 48 8D 05 .. .. .. .. 48 8D 0D .. .. .. ..")) {
+                sVersion = "v17.0"; // v17.0, what? How?
+                bDetected = true;
+            }
+            // Train Sim World CSX Heavy Haul
+            else if (PE.compareEP("4D 8D ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 89 ?? ?? ?? ?? ?? 48 8D ?? ?? 48 89 ?? 48 89 ?? 48 89")) {
+                sVersion = "v3.0b";
+                bDetected = true;
+            } else if (PE.findSignature(0, PE.getSize(), "64 65 6E 75 76 6F 5F 61 74 64 00 00 00 00 00 00") !== -1) {
+                // Unknown version
+                // sVersion = "v?";
+                bDetected = true;
+            }
+            // Check if steam_api64.dll present
+            if (PE.isLibraryPresent("steam_api64.dll")) {
+                // Override additional info
+                sOptions = "Steam";
+                bDetected = true;
+            }
+            // Check if uplay_r1_loader64.dll present
+            if (PE.isLibraryPresent("uplay_r1_loader64.dll")) {
+                // Override additional info
+                sOptions = "uPlay";
+                bDetected = true;
+            }
+            // Check if Core/Activation64.dll present
+            if (PE.isLibraryPresent("Core/Activation64.dll")) {
+                // Override additional info
+                sOptions = "Origin";
+                bDetected = true;
+            }
+        } else {
+            // Pro Evolution Soccer 2017, Champions of Anteria
+            if (PE.compareEP("55 89 E5 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??")) {
+                sVersion = "v1.0";
+                bDetected = true;
+            }
+            // Romance of 13 Kingdoms, 2Dark
+            else if (PE.compareEP("8D ?? ?? ?? ?? ?? ?? 89 7C 24 04 89 E7")) {
+                sVersion = "v2.0";
+                bDetected = true;
+            } else {
+                sVersion = "v?";
+            }
+            // Check if steam_api64.dll present
+            if (PE.isLibraryPresent("steam_api.dll")) {
+                // Override additional info
+                sOptions = "Steam";
+                bDetected = true;
+            }
+            // Check if uplay_r1_loader.dll present
+            if (PE.isLibraryPresent("uplay_r1_loader.dll")) {
+                // Override additional info
+                sOptions = "uPlay";
+                bDetected = true;
+            }
+            // Check if Core/Activation.dll present
+            if (PE.isLibraryPresent("Core/Activation.dll")) {
+                // Override additional info
+                sOptions = "Origin";
+                bDetected = true;
+            }
+        }
+    }
+
+    return result();
+}

db/PE/DeployMaster.1.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "DeployMaster");
+
+function detect() {
+    if (PE.compareEP("558bec81c4........5333c08985........8985........b8........e8........33c05568........64ff30")) {
+        if (PE.compareOverlay("'BZh91'")) {
+            sVersion = "2.8.0";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Dimd_SFX.1.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("sfx", "Dimd");
+
+function detect() {
+    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
+        if (PE.compareOverlay("........'DIMDMSCF'")) {
+            sOptions = "CAB SFX";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Ding_Boys_PE-lock_Phantasm.2.sg

@@ -0,0 +1,18 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Ding Boys PE-lock Phantasm");
+
+function detect() {
+    if (PE.compareEP("555756525153E8000000005D8BD581ED")) {
+        sVersion = "0.07/0.8";
+        bDetected = true;
+    } else if (PE.compareEP("5557565251536681C3EB02EBFC6681C3EB02EBFC")) {
+        sVersion = "1.0/1.1";
+        bDetected = true;
+    } else if (PE.compareEP("9C5557565251539CFAE8000000005D81ED")) {
+        sVersion = "1.5b3";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Direct2D.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "Direct2D");
+
+function detect() {
+    if (PE.isLibraryPresentExp(/^d2d*/i)) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Direct3D.4.sg

@@ -0,0 +1,38 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "Direct3D");
+
+function detect() {
+    if (PE.isLibraryPresentExp(/^d3d*/i)) {
+        bDetected = true;
+
+        var runtimeLibrary = PE.isLibraryPresentExp(/^d3d\d/i);
+
+        // d3d12.dll -> d3d[12].dll -> Direct3D v12
+        if (runtimeLibrary != null) {
+
+            var versionNumber = String(runtimeLibrary).substr(3, 2);
+
+            if (isNumber(versionNumber)) { // 10+
+                sVersion = versionNumber;
+            } else { // 8, 9
+                sVersion = versionNumber[0];
+            }
+        }
+
+    }
+
+    return result();
+}
+
+// Checks whether the resulting string is a number
+function isNumber(str) {
+    if (str.length === 0) return false;
+    for (var n = 0; n < str.length; n++)
+        for (var e = 0; e < 10 && str[n] !== "0123456789" [e]; e++)
+            if (e === 9) return false;
+    return true;
+}

db/PE/DirectX.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "DirectX Graphics");
+
+function detect() {
+    if (PE.isLibraryPresentExp(/^dxgi/i)) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Dolphin_VM.1.sg

@@ -0,0 +1,18 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+// Executable made by Dolphin XP ToGo Application (Dolphin Smalltalk platform)
+
+init("other", "Dolphin Virtual Machine");
+
+function detect() {
+    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")) {
+        if (PE.compareOverlay("'IST'00")) {
+            sVersion = "5.0";
+            sOptions = "2003 by Object Arts";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/DotFix_Nice_Protect.2.sg

@@ -0,0 +1,23 @@
+// Detect It Easy: detection rule file
+
+init("protector", "DotFix NiceProtect");
+
+function detect() {
+    if (PE.compareEP("E9FF000000608B7424248B7C2428FCB28033DBA4B302E86D00000073F633C9E864000000731C33C0E85B0000007323B30241B010E84F00000012C073F7753FAAEBD4E84D0000002BCB7510E842000000EB28ACD1E8")) {
+        sVersion = "2.1-2.5";
+        bDetected = true;
+    } else if (PE.compareEP("60E8550000008DBD........68........033C248BF79068........9BDBE355DB04248BC7DB442404DEC1DB1C248B1C2466AD51DB04249090DA8D........DB1C24D1E129")) {
+        bDetected = true;
+    } else if (PE.compareEP("60be........8dbe........5783cd..eb$$619090505174..83c8..eb")) {
+        bDetected = true;
+    } else if (PE.compareEP("e8$$$$$$$$eb$$5aeb$$524aeb$$eb$$b9........eb$$eb$$dd..eb$$803411..eb$$eb$$e2")) {
+        sVersion = "1.0-2.x";
+        bDetected = true;
+    } else if (PE.compareEP("60BE")) {
+        if (PE.section["."]) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Dotfuscator.2.sg

@@ -0,0 +1,11 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Dotfuscator");
+
+function detect() {
+    if (_getNumberOfResults("protector") <= 1 && PE.isNetObjectPresent("DotfuscatorAttribute")) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Duals_eXe_Encryptor.2.sg

@@ -0,0 +1,19 @@
+// Detect It Easy: detection rule file
+
+init("cryptor", "Duals eXe Encryptor");
+
+function detect() {
+    if (PE.compareEP("558BEC81EC00050000E8000000005D81ED0E")) {
+        switch (PE.readWord(PE.nEP + 18)) {
+            case 0x308:
+                sVersion = "1.0";
+                break;
+            case 0x43A:
+                sVersion = "1.0b";
+                break;
+        }
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/DxPack.2.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+
+init("packer", "DxPack");
+
+function detect() {
+    if (PE.compareEP("60E8........5D8BFD81ED........2BB9........81EF........83BD..........0F84")) {
+        switch (PE.readByte(PE.nEP + 32)) {
+            case 0xB9:
+                sVersion = "1.0";
+                break;
+            case 0xBD:
+                sVersion = "0.86";
+                break;
+        }
+        bDetected = true;
+    } else if (PE.compareEP("EB03C20C00558BEC81EC00100000B80000....B900100000BA0000....89")) {
+        sVersion = "1.0";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/ENIGMA.2.sg

@@ -0,0 +1,115 @@
+// Detect It Easy: detection rule file
+// 07.12.2014 detect x64, build date added //ajax
+
+init("protector", "Enigma");
+
+function getVersion() {
+    var nSection = PE.nLastSection,
+        nOffset = PE.section[nSection].FileOffset,
+        nSize = PE.section[nSection].FileSize;
+    if (nSize == 0) {
+        nOffset = PE.section[nSection - 1].FileOffset;
+        nSize = PE.section[nSection - 1].FileSize;
+    }
+    var nVersionOffset = PE.findSignature(nOffset, nSize, "000000'ENIGMA'");
+    if (nVersionOffset != -1) {
+
+        var sMajor = PE.readByte(nVersionOffset + 9),
+            sMinor = PE.readByte(nVersionOffset + 10),
+            bYear = PE.readWord(nVersionOffset + 11),
+            bMonth = PE.readWord(nVersionOffset + 13),
+            bDay = PE.readWord(nVersionOffset + 15),
+            bHour = PE.readWord(nVersionOffset + 17),
+            bMin = PE.readWord(nVersionOffset + 19),
+            bSec = PE.readWord(nVersionOffset + 21);
+
+        sVersion = sMajor + "." + sMinor + " build " + bYear + "." + bMonth + "." + bDay + " " + bHour + ":" + bMin + ":" + bSec;
+        return 1;
+    }
+    nVersionOffset = PE.findSignature(nOffset, nSize, "'Enigma Protector'");
+    if (nVersionOffset != -1) {
+        sVersion = "5.X";
+        return 1;
+    }
+
+    return 0;
+}
+
+function getVersion_old1x() {
+    var nSection = PE.nLastSection;
+
+    var nVersionOffset = PE.findSignature(PE.section[nSection].FileOffset, PE.section[nSection].FileSize, "'ENIGMA'07' PROT'");
+
+    if (nVersionOffset != -1) {
+        sVersion = '1.14';
+        return 1;
+    }
+
+    return 0;
+}
+
+function getVersion_old() {
+    if (PE.section[".data"]) {
+
+        var nOffset = PE.section[".data"].FileOffset,
+            nOffset = PE.findString(nOffset, PE.section[".data"].FileSize, "Enigma protector v");
+
+        if (nOffset != -1) {
+            sVersion = PE.getString(nOffset + 18, 4);
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+function detect() {
+    if (!PE.isPEPlus()) {
+        if (PE.compareEP("558bec83c4..b8........e8........9a............e9$$$$$$$$60e8000000005d..ed")) {
+            getVersion();
+            bDetected = true;
+        } else if (PE.compareEP("60e8000000005d81ed........81ed........e9")) {
+            getVersion();
+            bDetected = true;
+        } else if (PE.compareEP("68........e8$$$$$$$$eb$$83c4..e9$$$$$$$$60e8000000005d81ed")) {
+            getVersion();
+            bDetected = true;
+        } else if (PE.compareEP("eb$$e9$$$$$$$$60e8000000005d81ed........81ed........e9")) {
+            getVersion();
+            bDetected = true;
+        } else if (PE.compareEP("e8$$$$$$$$83c4..e9$$$$$$$$60e8000000005d81ed........81ed........e9")) {
+            getVersion();
+            bDetected = true;
+        } else if (PE.compareEP("60e8000000005d83....81ed")) //first versions
+        {
+            getVersion_old();
+            bDetected = true;
+        } else if (PE.compareEP("eb$$e9$$$$$$$$60e8000000005d83....81ed")) //1.14
+        {
+            getVersion_old1x();
+            getVersion_old();
+            bDetected = true;
+        }
+    } else if (PE.compareEP("5051525355565741504151415241534154415541564157489C4881EC080000000FAE1C24E8000000005D")) {
+        getVersion();
+        bDetected = true;
+    }
+
+    if (!bDetected) {
+        if (PE.getNumberOfImports() > 1 &&
+            PE.getNumberOfImportThunks(1) == 1 &&
+            PE.getImportFunctionName(1, 0) == "MessageBoxA" &&
+            PE.getSectionCharacteristics(0) == 0xe0000040 &&
+            getVersion()) {
+            bDetected = true;
+        } else if (PE.getSectionNameCollision("1", "2") == "enigma") {
+            bDetected = true;
+        } else if (PE.isNET()) {
+            if (PE.isSignatureInSectionPresent(0, "000000'ENIGMA'")) {
+                bDetected = true;
+            }
+        }
+    }
+
+    return result();
+}

db/PE/EXE32Pack.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("packer", "Exe32Pack");
+
+function detect() {
+    if (PE.compareEP("3BC074028183553BC074028183533BC97401BC563BD27402818557E8000000003BDB7401BE5D8BD581ED")) {
+        sVersion = "1.4X";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/EXECryptor.2.sg

@@ -0,0 +1,99 @@
+// Detect It Easy: detection rule file
+
+init("cryptor", "EXECryptor");
+
+function detect() {
+    if (PE.compareEP("A4......00000000FFFFFFFF3C......94......D8......00000000FFFFFFFFB8")) {
+        sVersion = "2.0/2.1";
+        sOptions = "protected IAT";
+        bDetected = true;
+    } else if (PE.compareEP("558BEC83C4F4565753BE........B80000....8945FC89C28B460C09C00F84")) {
+        sVersion = "2.0/2.1";
+        bDetected = true;
+    } else if (PE.compareEP("BE........B80000....8945FC89C28B460C09C00F84..00000001D089C350FF15")) {
+        sVersion = "2.1.17";
+        bDetected = true;
+    } else if (PE.compareEP("E8$$$$$$$$E800000000............8B1C2481EB........B8........506A..68")) {
+        sVersion = "2.2.4";
+        bDetected = true;
+    } else if (PE.compareEP("5068........5881E0........E9......00870C2459E8......008945F8E9")) {
+        sVersion = "2.2.6";
+        sOptions = "minimum protection";
+        bDetected = true;
+    } else if (PE.compareEP("508BC687042468........5EE9........85C8E9........81C3........0F81")) {
+        sVersion = "2.2.6";
+        sOptions = "DLL/minimum protection";
+        bDetected = true;
+    } else if (PE.compareEP("E80000000058..........8B1C2481EB........B8........506A046800100000506A00B8")) {
+        sVersion = "2.2/2.3";
+        sOptions = "compressed code";
+        bDetected = true;
+    } else if (PE.compareEP("CC......00000000FFFFFFFF3C......B4......08......00000000FFFFFFFFE8")) {
+        sVersion = "2.2/2.3";
+        sOptions = "protected IAT";
+        bDetected = true;
+    } else if (PE.compareEP("5168........5981F1123CCB98E9532C0000F7D7E9EB6000008345F802E9E3360000")) {
+        sVersion = "2.3.9";
+        sOptions = "compressed resources";
+        bDetected = true;
+    } else if (PE.compareEP("68........E9......FF50C1C8188905........C3C1C01851E9......FF84C00F84")) {
+        sVersion = "2.3.9";
+        sOptions = "minimum protection";
+        bDetected = true;
+    } else if (PE.compareEP("5068........58C1C00FE9......00870424588945FCE9......FFFF05........E9")) {
+        sVersion = "2.3.9";
+        sOptions = "DLL/compressed resources";
+        bDetected = true;
+    } else if (PE.compareEP("5168........872C248BCD5D81E1........E9......008945F85168........5981F1")) {
+        sVersion = "2.3.9";
+        sOptions = "DLL/minimum protection";
+        bDetected = true;
+    } else if (PE.compareEP("56575331DB89C689D70FB60689C283E01FC1EA05742D4A74158D5C130246C1E00889")) {
+        sVersion = "2.xx";
+        sOptions = "compressed resources";
+        bDetected = true;
+    } else if (PE.compareEP("558BEC83C4ECFC5357568945FC8955F889C689D766813E4A430F852301000083C60A")) {
+        sVersion = "2.xx";
+        sOptions = "max. compressed resources";
+        bDetected = true;
+    } else if (PE.compareEP("E824......8B4C240CC70117..01..C781..............31C089411489411880A1")) {
+        sVersion = "1.3.0.45";
+        bDetected = true;
+    } else if (PE.compareEP("E8$$$$$$$$31c064ff30648920648f05........83c4..e9$$$$$$$$60e8$$$$$$$$83c4")) {
+        sVersion = "1.4X-1.5X";
+        bDetected = true;
+    } else if (PE.compareEP("E8$$$$$$$$31C064FF30648920CCC3")) {
+        sVersion = "1.5X";
+        bDetected = true;
+    } else if (PE.compareEP("83C6148B55FCE9..FFFFFF")) {
+        sVersion = "2.1X";
+        bDetected = true;
+    } else if (PE.compareEP("E9........669C60508D88........8D900416....8BDC8BE1")) {
+        sVersion = "2.1X";
+        bDetected = true;
+    } else if (PE.compareEP("FFE0E804000000FFFFFFFF5EC300")) {
+        sVersion = "2.2X";
+        bDetected = true;
+    } else if (PE.compareEP("E9$$$$$$$$E8$$$$$$$$0F")) {
+        bDetected = true;
+    }
+
+    if (!bDetected) {
+        var nNumberOfSections = PE.section.length;
+        if (nNumberOfSections > 3 &&
+            PE.getNumberOfImports() == 2 &&
+            PE.getNumberOfImportThunks(1) == 1 &&
+            PE.getImportFunctionName(1, 0) == "MessageBoxA") {
+            for (var nAdjust = 1; nAdjust < 3; nAdjust++) {
+                if (PE.getImportSection() == nNumberOfSections - nAdjust &&
+                    PE.section[nNumberOfSections - nAdjust - 1].FileSize == 0) {
+                    sVersion = nNumberOfSections > 4 ? "2.4X" : "2.X";
+                    bDetected = true;
+                    break;
+                }
+            }
+        }
+    }
+
+    return result();
+}

db/PE/EXEFog.2.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protector", "ExeFog");
+
+function detect() {
+    if (PE.compareEP("56e8$$$$$$$$5e5ee9$$$$$$$$e8$$$$$$$$5d83c5..55c3")) {
+        sVersion = "1.1";
+        bDetected = true;
+    } else if (PE.compareEP("52e8$$$$$$$$83c4..5a8be4510fb6c981e5")) {
+        sVersion = "1.1";
+        bDetected = true;
+    }
+
+    var ep_off = PE.getEntryPointOffset();
+    if (PE.findSignature(ep_off, 0x1000, "6545c2fb195bbd004040ebef9155f0401897db0024e8e80000008387202e87d17820fb1cb800b0ef0b000000848e") != -1) {
+        sVersion = "1.1";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/EXE_Password_Protector.2.sg

@@ -0,0 +1,12 @@
+// By Eliseu Filipi
+
+init("protector", "EXE Password Protector");
+
+function detect() {
+    if (PE.compareEP("6A606810B54000E82E020000BF940000008BC7E822F4FFFF8965E88BF4893E56FF1510B040008B4E10890D00ED40008B4604")) {
+        sVersion = "1.1";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Eazfuscator.2.sg

@@ -0,0 +1,16 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+// https://www.gapotchenko.com/eazfuscator.net
+init("protector", "EazFuscator");
+
+function detect() {
+    bDetected =
+        PE.isNET() &&
+        PE.isSignaturePresent(PE.section[0].FileOffset, 1024, "'fefef'") &&
+        PE.isSignatureInSectionPresent(0, "00 E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 ** E2 80 **")
+
+    return result();
+}

db/PE/ElecKey.2.sg

@@ -0,0 +1,33 @@
+// Detect It Easy: detection rule file
+// 2022.04.16 2.00.X version Thanks: A.S.L. <asl@onet.eu>
+
+init("protector", "ElecKey");
+
+function detect() {
+    if (PE.isNET()) {
+        if (PE.isSignatureInSectionPresent(0, "83c42068........68........c744240800000000ff15........50ff15........85c0a3")) {
+            sOptions = "AnyCPU";
+            bDetected = true;
+        } else if (PE.isSignatureInSectionPresent(0, "488b0dd2be01006641b83200488d917b070000ff15a040010033c9ff15b8400100488b")) {
+            sOptions = "x64";
+            bDetected = true;
+        }
+    }
+
+    if (!bDetected) {
+        // 2.00.X
+        if (PE.isPEPlus()) {
+            if (PE.compareEP("41504151515257535556E8000000005B48B8................482BD8488BEB")) {
+                sVersion = "2.00.X";
+                bDetected = true;
+            }
+        } else {
+            if (PE.compareEP("515257535556E8000000005BB8........2BD8")) {
+                sVersion = "2.00.X";
+                bDetected = true;
+            }
+        }
+    }
+
+    return result();
+}

db/PE/ElectronApp.3.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+// Author: sendersu
+/*
+If errors pls contact sendersu on cracklab.team
+*/
+
+init("library", "Electron package");
+
+function detect() {
+    if (PE.isSectionNamePresent("CPADinfo") &&
+        PE.isSectionNamePresent(".00cfg")
+    ) {
+        var nOffset = PE.section["CPADinfo"].FileOffset;
+        var nSize = PE.section["CPADinfo"].FileSize;
+        var nPresent = PE.findString(nOffset, nSize, "daPC");
+
+        if (nPresent != -1)
+            bDetected = true;
+    }
+
+    return result();
+}

db/PE/Enigma_Virtual_Box.2.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Enigma");
+
+function detect() {
+
+
+    if (bDetected) {
+        sVersion = "Virtual Box";
+    }
+
+    return result();
+}