Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-22 06:15:31 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/GP-6657_James_x86_win_func_start_patterns' into Ghidra_12.1

Browse Source
This commit is contained in:
Ryan Kurtz
2026-04-07 17:26:34 -04:00
parent 09100d71f5 535ce3e6d3
commit ed4a5b9809
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Processors/x86/data/patterns/x86win_patterns.xml
+2
View File
@@ -10,6 +10,7 @@
</prepatterns>
<postpatterns>
<data>0x558bec</data> <!-- PUSH EBP : MOV EBP,ESP -->
<data>0x5589e5</data> <!-- PUSH EBP : MOV EBP,ESP -->
<data>0x83ec 0.....00 </data> <!-- SUBESP#small -->
<data>0x6aff68........64a100000000 </data> <!-- PUSH-1 PUSHFUNC MOVEAXFS[0] -->
<data>0x568bf1 </data> <!-- PUSHESI MOVESIECX -->
@@ -29,6 +30,7 @@
<data>0x53568bf0</data> <!-- PUSH EBX : PUSH ESI : MOV ESI,EAX -->
<data>0x56578bf9</data> <!-- PUSH ESI : PUSH EDI : MOV EDI,ECX -->
<data>0x56578bf1</data> <!-- PUSH ESI : PUSH EDI : MOV ESI,ECX -->
<data>0x55575653</data> <!-- PUSH EBP : PUSH EDI : PUSH ESI : PUSH EBX -->
<funcstart/>
</postpatterns>