Improved x86 signatures

61a68f07 · devttys0 · 43c30ea4 · 61a68f07
Commit 61a68f07 authored Dec 21, 2013 by devttys0
Show whitespace changes
Inline Side-by-side

Showing with 9 additions and 1 deletions

binarch src/binwalk/magic/binarch +9 -1

No files found.
--- a/src/binwalk/magic/binarch
+++ b/src/binwalk/magic/binarch
@@ -86,5 +86,13 @@
 # x86 epilogue
 # push ebp
 # move ebp, esp
-0	string	\x55\x89\xE5	Intel x86 instructions, function epilogue
+# sub esp, XX
+#
+# push ebp
+# move ebp, esp
+# push edi
+# push esi
+0	string	\x55\x89\xE5\x83\xEC				Intel x86 instructions, function prologue
+0	string	\x55\x89\xE5\x57\x56				Intel x86 instructions, function prologue
+0	string	\x90\x90\x90\x90\x90\x90\x90\x90	Intel x86 instructions, nops{jump-to-offset:8}