From 0ae0e17bb16cf03317e9d6f2da352ee7c6ad3fa4 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Wed, 8 Aug 2012 21:32:15 +0200
Subject: [PATCH] Support Confuser 1.9 r76119 anti debugger

---
 de4dot.code/deobfuscators/Confuser/AntiDebugger.cs | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs b/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs
index fc966deb..b2df7f99 100644
--- a/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs
+++ b/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs
@@ -73,9 +73,14 @@ namespace de4dot.code.deobfuscators.Confuser {
 				return false;
 			if (!DotNetUtils.isMethod(method, "System.Void", "()"))
 				return false;
-			if (!DotNetUtils.hasString(method, "COR_ENABLE_PROFILING"))
-				return false;
-			if (!DotNetUtils.hasString(method, "COR_PROFILER"))
+			if (DotNetUtils.hasString(method, "COR_ENABLE_PROFILING") &&
+				DotNetUtils.hasString(method, "COR_PROFILER")) {
+			}
+			else if (DotNetUtils.hasString(method, "COR_") &&
+				DotNetUtils.hasString(method, "ENABLE_PROFILING") &&
+				DotNetUtils.hasString(method, "PROFILER")) {
+			}
+			else
 				return false;
 			if (!DotNetUtils.hasString(method, "Profiler detected"))
 				return false;