mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-6657 add x86 win func start patterns

Browse Source
This commit is contained in:
James
2026-04-06 14:18:36 -04:00
parent dd938c32be
commit 535ce3e6d3
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Ghidra/Processors/x86/data/patterns/x86win_patterns.xml
View File

@@ -10,6 +10,7 @@
</prepatterns>
<postpatterns>
<data>0x558bec</data> <!-- PUSH EBP : MOV EBP,ESP -->
<data>0x5589e5</data> <!-- PUSH EBP : MOV EBP,ESP -->
<data>0x83ec 0.....00 </data> <!-- SUBESP#small -->
<data>0x6aff68........64a100000000 </data> <!-- PUSH-1 PUSHFUNC MOVEAXFS[0] -->
<data>0x568bf1 </data> <!-- PUSHESI MOVESIECX -->
@@ -29,6 +30,7 @@
<data>0x53568bf0</data> <!-- PUSH EBX : PUSH ESI : MOV ESI,EAX -->
<data>0x56578bf9</data> <!-- PUSH ESI : PUSH EDI : MOV EDI,ECX -->
<data>0x56578bf1</data> <!-- PUSH ESI : PUSH EDI : MOV ESI,ECX -->
<data>0x55575653</data> <!-- PUSH EBP : PUSH EDI : PUSH ESI : PUSH EBX -->
<funcstart/>
</postpatterns>