mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

fixed bug detecting segmented addressing, new 16-bit start patterns

Browse Source
This commit is contained in:
caheckman
2019-08-27 14:27:19 -04:00
parent afbceb2072
commit 7125cc4171
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Ghidra/Processors/x86/data/patterns/x86-16_default_patterns.xml
View File

@@ -6,7 +6,8 @@
<data>0x4dcb</data> <!-- DEC(BP) RET() -->
<data>0.011... 1100.011</data> <!-- POP(BP|BX|DS|SI) RET -->
<data>1100.010 .0.....0 0x00</data> <!-- RET(constant) -->
<data>0xc390</data> <!-- RET NOP -->
<data>1100.010 .0.....0 0x00 0x90</data> <!-- RET(constant) NOP -->
<data>0xc390</data> <!-- RET NOP -->
<data>0xcb90</data>
</prepatterns>
<postpatterns>
@@ -14,6 +15,7 @@
<data>0x5589e5</data> <!-- PUSH(BP) MOV(BP,SP) -->
<data>0xc8 000....0 0x0000</data> <!-- ENTER (constant, 0x0) -->
<data>0x8cd89045</data> <!-- MOV(AX,DS) NOP INC(BP) -->
<data>0x8cd055</data> <!-- MOV(AX,SS) PUSH(BP) -->
<funcstart/>
</postpatterns>
</patternpairs>