Skip to content

Instantly share code, notes, and snippets.

@confile
Forked from williballenthin/get_eip.yara
Created October 30, 2018 08:47
Show Gist options
  • Save confile/121f2583bb637e520ca1c4cee627eaa0 to your computer and use it in GitHub Desktop.
Save confile/121f2583bb637e520ca1c4cee627eaa0 to your computer and use it in GitHub Desktop.
rule get_eip
{
meta:
author = "William Ballenthin"
email = "william.ballenthin@fireeye.com"
license = "Apache 2.0"
copyright = "FireEye, Inc"
description = "Match x86 that appears to fetch $PC."
strings:
// 0: e8 00 00 00 00 call 5 <_main+0x5>
// 5: 58 pop eax
// 6: 5b pop ebx
// 7: 59 pop ecx
// 8: 5a pop edx
// 9: 5e pop esi
// a: 5f pop edi
$x86 = { e8 00 00 00 00 (58 | 5b | 59 | 5a | 5e | 5f) }
condition:
$x86
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment