private static ISignature IdentifyPhoenixProtector(AssemblyDefinition asmDef, out bool found)
{
found = false;
if (asmDef.FindMethod(mDef =>
mDef.Body.Instructions.GetOpCodeCount(OpCodes.Xor) == 2 &&
mDef.Body.Instructions.FirstOfOpCode(OpCodes.Shl) != null &&
mDef.Body.Instructions.FirstOfOpCode(OpCodes.Or) != null) != null || (asmDef.EntryPoint.Name.StartsWith("?") && asmDef.EntryPoint.Name.EndsWith("?")))
{
found = true;
return new Signatures.PhoenixSignature();
}
return new Signatures.UnidentifiedSignature();
}
