Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-06-02 07:31:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/GP-6657_James_x86_win_func_start_patterns' into Ghidra_12.1

Browse Source
This commit is contained in:
Ryan Kurtz
2026-04-07 17:26:34 -04:00
parent 09100d71f5 535ce3e6d3
commit ed4a5b9809
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Processors/x86/data/patterns/x86win_patterns.xml
+2
View File
@@ -10,6 +10,7 @@
</prepatterns> </prepatterns>
<postpatterns> <postpatterns>
<data>0x558bec</data> <!-- PUSH EBP : MOV EBP,ESP --> <data>0x558bec</data> <!-- PUSH EBP : MOV EBP,ESP -->
<data>0x5589e5</data> <!-- PUSH EBP : MOV EBP,ESP -->
<data>0x83ec 0.....00 </data> <!-- SUBESP#small --> <data>0x83ec 0.....00 </data> <!-- SUBESP#small -->
<data>0x6aff68........64a100000000 </data> <!-- PUSH-1 PUSHFUNC MOVEAXFS[0] --> <data>0x6aff68........64a100000000 </data> <!-- PUSH-1 PUSHFUNC MOVEAXFS[0] -->
<data>0x568bf1 </data> <!-- PUSHESI MOVESIECX --> <data>0x568bf1 </data> <!-- PUSHESI MOVESIECX -->
@@ -29,6 +30,7 @@
<data>0x53568bf0</data> <!-- PUSH EBX : PUSH ESI : MOV ESI,EAX --> <data>0x53568bf0</data> <!-- PUSH EBX : PUSH ESI : MOV ESI,EAX -->
<data>0x56578bf9</data> <!-- PUSH ESI : PUSH EDI : MOV EDI,ECX --> <data>0x56578bf9</data> <!-- PUSH ESI : PUSH EDI : MOV EDI,ECX -->
<data>0x56578bf1</data> <!-- PUSH ESI : PUSH EDI : MOV ESI,ECX --> <data>0x56578bf1</data> <!-- PUSH ESI : PUSH EDI : MOV ESI,ECX -->
<data>0x55575653</data> <!-- PUSH EBP : PUSH EDI : PUSH ESI : PUSH EBX -->
<funcstart/> <funcstart/>
</postpatterns> </postpatterns>