// Detect It Easy: detection rule file
// Author: Levis <levintaeyeon@live.com> http://ltops9.wordpress.com/

meta("protector", "Confuser");

function getConfuserVersion() {
    var sResult = String();

    var nVersionOffset = PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "Confuser v");
    if (nVersionOffset !== -1) {
        sResult = PE.getString(nVersionOffset + 10);
    }

    return sResult;
}

function detect() {
    if (PE.isNetObjectPresent("ConfusedByAttribute")) {
        var sConfuserVersion = getConfuserVersion();
        if (sConfuserVersion) {
            sVersion = sConfuserVersion;
        } else {
            sVersion = "1.X";
        }

        bDetected = true;
    } else if (PE.isNet()) {
        if (PE.section.length >= 2) {
            var nVersionOffset = PE.findString(PE.section[1].FileOffset, PE.section[1].FileSize, "ConfuserEx v");
            if (nVersionOffset != -1) {
                sVersion = PE.getString(nVersionOffset + 12, 7);
                sName = "ConfuserEx";
                bDetected = true;
            }
        }
    }

    if (PE.getNetAssemblyName().indexOf("вє∂ѕ ρяσтє¢тσя") == 0) {
        sName = "ConfuserEx";
        sVersion = "Bed's mod";
        bDetected = true;
    } else if (bDetected && PE.isNetObjectPresent("DotNetPatcherPackerAttribute")) {
        sName = "ConfuserEx";
        sVersion = "DotNetPatcher mod";
        bDetected = true;
    }

    return result();
}