Skip to content

Instantly share code, notes, and snippets.

@williballenthin
Created July 23, 2018 22:17
Show Gist options
  • Save williballenthin/6057247ac0485ee4e974c93eb1530919 to your computer and use it in GitHub Desktop.
Save williballenthin/6057247ac0485ee4e974c93eb1530919 to your computer and use it in GitHub Desktop.
rule get_eip
{
meta:
author = "William Ballenthin"
email = "william.ballenthin@fireeye.com"
license = "Apache 2.0"
copyright = "FireEye, Inc"
description = "Match x86 that appears to fetch $PC."
strings:
// 0: e8 00 00 00 00 call 5 <_main+0x5>
// 5: 58 pop eax
// 6: 5b pop ebx
// 7: 59 pop ecx
// 8: 5a pop edx
// 9: 5e pop esi
// a: 5f pop edi
$x86 = { e8 00 00 00 00 (58 | 5b | 59 | 5a | 5e | 5f) }
condition:
$x86
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment