// DIE's signature file
// Author: r0da https://github.com/whereisr0da

init("protector","KoiVM");

function detect(bShowType,bShowVersion,bShowOptions)
{    
    sVersion="2.0";

    if(PE.isNET())
    {
        // VM Module
        // .text = the first section
        if(PE.isSignatureInSectionPresent(0,"'KoiVM.Runtime'"))
        {
            bDetected=1;
        }
        else if(PE.isSignatureInSectionPresent(0,"'VMEntryRun'"))
        {
            bDetected=1;
        }
        else if(PE.isSignatureInSectionPresent(0,"'KoiVM'"))
        {
            bDetected=1;
        } 
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
