Skip to content

R
rules
Unverified Commit 90cac274 by Jaume Martin Committed by GitHub
Options

Merge pull request #337 from wesinator/peid 

Disable Armadillo v1.71 PEiD rules
parents 1e9f6022 026d9c21
Showing with 2 additions and 10 deletions
Packers/peid.yar
...@@ -6037,6 +6037,7 @@ rule Armadillo_v177: PEiD ...@@ -6037,6 +6037,7 @@ rule Armadillo_v177: PEiD
} }
/* False positive - #39
rule Armadillo_v171: PEiD rule Armadillo_v171: PEiD
{ {
strings: strings:
...@@ -6044,7 +6045,7 @@ rule Armadillo_v171: PEiD ...@@ -6044,7 +6045,7 @@ rule Armadillo_v171: PEiD
condition: condition:
$a at pe.entry_point $a at pe.entry_point
} }*/
rule AsCrypt_v01_SToRM_4: PEiD rule AsCrypt_v01_SToRM_4: PEiD
{ {
...@@ -32810,15 +32811,6 @@ rule _PseudoSigner_01_Macromedia_Flash_Projector_60_Anorganix: PEiD ...@@ -32810,15 +32811,6 @@ rule _PseudoSigner_01_Macromedia_Flash_Projector_60_Anorganix: PEiD
} }
rule Armadillo_v171_additional: PEiD
{
strings:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 }
condition:
$a at pe.entry_point
}
rule VProtector_vcasm_additional: PEiD rule VProtector_vcasm_additional: PEiD
{ {
strings: strings:
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment