Detect-It-Easy/db/PE/Smart Assembly.2.sg

// DIE's signature file

init("protector","Smart Assembly");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.isNET())
    {
        if(PE.isSignatureInSectionPresent(0,"20ffffff005f175920ffff0000"))
        {
            sVersion="3.X";
            bDetected=1;
        }
        else if(PE.isNETStringPresent("Powered by {smartassembly}"))
        {
            sVersion="1.X-4.X";
            bDetected=1;
        }
        else if(PE.isNETStringPresent("Powered by SmartAssembly"))
        {
            sVersion="5.X";
            bDetected=1;
        }
        else if((nOffset=PE.findString(PE.section[0].FileOffset,
                                       PE.section[0].FileSize,
                                       "Powered by SmartAssembly "))!=-1)
        {
            sVersion=PE.getString(nOffset+25);
            bDetected=1;
        }
        else if(PE.isNETStringPresent("SmartAssembly.Attributes"))
        {
            bDetected=1;
        }
    }

    return result(bShowType,bShowVersion,bShowOptions);
}