// Detect It Easy: detection rule file format
// Author: Levis <levintaeyeon@live.com> http://ltops9.wordpress.com/

init("protector", "Confuser");

function getConfuserVersion() {
    var sResult = "";

    var nVersionOffset = PE.findString(PE.section[0].FileOffset, PE.section[0].FileSize, "Confuser v");
    if (nVersionOffset != -1) {
        sResult = PE.getString(nVersionOffset + 10);
    }

    return sResult;
}

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.isNetObjectPresent("ConfusedByAttribute")) {
        var sConfuserVersion = getConfuserVersion();
        if (sConfuserVersion != "") {
            sVersion = sConfuserVersion;
        } else {
            sVersion = "1.X";
        }

        bDetected = true;
    } else if (PE.isNET()) {
        if (PE.section.length >= 2) {
            var nVersionOffset = PE.findString(PE.section[1].FileOffset, PE.section[1].FileSize, "ConfuserEx v");
            if (nVersionOffset != -1) {
                sVersion = PE.getString(nVersionOffset + 12, 7);
                sName += "Ex";
                bDetected = true;
            }
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}