// DIE's signature file
// Author: Levis <levintaeyeon@live.com> http://ltops9.wordpress.com/

init("protector","Confuser");

function getConfuserVersion()
{
    var sResult="";
    var nOffset=PE.section[0].FileOffset;
    var nSize=PE.section[0].FileSize;

    var nVersionOffset=PE.findString(nOffset,nSize,"Confuser v");
    if(nVersionOffset!=-1)
    {
        sResult=PE.getString(nVersionOffset+10);
    }

    return sResult;
}

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.isNETStringPresent("ConfusedByAttribute"))
    {
        var sConfuserVersion=getConfuserVersion();
        if(sConfuserVersion!="")
        {
            sVersion=sConfuserVersion;
        }
        else
        {
            sVersion="1.X";
        }

        bDetected=1;
    } else if(PE.isNET()){
        if(PE.section.length>=2)
        {
            var nVersionOffset=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"ConfuserEx v");
            if(nVersionOffset!=-1)
            {
                sVersion=PE.getString(nVersionOffset+12,7);
				sName = "ConfuserEx";
                bDetected=1;
            }
        }
	}

    return result(bShowType,bShowVersion,bShowOptions);
}
