//  DIE's signature file
// 25.11.2018 added 5.X Version -  A.S.L - asl@onet.eu

init("protector","Spices.Net");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.isNET())
    {
        if(PE.isNETStringPresent("NineRays.Obfuscator"))
        {
            if(PE.isSignaturePresent(PE.section[1].FileOffset-512,512,
                                     "'Built using an evaluation version of 9Rays.Net Spices.Obfuscator.'"))
            {
                sOptions="Evaluation";
            }
            bDetected=1;
        }

        if(!bDetected)
        {
           var Spices="'9Rays.Net Spices.Net Obfuscator'";
           if(PE.isDll())
           {
               if((PE.isSignatureInSectionPresent(1,Spices))||(PE.isSignatureInSectionPresent(0,Spices)))
               {
                    sVersion="5.X";
                    sOptions="DLL";
                    bDetected=1;
               }
            }
        }
        else
        {
             if(PE.isSignatureInSectionPresent(0,Spices))
            {
                sVersion="5.X";
                bDetected=1;
            }
        }
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
