// DIE's signature file

init("protector","ENIGMA");

function getVersion()
{
    var nSection=PE.nLastSection;
    var nOffset=PE.section[nSection].FileOffset;
    var nSize=PE.section[nSection].FileSize;
    if(nSize==0)
    {
        nOffset=PE.section[nSection-1].FileOffset;
        nSize=PE.section[nSection-1].FileSize;
    }
    var nOffset=PE.findSignature(nOffset,nSize,"000000'ENIGMA'");
    if(nOffset!=-1)
    {
        var sMajor=PE.readByte(nOffset+9);
        var sMinor=PE.readByte(nOffset+10);
        sVersion=sMajor+"."+sMinor;
        return 1;
    }

    return 0;
}

function getVersion_old()
{
    if(PE.section[".data"])
    {
        var nOffset=PE.section[".data"].FileOffset;
        var nSize=PE.section[".data"].FileSize;
        var nOffset=PE.findString(nOffset,nSize,"Enigma protector v");
        if(nOffset!=-1)
        {
            sVersion=PE.getString(nOffset+18,4);
            return 1;
        }
    }
    return 0;
}

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("558bec83c4..b8........e8........9a............e9$$$$$$$$60e8000000005d..ed"))
    {
        getVersion();
        bDetected=1;
    }
    else if(PE.compareEP("60e8000000005d81ed........81ed........e9"))
    {
        getVersion();
        bDetected=1;
    }
    else if(PE.compareEP("68........e8$$$$$$$$eb$$83c4..e9$$$$$$$$60e8000000005d81ed"))
    {
        getVersion();
        bDetected=1;
    }
    else if(PE.compareEP("eb$$e9$$$$$$$$60e8000000005d81ed........81ed........e9"))
    {
        getVersion();
        bDetected=1;
    }
    else if(PE.compareEP("e8$$$$$$$$83c4..e9$$$$$$$$60e8000000005d81ed........81ed........e9"))
    {
        getVersion();
        bDetected=1;
    }
    else if(PE.compareEP("60e8000000005d83....81ed")) //first versions
    {
        getVersion_old();
        bDetected=1;
    }
    else if(PE.isNET())
    {
        if(PE.isSignatureInSectionPresent(0,"000000'ENIGMA'"))
        {
            bDetected=1;
        }
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
