mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2026-09-25 17:00:36 -09:00
73 lines
6.5 KiB
XML
Executable File
73 lines
6.5 KiB
XML
Executable File
<patternlist>
|
|
|
|
<patternpairs>
|
|
|
|
<prepatterns>
|
|
|
|
<data>01000000 00111111 ........ 0.0..... </data> <!-- packed EE dealloc_return -->
|
|
<data>01000000 00011111 ........ 001..... </data> <!-- packed EE dealloc_return -->
|
|
|
|
<data>11000000 00111111 ........ 0.0..... </data> <!-- packed EE jumpr LR -->
|
|
<data>11000000 00011111 ........ 001..... </data> <!-- packed EE jumpr LR -->
|
|
|
|
<data>00011110 11000000 00011110 10010110 </data> <!-- PP dealloc_return, last -->
|
|
<data>00011110 01000000 00011110 10010110 ........ 11...... ........ ........ </data> <!-- PP dealloc_return, 2nd to last -->
|
|
<data>00011110 01000000 00011110 10010110 ........ 00...... ........ ........ </data> <!-- PP dealloc_return, 2nd to last -->
|
|
<data>00011110 01000000 00011110 10010110 ........ 01...... ........ ........ ........ 11...... ........ ........ </data> <!-- PP dealloc_return, 3rd to last -->
|
|
<data>00011110 01000000 00011110 10010110 ........ 01...... ........ ........ ........ 00...... ........ ........ </data> <!-- PP dealloc_return, 3rd to last -->
|
|
<data>00011110 01000000 00011110 10010110 ........ 01...... ........ ........ ........ 01...... ........ ........ ........ 11...... ........ ........ </data> <!-- PP dealloc_return 4th to last -->
|
|
|
|
<data>.......0 11...... ........ 0101100. </data> <!-- PP jump, last -->
|
|
<data>.......0 01...... ........ 0101100. ........ 11...... ........ ........ </data> <!-- PP jump, 2nd to last -->
|
|
<data>.......0 01...... ........ 0101100. ........ 00...... ........ ........ </data> <!-- PP jump, 2nd to last -->
|
|
<data>.......0 01...... ........ 0101100. ........ 01...... ........ ........ ........ 11...... ........ ........ </data> <!-- PP jump, 3rd to last -->
|
|
<data>.......0 01...... ........ 0101100. ........ 01...... ........ ........ ........ 00...... ........ ........ </data> <!-- PP jump, 3rd to last -->
|
|
<data>.......0 01...... ........ 0101100. ........ 01...... ........ ........ ........ 01...... ........ ........ ........ 11...... ........ ........ </data> <!-- PP jump 4th to last -->
|
|
|
|
<data>00000000 01000000 100..... 01010010 </data> <!-- PP jumpr, last -->
|
|
<data>00000000 01000000 100..... 01010010 ........ 11...... ........ ........ </data> <!-- PP jumpr, 2nd to last -->
|
|
<data>00000000 01000000 100..... 01010010 ........ 00...... ........ ........ </data> <!-- PP jumpr, 2nd to last -->
|
|
<data>00000000 01000000 100..... 01010010 ........ 01...... ........ ........ ........ 11...... ........ ........ </data> <!-- PP jumpr, 3rd to last -->
|
|
<data>00000000 01000000 100..... 01010010 ........ 01...... ........ ........ ........ 00...... ........ ........ </data> <!-- PP jumpr, 3rd to last -->
|
|
<data>00000000 01000000 100..... 01010010 ........ 01...... ........ ........ ........ 01...... ........ ........ ........ 11...... ........ ........ </data> <!-- PP jumpr 4th to last -->
|
|
|
|
</prepatterns>
|
|
|
|
<postpatterns>
|
|
|
|
<!-- First Instruction in Packet -->
|
|
<data>........ .1000... 10011101 10100000 </data> <!-- allocframe (v2,10) - 1st in packet -->
|
|
<data>....0000 0011110. ........ 011..... </data> <!-- allocframe (v4,right,6,7) - 1 of 1 in packet -->
|
|
<data>....0000 0011110. ........ 101..... </data> <!-- allocframe (v4,right,10,11) - 1 of 1 in packet -->
|
|
<data>....0000 00.1110. ........ 110..... </data> <!-- allocframe (v4,right,12,13) - 1 of 1 in packet -->
|
|
<data>....0000 0001110. ........ 111..... </data> <!-- allocframe (v4,right,14,15) - 1 of 1 in packet -->
|
|
|
|
<!-- Second Instruction in Packet -->
|
|
<data>........ 01...... ........ ........ ........ .1000... 10011101 10100000 </data> <!-- allocframe (v2,10) - 2nd in packet -->
|
|
<data>........ 01...... ........ ........ ....0000 0011110. ........ 011..... </data> <!-- allocframe (v4,right,6,7) - 2 of 2 in packet -->
|
|
<data>........ 01...... ........ ........ ....0000 0011110. ........ 101..... </data> <!-- allocframe (v4,right,10,11) - 2 of 2 in packet -->
|
|
<data>........ 01...... ........ ........ ....0000 00.1110. ........ 110..... </data> <!-- allocframe (v4,right,12,13) - 2 of 2 in packet -->
|
|
<data>........ 01...... ........ ........ ....0000 0001110. ........ 111..... </data> <!-- allocframe (v4,right,14,15) - 2 of 2 in packet -->
|
|
|
|
<!-- Third Instruction in Packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ........ .1000... 10011101 10100000 </data> <!-- allocframe (v2,10) - 3rd in packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ....0000 0011110. ........ 011..... </data> <!-- allocframe (v4,right,6,7) - 3 of 3 in packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ....0000 0011110. ........ 101..... </data> <!-- allocframe (v4,right,10,11) - 3 of 3 in packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ....0000 00.1110. ........ 110..... </data> <!-- allocframe (v4,right,12,13) - 3 of 3 in packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ....0000 0001110. ........ 111..... </data> <!-- allocframe (v4,right,14,15) - 3 of 3 in packet -->
|
|
|
|
<!-- Fourth Instruction in Packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ........ 01...... ........ ........ ........ 11000... 10011101 10100000 </data> <!-- allocframe (v2,10) - 4th in packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ........ 01...... ........ ........ ....0000 0011110. ........ 011..... </data> <!-- allocframe (v4,right,6,7) - 4 of 4 in packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ........ 01...... ........ ........ ....0000 0011110. ........ 101..... </data> <!-- allocframe (v4,right,10,11) - 4 of 4 in packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ........ 01...... ........ ........ ....0000 00.1110. ........ 110..... </data> <!-- allocframe (v4,right,12,13) - 4 of 4 in packet -->
|
|
<data>........ 01...... ........ ........ ........ 01...... ........ ........ ........ 01...... ........ ........ ....0000 0001110. ........ 111..... </data> <!-- allocframe (v4,right,14,15) - 4 of 4 in packet -->
|
|
|
|
<funcstart validcode="8" />
|
|
|
|
</postpatterns>
|
|
|
|
</patternpairs>
|
|
|
|
</patternlist>
|