// DiE's Signature File
// ConfuserEx Detection
// Author: Levis <levintaeyeon@live.com> http://ltops9.wordpress.com/

init("protector","ConfuserEx");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.isNET())
    {
        if(PE.section.length>=2)
        {
            var nVersionOffset=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"ConfuserEx v");
            if(nVersionOffset!=-1)
            {
                sVersion=PE.getString(nVersionOffset+12,7);
                bDetected=1;
            }
        }
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
