mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2026-10-01 17:11:44 -09:00
42 lines
2.0 KiB
XML
42 lines
2.0 KiB
XML
<patternlist>
|
|
|
|
<patternpairs totalbits="32" postbits="16">
|
|
<!-- Higher confidence patterns, after a return and more defined bits -->
|
|
<prepatterns>
|
|
<data>0x4e 0x75</data> <!-- ret -->
|
|
<data>0x4e 0x75 0x4e 0x71 </data> <!-- ret; padding -->
|
|
<data>0x4e 0x75 0x00 0x00 </data> <!-- ret; padding -->
|
|
<data>0x4e 0x5e 0x4e 0x75</data> <!-- unlk A6; ret -->
|
|
<data>0x4e 0x5e 0x4e 0x75 0x4e 0x71 </data> <!-- unlk A6; ret; padding -->
|
|
<data>0x4e 0x5e 0x4e 0x75 0x00 0x00 </data> <!-- unlk A6; ret; padding -->
|
|
</prepatterns>
|
|
<postpatterns>
|
|
<data>01001111 11101111 1111.... .......0 </data> <!-- lea (-imm,SP),SP) -->
|
|
<data>0x4e 0x56 0x00 0x00 </data> <!-- link.w A6, 0 -->
|
|
<data>0x4e 0x56 1111.... .......0 </data> <!-- link.w A6, -imm -->
|
|
<data>0101...1 10001111 01001000 11010111 ........ ........ </data> <!-- subq.l +imm, SP; movem.l {}, (SP) -->
|
|
<data>0010...0 0.101111 0000.... .......0 </data> <!-- mov.l (+imm, SP), reg -->
|
|
<data>0x48 0xe7 ........ ........ </data> <!-- movem.l {regs}, -(SP) -->
|
|
<data>0x2f 0x02 </data> <!-- move.l D2,-SP -->
|
|
<data>0x2f 0x03 </data> <!-- move.l D3,-SP -->
|
|
<data>0x2f 0x0a </data> <!-- move.l A2,-SP -->
|
|
<data>0x2f 0x0b </data> <!-- move.l A3,-SP -->
|
|
<funcstart/>
|
|
</postpatterns>
|
|
</patternpairs>
|
|
|
|
<patternpairs totalbits="32" postbits="16">
|
|
<!-- pattern after a bra.w, use more solid patterns for function starts -->
|
|
<prepatterns>
|
|
<data>0x60 0x00 ........ ........ </data> <!-- bra.w -->
|
|
</prepatterns>
|
|
<postpatterns>
|
|
<data>01001111 11101111 1111.... .......0 </data> <!-- lea (-imm,SP),SP) -->
|
|
<data>0x4e 0x56 0x00 0x00 </data> <!-- link.w A6, 0 -->
|
|
<data>0x4e 0x56 1111.... .......0 </data> <!-- link.w A6, -imm -->
|
|
<funcstart/>
|
|
</postpatterns>
|
|
</patternpairs>
|
|
|
|
|
|
</patternlist> |