// DIE's signature file

init("packer","UPX");

function getUPXOptions(nOffset)
{
    var nMethod=ELF.readByte(nOffset+2);
    var nLevel=ELF.readByte(nOffset+3);
    var sCompression="";
    switch(nMethod) // From http://sourceforge.net/p/upx/code/ci/default/tree/src/conf.h
    {
    case 2:
    case 3:
    case 4:
    case 5:
    case 6:
    case 7:
    case 8:
    case 9:
    case 10: sCompression="NRV"; break;
    case 14: sCompression="LZMA"; break;
    case 15: sCompression="zlib"; break;
    }

    if(sCompression!="")
    {
        sOptions=sOptions.append(sCompression);
        if(nLevel==8)
        {
            sOptions=sOptions.append("best");
        }
        else
        {
            sOptions=sOptions.append("brute");
        }
    }
}

function detect(bShowType,bShowVersion,bShowOptions)
{
    var nSize=ELF.getSize();
    if(ELF.compare("'UPX!'",nSize-0x24))
    {
        getUPXOptions(nSize-0x20);
        bDetected=1;
    }
    else if(ELF.compareEP("E8........EB0E5A585997608A542420E9........60"))
    {
        sVersion="3.X";
        bDetected=1;
    }

    var nOffset=ELF.findString(0,nSize,"$Id: UPX");
    if(nOffset!=-1)
    {
        sVersion=ELF.getString(nOffset+9,4);
        bDetected=1;
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
