die-python 0.4.0__cp313-abi3-win_amd64.whl

db/PE/Yodas_Crypter.2.sg

@@ -0,0 +1,35 @@
+// Detect It Easy: detection rule file
+
+init("cryptor", "Yoda's Crypter");
+
+function detect() {
+    if (PE.compareEP("60E8000000005D81ED........E8A1000000E8D1000000E885010000F785")) {
+        sVersion = "1.0";
+        bDetected = true;
+    } else if (PE.compareEP("60E8000000005D81ED........B9....00008DBD........8BF7")) {
+        switch (PE.readWord(PE.nEP + 14)) {
+            case 0x009E:
+                sVersion = "1.1";
+                break;
+            case 0x097B:
+                sVersion = "1.2";
+                break;
+            default:
+                sVersion = "1.x";
+        }
+        bDetected = true;
+    } else if (PE.compareEP("558BEC53565760E8000000005D81ED")) {
+        if (PE.compareEP("E803000000EB01", 19)) {
+            sVersion = "1.0b";
+            bDetected = true;
+        } else if (PE.compareEP("B9", 19)) {
+            sVersion = "1.3";
+            bDetected = true;
+        }
+    } else if (PE.compareEP("558BEC81ECC00000005356578DBD40FFFFFFB930000000B8CCCCCCCCF3AB60")) {
+        sVersion = "1.3";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Yodas_Protector.2.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Yoda's Protector");
+
+function detect() {
+    if (PE.compareEP("558BEC535657E8$$$$$$$$E8$$$$$$$$33C064FF30648920CCC3")) {
+        sVersion = "1.01";
+        bDetected = true;
+    } else if (PE.compareEP("E8$$$$$$$$BB........E8$$$$$$$$E8$$$$$$$$33c064ff306489204bccc3")) {
+        sVersion = "1.02-1.03";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Yummy_Game_SoftwareShield.2.sg

@@ -0,0 +1,17 @@
+// Detect It Easy: detection rule file
+// Author: Levis
+
+/*
+Created by Levis <levintaeyeon@live.com> - Site: http://ltops9.wordpress.com
+*/
+
+init("protector", "Yummy Game SoftwareShield");
+
+function detect() {
+    if (PE.compareEP("31C0E9B9FFFFFFC3")) {
+        sVersion = "5.x";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Zig.4.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+
+init("compiler", "Zig");
+
+function detect() {
+    if (PE.compare("'MZ'78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\
+0000'PE'0000")) {
+        if ((PE.section[".rdata"]) && (PE.isDeepScan())) {
+            var nOffset = PE.section[".rdata"].FileOffset;
+            var nSize = PE.section[".rdata"].FileSize;
+            var nVersionOffset = PE.findSignature(nOffset, nSize, "5A00490047005F00440045004200550047005F0043004F004C004F005200"); // Unicode ZIG_DEBUG_COLOR
+
+            if (nVersionOffset != -1) {
+                bDetected = true;
+            }
+        }
+    }
+
+    _setLang("Zig", bDetected);
+
+    return result();
+}

db/PE/ZipCentral_SFX.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("sfx", "ZipCentral SFX-32");
+
+function detect() {
+    if (PE.compareEP("558BEC83C4..33C089....B8........e8........33c05568........64....64....6a")) {
+        if (PE.compareOverlay("'MPV*'")) {
+            sVersion = "2.0";
+            sOptions = PE.getGeneralOptions();
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Zip_SFX.2.sg

@@ -0,0 +1,62 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("sfx", "Zip SFX");
+
+function detect() {
+    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965..ff15")) {
+        if (PE.findSignature(PE.getOverlayOffset(), Math.min(255, PE.getOverlaySize()), "'PK'0304") != -1) {
+            bDetected = true;
+        }
+    } else if (PE.compareEP("558bec83c4..b8........e8........33c05568........64ff30648920e8")) {
+        if (PE.resource.length) {
+            if (PE.resource[0].Type == 784) { // ZIP
+                bDetected = true;
+            }
+        }
+    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb")) {
+        if (PE.compareOverlay("'PK'0304")) {
+            sOptions = "by Intel";
+            bDetected = true;
+        }
+    }
+    if (PE.compareEP("558bec83c4..5356e8$$$$$$$$e8........6a..e8........8905........e8........8905")) {
+        if (PE.compareOverlay("'PK'0304")) {
+            sOptions = "by C.Ghisler & Co.";
+            bDetected = true;
+        }
+    }
+    if (PE.compareEP("558becb8........e8........5356be........578d45..5633db5053ff15........85c00f84")) {
+        if (PE.findSignature(PE.getOverlayOffset(), 0x1000, "'PK'0304") != -1) {
+            sOptions = "by Symantec";
+            bDetected = true;
+        }
+    }
+    if (PE.compareEP("83ec..5657ff15........8bf08d4424..50c74424..........ff15........8a068b3d........3c..75..56ffd7")) {
+        if (PE.compareOverlay("'PK'0304")) {
+            sName = "SymW32SFX";
+            sOptions = "by Symantec";
+            bDetected = true;
+        }
+    }
+    if (PE.compareEP("558bec83ec..565733ffff15........8bf0897d..8d45..50ff15........8a063c..75..56ff15")) {
+        if (PE.compareOverlay("'PK'0304")) {
+            sName = "Symantec EasyZIP SFX";
+            bDetected = true;
+        }
+    }
+    if (PE.compareEP("558bec83ec..56ff15........8bf08a003c..75..84c074..803e..74..46803e..75..803e..75..46eb")) {
+        if (PE.findSignature(PE.getOverlayOffset(), 0x2000, "'PK'0304") != -1) {
+            sOptions = "Squeez SFX by SpeedProject 1995-1998"
+            bDetected = true;
+        }
+    }
+    if (PE.compareEP("6a..33c0505050ff15........50e8$$$$$$$$55b8........8bece8........53b9........5657be")) {
+        if (PE.compareOverlay("'PK'0304")) {
+            sOptions = "EasyZIP SFX by AKSoft 1995-1996";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Zprotect.2.sg

@@ -0,0 +1,26 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Zprotect");
+
+function detect() {
+    if (PE.section.length > 3) {
+        if ((PE.section[0].FileOffset == 0) && (PE.section[0].FileSize == 0)) {
+            if (!PE.isDosStubPresent()) {
+                if (PE.compare("6B65726E656C33322E646C6C000000005669727475616C416C6C6F6300000000", PE.section[1].FileOffset)) {
+                    sVersion = "1.X";
+                    bDetected = true;
+                } else if ((PE.getEntryPointSection() == 1) && (PE.calculateEntropy(PE.section[2].FileOffset, PE.section[2].FileSize) > 7.6)) {
+                    sVersion = "1.X";
+                    bDetected = true;
+                }
+            }
+        }
+    }
+    if (PE.compareEP("e8$$$$$$$$87..248d..........87..24e9$$$$$$$$60e9$$$$$$$$54e9")) {
+        bDetected = true;
+    }
+
+    // TODO EP NFD
+
+    return result();
+}

db/PE/Zydis.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "Zyan Disassembler");
+
+function detect() {
+    if (PE.isLibraryPresent("zydis.dll")) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/_FixDetects.9.sg

@@ -0,0 +1,79 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+function detect() {
+
+    removeFalsePositive({
+        falsePositive: { packer: "AHpacker" },
+        ifPresents: { packer: "ExE Pack" }
+    });
+
+    removeFalsePositive({
+        falsePositive: { linker: "Turbo Linker" },
+        ifPresents: { linker: "Microsoft Linker" }
+    });
+
+    removeFalsePositive({
+        falsePositive: { tool: "Borland Delphi" },
+        ifPresents: { tool: "Microsoft Linker" }
+    });
+
+    removeFalsePositive({
+        falsePositive: { compiler: "FASM" },
+        ifPresents: { packer: "Simple Pack" }
+    });
+
+    // Number of "compiler" more than 1? Remove Visual C++.
+    if (_isResultPresent("compiler", "Microsoft Visual C/C++") && _getNumberOfResults("compiler") > 1) {
+        _removeResult("compiler", "Microsoft Visual C/C++");
+
+        if (_getNumberOfResults("language") > 1 && _isLangPresent("C/C++")) {
+            _removeResult("language", "C/C++");
+        }
+    }
+
+    // Visual Studio? -> C#
+    if (_isLangPresent("MSIL/C#") && _isResultPresent("tool", "Visual Studio")) {
+        _removeResult("language", "MSIL/C#");
+        _setLang("C#");
+    }
+
+
+
+    return null;
+
+    return result();
+}
+
+function removeFalsePositive(data) {
+
+    var falsePositive = data.falsePositive,
+        ifPresents = data.ifPresents;
+
+    var falsePositiveKey = String(),
+        falsePositiveValue = String();
+
+    for (var key in falsePositive) {
+        if (falsePositive.hasOwnProperty(key)) {
+            falsePositiveKey = key;
+            falsePositiveValue = falsePositive[key];
+            break;
+        }
+    }
+
+    var ifPresentsKey = String(),
+        ifPresentsValue = String();
+
+    for (var key in ifPresents) {
+        if (ifPresents.hasOwnProperty(key)) {
+            ifPresentsKey = key;
+            ifPresentsValue = ifPresents[key];
+            break;
+        }
+    }
+
+    if (_isResultPresent(falsePositiveKey, falsePositiveValue) && _isResultPresent(ifPresentsKey, ifPresentsValue)) {
+        _removeResult(falsePositiveKey, falsePositiveValue);
+    }}

db/PE/_NetCompilersLibs.4.sg

@@ -0,0 +1,39 @@
+// Detect It Easy: detection rule file
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+
+function detect() {
+
+    // https://github.com/0xd4d/dnlib
+    if (PE.isNetObjectPresent("dnlib") && PE.isNetObjectPresent("ModuleDef"))
+        _setResult("library", "dnlib", "", "");
+
+    // https://www.mono-project.com/docs/tools+libraries/libraries/Mono.Cecil/
+    if (PE.isNetObjectPresent("Mono.Cecil"))
+        _setResult("library", "Mono.Cecil", "", "");
+
+    // https://github.com/Washi1337/AsmResolver
+    if (PE.isNetObjectPresent("AsmResolver"))
+        _setResult("library", "AsmResolver", "", "");
+
+    // https://learn.microsoft.com/en-us/dotnet/framework/reflection-and-codedom/using-the-codedom
+    if (PE.isNetObjectPresent("System.CodeDom.Compiler")) { // Standard .NET library
+        var languages = "";
+
+        if (PE.isNetObjectPresent("CSharpCodeProvider"))
+            languages = "C#";
+
+        if (PE.isNetObjectPresent("VBCodeProvider"))
+            languages += (languages != "" ? " + " : "") + "VB.NET";
+
+        if (PE.isNetObjectPresent("JScriptCodeProvider")) // Should check the relation to System.CodeDom......
+            languages += (languages != "" ? " + " : "") + "JScript";
+
+        if (languages != "") {
+            _setResult("library", "CodeDom Compiler", "", languages);
+        }
+    }
+
+    return result();
+}

db/PE/_PE.0.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+
+init("operation system", "Windows");
+
+function detect() {
+    if (PE.isVerbose()) {
+        sName = PE.getOperationSystemName();
+        sVersion = PE.getOperationSystemVersion();
+        sOptions = PE.getOperationSystemOptions();
+
+        bDetected = true;
+
+        if (PE.section[".rossym"]) {
+            if (PE.section[".rossym"].Characteristics == 0x42000802) {
+                sVersion = "v0.3+";
+                sName = "React OS";
+            }
+        }
+    }
+
+    return result();
+}