die-python 0.4.0__cp313-abi3-win_amd64.whl

db/PE/iPB_Protect.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("protector", "iPB Protect");
+
+function detect() {
+    if (PE.compareEP("558BEC6AFF68'KCUF'68'TIHS'64A100000000")) {
+        sVersion = "0.1.3-0.1.7";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/inPEct.1.sg

@@ -0,0 +1,10 @@
+init("joiner", "inPEct");
+
+function detect() {
+    if (PE.compareEP("E8000000005D5583C5208BF58BFEB9......00BA........AD8BD833C2C1C20703D3ABE2F3")) {
+        sVersion = "1.1";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/java.3.sg

@@ -0,0 +1,21 @@
+// Detect It Easy: detection rule file
+
+init("library", "Java");
+
+function detect() {
+    if (PE.getOverlaySize() > 0x40) {
+        if (PE.findString(PE.getOverlayOffset(), 0x40, "META-INF/MANIFEST.MF") != -1) {
+            var nResSection = PE.getResourceSection();
+            if (nResSection != -1) {
+                if (PE.isSignatureInSectionPresent(nResSection, "'Java Runtime Environment'")) {
+                    bDetected = true;
+                }
+            }
+        }
+    }
+
+
+    _setLang("Java", bDetected);
+
+    return result();
+}

db/PE/keygens.1.sg

@@ -0,0 +1,25 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("keygen", "Keygen");
+
+function detect() {
+    if (PE.compareEP("6a..e8........a3........c705................c705................c705................c705................c705................a1........a3........6a..ff35........e8........a3........a3........68")) {
+        sOptions = "by Dimedrol //CORE";
+        bDetected = true;
+    } else if (PE.compareEP("606a..e8........a3........6a..6a..6a..e8........506a..e8........50e8........a3........8bf883c7..f647")) {
+        sOptions = "by promethee //ECLIPSE";
+        bDetected = true;
+    } else if (PE.compareEP("6a..e8........a3........68........6a..6a..6a..6a..68........6a..6a..6a..68........6a..6a..6a..6a..e8........a3........6a")) {
+        sOptions = "by Duelist //CORE";
+        bDetected = true;
+    } else if (PE.compareEP("6a..e8........a3........6a..68........6a..6a..50e8........50e8........c3")) {
+        sOptions = "2000 by Duelist //CORE";
+        bDetected = true;
+    } else if (PE.compareEP("6a..e8........a3........33c066b8....6a..68........6a..50ff35........e8........e8........c8......53575633c0668b45..663d....75..eb")) {
+        sOptions = "by //oDDiTy";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/kkrunchy.2.sg

@@ -0,0 +1,19 @@
+// Detect It Easy: detection rule file
+
+init("packer", "kkrunchy");
+
+function detect() {
+    if (PE.compareEP("BD........C745..........B8........89450489455450C74510")) {
+        sVersion = "0.23 alpha 2";
+        bDetected = true;
+    } else if (PE.compareEP("BD........C745..........FF4D08C6450C058D7D1431C0B40489C1F3ABBF")) {
+        sVersion = "0.2X";
+        bDetected = true;
+    } else if (PE.compareEP("bd........c7............fcff4d0831d28d7d30be")) {
+        bDetected = true;
+    } else if (PE.compare("'MZfarbrauschPE'")) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/ldc.4.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+
+init("compiler", "ldc");
+
+function detect() {
+    if (PE.isSectionNamePresent(".minfo") && (!(PE.isSectionNamePresent("._deh")))) {
+        bDetected = true;
+    }
+
+    _setLang("D", bDetected);
+
+    return result();
+}

db/PE/linker.6.sg

@@ -0,0 +1,100 @@
+// Detect It Easy: detection rule file
+
+init("linker", "unknown", PE.getCompilerVersion(), PE.getGeneralOptionsEx());
+
+includeScript("FASM");
+includeScript("RosASM");
+includeScript("SpASM");
+includeScript("FPC");
+
+function detect() {
+    if (PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'0000000000000'PE'0000")) {
+        var nMajor = PE.getMajorLinkerVersion();
+        var nMinor = PE.getMinorLinkerVersion();
+        if (nMajor == 2) {
+            if (nMinor == 55) {
+                sName = "LCC Linker";
+                sVersion += "*";
+                bDetected = true;
+            } else if (nMinor <= 40 || nMinor == 56) {
+                sName = "GNU Linker ld (GNU Binutils)";
+                if (nMinor == 56) {
+                    sVersion += "*";
+                }
+                bDetected = true;
+            } else if (nMinor == 50) {
+                sName = "Polink";
+                sVersion += "*";
+                bDetected = true;
+            }
+        } else if (nMajor == 1) {
+            if (nMinor == 3) {
+                sName = "LCC Linker";
+                bDetected = true;
+            }
+        }
+    } else if (PE.compare("'This program must be run under Win'....0D0A24..00", 0x50)) {
+        sName = "Turbo Linker";
+        if (sVersion == "2.25") {
+            sVersion += "*,Delphi";
+        }
+        bDetected = true;
+    } else if (PE.compare("FB..'jr'", 0x1e)) {
+        sName = "Turbo Linker";
+        sVersion = (PE.readByte(0x1f) / 16).toFixed(1);
+        if (PE.compare("'32STUB'", 0x200)) {
+            sOptions = sOptions.append("RTM32");
+        }
+        bDetected = true;
+    } else if (PE.compare( /*[Tt]*/ "'his is a Windows '" /*(?:95|NT)*/ , 0x4f)) {
+        sName = "Watcom Linker";
+        sVersion += "*";
+        bDetected = true;
+    } else if (PE.compare("'MZ'6c000100000002000000ffff000000000000110000004000000000000000'Win'....' Program!\r\n\b409ba0001cd21b44ccd2160000000'GoLink, GoAsm www.GoDevTool.com'00")) {
+        sName = "GoLink";
+        bDetected = true;
+    }
+    var nMajor = PE.getMajorLinkerVersion();
+    var nMinor = PE.getMinorLinkerVersion();
+    if ((nMajor == 2) && (nMinor == 18)) {
+        sName = "Watcom Linker";
+        bDetected = true;
+    } else if ((nMajor == 2) && (nMinor == 52)) {
+        sName = "PowerBASIC Linker";
+        bDetected = true;
+    }
+    // Correct version
+    if (sName == "Borland Linker") {
+        if (PE.getMajorLinkerVersion() > 15) {
+            sVersion += "*";
+        }
+    }
+
+    /* if(!bDetected&&(bShowVersion||bShowOptions))
+    {
+        if(!bShowType)
+        {
+            sName+=" "+sType;
+        }
+        bDetected=1;
+    } */
+
+    if (bFASM) {
+        // FASM doesn't have a linker.
+        bDetected = false;
+    }
+    if (bRosASM) {
+        // RosASM doesn't have a linker.
+        bDetected = false;
+    }
+    if (bSpASM) {
+        // SpASM doesn't have a linker.
+        bDetected = false;
+    }
+    if (bFPC) {
+        // Free Pascal doesn't have a linker.
+        bDetected = false;
+    }
+
+    return result();
+}

db/PE/mPack.2.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+
+init("packer", "mPack");
+
+function detect() {
+    if (PE.compareEP("E90000000060E8140000005D81ED000000006A45E8A30000006800000000E85861E8AA0000004E")) {
+        sVersion = "0.0.2";
+        bDetected = true;
+    } else if (PE.compareEP("558BEC83....33C08945F0B8........E867C4FFFF33C05568........64FF306489208D55F033C0E893C8FFFF")) {
+        sVersion = "0.0.3";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/mkfPack.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("packer", "mkfPack");
+
+function detect() {
+    if (PE.compareEP("e8$$$$$$$$5b81eb........8b93........536a..68........526a..ff93........5b8bf08bbb........03fb5657e8........83c4..8d93........5253ffe6")) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/nPack.2.sg

@@ -0,0 +1,36 @@
+// Detect It Easy: detection rule file
+
+init("packer", "nPack");
+
+function detect() {
+    if (PE.compareEP("833D..........7505E901000000C3E841000000B8........2B05........A3........E85E000000E8")) {
+        switch (PE.getEPSignature(42, 7)) {
+            case "E0010000E8EC06":
+                sVersion = "1.1.150.2006.Beta";
+                break;
+            case "EC010000E8F806":
+                sVersion = "1.1.200.2006.Beta";
+                break;
+            default:
+                sVersion = "1.1.xxx";
+        }
+        bDetected = true;
+    } else if (PE.compareEP("833D..........7505E901000000C3E846000000E873000000B8........2B05........A3........E89C000000E8")) {
+        switch (PE.readDword(PE.nEP + 47)) {
+            case 0x204:
+                sVersion = "1.1.250.2006.Beta";
+                break;
+            case 0x22D:
+                sVersion = "1.1.300.2006.Beta";
+                break;
+            case 0x248:
+                sVersion = "1.1.800.2008.Beta";
+                break;
+            default:
+                sVersion = "1.1.xxx";
+        }
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/netshrink.2.sg

@@ -0,0 +1,25 @@
+// Detect It Easy: detection rule file
+
+init("protector", ".netshrink");
+
+function detect() {
+    if (PE.isNET()) {
+        if (PE.isSignatureInSectionPresent(0, "20fe2b136028........13..203b28136028........13..11..11..161f4028........26")) {
+            sVersion = "2.01 Demo";
+            sOptions = "Password";
+            bDetected = true;
+        } else if (PE.isSignatureInSectionPresent(0, "20ad65133228........13..206866133228........13..11..11..161f4028........26")) {
+            sVersion = "2.01 Demo";
+            sOptions = "Password";
+            bDetected = true;
+        } else if (PE.isSignatureInSectionPresent(0, "20b9059f0728........13..2066059f0728........13..11..11..161f4028........26")) {
+            sVersion = "2.01 Demo";
+            bDetected = true;
+        } else if (PE.isSignatureInSectionPresent(0, "20e6ea19be28........13..2039ea19be28........13..11..11..161f4028........26")) {
+            sVersion = "2.01 Demo";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/obfus_h.5.sg

@@ -0,0 +1,15 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+// https://github.com/DosX-dev/obfus.h
+init("protection", "obfus.h");
+
+function detect() {
+    if ((PE.section[".obfh"] || PE.isExportFunctionPresent("WhatSoundDoesACowMake")) &&
+        PE.isFunctionPresent("vsprintf") && !PE.isFunctionPresent("printf"))
+        bDetected = true;
+
+    return result();
+}

db/PE/obfusheader_h.5.sg

@@ -0,0 +1,32 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+// https://github.com/ac3ss0r/obfusheader.h
+init("protection", "obfusheader.h");
+
+function detect() {
+    if (PE.section[".rdata"] && PE.isFunctionPresent("LoadLibraryA") && PE.isFunctionPresent("GetProcAddress") && PE.isSignaturePresent(
+            0x00,
+            PE.getSize() - PE.getOverlaySize(),
+            "00 'Stop reversing the ' ** ** ** **")) {
+        bDetected = true;
+    }
+
+    const dataSection = PE.section[".data"];
+    if (dataSection && PE.compare("6162636465666768696A6B6C6D6E6F707172737475767778797A534C41494450", dataSection.FileOffset)) {
+        sOptions = "data consts";
+        bDetected = true;
+    }
+
+    if (bDetected && PE.section[".vmp0"]) {
+        sOptions += (sOptions ? " + " : "") + "fake signs";
+        _removeResult("protector", "Enigma");
+        _removeResult("protector", "SecuROM");
+        _removeResult("protector", "Denuvo");
+        _removeResult("protector", "Themida/Winlicense");
+    }
+
+    return result();
+}

db/PE/ps2exe.2.sg

@@ -0,0 +1,15 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+// https://github.com/MScholtes/PS2EXE
+init("packer", "PS2EXE");
+
+function detect() {
+    bDetected = PE.isNetUStringPresent("^-([^: ]+)[ :]?([^:]*)$");
+
+    _setLang("PowerShell", bDetected);
+
+    return result();
+}

db/PE/rar.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("sfx", "RAR");
+
+function detect() {
+    if (PE.compareEP("558bec83c4..535657e8........e8........33c05568........64ff30648920e8")) {
+        for (var i = 0; i < PE.resource.length; i++) {
+            if (PE.compare("'rar!'", PE.resource[i].Offset)) {
+                bDetected = true;
+            }
+        }
+    }
+
+    return result();
+}

db/PE/rar.6.sg

@@ -0,0 +1,10 @@
+// Detect It Easy: detection rule file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+includeScript("rar");
+
+function detect() {
+    detect_RAR(0);
+
+    return result();
+}

db/PE/scr2exe.2.sg

@@ -0,0 +1,18 @@
+// Detect It Easy: detection rule file
+// Author: sendersu
+// Edited: DosX
+
+// www.screen-record.com/screen2exe.htm
+
+init("packer", "SCREEN2EXE/SCREEN2SWF");
+
+function detect() {
+    var rdataSection = PE.section[".rdata"];
+
+    if (!PE.is64() && PE.compareEP("E8........E9........8BFF558BEC83EC..5356") && rdataSection && PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Video created by SCREEN2EXE/SCREEN2SWF") != -1) {
+        bDetected = true;
+        sVersion = PE.getFileVersion().split(", ").join(".");
+    }
+
+    return result();
+}

db/PE/sql-server.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "SQLite");
+
+function detect() {
+    if (PE.isLibraryPresentExp(/^sqlmin|^sqllang|^sqltses|^sqldk/i)) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/sqlite.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "SQLite");
+
+function detect() {
+    if (PE.isLibraryPresentExp(/sqlite/i)) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/sqx.1.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: A.S.L <asl@onet.eu>
+// Exeinfo PE not detect this SFX , other detectors too !
+// SIGNATURE CREATED : 2023.10.02
+
+init("installer", "SQX Archive Installer 2002");
+
+function detect() {
+    if (PE.compareEP("558bec83ec44") && PE.isSectionNamePresent(".data") && PE.findString(PE.section[".data"].FileOffset, PE.section[".data"].FileSize, "SFX kann nicht gestartet werden") != 1) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/tElock.2.sg

@@ -0,0 +1,81 @@
+// Detect It Easy: detection rule file
+
+init("protector", "tElock");
+
+function detect() {
+    if (PE.compareEP("668BC08D2424EB01EB60EB01EB9CE8000000005E83C6508BFE68")) {
+        sVersion = "0.41x";
+        bDetected = true;
+    } else if (PE.compareEP("C1EE00668BC9EB01EB60EB01EB9CE8000000005E83C6")) {
+        switch (PE.readByte(PE.nEP + 22)) {
+            case 0x52:
+                sVersion = "0.4x";
+                break;
+            case 0x5E:
+                sVersion = "0.5x";
+                break;
+        }
+        bDetected = true;
+    } else if (PE.compareEP("E90000000060E8000000005883C008")) {
+        sVersion = "0.60";
+        bDetected = true;
+    } else if (PE.compareEP("60E8....0000C383")) {
+        switch (PE.readWord(PE.nEP + 2)) {
+            case 0x10BD:
+                sVersion = "0.70";
+                break;
+            case 0x10ED:
+                sVersion = "0.71";
+                break;
+            case 0x1144:
+                sVersion = "0.71b2";
+                break;
+            case 0x1148:
+                sVersion = "0.71b7";
+                break;
+            case 0x11F9:
+                sVersion = "0.80";
+                break;
+            default:
+                sVersion = "0.7x-0.84";
+        }
+        bDetected = true;
+    } else if (PE.compareEP("60E802000000CD20E8000000005E2BC9587402")) {
+        sVersion = "0.85f";
+        bDetected = true;
+    } else if (PE.compareEP("....E802000000E800E8000000005E2B")) {
+        sVersion = "0.90";
+        bDetected = true;
+    } else if (PE.compareEP("E9....FFFF")) {
+        if (PE.compareEP("E97EE9")) {
+            sVersion = "0.92a";
+            bDetected = true;
+        } else if (PE.compareEP("E9D5E4")) {
+            sVersion = "0.95";
+            bDetected = true;
+        } else if (PE.compareEP("E959E4")) {
+            sVersion = "0.96";
+            bDetected = true;
+        } else if (PE.compareEP("E925E4")) {
+            sVersion = "0.98b1";
+            bDetected = true;
+        } else if (PE.compareEP("E91BE4")) {
+            sVersion = "0.98b2";
+            bDetected = true;
+        } else if (PE.compareEP("E999D7")) {
+            sVersion = "0.98 Special Build";
+            bDetected = true;
+        } else if (PE.compareEP("E95EDF")) {
+            sVersion = "0.99";
+            bDetected = true;
+        } else if (PE.compareEP("E93FDF")) {
+            sVersion = "0.99c";
+            bDetected = true;
+        } else if (PE.compareEP("E9E5E2")) {
+            sVersion = "1.00";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/tcc.4.sg

@@ -0,0 +1,45 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+
+// The best compiler for C. VC/Clang/GCC sucks!
+// Thank you, Bellard. ;)
+
+init("compiler", "Tiny C");
+
+function detect() {
+    if (PE.isNET()) return;
+
+    var isLinkerDetected = false,
+        isInitFuncDetected = false,
+        isStdLibUsed = PE.isLibraryPresent("msvcrt.dll");
+
+    if (PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000'PE'0000") &&
+        PE.getCompilerVersion() == "6.0" && !PE.section[".reloc"] && !PE.section[".tls"] && !PE.section[".rdata"] && !PE.section[".rsrc"]) {
+        _setResult("linker", "TCC Linker", "v6.0", "");
+        isLinkerDetected = true;
+    }
+
+    if (isStdLibUsed && PE.compareEP(PE.is64() ?
+            "554889e54881ec........b8........8945..b8........4989c24c89d1e8" :
+            "5589e581ec........908d45..50e8........83c4..b8........8945..b8........50e8........83c4"))
+        isInitFuncDetected = true;
+
+    if (isLinkerDetected || isInitFuncDetected) bDetected = true;
+
+    if (bDetected && !isInitFuncDetected && PE.compareEP("5589E581EC........90E8")) {
+        sVersion = "legacy";
+        isInitFuncDetected = true;
+    }
+
+    if (bDetected) {
+        if (!isStdLibUsed) sOptions = "no std"; // detectible on last versions
+        if (!isInitFuncDetected) sOptions += (sOptions ? " + " : "") + "no init"; // if EP is '_start()'
+    }
+
+    _setLang("C", bDetected);
+
+    return result();
+}

db/PE/wxWidgets.5.sg

@@ -0,0 +1,27 @@
+// Detect It Easy: detection rule file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+init("library", "wxWidgets");
+
+includeScript("wxWidgets");
+
+function detect() {
+    if (aWx == 1) {
+        sOptions = "static";
+        bDetected = true;
+    } else if (aWx) {
+        sVersion = (aWx[2] / 10).toFixed(1);
+        if (aWx[1]) {
+            sOptions = "universal";
+        }
+        if (aWx[3]) {
+            sOptions += (sOptions ? ", " : "") + "unicode";
+        }
+        if (aWx[4]) {
+            sOptions += (sOptions ? ", " : "") + "debug";
+        }
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/yzPack.2.sg

@@ -0,0 +1,26 @@
+// Detect It Easy: detection rule file
+
+init("packer", "yzPack");
+
+function detect() {
+    if (PE.compareEP("6033C08D480750E2FD8BEC648B4030780C8B400C")) {
+        sVersion = "1.0-1.1";
+        bDetected = true;
+    } else if (PE.compareEP("4D5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9")) {
+        sVersion = "1.2";
+        bDetected = true;
+    } else if (PE.compareEP("5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9")) {
+        sVersion = "1.12";
+        bDetected = true;
+    } else if (PE.compareEP("25........6187CC5545455581EDCA00000055A4B302FF142473F833C9FF1424731833C0FF1424731FB3")) {
+        sVersion = "2.0";
+        bDetected = true;
+    }
+    /*else if(PE.isSignaturePresent(0,512,"'MZKERNEL32'")) // false detect  (Win)Upack
+    {
+        sVersion="2.0";
+        bDetected=1;
+    } */
+
+    return result();
+}

db/PE/zip.6.sg

@@ -0,0 +1,10 @@
+// Detect It Easy: detection rule file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+includeScript("zip-file");
+
+function detect() {
+    detect_Zip(0);
+
+    return result();
+}

db/PE/zlib.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "zlib");
+
+function detect() {
+    if (PE.isLibraryPresentExp(/^zlib*/)) {
+        bDetected = true;
+    }
+
+    return result();
+}