Added TweetablePolygonPng

099090a8 · Manfred Kaiser · GitHub · 38722445 · 099090a8
Unverified Commit 099090a8 authored Mar 23, 2021 by Manfred Kaiser Committed by GitHub Mar 23, 2021
Hide whitespace changes
Inline Side-by-side

Showing with 19 additions and 0 deletions

tweetable-polyglot-png.yar packers/tweetable-polyglot-png.yar +19 -0

No files found.
--- a/packers/tweetable-polyglot-png.yar
+++ b/packers/tweetable-polyglot-png.yar
+rule TweetablePolygonPng {
+  meta:
+    description = "tweetable-polyglot-png: https://github.com/DavidBuchanan314/tweetable-polyglot-png"
+    author = "Manfred Kaiser"
+  strings:
+    $magic1 = { 50 4b 01 02 }
+    $magic2 = { 50 4b 03 04 }
+    $magic3 = { 50 4b 05 06 }
+
+  condition:
+    (
+      uint32be(0) == 0x89504E47 or
+      uint32be(0) == 0xFFD8FFE0
+    ) and
+    $magic1 and
+    $magic2 and
+    $magic3
+
+}