mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'GT-3090_NearPointerResolve' into GT-3090_16bit_analysis

Browse Source
This commit is contained in:
caheckman
2019-08-27 14:40:16 -04:00
parent faf93508e6 7125cc4171
commit 06de0d46a0
24 changed files with 385 additions and 197 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Ghidra/Processors/x86/data/patterns/x86-16_default_patterns.xml
View File

@@ -6,7 +6,8 @@
<data>0x4dcb</data> <!-- DEC(BP) RET() -->
<data>0.011... 1100.011</data> <!-- POP(BP|BX|DS|SI) RET -->
<data>1100.010 .0.....0 0x00</data> <!-- RET(constant) -->
<data>0xc390</data> <!-- RET NOP -->
<data>1100.010 .0.....0 0x00 0x90</data> <!-- RET(constant) NOP -->
<data>0xc390</data> <!-- RET NOP -->
<data>0xcb90</data>
<data>0xc3</data>
</prepatterns>
@@ -15,6 +16,7 @@
<data>0x5589e5</data> <!-- PUSH(BP) MOV(BP,SP) -->
<data>0xc8 000....0 0x0000</data> <!-- ENTER (constant, 0x0) -->
<data>0x8cd89045</data> <!-- MOV(AX,DS) NOP INC(BP) -->
<data>0x8cd055</data> <!-- MOV(AX,SS) PUSH(BP) -->
<funcstart/>
</postpatterns>
</patternpairs>