//  DIE's signature file
// 25.11.2018 added 5.X Version -  A.S.L - asl@onet.eu

init("protector", "Spices.Net");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.isNET()) {
        if (PE.isNetObjectPresent("NineRays.Obfuscator")) {
            if (PE.isSignaturePresent(PE.section[1].FileOffset - 512, 512,
                    "'Built using an evaluation version of 9Rays.Net Spices.Obfuscator.'")) {
                sOptions = "Evaluation";
            }
            bDetected = true;
        }

        if (!bDetected) {
            var Spices = "'9Rays.Net Spices.Net Obfuscator'";
            if (PE.isDll()) {
                if ((PE.isSignatureInSectionPresent(1, Spices)) || (PE.isSignatureInSectionPresent(0, Spices))) {
                    sVersion = "5.X";
                    sOptions = "DLL";
                    bDetected = true;
                }
            }
        } else {
            if (PE.isSignatureInSectionPresent(0, Spices)) {
                sVersion = "5.X";
                bDetected = true;
            }
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}