From 68d962fb6e23033d14245ae3f9a404ad8644d582 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Wed, 30 Nov 2011 19:10:56 +0100
Subject: [PATCH] Return null if inflated data isn't an MZ file

---
 .../deobfuscators/dotNET_Reactor/NativeImageUnpacker.cs        | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/NativeImageUnpacker.cs b/de4dot.code/deobfuscators/dotNET_Reactor/NativeImageUnpacker.cs
index b12b0186..ac6961bd 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/NativeImageUnpacker.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/NativeImageUnpacker.cs
@@ -58,6 +58,9 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
 			if (count != inflatedSize)
 				return null;
 
+			if (BitConverter.ToInt16(inflatedData, 0) != 0x5A4D)
+				return null;
+
 			return inflatedData;
 		}