// DIE's signature file
// Author: hors, sendersu
/*
If errors pls contact sendersu on cracklab.team
*/

init("protector","Safengine Shielden");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("E8........5361"))
    {
        if(PE.section[PE.nLastSection].FileSize==0x1000
         &&PE.section[PE.nLastSection].VirtualSize==0x1000)
        {
            sVersion="2.X";
            bDetected=1;
        }
        if(PE.section[PE.nLastSection].FileSize==0x2000
         &&PE.section[PE.nLastSection].VirtualSize==0x2000)
        {
            sVersion="";
            bDetected=1;
        }
    }
    if(PE.compareEP("EB$$E9$$$$$$$$E8........'Safengine Shielden'"))
    {
        sVersion="2.X";
        bDetected=1;
    }
    if (bDetected == 1)
    {
        // try to deduce specific version from payload (if present)
        var s = PE.getSize()
        var nOffset = PE.findString(0, PE.getSize(), "Safengine Shielden v")
        if (nOffset != -1)
        {
          sVersion = PE.getString(nOffset+19)
        }
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
