Delphi 11 Alexandria compiler detection #120

claudiudc · 2022-07-04T14:50:10Z

claudiudc
Jul 4, 2022

Good day,
I am using die to detect some versions of delphi. Could you confirm that the latest version of delphi(11 Alexandria) is supported?
I've attached a small project compiled with embarcadero 11 alexandria and it seems to detect only a generic name like Embarcadero Delphi(XE2-XE6)[-]
Is it possible to update the signature database to detect this version as 11 Alexandria?

In Delphi4.sig I see this:

if(bNewVersion)
{
if(PE.section[".rdata"])
{
var nRDataOffset=PE.section[".rdata"].FileOffset;
var nRDataSize=PE.section[".rdata"].FileSize;
var nVersionOffset=PE.findString(nRDataOffset,nRDataSize,"Embarcadero Delphi for Win");
if(nVersionOffset!=-1)
{
var sCompilerVersion=PE.getString(nVersionOffset+46,4);
if(sCompilerVersion=="28.0")
{
sVersion="XE7";
}
else if(sCompilerVersion=="29.0")
{
sVersion="XE8";
}
else if(sCompilerVersion=="30.0")
{
sVersion="10 Seattle";
}
else if(sCompilerVersion=="31.0")
{
sVersion="10.1 Berlin";
}
else if(sCompilerVersion=="32.0")
{
sVersion="10.2 Tokyo";
}
else if(sCompilerVersion=="33.0")
{
sVersion="10.3 Rio";
}
}
}