die-python 0.4.0__cp313-abi3-win_amd64.whl

die/db/db/Binary/shellcode.pe_to_shellcode.1.sg

@@ -0,0 +1,107 @@
+// Detect It Easy: detection rule file
+// Author: nicholasmckinney
+
+
+// Detects hashezerade's reflective pe_to_shellcode generator
+// https://github.com/hasherezade/pe_to_shellcode
+
+init("shellcode", "pe_to_shellcode");
+
+
+function detect() {
+    bDetected = false;
+
+    // https://github.com/hasherezade/pe_to_shellcode/blob/master/pe2shc/stub2/stub32.bin
+    var stub32 = "558BEC51518D45F85350E8AA0100005984C0750883C8FFE9A4000000\
+    56578B7D08B84D5A00006639070F858C0000008B773C03F7813E50450000757F8D86A0\
+    00000033DB391875046AFDEB71FF76345750E8FB00000083C40C84C075046AFCEB5C39\
+    9E80000000742357FFB684000000FFB680000000FF75FCFF75F8E86F00000083C41484\
+    C075046AFBEB318D86C0000000391874095750E82800000059598B4628B90020000003\
+    C766854E167408536A0157FFD0EB07FFD0EB036AFE585F5E5BC9C204008B4424045657\
+    8B7C24108B008B74380C85F674128B0E85C9740C6A006A0157FFD183C60475EE5FB001\
+    5EC3538B5C241855568B7424185703F3EB3C03C350FF5424188BE885ED74408B7E1003\
+    FBEB1F79050FB7C1EB058D430203C185C074295055FF54242085C0741F890783C7048B\
+    0F85C975DB83C6148B460C85C075BD85F60F95C05F5E5D5BC332C0EBF78B4424045355\
+    568B08034C241457EB478B410483F808723F8D68F8D1ED6A005B74320FB7545908668B\
+    C266C1E80C6685C074216683F803752B8B44241881E2FF0F00002B44241C03D6035424\
+    180102433BDD72CE0349048B3185F675B3B0015F5E5D5BC332C0EBF7565768029FE66A\
+    E88B0100008BF05985F67431688DBDC13F56E87C0000008BF8595985FF741E68FF1F7C\
+    C956E869000000595985C0740D8B4C240C894104B0018939EB0232C05F5EC353568B74\
+    240C83CAFF8A1E84DB743B8A7C24105784FF750A8D43BF3C19770380C3206A085F8BCA\
+    0FBEC3D1E933C28BD181F22083B8ED24010F44D1D0FB83EF0175E3468A1E84DB75CB5F\
+    F7D25E8BC25BC351515355568B742418B84D5A00005766390675618B463C8B44307885\
+    C074568B54301C33FF8B4C30188954241C8B5430208B443024894C241085C974388D1C\
+    328D2C308B4C241C0FB745006A018D048103C6894424188B0303C650E84FFFFFFF5959\
+    3B44242074164783C50283C3043B7C241072CE33C05F5E5D5B5959C38B4424148B0003\
+    C6EBEF56578B7C240C83CAFF33F60FB7076685C0745B5355807C2418000FB7C8894C24\
+    1475108D41BF6683F819770783C120894C2414668B5C24146A085D8BC233CAD1E88BD0\
+    81F22083B8ED80E1010F44D066D1EB66895C241483ED0174068B4C2414EBD9460FB704\
+    776685C075A95D5BF7D25F8BC25EC364A1300000005356578B780C83C7148B37EB288D\
+    46F885C074258B581885DB741E8378300074126A00FF7030E85AFFFFFF59593B442410\
+    740C8B363BF775D433C05F5E5BC38BC3EBF800000000000000";
+
+    // https://github.com/hasherezade/pe_to_shellcode/blob/master/pe2shc/stub2/stub64.bin
+    var stub64 = "56488BF44883E4F04883EC20E805000000488BE65EC348895C240857\
+    4883EC30488BF9488D4C2420E83702000084C0750883C8FFE9BD000000B84D5A000066\
+    39070F85AA00000048635F3C4803DF813B504500000F8597000000488D8BB000000083\
+    3900750AB8FDFFFFFFE9860000004C8B4330488BD7E86201000084C07507B8FCFFFFFF\
+    EB6F83BB9000000000742A0F28442420488D4C2420488B93900000004C8BC7660F7F44\
+    2420E89300000084C07507B8FBFFFFFFEB3C488D8BD00000008339007408488BD7E833\
+    0000008B4328B9002000004803C766854B16740E4533C0488BCF418D5001FFD0EB09FF\
+    D0EB05B8FEFFFFFF488B5C24404883C4305FC348895C2408574883EC208B01488BFA48\
+    8B5C10184885DB741B4C8B0B4D85C974134533C0488BCF418D500141FFD14883C30875\
+    E5488B5C2430B0014883C4205FC3488BC4488958084889681048897018488978204156\
+    4883EC208BDA498BF04903D84C8BF1EB4A8BC84803CE41FF16488BE84885C074628B7B\
+    104803FEEB2679050FB7D1EB07488D56024803D14885D27447488BCD41FF56084885C0\
+    743B4889074883C708488B0F4885C975D24883C3148B430C85C075AF4885DB0F95C048\
+    8B5C2430488B6C2438488B742440488B7C24484883C420415EC332C0EBE148895C2408\
+    48897C2410448B09498BD84C03CA4C8BDA33FF458B114585D27459418379040872F141\
+    8B51044C8BC74883EA0848D1EA7435430FB74C41080FB7C166C1E80C6685C074236683\
+    F80A752681E1FF0F0000498BC34103CA482BC34903CB49FFC04801014C3BC272CB418B\
+    41044C03C8EBA332C0EB02B001488B5C2408488B7C2410C348895C2408488974241057\
+    4883EC20488BD9B9029FE66AE8FD010000488BF84885C07432BA8DBDC13F488BC8E893\
+    000000488BF04885C0741DBAFF1F7CC9488BCFE87E0000004885C0740B48894308B001\
+    488933EB0232C0488B5C2430488B7424384883C4205FC3448A09448ADA4C8BD14183C8\
+    FFEB414584DB750C418D41BF3C1977044180C120BA08000000418BC8410FBEC14133C0\
+    D1E9448BC14181F02083B8ED2401440F44C141D0F94883EA0175DB49FFC2458A0A4584\
+    C975BA41F7D0418BC0C3488BC448895808488968104889701848897820415441564157\
+    B84D5A0000448BFA4C8BC16639010F85870000004863413C8B8C088800000085C97478\
+    498D040833FF8B68184885ED746A448B4820448B50244D03C8448B601C4D03D0410FB7\
+    02458B194D03D883CAFF498D3484EB2741BE080000008BCA0FBEC333C2D1E98BD181F2\
+    2083B8ED24010F44D1D0FB4983EE0175E249FFC3418A1B84DB75D2F7D2413BD7742D48\
+    FFC74983C2024983C104483BFD72A833C0488B5C2420488B6C2428488B742430488B7C\
+    2438415F415E415CC3428B04064903C0EBDC48895C240848897C2410440FB7094183C8\
+    FF33FF8ADA448BD74C8BD9EB4684DB750F418D41BF6683F8197705664183C120BA0800\
+    0000418BC8410FB7C14133C0D1E9448BC14181F02083B8ED2401440F44C16641D1E948\
+    83EA0175DA49FFC2470FB70C53664585C975B4488B5C240841F7D0488B7C2410418BC0\
+    C348895C240848896C24104889742418574883EC2065488B0425600000008BE9488B78\
+    184883C720488B1F483BDF7430488D43F04885C07427488B70304885F6741E488B4860\
+    4885C9740B33D2E834FFFFFF3BC57405488B1BEBD0488BC6EB0233C0488B5C2430488B\
+    6C2438488B7424404883C4205FC300000000000000000000000000";
+
+    var redir32_64_Start = "4D5A4552E8000000005B4883EB09534881C3";
+    var redir32_Start = "4D5A4552E8000000005883E8095005";
+    var redir64_Start = "4D5A4552E800000000594883E909488BC14805";
+
+    var signatures = [redir32_64_Start, redir32_Start, stub32, redir64_Start, stub64];
+
+    var nSize = Binary.getSize();
+
+    if (nSize > 0x4000) {
+        nSize = 0x4000;
+    }
+
+    for (var i = 0; i < signatures.length; i++) {
+        if (Binary.isSignaturePresent(0, nSize, signatures[i])) {
+            bDetected = true;
+
+            if (i <= 2) {
+                sOptions = "x86";
+            } else {
+                sOptions = "AMD64";
+            }
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/srdi-monoxgas.1.sg

@@ -0,0 +1,128 @@
+// Detect It Easy: detection rule file
+// Author: nicholasmckinney
+
+
+init("shellcode", "Monoxgas sRDI");
+
+
+// https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py
+function detect() {
+    bDetected = false;
+
+    // 32-bit and 64-bit start out with the same first 5 bytes (relative jump)
+    var jumpStartOffset = Binary.findSignature(0, Binary.getSize(), "E800000000");
+
+    if (jumpStartOffset < 0) {
+    
+    }
+
+    var currentOffset = jumpStartOffset + 5;
+
+    // Possible 64-bit sRDI
+    // https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py#L76-L80
+    if (Binary.readDword(currentOffset) == 0xC8894959) {
+
+        currentOffset += 4;
+
+        // https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py#L83-L84
+        if ((Binary.readDword(currentOffset) & 0xFF) != 0xBA) {
+        
+        }
+
+        currentOffset += 5; // 1 byte for MOV EDX, 4 bytes for function hash
+
+
+        // 4 bytes from rel jump for func hash
+        var setupLocation = Binary.readDword(currentOffset);
+
+        if ((setupLocation & 0xFFFFFF) != 0xC08149) {
+        
+        }
+
+        currentOffset += 7; // 33 bytes for bytes compared + 4 bytes for user data location
+
+        if ((Binary.readDword(currentOffset) & 0xFFFF) != 0XB941) {
+        
+        }
+
+        currentOffset += 6; // 2 bytes for mov r9d, 4 bytes for length of user data
+
+        var nextBytes = "564889E64883E4F04883EC3048894C24284881C1"; // 20 bytes length
+        if (!Binary.isSignaturePresent(currentOffset, 20, nextBytes)) {
+        
+        }
+
+        // https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py#L113
+        currentOffset += 24; // 20 bytes for continued setup, 4 bytes for offset to DLL
+
+        if (Binary.readDword(currentOffset) != 0x202444C7) {
+        
+        }
+
+        currentOffset += 8; // 4 bytes for mov, 4 bytes for flags operand
+
+        if (Binary.readByte(currentOffset) != 0xE8) {
+        
+        }
+
+        currentOffset += 5; // 5 bytes for rel jump
+
+        // https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py#L127-L134
+        if (!Binary.isSignaturePresent(currentOffset, 5, "4889F45EC3")) {
+        
+        }
+
+        bDetected = true;
+        sOptions = "AMD64";
+    }
+    // Possible 32-bit sRDI
+    else if (Binary.readDword(currentOffset) == 0xE5895558) {
+
+
+        // https://github.com/monoxgas/sRDI/blob/9fdd5c44383039519accd1e6bac4acd5a046a92c/Python/ShellcodeRDI.py#L159-L171
+        if (!Binary.isSignaturePresent(currentOffset, 7, "585589E589C268")) {
+        
+        }
+
+        currentOffset += 11; // 7 bytes for sig above + 4 bytes for flags
+
+        if ((Binary.readDword(currentOffset) & 0xFFFFFF) != 0xC28150) {
+        
+        }
+
+        currentOffset += 7; // 3 bytes for sig above + 4 bytes for user data location
+
+        if (Binary.readByte(currentOffset) != 0x68) {
+        
+        }
+
+        currentOffset += 5; // 5 bytes to push length of user data
+
+        if (Binary.readWord(currentOffset) != 0x6852) {
+        
+        }
+
+        currentOffset += 6; // 1 byte to push edx, 5 bytes to push hash of function
+
+        if (Binary.readByte(currentOffset) != 0x05) {
+        
+        }
+
+        currentOffset += 5; // 5 bytes to add offset of dll to eax
+
+        if (Binary.readWord(currentOffset) != 0xE850) {
+        
+        }
+
+        currentOffset += 6; // 1 byte to push eax, 5 bytes to rel jump to reflective loader
+
+        if (!Binary.isSignaturePresent(currentOffset, 5, "83C414C9C3")) {
+        
+        }
+
+        bDetected = true;
+        sOptions = "x86";
+    }
+
+    return result();
+}

die/db/db/Binary/text.HTML.1.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+
+init("source", "HTML");
+
+function detect() {
+    var sText = Binary.getHeaderString();
+    if (/^<(!DOCTYPE )?html/m.test(sText)) {
+        bDetected = true;
+    }
+
+    _setLang("HTML", bDetected);
+
+    return result();
+}

die/db/db/Binary/text.Pascal.1.sg

@@ -0,0 +1,19 @@
+// Detect It Easy: detection rule file
+
+init("source", "Pascal");
+
+function detect() {
+    var sText = Binary.getHeaderString();
+    /* if(/^unit/im.test(sText))
+    {
+        bDetected=1;
+    } */
+    if (/^\s*program\s.*\s*uses\s/im.test(sText)) {
+        bDetected = true;
+    }
+
+
+    _setLang("Pascal", bDetected);
+
+    return result();
+}

die/db/db/Binary/text.RegistryFile.sg

@@ -0,0 +1,20 @@
+// Detect It Easy: detection rule file
+// Author: Arjan Onwezen
+
+init("format", "Registry file");
+
+function detect() {
+    if (Binary.compare("'REGEDIT4'0D 0A 0D 0A")) {
+        bDetected = true;
+        sVersion = "v4"
+    } else if (Binary.compare("'Windows Registry Editor Version 5.00'0D 0A 0D 0A")) {
+        bDetected = true;
+        sVersion = "v5"
+    } else if (Binary.compare("FF FE 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6F 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 20 00 35 00 2E 00 30 00 30 00 0D 00 0A 00 0D 00 0A 00")) {
+        bDetected = true;
+        sVersion = "v5"
+        sOption("UTF-16LE");
+    }
+
+    return result();
+}

die/db/db/Binary/text.Shell.1.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+init("script", "Shell");
+
+includeScript("shell-script");
+
+function detect() {
+    if (isInterpreter("sh")) {
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/Binary/text.XML.1.sg

@@ -0,0 +1,18 @@
+// Detect It Easy: detection rule file
+
+init("source", "XML");
+
+function detect() {
+    var sText = Binary.getHeaderString();
+    // Ignore the UTF-8 BOM.
+    if (/^(?:\xef\xbb\xbf)?<\?xml/.test(sText)) {
+        var aVersion = sText.match(/version="(.*?)"/);
+        if (aVersion) {
+            sVersion = aVersion[1];
+        }
+
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/Binary/text.c.1.sg

@@ -0,0 +1,35 @@
+// Detect It Easy: detection rule file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+init("source", "C/C++");
+
+function detect() {
+    var sText = Binary.getHeaderString();
+    if (/^#ifndef (\w+).*\s+^#define \1/m.test(sText) ||
+        /#\s*pragma (?:once|hdrstop)/.test(sText)) {
+        sOptions = "header";
+        bDetected = true;
+    }
+    if (/^(?:class\b|virtual\b|public:|private:|template\b)/m.test(sText)) {
+        if (!(/\sdef\s/.test(sText))) // to avoid false positives on python
+        {
+            sName = "C++";
+            bDetected = true;
+        }
+    } else {
+        var aInclude = sText.match(/^#include ["<].*?[>"]/mg);
+        if (aInclude) {
+            bDetected = true;
+            for (var i = 0; i < aInclude.length; i++) {
+                if (aInclude[i].indexOf(".") < 0) {
+                    sName = "C++";
+                    break;
+                }
+            }
+        } else if (/^#define/m.test(sText)) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/text.pdb.1.sg

@@ -0,0 +1,40 @@
+// https://github.com/horsicq/Detect-It-Easy signature file
+// Author: Kaens (TG @kaens)
+
+init("format", "Protein Data Bank file");
+
+includeScript("read");
+
+function detect() {
+    if (Binary.compare("'HEADER'") && (Binary.isHeuristicScan() || extIs("pdb"))) {
+        //ref http://www.wwpdb.org/documentation/file-format-content/format33/sect1.html
+        L = ['', '', '', '', ''];
+        ttl = '';
+        L[0] = Binary.read_ansiString(0, Binary.findSignature(0, 81, "0A"));
+        if (/[\x20-\x7F]{65,}/.test(L[0])) {
+            bDetected = true;
+            if (Binary.isVerbose()) {
+                p = L[0].length + 1;
+                for (i = 1; i < L.length; i++) {
+                    L[i] = Binary.read_ansiString(p, Binary.findSignature(p, 81, "0A") - p);
+                    p += L[i].length + 1;
+                }
+                for (i = 0; i < L.length; i++) {
+                    switch (L[i].substr(0, 6)) {
+                        case "HEADER":
+                            sOptionT(L[i].substr(10, 40), "Classification: ");
+                            sOptionT(L[i].substr(62, 10), "ID: "); //4 is the format, but 10 for future-proofing
+                            sOptionT(L[i].substr(50, 9), "dep. ");
+                            break;
+                        case "TITLE ":
+                            ttl += ' ' + L[i].substr(10, 70).trim();
+                            break;
+                    }
+                }
+                sOptionT(ttl, "Title: ")
+            }
+        }
+    }
+
+    return result();
+}

die/db/db/Binary/text.plaintext.3.sg

@@ -0,0 +1,25 @@
+// Detect It Easy: detection rule file
+
+init("format", "plain text");
+
+function detect() {
+    if (Binary.isPlainText()) {
+        var sText = Binary.getString(0, Math.min(Binary.getSize(), 3));
+        // UTF-8 BOM.
+        if (/^\xef\xbb\xbf/.test(sText)) {
+            sName = "UTF-8 text";
+        }
+
+        var size = Binary.getSize() < 4096 ? Binary.getSize() : 4096;
+        var pos = Binary.findByte(0, size, 10);
+        if (pos != -1) {
+            sOptions = (pos != 0 && Binary.readByte(pos - 1) == 13) || (pos + 1 < Binary.getSize() && Binary.readByte(pos + 1) == 13) ? "CRLF" : "LF";
+        } else if (Binary.findByte(0, size, 13) != -1) {
+            sOptions = "CR";
+        }
+
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/Binary/text.python.1.sg

@@ -0,0 +1,17 @@
+// Detect It Easy: detection rule file
+init("source", "Python");
+
+function detect() {
+    var sText = Binary.getHeaderString();
+
+    if ((/import\s/.test(sText)) && (/class\s/.test(sText)) && (/self/.test(sText))) {
+        if (/\sdef\s/.test(sText)) {
+            bDetected = true;
+        }
+    }
+
+
+    _setLang("Python", bDetected);
+
+    return result();
+}

die/db/db/Binary/text.script.2.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+init("script");
+
+includeScript("shell-script");
+
+function detect() {
+    if (sInterpreter) {
+        // Capitalize the first letter, lowercase the rest.
+        sName = sInterpreter.substr(0, 1).toUpperCase() + sInterpreter.substr(1).toLowerCase();
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/Binary/video.MP4.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: A.S.L - <asl@onet.eu> 2019
+
+init("format", "MP4 Video");
+
+function detect() {
+    if (Binary.getSize() > 100) {
+        if (Binary.compare("000000..'ftyp'")) {
+            sVersion = "";
+            sOptions = Binary.getString(16); // example : isomiso2avc1mp41 / isomavc1 / isom
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

die/db/db/Borland

@@ -0,0 +1,19 @@
+// Borland Delphi tests for Borland C++ first, so ensure we only do it once.
+
+var bBorlandC;
+if (typeof bBorlandC === "undefined") {
+    bBorlandC = 0;
+    if (PE.compare("'MZ'50000200000004000F00FFFF0000B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000020000BA10000E1FB409CD21B8014CCD219090'This program must be run under Win32\r\n$'370000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'PE'0000")) {
+        bBorlandC = 1;
+    } else if (PE.compareEP("A1........C1E002A3")) {
+        bBorlandC = 1;
+    } else if (PE.compareEP("EB10'fb:C++HOOK'90")) {
+        bBorlandC = 2;
+    } else if (PE.section.length > 1) {
+        var nOffset = PE.section[1].FileOffset;
+        var nSize = Math.min(1024, PE.section[1].FileSize);
+        if (PE.isSignaturePresent(nOffset, nSize, "'Borland C++ - Copyright'")) {
+            bBorlandC = 1;
+        }
+    }
+}

die/db/db/COM/32-bit_crypt.2.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protector", "32-bit crypt");
+
+function detect() {
+    if (Binary.compare("6633c9678a81........34..2c..34..678881........6683c1..6681f9........75")) {
+        sOptions = "by SWW //DiGiTAl FaCToRY";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/COM/4kZIP.2.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("packer", "4kZIP");
+
+function detect() {
+    if (Binary.compare("fcb1..e8$$$$8736....b8....d3e0482306....66d32e....280e....77..506633c0ac8a0e....80c1..66d3e0")) {
+        sOptions = "by pascal //Digital Nightmare";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/COM/8086_Forth_83.4.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("compiler", "8086 Forth 83");
+
+function detect() {
+    if (Binary.compare("e9$$$$8cc88ed88ed08ec0a1....b0..a3....2d....a3....2d....8be8bb....031e....892f2d....a3....bb....031e....89078be0be....e9")) {
+        sVersion = "2.1.0";
+        sOptions = "1985";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/COM/A3E.1.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("converter", "A3E (text2com)");
+
+function detect() {
+    if (Binary.compare("1e33c050be....81c6....b8....8ec0bf....b9....f3a5cb")) {
+        sOptions = "1992 by JHSoft";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/COM/ABK-Scrambler.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protector", "ABK-Scrambler");
+
+function detect() {
+    if (Binary.compare("b430cd2186e03d....73..cd209c06b8....50cf")) {
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/COM/ACE_Scrambler.2.sg

@@ -0,0 +1,34 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("protector", "A.C.E. Scrambler");
+
+function detect() {
+    if (Binary.compare("2c..fec024..34..fec824..34..bb....0c..eb$$24..0c..81eb....f6d8eb$$2c..fec0ffe3")) {
+        sOptions = "1996";
+        bDetected = true;
+    } else if (Binary.compare("24..0c..f6d8eb$$fec8bb....04..0c..f6d804..fec0f6d881eb....24..f6d8fec034..0c..04..2c..ffe3")) {
+        sOptions = "1996";
+        bDetected = true;
+    } else if (Binary.compare("34..fec834..0c..24..04..fec0bb....0c..2c..0c..81eb....eb$$fec0f6d82c..fec0f6d80c..ffe3")) {
+        sOptions = "1996";
+        bDetected = true;
+    } else if (Binary.compare("24..fec82c..bb....fec8f6d8eb$$04..81eb....0c..fec0fec80c..34..ffe3")) {
+        sOptions = "1996";
+        bDetected = true;
+    } else if (Binary.compare("24..eb$$04..bb....f6d834..fec8fec0eb$$0c..81eb....34..24..34..eb$$ffe3")) {
+        sOptions = "1996";
+        bDetected = true;
+    } else if (Binary.compare("34..fec804..24..0c..04..bb....0c..04..f6d881eb....0c..fec8f6d824..0c..ffe3")) {
+        sOptions = "1996";
+        bDetected = true;
+    } else if (Binary.compare("f6d834..2c..bb....0c..34..fec004..34..fec004..81eb....2c..34..24..eb$$04..2c..04..ffe3")) {
+        sOptions = "1996";
+        bDetected = true;
+    } else if (Binary.compare("fec0eb$$24..34..bb....f6d834..fec024..fec0f6d834..81eb....f6d80c..eb$$04..ffe3")) {
+        sOptions = "1996";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/COM/ACiDDRAW.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("self-displayer", "ACiDDRAW");
+
+function detect() {
+    if (Binary.compare("e9$$$$b8....cd10b4..b9....cd10e8....ba....90e8....3d....75..e9....3d....75..e9....3d....75..e9....3d....75..eb")) {
+        sVersion = "1.2";
+        bDetected = true;
+    } else if (Binary.compare("eb$$b8....cd10b4..b9....cd10e8....ba....90e8....3d....75..e9....3d....75..e9....3d....75..e9....3d....75..eb")) {
+        sVersion = "1.2";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/COM/ANS2ALL.1.sg

@@ -0,0 +1,18 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("self-displayer", "ANS2ALL");
+
+function detect() {
+    if (Binary.compare("e9$$$$e8$$$$b8....cd103c..75..80fb..73..58b8....cd21fcb8....8ec0be....bf....b9....f3a4fa")) {
+        sVersion = "1.3";
+        sOptions = "by ZeroCoder //XG";
+        bDetected = true;
+    }
+    if (Binary.compare("e9$$$$2bc9b6..b2..b7..b4..cd212ad22af6b7..b4..cd10b6..32d2b7..b4..cd101e33c050")) {
+        sOptions = "by ZeroCoder //XG";
+        bDetected = true;
+    }
+
+    return result();
+}

die/db/db/COM/ARF_AV_Inject.1.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("immunizer", "ARF/AV Inject");
+
+function detect() {
+    if (Binary.compare("e9$$$$b8....50558bec83c4..061e90c746......c746......c646....c746......c746......8b5e..8dbf....b9")) {
+        sVersion = "2.4";
+        sOptions = "1995 by ARF Enterprises";
+        bDetected = true;
+    }
+
+    return result();
+}