Commit 459886a7 by devttys0

Added coldfire binarch signature; fixed file signature for arcadyan firmware

parent 0b95ff68
......@@ -275,8 +275,11 @@ class Signature(object):
self.lines = [first_line]
self.title = first_line.format
self.offset = first_line.offset
self.confidence = first_line.size
self.regex = self._generate_regex(first_line)
try:
self.confidence = first_line.tags['confidence']
except KeyError:
self.confidence = first_line.size
def _generate_regex(self, line):
'''
......
......@@ -120,5 +120,10 @@
# push esi
0 string \x55\x89\xE5\x83\xEC Intel x86 instructions, function prologue
0 string \x55\x89\xE5\x57\x56 Intel x86 instructions, function prologue
0 string \x90\x90\x90\x90\x90\x90\x90\x90 Intel x86 instructions, nops{jump:8}
0 string \x90\x90\x90\x90\x90\x90\x90\x90 Intel x86 instructions, nops{jump:8}{overlap}
# unlk a6
# rts
# link a6, XX
0 string N^NuNV Motorola Coldfire instructions, function prologue/epilogue
......@@ -115,6 +115,7 @@
>12 ubelong !0 {invalid}
>28 string !\x00*12 {invalid}
# http://lxr.free-electrons.com/source/fs/ubifs/ubifs-media.h
#0 string UBI\x23 UBI erase count header,
#>4 ubyte x version: %d,
#>5 string !\x00*3 {invalid}
......@@ -123,16 +124,10 @@
#>20 ubelong x data offset: 0x%X
# http://lxr.free-electrons.com/source/fs/ubifs/ubifs-media.h
#0 lelong 0x06101831 UBIFS master node,
#>20 ubyte !7 {invalid} # Only look for the master node
#>22 leshort !0 {invalid}
#>24 lequad x highest inode: %d,
#>32 lequad x commit number: %d
# http://lxr.free-electrons.com/source/fs/ubifs/ubifs-media.h
0 lelong 0x06101831 UBIFS
>20 ubyte <6
>>20 ubyte >7 {invalid} # Only look for superblock and master nodes
>20 ubyte x type: 0x%X
>20 ubyte <6 {invalid}
>20 ubyte >7 {invalid} # Only look for superblock and master nodes
>20 ubyte 7 master node,
>>22 leshort !0 {invalid}
>>24 lequad x highest inode: %d,
......
......@@ -518,10 +518,10 @@
>18 beshort+16 x data offset from start of block: %d
# Obfuscated Arcadyan firmware
0x68 belong 0x00D508 Obfuscated Arcadyan firmware,
>3 byte !0 {invalid}
0x68 string \x00\xD5\x08 Obfuscated Arcadyan firmware,
>0x6B byte !0 invalid signature trailing byte [0x%X],{invalid}
>0 ubelong x signature bytes: 0x%X,
>0x70 string !\x00\x00\x00\x00\x00\x00\x00 {invalid},
>0x70 string !\x00\x00\x00\x00\x00\x00 invalid padding bytes,{invalid}
>0x70 belong 0x00000000 see https://github.com/devttys0/wrt120n/deobfuscator
# Digi firmware images
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment