// DIE's signature file
// Author: KDSS-Research

init("protector", "NetShield Protector");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.isNET()) {
        bDetected = 1;
        if (validateReferences(
                isPositive = true,
                references = [
                    "System.Security.Cryptography",
                    "System.Text",
                    "System.CodeDom.Compiler",
                    "System.Reflection"

                ]
            )) {
            bDetected = 0;
            return null; // end
        } 
        if (!PE.isSectionNamePresent("!Sugar")) {
             bDetected = 0;
        }
         if (!PE.isNETStringPresent("_Lambda$__1") || 
          !PE.isNETStringPresent("_Lambda$__2") || 
          !PE.isNETStringPresent("k.exe")){
          sOptions += " [Rename Methods, etc...]";
        }
        if(PE.isNETStringPresent("ConfusedByAttribute")){
            sOptions += " [Fake Obfuscator Attributes]";
        }
    }
    

    return result(bShowType, bShowVersion, bShowOptions);
}


// validateReferences by DosX
function validateReferences(isPositive, references) {
    for (var i = 0; i < references.length; i++) {
        var sign = "00'" + references[i] + "'00";
        if (isPositive == true) {
            if (!PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        } else { // negative
            if (PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        }
    }
    return false;
}