Explain features: Deep & Heuristic mode

[NtWriteCode]

Are there any documentations about these features? I can't find any info on how they work. I'm just curious on the high level if signatures work differently or DIE scans somehow differently or what else?

Thank you! :)

[horsicq]

Some signatures use "isDeepScan()" and "isHeuristicScan()" functions. It works if we use the checkboxes or flags

[horsicq]

Example:

Detect-It-Easy/db/PE/ASM_Guard.2.sg

Line 11 in 6cba6b3

if (!PE.isDeepScan()) {

Example:

Detect-It-Easy/db/PE/__GenericHeuristicAnalysis_By_DosX.7.sg

Line 74 in 6cba6b3

if (PE.isHeuristicScan()) {