// DIE's signature file

init("protector","NTkrnl Protector");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("68........e8")&&(PE.nLastSection>=1))
    {
        if(PE.getNumberOfImports()==1)
        {
            if(PE.getNumberOfImportThunks(0)==2)
            {
                if((PE.getImportFunctionName(0,0)=="LoadLibraryA")&&(PE.getImportFunctionName(0,1)=="GetProcAddress"))
                {
                    if(PE.isSignatureInSectionPresent(1,"'http://www.ntcore.com  '"))
                    {
                        sVersion="0.1";
                        bDetected=1;
                    }
                    else if(PE.isSignatureInSectionPresent(1,"'http://www.ntkrnl.com'"))
                    {
                        sVersion="0.15";
                        bDetected=1;
                    }
                    /* if(bDetected)
                    {
                        var nFind=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"Version ");
                        if(nFind!=-1)
                        {
                            sVersion=PE.getString(nFind,20);
                            var aVersion=sVersion.match(/Version ?(.*?) /);
                            sVersion=aVersion[1];
                        }
                    } */
                }

            }
        }
    }
    /*if(PE.compareEP("68........e8........c3")&&(PE.compareEP("68########60e8$$$$$$$$5d4555c3")))
    {
        bDetected=1;
    } */

    return result(bShowType,bShowVersion,bShowOptions);
}
